windows.storage.dll

  • File Path: C:\Windows\system32\windows.storage.dll
  • Description: Microsoft WinRT Storage API

Hashes

Type Hash
MD5 1061075F1471A73CBE65B779906F2AE7
SHA1 B5FCD097DFF06940151A0129C5475C121264AF97
SHA256 02AFF6EA7BA2E0F3BCFEBF0DDD38BADC0EC69D37A02ABA48F758A8D04C922AE2
SHA384 783416F0DC7269C35272C8531213F61A6A081FAD2B95EB51484A83BCF27AEBCB122D388F2E7F319E3514C093704D8BD7
SHA512 48DAB867907AF11E421C9D5E5241DD9C77CC2F204A823A6B5DA5648D9125866C6E09BEED0A6C4E4346D1F418CD1D5F7DA4419DAD071AC3D038DFF85405C91FE3
SSDEEP 98304:3npeDa+zrhOlat81dGJi1zTWH0EwUMR364EBQs8r77n:ZeDa+zrt+7Ci1HWUEwdRK4Ns8n7
IMP 21559E437C30754001E11F869ECE73EC
PESHA1 B664A8490013226F3D4944D57475859CF9B5B806
PE256 DEA38D83E6ED67629E2E5666C68C5934E54C6A839FBAC7829641A8F66E9C55DA

DLL Exports:

Function Name Ordinal Type
SHGetFolderLocation 152 Exported Function
SHGetFileInfoW 151 Exported Function
SHGetDesktopFolder 150 Exported Function
SHGetFolderPathA 153 Exported Function
SHGetFolderPathEx 156 Exported Function
SHGetFolderPathAndSubDirW 155 Exported Function
SHGetFolderPathAndSubDirA 154 Exported Function
SHFlushSFCache 149 Exported Function
SHCreateShellItemArrayWithFolderParent 146 Exported Function
SHCreateShellItemArrayFromShellItem 145 Exported Function
SHCreateShellItemArrayFromIDLists 144 Exported Function
SHCreateStdEnumFmtEtc 74 Exported Function
SHFindFiles 90 Exported Function
SHFileOperationWithAdditionalFlags 148 Exported Function
ShellExecuteExW 227 Exported Function
SHGetPathFromIDListW 167 Exported Function
SHGetPathFromIDListEx 166 Exported Function
SHGetNameFromIDList 165 Exported Function
SHGetSetSettings 68 Exported Function
SHGetSpecialFolderPathW 170 Exported Function
SHGetSpecialFolderPathA 169 Exported Function
SHGetSpecialFolderLocation 168 Exported Function
SHGetKnownFolderPath 164 Exported Function
SHGetInstanceExplorer 159 Exported Function
SHGetIDListFromObject 158 Exported Function
SHGetFolderPathW 157 Exported Function
SHGetItemFromObject 160 Exported Function
SHGetKnownFolderItem 163 Exported Function
SHGetKnownFolderIDList_Internal 162 Exported Function
SHGetKnownFolderIDList 161 Exported Function
SHChangeNotification_Lock 644 Exported Function
SHBindToParent 128 Exported Function
SHBindToObject 127 Exported Function
SHChangeNotification_Unlock 645 Exported Function
SHChangeNotifyRegister 2 Exported Function
SHChangeNotifyDeregister 4 Exported Function
SHChangeNotify 129 Exported Function
SHBindToFolderIDListParentEx 126 Exported Function
RegistryVerbs_GetHandlerMultiSelectModel 124 Exported Function
RebaseOnVolumeID 123 Exported Function
RebaseOnDriveLetter 122 Exported Function
SendNotificationsForLibraryItem 224 Exported Function
SHBindToFolderIDListParent 125 Exported Function
SetThreadFlags 226 Exported Function
SerializeLinkToText 225 Exported Function
SHCreateItemInKnownFolder 139 Exported Function
SHCreateItemFromParsingName 138 Exported Function
SHCreateItemFromIDList 137 Exported Function
SHCreateItemWithParent 140 Exported Function
SHCreateShellItemArrayFromDataObject 143 Exported Function
SHCreateShellItemArray 142 Exported Function
SHCreateItemWithParentAndChildId 141 Exported Function
SHCreateDirectoryExW 136 Exported Function
SHCreateAssociationRegistration 131 Exported Function
SHCoCreateInstanceWorker 130 Exported Function
SHCLSIDFromString 147 Exported Function
SHCreateDataObject 132 Exported Function
SHCreateDirectoryExA 135 Exported Function
SHCreateDirectory 134 Exported Function
SHCreateDefaultExtractIcon 133 Exported Function
SHGetStockIconInfo 171 Exported Function
STORAGE_PathIsEqualOrSubFolderOfKnownFolders 205 Exported Function
STORAGE_MakeDestinationItem 204 Exported Function
Storage_Internal_GetAccessListForPackage 232 Exported Function
STORAGE_SHAddToRecentDocs 206 Exported Function
STORAGE_SHCreateDirectory 209 Exported Function
STORAGE_SHConfirmOperation 208 Exported Function
STORAGE_SHAddToRecentDocsEx 207 Exported Function
STORAGE_GetSystemPersistedStorageItemList 203 Exported Function
STORAGE_CStatusProvider_CreateInstance 188 Exported Function
STORAGE_CreateStorageItemFromShellItem_FullTrustCaller_UseImplicitFlagsAndPackage 200 Exported Function
STORAGE_CreateStorageItemFromShellItem_FullTrustCaller_ForPackage_WithProcessHandleAndSecondaryStreamName 199 Exported Function
STORAGE_CStorageItem_GetValidatedStorageItem 189 Exported Function
STORAGE_GetShellItemFromStorageItem 202 Exported Function
STORAGE_FillResultWithNullForKeys 201 Exported Function
STORAGE_CStorageItem_GetValidatedStorageItemObject 190 Exported Function
STORAGE_SHGetPathFromMsUri 220 Exported Function
STORAGE_SHGetDesktopFolderWorker 219 Exported Function
STORAGE_SHFreeNameMappings 218 Exported Function
STORAGE_SHPathPrepareForWriteA 221 Exported Function
StorageItemHelpers_IsSupportedRemovablePath 231 Exported Function
STORAGE_SHValidateMSUri 223 Exported Function
STORAGE_SHPathPrepareForWriteW 222 Exported Function
STORAGE_SHFileOperationA 217 Exported Function
STORAGE_SHCreateShellItemArray 212 Exported Function
STORAGE_SHCreateDirectoryExWWorker 211 Exported Function
STORAGE_SHCreateDirectoryExA 210 Exported Function
STORAGE_SHCreateShellItemArrayFromDataObject 213 Exported Function
STORAGE_SHFileOperation 216 Exported Function
