rasmans.dll
v10.0.19041.6456
64-bit
Windows NT
Analyzed
Security warning
This file has been flagged as potentially dangerous, and downloads are disabled.
Reason: Detected potentially dangerous functions used for process injection: OpenProcess
Exported functions 8
NlmGetBestCostNetworkConnection
#1 · 0xaae70
NlmGetCostedNetworkSettings
#2 · 0xa5170
NlmSetCostedNetworkSettings
#3 · 0xa55e0
ServiceInitialized
#4 · 0x13a30
ServiceMain
#5 · 0x36470
ServiceRequestInProcess
#6 · 0x13970
VpnProfileMatchingNrpt
#7 · 0xc2d90
VpnProfileNrptHasExemptions
#8 · 0xc2ec0
No function matches your filter.
Imported DLLs & functions 384
ApiSetQueryApiSetPresence
0x1800d8900
SetConsoleCtrlHandler
0x1800d8910
DelayLoadFailureHook
0x1800d8920
ResolveDelayLoadedAPI
0x1800d8930
GetLastError
0x1800d8950
SetLastError
0x1800d8958
SetUnhandledExceptionFilter
0x1800d8940
UnhandledExceptionFilter
0x1800d8948
CompareFileTime
0x1800d89b8
CreateDirectoryW
0x1800d89a0
CreateFileA
0x1800d8990
CreateFileW
0x1800d8988
DeleteFileW
0x1800d8998
FindClose
0x1800d8980
FindFirstFileW
0x1800d89c8
FindNextFileW
0x1800d89e0
GetFileAttributesW
0x1800d89e8
GetFileInformationByHandle
0x1800d89c0
GetFileType
0x1800d89d8
GetFinalPathNameByHandleW
0x1800d89b0
GetFullPathNameW
0x1800d8978
QueryDosDeviceW
0x1800d8970
ReadFile
0x1800d89d0
SetFileInformationByHandle
0x1800d8968
WriteFile
0x1800d89a8
CopyFileW
0x1800d89f8
GetProcessHeap
0x1800d8a20
HeapAlloc
0x1800d8a28
HeapFree
0x1800d8a30
GlobalAlloc
0x1800d8a48
GlobalFree
0x1800d8a40
LocalAlloc
0x1800d8a58
LocalFree
0x1800d8a50
GlobalReAlloc
0x1800d8a68
CreateIoCompletionPort
0x1800d8a78
DeviceIoControl
0x1800d8a90
GetOverlappedResult
0x1800d8a80
GetQueuedCompletionStatus
0x1800d8a98
PostQueuedCompletionStatus
0x1800d8a88
WTSGetActiveConsoleSessionId
0x1800d8aa8
PowerCreateRequest
0x1800d8ab8
DisableThreadLibraryCalls
0x1800d8ad8
FreeLibrary
0x1800d8ae8
FreeLibraryAndExitThread
0x1800d8af0
GetModuleHandleExA
0x1800d8ac8
GetModuleHandleExW
0x1800d8af8
GetModuleHandleW
0x1800d8ad0
GetProcAddress
0x1800d8ae0
LoadLibraryExA
0x1800d8b08
LoadLibraryExW
0x1800d8b00
CompareStringA
0x1800d8b18
ExpandEnvironmentStringsA
0x1800d8b28
ExpandEnvironmentStringsW
0x1800d8b30
GetCommandLineA
0x1800d8b38
CreateProcessAsUserW
0x1800d8ba8
CreateThread
0x1800d8b58
GetCurrentProcess
0x1800d8b90
GetCurrentProcessId
0x1800d8b48
GetCurrentThread
0x1800d8b70
GetCurrentThreadId
0x1800d8b60
GetExitCodeProcess
0x1800d8b78
