explorer[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
explorer.exe
Size 3.2MB
Sample260910-3e72bsxdld
SHA256 c5e95f643581ffd5eda5b6bac0dea664208357037e074d65cde6d5f10bc2c083
MD5 7b2798bd507ec7fec0d8ddf2ebe05627
SHA1 502a28ff4c5f37be4e3e8b822a86b9265093c24b
SHA512 9262800b0e0bc1adb5ef2820abf37c8440df1e54e170e13c299f79e18b3eb629be29f6977f9db4cd57fbe7c04dfecd55a8e1fdc088c4ee2a90be8c4c15715f7a
SSDEEP 49152:Fn1hvOITVAjCQ7cLkSVGJ/XgpfP1dpRT/T4zbw8A7/eFwD:1xYfafPAzbw8a0k
TLSH
T1EEF58C5927F840C4E17AC17CC9468B16EA713C255331A6DF0660BA7E6F33BE4993EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

explorer.exe

.exe 3.2MB

explorer.exe

IMPHASH bdd8ee2df9648751280f3728ed69a420
SHA256 c5e95f643581ffd5eda5b6bac0dea664208357037e074d65cde6d5f10bc2c083
MD5 7b2798bd507ec7fec0d8ddf2ebe05627
SHA1 502a28ff4c5f37be4e3e8b822a86b9265093c24b
SHA512 9262800b0e0bc1adb5ef2820abf37c8440df1e54e170e13c299f79e18b3eb629be29f6977f9db4cd57fbe7c04dfecd55a8e1fdc088c4ee2a90be8c4c15715f7a
SSDEEP 49152:Fn1hvOITVAjCQ7cLkSVGJ/XgpfP1dpRT/T4zbw8A7/eFwD:1xYfafPAzbw8a0k
TLSH
T1EEF58C5927F840C4E17AC17CC9468B16EA713C255331A6DF0660BA7E6F33BE4993EB12
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x64 arch:x64

Digest

81:ff:4d:23:bb:b7:a1:a0:5f:bb:1c:da:c8:5e:0d:90:ba:55:2a:57:fe:f3:27:c8:b4:19:a7:b1:37:dd:98:ce

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 8, 2026

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:05:9b:7a:bc:51:a1:9e:71:24:18:00:00:00:00:05:9b

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 16, 2026 - Oct 17, 2026

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:07:76:56:00:00:00:00:00:08

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Oct 19, 2011 - Oct 19, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:321A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:1a:a9:a0:1d:06:a0:0f:43:aa:00:01:00:00:02:1a

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 14, 2025 - Nov 13, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

Major OS version

Entry point

692128

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

explorer.pdb

msvcp_win

_Mtx_lock _Mtx_unlock _Cnd_init_in_situ _Cnd_destroy_in_situ _Cnd_broadcast _Cnd_wait _Cnd_register_at_thread_exit _Cnd_unregister_at_thread_exit ?_Syserror_map@std@@YAPEBDH@Z ?_ReportUnobservedException@details@Concurrency@@YAXXZ ?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAPEAGXZ ?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEBG_J@Z ?pptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ ?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAHXZ ?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ _Thrd_yield ?_Winerror_map@std@@YAHH@Z _Mtx_destroy_in_situ ?_Xinvalid_argument@std@@YAXPEBD@Z ?gptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ ?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXH@Z ??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAA@XZ ?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAGXZ ?__ExceptionPtrToBool@@YA_NPEBX@Z ?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEAG_J@Z ?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAPEAV12@PEAG_J@Z ?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAXAEBVlocale@2@@Z _Mtx_init_in_situ ?pbase@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ ??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAA@XZ ?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG0@Z ?__ExceptionPtrCreate@@YAXPEAX@Z ?eback@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ ?egptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ ??1?$basic_ios@GU?$char_traits@G@std@@@std@@UEAA@XZ ?setg@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG00@Z ?epptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ ?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG00@Z ??0?$basic_ios@GU?$char_traits@G@std@@@std@@IEAA@XZ ??0?$basic_iostream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z ??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@I@Z ??1?$basic_iostream@GU?$char_traits@G@std@@@std@@UEAA@XZ ?__ExceptionPtrDestroy@@YAXPEAX@Z ?__ExceptionPtrAssign@@YAXPEAXPEBX@Z ?__ExceptionPtrCopy@@YAXPEAXPEBX@Z ?__ExceptionPtrCurrentException@@YAXPEAX@Z ?__ExceptionPtrRethrow@@YAXPEBX@Z ?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z ?_Throw_Cpp_error@std@@YAXH@Z _Thrd_detach _Thrd_join _Thrd_id ?_Xbad_function_call@std@@YAXXZ ?_Xout_of_range@std@@YAXPEBD@Z _Cnd_do_broadcast_at_thread_exit ?_Xlength_error@std@@YAXPEBD@Z