STORAGE_SHCreateShellItemArrayFromShellItem 215 Exported Function
STORAGE_SHCreateShellItemArrayFromIDLists 214 Exported Function
SHSetFolderPathW 180 Exported Function
SHSetFolderPathA 179 Exported Function
SHRestricted 100 Exported Function
SHSetKnownFolderPath 181 Exported Function
SHSysErrorMessageBox 184 Exported Function
SHSetTemporaryPropertyForItem 183 Exported Function
SHSetLocalizedName 182 Exported Function
SHResolveLibrary 178 Exported Function
SHKnownFolderFromCSIDL 173 Exported Function
SHILCreateFromPath 28 Exported Function
SHGetTemporaryPropertyForItem 172 Exported Function
SHKnownFolderToCSIDL 174 Exported Function
SHPrepareKnownFoldersUser 177 Exported Function
SHPrepareKnownFoldersCommon 176 Exported Function
SHParseDisplayName 175 Exported Function
STORAGE_CreateStorageItemFromPath_FullTrustCaller_ForPackage 194 Exported Function
STORAGE_CreateStorageItemFromPath_FullTrustCaller 193 Exported Function
STORAGE_CreateSortColumnArrayFromListDesc 192 Exported Function
STORAGE_CreateStorageItemFromPath_PartialTrustCaller 195 Exported Function
STORAGE_CreateStorageItemFromShellItem_FullTrustCaller_ForPackage_WithProcessHandle 198 Exported Function
STORAGE_CreateStorageItemFromShellItem_FullTrustCaller_ForPackage 197 Exported Function
STORAGE_CreateStorageItemFromShellItem_FullTrustCaller 196 Exported Function
STORAGE_ClearDestinationsForAllApps 191 Exported Function
StateRepoVerbsCache_GetContextMenuVerbs 229 Exported Function
StateRepoVerbsCache_Destroy 228 Exported Function
SHTestTokenMembership 245 Exported Function
StateRepoVerbsCache_RebuildCacheAsync 230 Exported Function
STORAGE_CEnumFiles_CreateInstance 187 Exported Function
STORAGE_AddNewFolderToFrequentPlaces 186 Exported Function
STORAGE_AddItemToRecentDocs 185 Exported Function
DeserializeTextToLink 44 Exported Function
DataAccessCaches_InvalidateForLibrary 43 Exported Function
CViewSettings_CreateInstance 32 Exported Function
DetermineFolderDestinationParentAppID 45 Exported Function
DllGetClassObject 48 Exported Function
DllGetActivationFactory 47 Exported Function
DllCanUnloadNow 46 Exported Function
CustomStatePropertyDescription_CreateWithStateIdentifier 41 Exported Function
CShellItemArrayAsVirtualizedObjectArray_CreateInstance 24 Exported Function
CShellItemArrayAsCollection_CreateInstance 23 Exported Function
CShellItemArray_CreateInstance 26 Exported Function
CShellItemArrayWithCommonParent_CreateInstance 25 Exported Function
CustomStatePropertyDescription_CreateWithItemPropertyStore 40 Exported Function
CTaskAddDoc_Create 31 Exported Function
CStorageItem_GetValidatedStorageItemObject 30 Exported Function
GetInfoForFileInUse 945 Exported Function
GetFindDataFromFileInformationByHandle 57 Exported Function
GetFindDataForPath 56 Exported Function
GetRegDataDrivenCommand 58 Exported Function
GetSystemPersistedStorageItemList 61 Exported Function
GetSelectionStateFromItemArray 60 Exported Function
GetRegDataDrivenCommandWithAssociation 59 Exported Function
GetFileUndoText 55 Exported Function
DllUnregisterServer 51 Exported Function
DllRegisterServer 50 Exported Function
DllMain 49 Exported Function
DragQueryFileW 52 Exported Function
GetCommandProviderForFolderType 54 Exported Function
GetCachedFileUpdateInformation 938 Exported Function
EnumShellItemsFromEnumFullIdList 53 Exported Function
CFSFolder_AdjustForSlowColumn 14 Exported Function
CFreeThreadedItemContainer_CreateInstance 18 Exported Function
CFileOperationRecorder_CreateInstance 17 Exported Function
CFSFolder_CreateFolder 15 Exported Function
CopyDefaultLibrariesFromGroupPolicy 33 Exported Function
CMruLongList_CreateInstance 19 Exported Function
CFSFolder_IsCommonItem 16 Exported Function
CDesktopFolder_CreateInstanceWithBindContext 13 Exported Function
AssocCreateForClasses 8 Exported Function
_PredictReasonableImpact 234 Exported Function
_CleanRecentDocs 233 Exported Function
AssocGetDetailsOfPropKey 9 Exported Function
CCollectionFactory_CreateInstance 12 Exported Function
CCachedShellItem_CreateInstance 11 Exported Function
AssocShouldProcessUseAppToAppLaunching 10 Exported Function
CreateStorageItemFromShellItem_FullTrustCaller_ForPackage 925 Exported Function
CreateStorageItemFromShellItem 942 Exported Function
CreateStorageItemFromPath_PartialTrustCaller 38 Exported Function
CreateVolatilePropertyStore 39 Exported Function
CShellItem_CreateInstance 29 Exported Function
CRegFolder_CreateInstance 22 Exported Function
CRegFolder_CreateAndInit 21 Exported Function