OpenProcessToken
0x1800d8b98
OpenThreadToken
0x1800d8b50
ProcessIdToSessionId
0x1800d8ba0
QueueUserAPC
0x1800d8b80
SetThreadToken
0x1800d8b88
TerminateProcess
0x1800d8b68
OpenProcess
0x1800d8bc0
SetProcessMitigationPolicy
0x1800d8bb8
QueryPerformanceCounter
0x1800d8bd0
RegCloseKey
0x1800d8bf0
RegCreateKeyExW
0x1800d8be0
RegDeleteKeyExW
0x1800d8bf8
RegDeleteValueA
0x1800d8c30
RegDeleteValueW
0x1800d8c40
RegEnumKeyExW
0x1800d8c10
RegGetValueA
0x1800d8c28
RegGetValueW
0x1800d8c48
RegNotifyChangeKeyValue
0x1800d8be8
RegOpenKeyExA
0x1800d8c00
RegOpenKeyExW
0x1800d8c18
RegQueryInfoKeyW
0x1800d8c50
RegQueryValueExA
0x1800d8c38
RegQueryValueExW
0x1800d8c20
RegSetValueExW
0x1800d8c08
RtlCaptureContext
0x1800d8c68
RtlCompareMemory
0x1800d8c78
RtlLookupFunctionEntry
0x1800d8c60
RtlVirtualUnwind
0x1800d8c70
CompareStringW
0x1800d8c90
MultiByteToWideChar
0x1800d8c88
WideCharToMultiByte
0x1800d8c98
CharLowerBuffW
0x1800d8ca8
CharNextW
0x1800d8cb0
CharPrevW
0x1800d8cb8
lstrcmpiW
0x1800d8cd0
lstrcmpW
0x1800d8ce0
lstrlenA
0x1800d8cd8
lstrlenW
0x1800d8cc8
CreateEventA
0x1800d8d40
CreateEventW
0x1800d8d08
CreateMutexW
0x1800d8d68
DeleteCriticalSection
0x1800d8d38
EnterCriticalSection
0x1800d8d48
InitializeCriticalSection
0x1800d8d00
InitializeCriticalSectionAndSpinCount
0x1800d8d28
LeaveCriticalSection
0x1800d8d10
OpenMutexW
0x1800d8d58
ReleaseMutex
0x1800d8d60
ReleaseSemaphore
0x1800d8d30
ResetEvent
0x1800d8d18
SetEvent
0x1800d8cf8
WaitForMultipleObjectsEx
0x1800d8d20
WaitForSingleObject
0x1800d8cf0
WaitForSingleObjectEx
0x1800d8d50
Sleep
0x1800d8d78
GetLocalTime
0x1800d8da8
GetSystemDirectoryA
0x1800d8da0
GetSystemDirectoryW
0x1800d8d88
GetSystemTime
0x1800d8db8
GetSystemTimeAsFileTime
0x1800d8d98
GetSystemWindowsDirectoryW
0x1800d8d90
GetTickCount
0x1800d8dc0
GetVersionExW
0x1800d8db0
GetProductInfo
0x1800d8dd0
CloseThreadpoolTimer
0x1800d8e10
CloseThreadpoolWait
0x1800d8e00
CloseThreadpoolWork
0x1800d8e38
CreateThreadpoolTimer
0x1800d8e28
CreateThreadpoolWait
0x1800d8df8
CreateThreadpoolWork
0x1800d8e20
SetThreadpoolTimer
0x1800d8e08
SetThreadpoolWait
0x1800d8df0
SubmitThreadpoolWork
0x1800d8de0
WaitForThreadpoolTimerCallbacks
0x1800d8de8
WaitForThreadpoolWaitCallbacks
0x1800d8e18
WaitForThreadpoolWorkCallbacks
0x1800d8e30
QueueUserWorkItem
0x1800d8e48
SystemTimeToFileTime
0x1800d8e58
CM_Get_Device_ID_List_SizeW
0x1800d8e78
CM_Get_Device_ID_ListW
0x1800d8e80
CM_Get_Device_IDW
0x1800d8e70
CM_Locate_DevNodeW
0x1800d8e88