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback _c_exit _initterm_e _initterm _set_error_mode

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-private-l1-1-0

_o__wcslwr _o__wcslwr_s _o__wcsnicmp _o__wtoi _o_abort _o_ceil _o_ceilf _o_exit _o_floor _o_fmod _o_free _o_iswspace _o_lround _o_malloc _o_memcpy_s _o_pow _o_strtoul _o_terminate _o_towlower _o_towupper memmove _o_wcscat_s _o_wcscpy_s _o_wcsncpy_s _o_wcstol __CxxFrameHandler3 __C_specific_handler __current_exception __current_exception_context _o__wcsicmp _o__set_new_mode _o__set_fmode _o__set_errno _o__set_app_type _o__seh_filter_exe _o__register_onexit_function _o__recalloc _o__purecall _o__ltow_s _o__localtime64 _o__itow_s _o__itoa_s _o__invalid_parameter_noinfo_noreturn _o__invalid_parameter_noinfo _o__initialize_wide_environment _o__initialize_onexit_table _o__get_wide_winmain_command_line _o__get_errno _o__exit _o__errno _o__difftime64 _o__crt_atexit _o__configure_wide_argv _o__configthreadlocale _o__cexit _o__beginthreadex _o___stdio_common_vswprintf _o___stdio_common_vsprintf _o___stdio_common_vsnwprintf_s _o___stdio_common_vsnprintf_s _o___std_exception_destroy _o___std_exception_copy wcschr _o___p__commode _o____lc_codepage_func wcsstr wcsrchr __std_terminate __CxxFrameHandler4 _o__mktime64 _CxxThrowException __C_specific_handler_noexcept memcmp memcpy

api-ms-win-crt-string-l1-1-0

strncmp wcscmp memset strcmp wcsspn memmove_s wcscspn

combase

ord87 GetErrorInfo ord140 ord86 ord179 ord88 ord111 SetErrorInfo

aepic

PicRetrieveFileInfo PicFreeFileInfo

api-ms-win-core-job-l2-1-0

CreateJobObjectW QueryInformationJobObject OpenJobObjectW SetInformationJobObject AssignProcessToJobObject

api-ms-win-core-registryuserspecific-l1-1-0

SHRegGetBoolUSValueW SHRegGetUSValueW

api-ms-win-core-windowserrorreporting-l1-1-3

RegisterApplicationRestart

api-ms-win-core-url-l1-1-0

UrlUnescapeW

api-ms-win-core-windowserrorreporting-l1-1-1

WerUnregisterCustomMetadata WerRegisterCustomMetadata

api-ms-win-core-kernel32-private-l1-1-0

CheckElevation CheckElevationEnabled

api-ms-win-core-atoms-l1-1-0

GlobalGetAtomNameW

ntdll

NtOpenProcessToken RtlCompareUnicodeString RtlVirtualUnwind RtlLookupFunctionEntry RtlPublishWnfStateData NtSetSystemInformation RtlFlushHeaps RtlUnsubscribeWnfNotificationWaitForCompletion RtlDeriveCapabilitySidsFromName RtlQueryWnfStateData RtlGetDeviceFamilyInfoEnum RtlSubscribeWnfStateChangeNotification RtlUnsubscribeWnfStateChangeNotification NtClose RtlCaptureContext NtDeviceIoControlFile NtOpenFile RtlInitUnicodeString NtQueryWnfStateData NtSetInformationProcess NtQueryInformationProcess RtlNtStatusToDosErrorNoTeb RtlAllocateHeap RtlFreeHeap NtSetThreadExecutionState NtPowerInformation VerSetConditionMask RtlNtStatusToDosError RtlQueryResourcePolicy RtlIsFeatureEnabledForEnterprise RtlQueryUnbiasedInterruptTime NtQuerySystemInformationEx NtQuerySystemInformation RtlGetNtSystemRoot WinSqmIsOptedIn WinSqmAddToStream RtlAcquireSRWLockExclusive RtlReleaseSRWLockExclusive RtlAcquireSRWLockShared RtlReleaseSRWLockShared NtQueryInformationToken NtOpenThreadToken RtlQueryElevationFlags