CreateStorageItemFromPath_FullTrustCaller_ForPackage 5 Exported Function
CreateItemArrayFromItemStore 34 Exported Function
CreateExtrinsicPropertyStore 943 Exported Function
CPrivateProfileCache_Save 20 Exported Function
CreateItemArrayFromObjectArray 35 Exported Function
CreateStorageItemFromPath_FullTrustCaller 3 Exported Function
CreateSortColumnArray 37 Exported Function
CreateLocalizationDesktopIni 36 Exported Function
GetSystemPersistedStorageItemListForUser 62 Exported Function
ILGetNext 108 Exported Function
ILFree 107 Exported Function
ILFindLastID 106 Exported Function
ILGetSize 109 Exported Function
ILLoadFromStreamEx 846 Exported Function
ILIsParent 111 Exported Function
ILIsEqual 110 Exported Function
ILFindChild 105 Exported Function
HideExtension 99 Exported Function
GrantWorkingDirectoryAccess_FullTrustCaller_ForPackage 98 Exported Function
GrantPathAccess_FullTrustCaller_ForPackage 97 Exported Function
ILAppendID 101 Exported Function
ILCombine 104 Exported Function
ILCloneFirst 103 Exported Function
ILClone 102 Exported Function
PathIsExe 118 Exported Function
PathContainedByManifestedKnownFolder_FullTrustCaller_ForPackage 7 Exported Function
PathCleanupSpec 117 Exported Function
PathMakeUniqueName 119 Exported Function
QueryStorageAccess_FullTrustCaller_ForToken 121 Exported Function
QueryStorageAccess_FullTrustCaller_ForPackage 120 Exported Function
PathYetAnotherMakeUniqueName 75 Exported Function
NeverProvidedByJunction 116 Exported Function
IsLFNDriveW 42 Exported Function
ILSaveToStream 27 Exported Function
ILRemoveLastID 112 Exported Function
IsLibraryCreatedByPolicy 113 Exported Function
IsUserAnAdmin 680 Exported Function
IsNameListedUnderKey 115 Exported Function
IsLibraryPolicyEnabled 114 Exported Function
Global_WindowsStorage_fIconCacheHasBeenSuccessfullyCreated 81 Exported Function
Global_WindowsStorage_fEndInitialized 80 Exported Function
Global_WindowsStorage_esServerMode 79 Exported Function
Global_WindowsStorage_fIconCacheIsValid 82 Exported Function
Global_WindowsStorage_iLastSysIcon 85 Exported Function
Global_WindowsStorage_hwndSCN 84 Exported Function
Global_WindowsStorage_fNeedsInitBroadcast 83 Exported Function
Global_WindowsStorage_dwThreadInitializing 78 Exported Function
Global_WindowsStorage_afNotRedirected 71 Exported Function
GetUserChoiceForUrl 6 Exported Function
GetThreadFlags 63 Exported Function
Global_WindowsStorage_ccIcon 72 Exported Function
Global_WindowsStorage_dwThreadBindCtx 77 Exported Function
Global_WindowsStorage_csSCN 76 Exported Function
Global_WindowsStorage_csIconCache 73 Exported Function
Global_WindowsStorage_Untyped_FileClassSRWLock 65 Exported Function
Global_WindowsStorage_ulNextID 96 Exported Function
Global_WindowsStorage_tlsThreadFlags 94 Exported Function
Global_WindowsStorage_Untyped_MountPoint 66 Exported Function
Global_WindowsStorage_Untyped_rgshil 70 Exported Function
Global_WindowsStorage_Untyped_pFileHanderMap 69 Exported Function
Global_WindowsStorage_Untyped_pFileClassCacheTable 67 Exported Function
Global_WindowsStorage_tlsIconCache 93 Exported Function
Global_WindowsStorage_lProcessClassCount 88 Exported Function
Global_WindowsStorage_iUseLinkPrefix 87 Exported Function
Global_WindowsStorage_iLastSystemColorDepth 86 Exported Function
Global_WindowsStorage_lrFlags 89 Exported Function
Global_WindowsStorage_tlsChangeClientProxy 92 Exported Function
Global_WindowsStorage_nImageManagerVersion 91 Exported Function
Global_WindowsStorage_MaxIcons 64 Exported Function

Signature

  • Status: Signature verified.
  • Serial: 3300000266BD1580EFA75CD6D3000000000266
  • Thumbprint: A4341B9FD50FB9964283220A36A1EF6F6FAA7840
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: Windows.Storage.dll.MUI
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.19041.1 (WinBuild.160101.0800)
  • Product Version: 10.0.19041.1
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 64-bit

File Scan

  • VirusTotal Detections: 0/69
  • VirusTotal Link: https://www.virustotal.com/gui/file/02aff6ea7ba2e0f3bcfebf0ddd38badc0ec69d37a02aba48f758a8d04c922ae2/detection/

Possible Misuse

The following table contains possible examples of windows.storage.dll being misused. While windows.storage.dll is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source Source File Example License
sigma proc_access_win_in_memory_assembly_execution.yml - '\|C:\Windows\SYSTEM32\windows.storage.dll+' DRL 1.0

MIT License. Copyright (c) 2020-2021 Strontic.