windows.storage.dll

  • File Path: C:\Windows\SysWOW64\windows.storage.dll
  • Description: Microsoft WinRT Storage API

Hashes

Type Hash
MD5 0F301A37BB114F52580CC266E4FD46F2
SHA1 9C8D548605A5C8D9ECFE1567CB41AFE98966A0C9
SHA256 4F059F2FD1932DDE9770B4CF6CBA01149A4A56AA53E3DC9A1D646FCBBF5EEAC4
SHA384 9D2ED1C8002094FD47FA4901360C95CE54756611DF31660778DE73DEB8057A07E940B4CF39289DABE0A4B5751006A3BA
SHA512 7E8C1160C4801F11E8B99985C6731F169CAFCC13365ECCD4826CA393AA3687D7C3A33138B1642C0EEBA963B9E3A40EEBC4C2ECFB206C2E8133D2A612A160DD59
SSDEEP 98304:18snTHWViErpL6gA8QaR9Xi5RQjSqcjRnRy8z:18gT29E4Reqcl3
IMP 3A07426B0ED6387DAF925E2185C75549
PESHA1 04656601A90D37BE1F20E5381265B9C98FBD2343
PE256 7F5AE6131A8FE0C806060E6A860AEE3CB6DC98E75368213C897376DC1CC51766

DLL Exports:

Function Name Ordinal Type
SHGetFolderLocation 152 Exported Function
SHGetFileInfoW 151 Exported Function
SHGetDesktopFolder 150 Exported Function
SHGetFolderPathA 153 Exported Function
SHGetFolderPathEx 156 Exported Function
SHGetFolderPathAndSubDirW 155 Exported Function
SHGetFolderPathAndSubDirA 154 Exported Function
SHFlushSFCache 149 Exported Function
SHCreateShellItemArrayWithFolderParent 146 Exported Function
SHCreateShellItemArrayFromShellItem 145 Exported Function
SHCreateShellItemArrayFromIDLists 144 Exported Function
SHCreateStdEnumFmtEtc 74 Exported Function
SHFindFiles 90 Exported Function
SHFileOperationWithAdditionalFlags 148 Exported Function
ShellExecuteExW 227 Exported Function
SHGetPathFromIDListW 167 Exported Function
SHGetPathFromIDListEx 166 Exported Function
SHGetNameFromIDList 165 Exported Function
SHGetSetSettings 68 Exported Function
SHGetSpecialFolderPathW 170 Exported Function
SHGetSpecialFolderPathA 169 Exported Function
SHGetSpecialFolderLocation 168 Exported Function
SHGetKnownFolderPath 164 Exported Function
SHGetInstanceExplorer 159 Exported Function
SHGetIDListFromObject 158 Exported Function
SHGetFolderPathW 157 Exported Function
SHGetItemFromObject 160 Exported Function
SHGetKnownFolderItem 163 Exported Function
SHGetKnownFolderIDList_Internal 162 Exported Function
SHGetKnownFolderIDList 161 Exported Function
SHChangeNotification_Lock 644 Exported Function
SHBindToParent 128 Exported Function
SHBindToObject 127 Exported Function
SHChangeNotification_Unlock 645 Exported Function
SHChangeNotifyRegister 2 Exported Function
SHChangeNotifyDeregister 4 Exported Function
SHChangeNotify 129 Exported Function
SHBindToFolderIDListParentEx 126 Exported Function
RegistryVerbs_GetHandlerMultiSelectModel 124 Exported Function
RebaseOnVolumeID 123 Exported Function
RebaseOnDriveLetter 122 Exported Function
SendNotificationsForLibraryItem 224 Exported Function
SHBindToFolderIDListParent 125 Exported Function
SetThreadFlags 226 Exported Function
SerializeLinkToText 225 Exported Function
SHCreateItemInKnownFolder 139 Exported Function
SHCreateItemFromParsingName 138 Exported Function
SHCreateItemFromIDList 137 Exported Function
SHCreateItemWithParent 140 Exported Function
SHCreateShellItemArrayFromDataObject 143 Exported Function
SHCreateShellItemArray 142 Exported Function
SHCreateItemWithParentAndChildId 141 Exported Function
SHCreateDirectoryExW 136 Exported Function
SHCreateAssociationRegistration 131 Exported Function
SHCoCreateInstanceWorker 130 Exported Function
SHCLSIDFromString 147 Exported Function
SHCreateDataObject 132 Exported Function
SHCreateDirectoryExA 135 Exported Function
SHCreateDirectory 134 Exported Function
SHCreateDefaultExtractIcon 133 Exported Function
SHGetStockIconInfo 171 Exported Function
STORAGE_PathIsEqualOrSubFolderOfKnownFolders 205 Exported Function
STORAGE_MakeDestinationItem 204 Exported Function
Storage_Internal_GetAccessListForPackage 232 Exported Function
STORAGE_SHAddToRecentDocs 206 Exported Function
STORAGE_SHCreateDirectory 209 Exported Function
STORAGE_SHConfirmOperation 208 Exported Function
STORAGE_SHAddToRecentDocsEx 207 Exported Function
STORAGE_GetSystemPersistedStorageItemList 203 Exported Function
STORAGE_CStatusProvider_CreateInstance 188 Exported Function
STORAGE_CreateStorageItemFromShellItem_FullTrustCaller_UseImplicitFlagsAndPackage 200 Exported Function
STORAGE_CreateStorageItemFromShellItem_FullTrustCaller_ForPackage_WithProcessHandleAndSecondaryStreamName 199 Exported Function
STORAGE_CStorageItem_GetValidatedStorageItem 189 Exported Function
STORAGE_GetShellItemFromStorageItem 202 Exported Function
STORAGE_FillResultWithNullForKeys 201 Exported Function
STORAGE_CStorageItem_GetValidatedStorageItemObject 190 Exported Function
STORAGE_SHGetPathFromMsUri 220 Exported Function
STORAGE_SHGetDesktopFolderWorker 219 Exported Function
STORAGE_SHFreeNameMappings 218 Exported Function
STORAGE_SHPathPrepareForWriteA 221 Exported Function
StorageItemHelpers_IsSupportedRemovablePath 231 Exported Function
STORAGE_SHValidateMSUri 223 Exported Function
STORAGE_SHPathPrepareForWriteW 222 Exported Function
STORAGE_SHFileOperationA 217 Exported Function
STORAGE_SHCreateShellItemArray 212 Exported Function
STORAGE_SHCreateDirectoryExWWorker 211 Exported Function
STORAGE_SHCreateDirectoryExA 210 Exported Function
STORAGE_SHCreateShellItemArrayFromDataObject 213 Exported Function
STORAGE_SHFileOperation 216 Exported Function