api-ms-win-core-libraryloader-l1-2-0

LoadResource GetModuleFileNameW SizeofResource GetModuleFileNameA FindStringOrdinal FreeLibrary GetModuleHandleA GetModuleHandleExW FindResourceExW LoadLibraryExW GetProcAddress GetModuleHandleW LockResource LoadStringW

api-ms-win-core-synch-l1-2-0

InitOnceComplete Sleep InitOnceExecuteOnce InitOnceBeginInitialize

api-ms-win-core-synch-l1-1-0

ReleaseSRWLockExclusive WaitForSingleObject AcquireSRWLockExclusive WaitForSingleObjectEx OpenSemaphoreW InitializeCriticalSectionEx CreateMutexExW AcquireSRWLockShared DeleteCriticalSection ResetEvent InitializeCriticalSectionAndSpinCount LeaveCriticalSection InitializeSRWLock SleepEx CreateMutexW OpenEventW ReleaseSemaphore OpenMutexW EnterCriticalSection ReleaseMutex ReleaseSRWLockShared WaitForMultipleObjectsEx InitializeCriticalSection CreateSemaphoreExW SetEvent CreateEventExW CreateEventW

api-ms-win-core-heap-l1-1-0

HeapAlloc GetProcessHeap HeapReAlloc HeapFree

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter SetErrorMode RaiseException SetUnhandledExceptionFilter SetLastError GetLastError

api-ms-win-core-file-l1-1-0

FindFirstFileExW GetVolumePathNameW FindClose DeleteFileW GetDiskFreeSpaceExW CreateFileW FindNextFileW FindFirstFileW WriteFile GetFileAttributesW GetFileAttributesExW SetFileInformationByHandle

api-ms-win-eventing-provider-l1-1-0

EventActivityIdControl EventEnabled EventSetInformation EventUnregister EventWrite EventRegister EventWriteTransfer

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolTimer CloseThreadpoolWait CreateThreadpoolWork WaitForThreadpoolTimerCallbacks CreateThreadpoolTimer WaitForThreadpoolWaitCallbacks SetThreadpoolWait SetThreadpoolTimer CreateThreadpoolWait SubmitThreadpoolWork TrySubmitThreadpoolCallback SetThreadpoolTimerEx

api-ms-win-core-processthreads-l1-1-0

InitializeProcThreadAttributeList ResumeThread GetExitCodeProcess ProcessIdToSessionId SetThreadPriority QueueUserAPC CreateThread TerminateProcess DeleteProcThreadAttributeList CreateProcessW GetStartupInfoW ExitProcess SetPriorityClass SetProcessShutdownParameters UpdateProcThreadAttribute GetCurrentThreadId SetThreadPriorityBoost OpenProcessToken GetCurrentThread OpenThreadToken GetCurrentProcess GetProcessId OpenThread GetPriorityClass GetCurrentProcessId

api-ms-win-core-localization-l1-2-0

GetLocaleInfoW FormatMessageA FormatMessageW GetLocaleInfoEx

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent DebugBreak OutputDebugStringW

api-ms-win-core-handle-l1-1-0

CloseHandle DuplicateHandle

oleaut32

VariantInit VarUI4FromStr SysAllocString VariantClear SysFreeString SysStringLen

api-ms-win-core-string-l1-1-0

CompareStringOrdinal MultiByteToWideChar WideCharToMultiByte CompareStringW

api-ms-win-shcore-comhelpers-l1-1-0

IUnknown_SetSite IUnknown_Set IUnknown_GetSite IUnknown_QueryService

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrCmpICW StrChrW QISearch StrCmpNIW StrCmpNICW StrCmpIW StrToIntW StrChrIW StrCmpICA

api-ms-win-core-registry-l1-1-0

RegOpenCurrentUser RegCopyTreeW RegDeleteKeyExW RegCreateKeyExW RegLoadMUIStringW RegSetValueExW RegDeleteTreeW RegQueryInfoKeyW RegQueryValueExW RegEnumValueW RegEnumKeyExW RegDeleteValueW RegGetValueW RegNotifyChangeKeyValue RegCloseKey RegOpenKeyExW

api-ms-win-core-heap-l2-1-0

LocalReAlloc LocalAlloc LocalFree

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent OpenProcess GetProcessMitigationPolicy