CM_MapCrToWin32Err
0x1800d8e90
CM_Open_DevNode_Key
0x1800d8e68
DevCloseObjectQuery
0x1800d8ea8
DevCreateObjectQuery
0x1800d8ea0
TraceMessage
0x1800d8ed0
EventActivityIdControl
0x1800d8ef8
EventRegister
0x1800d8ee8
EventSetInformation
0x1800d8f00
EventUnregister
0x1800d8ef0
EventWriteTransfer
0x1800d8ee0
AddAccessAllowedAce
0x1800d8f18
AdjustTokenPrivileges
0x1800d8fb0
AllocateAndInitializeSid
0x1800d8fc8
CheckTokenMembership
0x1800d8f78
CopySid
0x1800d8fa8
DuplicateToken
0x1800d8f60
DuplicateTokenEx
0x1800d8f68
EqualSid
0x1800d8f88
FreeSid
0x1800d8f70
GetLengthSid
0x1800d8f20
GetSecurityDescriptorDacl
0x1800d8fb8
GetSecurityDescriptorGroup
0x1800d8fc0
GetSecurityDescriptorOwner
0x1800d8fa0
GetSidLengthRequired
0x1800d8f40
GetSidSubAuthority
0x1800d8f48
GetTokenInformation
0x1800d8f98
ImpersonateLoggedOnUser
0x1800d8f80
InitializeAcl
0x1800d8f28
InitializeSecurityDescriptor
0x1800d8f30
InitializeSid
0x1800d8f38
RevertToSelf
0x1800d8f90
SetSecurityDescriptorDacl
0x1800d8f58
SetSecurityDescriptorGroup
0x1800d8f10
SetSecurityDescriptorOwner
0x1800d8f50
DnsFreeNrptRuleNamesList
0x1800d8750
DnsGetNrptRuleNamesList
0x1800d8748
DnsRemoveNrptRule
0x1800d8738
DnsSetNrptRules
0x1800d8740
FwAlloc
0x1800d8788
FWFreeFirewallRules
0x1800d8778
NetworkIsolationCreateInterfaceContainer
0x1800d8770
NetworkIsolationDeleteInterfaceContainer
0x1800d8780
FwAdvPolicyDecodeFirewallRule
0x1800d8760
fwpuclnt.dll
29
FwpiVpnTriggerAddAppSids
0x1800d9028
FwpiVpnTriggerAddFilePaths
0x1800d9040
FwpiVpnTriggerAddSecurityDescriptor
0x1800d90a8
FwpiVpnTriggerConfigureParameters
0x1800d9000
FwpiVpnTriggerEventSubscribe0
0x1800d9050
FwpiVpnTriggerEventUnsubscribe0
0x1800d8ff0
FwpiVpnTriggerRemoveAppSids
0x1800d9018
FwpiVpnTriggerRemoveFilePaths
0x1800d9010
FwpiVpnTriggerRemoveSecurityDescriptor
0x1800d9008
FwpiVpnTriggerResetNrptTriggering
0x1800d90c8
FwpiVpnTriggerSetStateDisconnected
0x1800d9048
FwpmCalloutAdd0
0x1800d9030
FwpmCalloutDeleteByKey0
0x1800d9038
FwpmEngineClose0
0x1800d9058
FwpmEngineOpen0
0x1800d90c0
FwpmFilterAdd0
0x1800d9060
FwpmFilterDeleteByKey0
0x1800d9020
FwpmFreeMemory0
0x1800d90a0
FwpmGetAppIdFromFileName0
0x1800d8ff8
FwpmProviderContextAdd0
0x1800d90d0
FwpmProviderContextAdd2
0x1800d9068
FwpmProviderContextDeleteByKey0
0x1800d90b8
FwpmTransactionAbort0
0x1800d9098
FwpmTransactionBegin0
0x1800d9070
FwpmTransactionCommit0
0x1800d90b0
IPsecSaCreateEnumHandle0
0x1800d9090
IPsecSaDestroyEnumHandle0
0x1800d9080