STORAGE_SHCreateShellItemArrayFromShellItem 215 Exported Function
STORAGE_SHCreateShellItemArrayFromIDLists 214 Exported Function
SHSetFolderPathW 180 Exported Function
SHSetFolderPathA 179 Exported Function
SHRestricted 100 Exported Function
SHSetKnownFolderPath 181 Exported Function
SHSysErrorMessageBox 184 Exported Function
SHSetTemporaryPropertyForItem 183 Exported Function
SHSetLocalizedName 182 Exported Function
SHResolveLibrary 178 Exported Function
SHKnownFolderFromCSIDL 173 Exported Function
SHILCreateFromPath 28 Exported Function
SHGetTemporaryPropertyForItem 172 Exported Function
SHKnownFolderToCSIDL 174 Exported Function
SHPrepareKnownFoldersUser 177 Exported Function
SHPrepareKnownFoldersCommon 176 Exported Function
SHParseDisplayName 175 Exported Function
STORAGE_CreateStorageItemFromPath_FullTrustCaller_ForPackage 194 Exported Function
STORAGE_CreateStorageItemFromPath_FullTrustCaller 193 Exported Function
STORAGE_CreateSortColumnArrayFromListDesc 192 Exported Function
STORAGE_CreateStorageItemFromPath_PartialTrustCaller 195 Exported Function
STORAGE_CreateStorageItemFromShellItem_FullTrustCaller_ForPackage_WithProcessHandle 198 Exported Function
STORAGE_CreateStorageItemFromShellItem_FullTrustCaller_ForPackage 197 Exported Function
STORAGE_CreateStorageItemFromShellItem_FullTrustCaller 196 Exported Function
STORAGE_ClearDestinationsForAllApps 191 Exported Function
StateRepoVerbsCache_GetContextMenuVerbs 229 Exported Function
StateRepoVerbsCache_Destroy 228 Exported Function
SHTestTokenMembership 245 Exported Function
StateRepoVerbsCache_RebuildCacheAsync 230 Exported Function
STORAGE_CEnumFiles_CreateInstance 187 Exported Function
STORAGE_AddNewFolderToFrequentPlaces 186 Exported Function
STORAGE_AddItemToRecentDocs 185 Exported Function
DeserializeTextToLink 44 Exported Function
DataAccessCaches_InvalidateForLibrary 43 Exported Function
CViewSettings_CreateInstance 32 Exported Function
DetermineFolderDestinationParentAppID 45 Exported Function
DllGetClassObject 48 Exported Function
DllGetActivationFactory 47 Exported Function
DllCanUnloadNow 46 Exported Function
CustomStatePropertyDescription_CreateWithStateIdentifier 41 Exported Function
CShellItemArrayAsVirtualizedObjectArray_CreateInstance 24 Exported Function
CShellItemArrayAsCollection_CreateInstance 23 Exported Function
CShellItemArray_CreateInstance 26 Exported Function
CShellItemArrayWithCommonParent_CreateInstance 25 Exported Function
CustomStatePropertyDescription_CreateWithItemPropertyStore 40 Exported Function
CTaskAddDoc_Create 31 Exported Function
CStorageItem_GetValidatedStorageItemObject 30 Exported Function
GetInfoForFileInUse 945 Exported Function
GetFindDataFromFileInformationByHandle 57 Exported Function
GetFindDataForPath 56 Exported Function
GetRegDataDrivenCommand 58 Exported Function
GetSystemPersistedStorageItemList 61 Exported Function
GetSelectionStateFromItemArray 60 Exported Function
GetRegDataDrivenCommandWithAssociation 59 Exported Function
GetFileUndoText 55 Exported Function
DllUnregisterServer 51 Exported Function
DllRegisterServer 50 Exported Function
DllMain 49 Exported Function
DragQueryFileW 52 Exported Function
GetCommandProviderForFolderType 54 Exported Function
GetCachedFileUpdateInformation 938 Exported Function
EnumShellItemsFromEnumFullIdList 53 Exported Function
CFSFolder_AdjustForSlowColumn 14 Exported Function
CFreeThreadedItemContainer_CreateInstance 18 Exported Function
CFileOperationRecorder_CreateInstance 17 Exported Function
CFSFolder_CreateFolder 15 Exported Function
CopyDefaultLibrariesFromGroupPolicy 33 Exported Function
CMruLongList_CreateInstance 19 Exported Function
CFSFolder_IsCommonItem 16 Exported Function
CDesktopFolder_CreateInstanceWithBindContext 13 Exported Function
AssocCreateForClasses 8 Exported Function
_PredictReasonableImpact 234 Exported Function
_CleanRecentDocs 233 Exported Function
AssocGetDetailsOfPropKey 9 Exported Function
CCollectionFactory_CreateInstance 12 Exported Function
CCachedShellItem_CreateInstance 11 Exported Function
AssocShouldProcessUseAppToAppLaunching 10 Exported Function
CreateStorageItemFromShellItem_FullTrustCaller_ForPackage 925 Exported Function
CreateStorageItemFromShellItem 942 Exported Function
CreateStorageItemFromPath_PartialTrustCaller 38 Exported Function
CreateVolatilePropertyStore 39 Exported Function
CShellItem_CreateInstance 29 Exported Function
CRegFolder_CreateInstance 22 Exported Function
CRegFolder_CreateAndInit 21 Exported Function