api-ms-win-core-com-l1-1-0

CoGetApartmentType CoRegisterClassObject CoInitializeSecurity CoRevokeClassObject StringFromCLSID CoGetMalloc CoFreeUnusedLibraries CoGetObjectContext CoInitializeEx CoSetProxyBlanket StringFromIID CoUninitialize CoTaskMemFree CoCreateGuid CoTaskMemAlloc CoCreateInstance CoWaitForMultipleHandles CoTaskMemRealloc CoCreateFreeThreadedMarshaler CoGetStdMarshalEx PropVariantClear StringFromGUID2 CoGetCallContext CLSIDFromString

api-ms-win-core-processenvironment-l1-1-0

GetCurrentDirectoryW ExpandEnvironmentStringsW GetCommandLineW GetEnvironmentVariableW SetEnvironmentVariableW

api-ms-win-core-shlwapi-legacy-l1-1-0

PathCombineW PathRemoveBlanksW PathFindFileNameW PathGetArgsW PathFindExtensionW PathGetDriveNumberW SHExpandEnvironmentStringsW PathRemoveFileSpecW PathQuoteSpacesW PathIsFileSpecW PathFileExistsW

api-ms-win-shcore-registry-l1-1-0

SHDeleteKeyW SHGetValueW SHDeleteValueW SHQueryInfoKeyW SHRegGetValueW SHSetValueW

api-ms-win-shcore-sysinfo-l1-1-0

SetCurrentProcessExplicitAppUserModelID IsOS

api-ms-win-shcore-registry-l1-1-1

SHRegGetValueFromHKCUHKLM

api-ms-win-core-sysinfo-l1-1-0

GetTickCount GetSystemTime GetTickCount64 GlobalMemoryStatusEx GetWindowsDirectoryW GetSystemDirectoryW GetSystemTimeAsFileTime GetComputerNameExW GetVersionExW

api-ms-win-shcore-taskpool-l1-1-0

SHTaskPoolQueueTask

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateString WindowsIsStringEmpty WindowsGetStringRawBuffer WindowsDeleteString WindowsCreateStringReference WindowsSubstringWithSpecifiedLength WindowsDuplicateString

api-ms-win-shcore-thread-l1-1-0

SHSetThreadRef SHCreateThreadRef SHCreateThread SetProcessReference SHGetThreadRef

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-security-base-l1-1-0

MakeAbsoluteSD GetTokenInformation CopySid AllocateAndInitializeSid FreeSid GetSecurityDescriptorDacl GetLengthSid IsValidSid SetKernelObjectSecurity GetAclInformation GetAce DeleteAce InitializeAcl AddAce EqualSid DuplicateToken CheckTokenMembership CreateWellKnownSid

api-ms-win-core-psapi-l1-1-0

K32EnumProcesses K32GetModuleFileNameExW QueryFullProcessImageNameW K32EnumProcessModules K32GetModuleBaseNameW

api-ms-win-core-version-l1-1-0

GetFileVersionInfoExW GetFileVersionInfoSizeExW VerQueryValueW

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceEnableLevel GetTraceLoggerHandle RegisterTraceGuidsW TraceMessage GetTraceEnableFlags UnregisterTraceGuids

api-ms-win-core-localization-obsolete-l1-2-0

GetUserDefaultUILanguage

api-ms-win-core-string-l2-1-1

SHLoadIndirectString

api-ms-win-core-processthreads-l1-1-3

SetProcessInformation SetThreadDescription

api-ms-win-core-registry-l1-1-1

RegSetKeyValueW RegDeleteKeyValueW

api-ms-win-core-winrt-l1-1-0

RoInitialize RoUninitialize RoActivateInstance RoGetActivationFactory

api-ms-win-shcore-unicodeansi-l1-1-0

SHUnicodeToAnsi SHAnsiToUnicode

api-ms-win-core-heap-obsolete-l1-1-0

GlobalUnlock GlobalLock

api-ms-win-core-string-obsolete-l1-1-0

lstrlenW lstrcmpiW

api-ms-win-core-memory-l1-1-0

MapViewOfFile CreateFileMappingW OpenFileMappingW UnmapViewOfFile

api-ms-win-core-largeinteger-l1-1-0

MulDiv

api-ms-win-core-winrt-error-l1-1-0

RoFailFastWithErrorContext RoOriginateError SetRestrictedErrorInfo RoTransformError GetRestrictedErrorInfo

api-ms-win-oobe-notification-l1-1-0

OOBEComplete

api-ms-win-core-path-l1-1-0

PathCchCombine PathCchAddExtension PathAllocCombine PathCchAppend

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor

api-ms-win-core-commandlinetoargv-l1-1-0

CommandLineToArgvW

api-ms-win-core-kernel32-legacy-l1-1-0

GetSystemPowerStatus RegisterWaitForSingleObject GetComputerNameW

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency QueryPerformanceCounter