IPsecSaEnum0
0x1800d9078
IPsecSaInitiateAsync0
0x1800d9088
IPHLPAPI.DLL
13
ConvertInterfaceGuidToLuid
0x1800d87e0
ConvertInterfaceIndexToLuid
0x1800d8798
ConvertInterfaceLuidToAlias
0x1800d87c8
ConvertInterfaceLuidToGuid
0x1800d87b8
ConvertInterfaceLuidToIndex
0x1800d87c0
CreateIpForwardEntry2
0x1800d87f8
DeleteIpForwardEntry2
0x1800d87f0
FreeDnsSettings
0x1800d87b0
GetAdaptersAddresses
0x1800d87d8
GetDnsSettings
0x1800d87a8
InitializeIpForwardEntry
0x1800d87e8
SetDnsSettings
0x1800d87a0
SetInterfaceDnsSettings
0x1800d87d0
msvcrt.dll
75
___lc_codepage_func
0x1800d9120
___lc_handle_func
0x1800d9128
___mb_cur_max_func
0x1800d90f0
__C_specific_handler
0x1800d9328
__crtGetStringTypeW
0x1800d9100
__crtLCMapStringW
0x1800d90f8
__CxxFrameHandler3
0x1800d91a8
__dllonexit
0x1800d9278
__mb_cur_max
0x1800d9118
__pctype_func
0x1800d9130
__uncaught_exception
0x1800d9108
_amsg_exit
0x1800d9298
_callnewh
0x1800d9148
_CxxThrowException
0x1800d9140
_errno
0x1800d9138
_initterm
0x1800d9290
_local_unwind
0x1800d9240
_lock
0x1800d9288
_ltoa
0x1800d9210
_ltow
0x1800d9168
_mbscspn
0x1800d91d0
_onexit
0x1800d9270
_stricmp
0x1800d9318
_strnicmp
0x1800d91e0
_ultoa_s
0x1800d91f8
_unlock
0x1800d9280
_vsnprintf
0x1800d9320
_vsnwprintf
0x1800d9310
_wcsicmp
0x1800d9308
_wcsnicmp
0x1800d9220
_wfopen_s
0x1800d91b8
_wtol
0x1800d9228
_XcptFilter
0x1800d92a0
??0exception@@QEAA@AEBQEBD@Z
0x1800d9180
??0exception@@QEAA@AEBQEBDH@Z
0x1800d9150
??0exception@@QEAA@AEBV0@@Z
0x1800d9178
??0exception@@QEAA@XZ
0x1800d9188
??1exception@@UEAA@XZ
0x1800d9190
??1type_info@@UEAA@XZ
0x1800d9238
?terminate@@YAXXZ
0x1800d90e0
?what@exception@@UEBAPEBDXZ
0x1800d9198
abort
0x1800d90e8
atol
0x1800d91f0
calloc
0x1800d91d8
fclose
0x1800d91b0
free
0x1800d92b0
malloc
0x1800d92a8
mbstowcs_s
0x1800d92d8
memcmp
0x1800d9248
memcpy
0x1800d9250
memcpy_s
0x1800d92f0
memmove
0x1800d9258
memmove_s
0x1800d9170
memset
0x1800d9260
qsort
0x1800d91e8
setlocale
0x1800d9110
strchr
0x1800d9230
strcmp
0x1800d9268
strcpy_s
0x1800d92f8
strpbrk
0x1800d92c8
strrchr
0x1800d91c8
strstr
0x1800d92d0
strtoul
0x1800d9218
tolower
0x1800d9160
wcscat_s
0x1800d92e8
wcschr
0x1800d9208
wcscmp
0x1800d9330
wcscpy_s
0x1800d9300
wcsncat_s
0x1800d9158
wcsncmp
0x1800d92b8
wcsnlen
0x1800d91c0
wcspbrk
0x1800d92c0
wcsstr
0x1800d9200
wcstok_s
0x1800d91a0
wcstombs_s
0x1800d92e0
NCryptFreeObject
0x1800d9360
NCryptGetProperty
0x1800d9358
NCryptOpenKey
0x1800d9340
NCryptOpenStorageProvider
0x1800d9350