CreateStorageItemFromPath_FullTrustCaller_ForPackage 5 Exported Function
CreateItemArrayFromItemStore 34 Exported Function
CreateExtrinsicPropertyStore 943 Exported Function
CPrivateProfileCache_Save 20 Exported Function
CreateItemArrayFromObjectArray 35 Exported Function
CreateStorageItemFromPath_FullTrustCaller 3 Exported Function
CreateSortColumnArray 37 Exported Function
CreateLocalizationDesktopIni 36 Exported Function
GetSystemPersistedStorageItemListForUser 62 Exported Function
ILGetNext 108 Exported Function
ILFree 107 Exported Function
ILFindLastID 106 Exported Function
ILGetSize 109 Exported Function
ILLoadFromStreamEx 846 Exported Function
ILIsParent 111 Exported Function
ILIsEqual 110 Exported Function
ILFindChild 105 Exported Function
HideExtension 99 Exported Function
GrantWorkingDirectoryAccess_FullTrustCaller_ForPackage 98 Exported Function
GrantPathAccess_FullTrustCaller_ForPackage 97 Exported Function
ILAppendID 101 Exported Function
ILCombine 104 Exported Function
ILCloneFirst 103 Exported Function
ILClone 102 Exported Function
PathIsExe 118 Exported Function
PathContainedByManifestedKnownFolder_FullTrustCaller_ForPackage 7 Exported Function
PathCleanupSpec 117 Exported Function
PathMakeUniqueName 119 Exported Function
QueryStorageAccess_FullTrustCaller_ForToken 121 Exported Function
QueryStorageAccess_FullTrustCaller_ForPackage 120 Exported Function
PathYetAnotherMakeUniqueName 75 Exported Function
NeverProvidedByJunction 116 Exported Function
IsLFNDriveW 42 Exported Function
ILSaveToStream 27 Exported Function
ILRemoveLastID 112 Exported Function
IsLibraryCreatedByPolicy 113 Exported Function
IsUserAnAdmin 680 Exported Function
IsNameListedUnderKey 115 Exported Function
IsLibraryPolicyEnabled 114 Exported Function
Global_WindowsStorage_fIconCacheHasBeenSuccessfullyCreated 81 Exported Function
Global_WindowsStorage_fEndInitialized 80 Exported Function
Global_WindowsStorage_esServerMode 79 Exported Function
Global_WindowsStorage_fIconCacheIsValid 82 Exported Function
Global_WindowsStorage_iLastSysIcon 85 Exported Function
Global_WindowsStorage_hwndSCN 84 Exported Function
Global_WindowsStorage_fNeedsInitBroadcast 83 Exported Function
Global_WindowsStorage_dwThreadInitializing 78 Exported Function
Global_WindowsStorage_afNotRedirected 71 Exported Function
GetUserChoiceForUrl 6 Exported Function
GetThreadFlags 63 Exported Function
Global_WindowsStorage_ccIcon 72 Exported Function
Global_WindowsStorage_dwThreadBindCtx 77 Exported Function
Global_WindowsStorage_csSCN 76 Exported Function
Global_WindowsStorage_csIconCache 73 Exported Function
Global_WindowsStorage_Untyped_FileClassSRWLock 65 Exported Function
Global_WindowsStorage_ulNextID 96 Exported Function
Global_WindowsStorage_tlsThreadFlags 94 Exported Function
Global_WindowsStorage_Untyped_MountPoint 66 Exported Function
Global_WindowsStorage_Untyped_rgshil 70 Exported Function
Global_WindowsStorage_Untyped_pFileHanderMap 69 Exported Function
Global_WindowsStorage_Untyped_pFileClassCacheTable 67 Exported Function
Global_WindowsStorage_tlsIconCache 93 Exported Function
Global_WindowsStorage_lProcessClassCount 88 Exported Function
Global_WindowsStorage_iUseLinkPrefix 87 Exported Function
Global_WindowsStorage_iLastSystemColorDepth 86 Exported Function
Global_WindowsStorage_lrFlags 89 Exported Function
Global_WindowsStorage_tlsChangeClientProxy 92 Exported Function
Global_WindowsStorage_nImageManagerVersion 91 Exported Function
Global_WindowsStorage_MaxIcons 64 Exported Function

Signature

  • Status: Signature verified.
  • Serial: 330000026551AE1BBD005CBFBD000000000265
  • Thumbprint: E168609353F30FF2373157B4EB8CD519D07A2BFF
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: Windows.Storage.dll
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.19041.508 (WinBuild.160101.0800)
  • Product Version: 10.0.19041.508
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 32-bit

File Scan

  • VirusTotal Detections: 0/66
  • VirusTotal Link: https://www.virustotal.com/gui/file/4f059f2fd1932dde9770b4cf6cba01149a4a56aa53e3dc9a1d646fcbbf5eeac4/detection/

Possible Misuse

The following table contains possible examples of windows.storage.dll being misused. While windows.storage.dll is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source Source File Example License
sigma proc_access_win_in_memory_assembly_execution.yml - '\|C:\Windows\SYSTEM32\windows.storage.dll+' DRL 1.0

MIT License. Copyright (c) 2020-2021 Strontic.