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead InterlockedPushEntrySList

api-ms-win-stateseparation-helpers-l1-1-0

GetPersistedRegistryLocationW

api-ms-win-security-lsalookup-l2-1-0

LookupAccountNameW

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-shell-namespace-l1-1-0

SHGetIDListFromObject SHBindToFolderIDListParent ILIsEqual ILRemoveLastID SHGetNameFromIDList SHBindToParent SHBindToObject SHCreateItemFromIDList SHParseDisplayName ILCloneFirst ILCombine ILFindLastID ILFree ILGetSize ILClone

api-ms-win-shlwapi-winrt-storage-l1-1-1

AssocCreate ord544 StrRetToBufW PathRemoveArgsW StrRetToStrW ord279 ShellMessageBoxW AssocQueryStringW ord292

api-ms-win-ntuser-sysparams-l1-1-0

GetSystemMetrics GetMonitorInfoW EnumDisplayMonitors SystemParametersInfoW

propsys

PropVariantToUInt32 PropVariantToStringAlloc PSCreateMemoryPropertyStore PSPropertyBag_WriteDWORD

api-ms-win-rtcore-ntuser-shell-l1-1-0

GetShellWindow

dxgi

DXGIDeclareAdapterRemovalSupport

api-ms-win-rtcore-ntuser-wmpointer-l1-1-0

EnableMouseInPointer GetCurrentInputMessageSource

api-ms-win-storage-exports-internal-l1-1-0

SHGetKnownFolderIDList SHGetFolderPathEx SetThreadFlags

api-ms-win-rtcore-ntuser-winevent-l1-1-0

UnhookWinEvent SetWinEventHook

api-ms-win-rtcore-ntuser-synch-l1-1-0

MsgWaitForMultipleObjectsEx

api-ms-win-appmodel-runtime-l1-1-0

GetPackagesByPackageFamily

api-ms-win-rtcore-ntuser-clipboard-l1-1-0

RegisterClipboardFormatW

api-ms-win-shell-dataobject-l1-1-1

DragQueryFileW

api-ms-win-rtcore-ntuser-private-l1-1-0

GetWindowBand

api-ms-win-rtcore-ntuser-powermanagement-l1-1-0

RegisterPowerSettingNotification UnregisterPowerSettingNotification

api-ms-win-shell-changenotify-l1-1-1

SHChangeNotifyRegisterThread SHChangeNotifyDeregister SHChangeNotification_Unlock SHChangeNotification_Lock SHChangeNotifyRegister

api-ms-win-ntuser-rectangle-l1-1-0

IntersectRect SetRectEmpty OffsetRect SubtractRect CopyRect EqualRect IsRectEmpty

coremessaging

CreateDispatcherQueueController

gdi32

GetDeviceCaps SelectObject GetStockObject CreateRectRgn OffsetRgn DeleteObject CombineRgn CreateCompatibleDC DeleteDC SetTextColor SetBkMode CreatePen Rectangle CreateSolidBrush SetRectRgn

api-ms-win-core-string-l2-1-0

CharLowerBuffW

wininet

InternetCrackUrlW

shcore

ord162 ord200 ord184 ord186 ord174 ord123 ord121 ord191 ord190 IStream_Write ord187

shell32

ord190 ord866 ord764 SHEvaluateSystemCommandTemplate ShellExecuteExW ShellExecuteW ord89 ord200 ord245 ord899 ord188 ord201 ord206 ord733 ord753 SHFileOperationW ord711 SHUpdateRecycleBinIcon ord60 SHAddToRecentDocs ord896 SHGetPathFromIDListW ord61 SHEnableServiceObject ord54 ord254 ord91 ord723 ord885 ord680 ord172 SHCreateItemInKnownFolder ord100