NCryptSetProperty
0x1800d9368
NCryptSignHash
0x1800d9348
NSI.dll
5
NsiEnumerateObjectsAllParametersEx
0x1800d8820
NsiGetAllParametersEx
0x1800d8810
NsiGetParameterEx
0x1800d8818
NsiSetAllParameters
0x1800d8828
NsiSetAllParametersEx
0x1800d8808
ntdll.dll
33
DbgPrint
0x1800d93f8
EtwGetTraceEnableFlags
0x1800d93d0
EtwGetTraceEnableLevel
0x1800d93b8
EtwGetTraceLoggerHandle
0x1800d93c0
EtwRegisterTraceGuidsW
0x1800d93b0
EtwTraceMessage
0x1800d9390
EtwUnregisterTraceGuids
0x1800d93e0
NtPowerInformation
0x1800d93d8
NtQueryInformationProcess
0x1800d9450
NtSetInformationThread
0x1800d9468
RtlAnsiStringToUnicodeString
0x1800d9458
RtlConvertSidToUnicodeString
0x1800d9428
RtlCopySid
0x1800d9388
RtlEqualSid
0x1800d9410
RtlFreeSid
0x1800d9400
RtlGUIDFromString
0x1800d93a0
RtlInitAnsiString
0x1800d9448
RtlInitString
0x1800d93e8
RtlInitUnicodeString
0x1800d9470
RtlIpv4AddressToStringA
0x1800d9460
RtlIpv4AddressToStringW
0x1800d9398
RtlIpv4StringToAddressW
0x1800d9420
RtlIpv6AddressToStringA
0x1800d9440
RtlIpv6AddressToStringW
0x1800d93a8
RtlIpv6StringToAddressA
0x1800d9418
RtlIpv6StringToAddressW
0x1800d9438
RtlIsStateSeparationEnabled
0x1800d93c8
RtlLengthSid
0x1800d9380
RtlNtStatusToDosError
0x1800d93f0
RtlPublishWnfStateData
0x1800d9430
RtlQueueWorkItem
0x1800d9408
RtlSubscribeWnfStateChangeNotification
0x1800d9378
RtlUnsubscribeWnfNotificationWaitForCompletion
0x1800d9478
RasRestoreDefaultLegacyProxySettings
0x1800d8838
RPCRT4.dll
17
I_RpcBindingIsClientLocal
0x1800d8878
I_RpcMapWin32Status
0x1800d88b8
NdrServerCall2
0x1800d8888
NdrServerCallAll
0x1800d88c8
RpcImpersonateClient
0x1800d8898
RpcRevertToSelf
0x1800d8868
RpcServerInqCallAttributesW
0x1800d8858
RpcServerInqDefaultPrincNameW
0x1800d88b0
RpcServerRegisterAuthInfoW
0x1800d8870
RpcServerRegisterIfEx
0x1800d88c0
RpcServerUnregisterIf
0x1800d88a0
RpcServerUseProtseqEpW
0x1800d8860
RpcStringFreeA
0x1800d8850
RpcStringFreeW
0x1800d8890
UuidCreate
0x1800d8880
UuidIsNil
0x1800d8848
UuidToStringA
0x1800d88a8
RouterLogDeregisterA
0x1800d94b0
RouterLogEventA
0x1800d9490
RouterLogEventStringA
0x1800d94a8
RouterLogEventStringW
0x1800d94c0
RouterLogEventW
0x1800d94c8
RouterLogRegisterA
0x1800d94a0
TraceDeregisterA
0x1800d9488
TraceRegisterExA
0x1800d9498
TraceVprintfExA
0x1800d94b8
NsiConnectToServer
0x1800d88d8
NsiDisconnectFromServer
0x1800d88e0
NsiRpcDeregisterChangeNotification
0x1800d88e8
NsiRpcRegisterChangeNotification
0x1800d88f0
No function matches your filter.