shlwapi

PathIsDirectoryW ord413 ord467

uxtheme

IsCompositionActive ord86

dwmapi

DwmSetWindowAttribute DwmGetWindowAttribute ord113

user32

SendDlgItemMessageW RegisterHotKey UnregisterHotKey GetLastActivePopup SwitchToThisWindow ord2574 IsHungAppWindow GetGuiResources MonitorFromRect ord2611 TranslateAcceleratorW ChangeWindowMessageFilterEx EndDialog ord2673 GetClassLongW TileWindows MonitorFromWindow SetCursor LoadCursorW IsIconic GetDC DestroyMenu GetMenuDefaultItem CreatePopupMenu ExitWindowsEx LockWorkStation LoadAcceleratorsW InjectMouseInput MapVirtualKeyExW InjectKeyboardInput GetLastInputInfo ord2521 GetPropW GetSysColor SendInput SetDesktopColorTransform PostThreadMessageW UnregisterClassA GetKeyState LoadIconW HungWindowFromGhostWindow ReleaseDC CascadeWindows RegisterClassExW EndPaint BeginPaint InvalidateRect ReleaseCapture PtInRect GetSysColorBrush UpdateLayeredWindow IsCharAlphaNumericW SetFocus DrawFocusRect SetWindowTextW UnregisterClassW ScreenToClient FillRect ord2522 InflateRect ShowWindowAsync CreateWindowInBand GetDesktopWindow CharNextW MonitorFromPoint DefWindowProcA CharLowerW SetWindowsHookExW UnhookWindowsHookEx GetAsyncKeyState CallNextHookEx GetClientRect IsWindowUnicode

mdmregistration

IsDeviceRegisteredWithManagement

api-ms-win-core-sidebyside-l1-1-0

DeactivateActCtx CreateActCtxW ReleaseActCtx ActivateActCtx

sspicli

GetUserNameExW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-errorhandling-l1-1-2

RaiseFailFastException

api-ms-win-core-threadpool-legacy-l1-1-0

UnregisterWaitEx

api-ms-win-core-kernel32-legacy-l1-1-1

VerifyVersionInfoW PowerSetRequest PowerCreateRequest

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime FileTimeToSystemTime

userenv

GetProfileType DeriveAppContainerSidFromAppContainerName

api-ms-win-core-localization-l1-2-3

GetUserDefaultGeoName

winhttp

WinHttpCrackUrl

dnsapi

DnsValidateName_W

api-ms-win-core-file-l2-1-2

CopyFileW

api-ms-win-shell-shdirectory-l1-1-0

ord292

api-ms-win-core-sysinfo-l1-2-0

GetNativeSystemInfo GetProductInfo

api-ms-win-core-sysinfo-l1-2-1

GetPhysicallyInstalledSystemMemory

api-ms-win-core-file-l1-2-0

GetVolumeNameForVolumeMountPointW

api-ms-win-core-io-l1-1-0

DeviceIoControl CreateIoCompletionPort GetQueuedCompletionStatus

api-ms-win-power-base-l1-1-0

CallNtPowerInformation GetPwrCapabilities

api-ms-win-service-management-l2-1-0

QueryServiceConfigW NotifyServiceStatusChangeW

api-ms-win-core-kernel32-legacy-l1-1-2

SetTermsrvAppInstallMode

api-ms-win-eventing-controller-l1-1-0

StartTraceW StopTraceW EnableTraceEx2

api-ms-win-core-processtopology-obsolete-l1-1-0

GetActiveProcessorCount

api-ms-win-core-processtopology-obsolete-l1-1-1

GetActiveProcessorGroupCount

api-ms-win-core-com-l1-1-1

RoGetAgileReference

api-ms-win-core-job-l1-1-0

IsProcessInJob

api-ms-win-core-file-l2-1-0

GetFileInformationByHandleEx

rpcrt4

RpcBindingFree RpcBindingSetAuthInfoExW I_RpcExceptionFilter RpcStringFreeW NdrClientCall3 RpcStringBindingComposeW RpcBindingFromStringBindingW

api-ms-win-appmodel-runtime-l1-1-1

FindPackagesByPackageFamily

api-ms-win-core-biptcltapi-l1-1-7

BiPtAssociateApplicationEntryPoint BiPtEnumerateWorkItemsForPackageName BiPtQueryWorkItem BiPtFreeMemory

urlmon

URLDownloadToCacheFileW

mscms

ord260

wtsapi32

WTSRegisterSessionNotification WTSUnRegisterSessionNotification

kernel32

GetModuleHandleExA HeapSize HeapDestroy

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

api-ms-win-ro-typeresolution-l1-1-1

RoCreatePropertySetSerializer

Name

.text

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

fothk

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.imrsiv

Size

Virtual Size

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

456KB

Virtual Size

453KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

80KB

Virtual Size

77KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

664KB

Virtual Size

663KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

12KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