vaultsvc.dll
v10.0.19041.5915
64-bit
Windows NT
Analyzed
Security warning
This file has been flagged as potentially dangerous, and downloads are disabled.
Reason: Detected potentially dangerous functions used for process injection: OpenProcess
Exported functions 2
ServiceMain
#1 · 0xbd50
VaultSvcStopCallback
#2 · 0x20300
No function matches your filter.
Imported DLLs & functions 266
ApiSetQueryApiSetPresence
0x180048490
CoCreateFreeThreadedMarshaler
0x1800484c0
CoInitializeEx
0x1800484b0
CoSetProxyBlanket
0x1800484a0
CoUninitialize
0x1800484b8
CoWaitForMultipleHandles
0x1800484a8
DebugBreak
0x1800484d8
IsDebuggerPresent
0x1800484e0
OutputDebugStringW
0x1800484d0
DelayLoadFailureHook
0x1800484f0
ResolveDelayLoadedAPI
0x180048500
GetLastError
0x180048530
RaiseException
0x180048520
SetLastError
0x180048510
SetUnhandledExceptionFilter
0x180048528
UnhandledExceptionFilter
0x180048518
CompareFileTime
0x180048540
CreateDirectoryW
0x180048560
CreateFileW
0x180048568
DeleteFileW
0x1800485a0
FindClose
0x1800485b8
FindFirstFileExW
0x1800485c0
FindNextFileW
0x1800485b0
GetDriveTypeW
0x180048548
GetFileAttributesW
0x180048570
GetFileSizeEx
0x180048590
GetFileTime
0x1800485a8
GetVolumeInformationW
0x180048550
GetVolumePathNameW
0x180048558
ReadFile
0x180048588
RemoveDirectoryW
0x180048598
SetFilePointer
0x180048580
WriteFile
0x180048578
MoveFileExW
0x1800485d0
CloseHandle
0x1800485e0
GetProcessHeap
0x180048600
HeapAlloc
0x1800485f8
HeapFree
0x180048608
HeapSize
0x1800485f0
LocalSize
0x180048630
InitializeSListHead
0x180048640
CreateFileTransactedW
0x180048650
CreateDirectoryTransactedW
0x180048678
DeleteFileTransactedW
0x180048668
FindFirstFileTransactedW
0x180048660
MoveFileTransactedW
0x180048670
RemoveDirectoryTransactedW
0x180048680
DisableThreadLibraryCalls
0x1800486a8
GetModuleFileNameA
0x1800486a0
GetModuleHandleExW
0x1800486b8
GetModuleHandleW
0x1800486b0
GetProcAddress
0x180048698
LoadStringW
0x180048690
FormatMessageW
0x1800486c8
GetCurrentProcess
0x1800486d8
GetCurrentProcessId
0x180048708
GetCurrentThread
0x1800486f0
GetCurrentThreadId
0x180048700
OpenProcessToken
0x1800486e8
OpenThreadToken
0x1800486e0
TerminateProcess
0x1800486f8
IsProcessorFeaturePresent
0x180048720
OpenProcess
0x180048718
QueryPerformanceCounter
0x180048730
QueryFullProcessImageNameW
0x180048740
RegCloseKey
0x180048768
RegCreateKeyExW
0x180048750
RegOpenCurrentUser
0x180048760
RegOpenKeyExW
0x180048770
RegQueryValueExW
0x180048778
RegSetValueExW
0x180048758
RtlCaptureContext
0x180048798
RtlCompareMemory
0x180048790
RtlLookupFunctionEntry
0x1800487a0
RtlVirtualUnwind
0x180048788
CompareStringOrdinal
0x1800487b0
AcquireSRWLockExclusive
0x180048840
AcquireSRWLockShared
0x1800487d8
CreateEventExW
0x1800487e0
CreateEventW
0x180048848
CreateMutexExW
0x180048830
CreateSemaphoreExW
0x1800487d0
DeleteCriticalSection
0x1800487f8
EnterCriticalSection
0x1800487f0
InitializeCriticalSectionEx
0x180048800
LeaveCriticalSection
0x180048828
OpenSemaphoreW
0x1800487c0
ReleaseMutex
0x180048820
ReleaseSemaphore
0x180048818
ReleaseSRWLockExclusive
0x180048808
ReleaseSRWLockShared
0x180048810
SetEvent
0x180048838
WaitForSingleObject
0x1800487c8
WaitForSingleObjectEx
0x1800487e8
GetSystemTimeAsFileTime
0x180048858
CloseThreadpoolTimer
0x180048878
CreateThreadpoolTimer
0x180048868
SetThreadpoolTimer
0x180048870
WaitForThreadpoolTimerCallbacks
0x180048880
FileTimeToSystemTime
0x180048890
RoGetActivationFactory
0x1800488a0
WindowsCreateStringReference
0x1800488c0
WindowsDeleteString
0x1800488b0
WindowsGetStringRawBuffer
0x1800488b8
ceilf
0x1800488d0
__C_specific_handler
0x180048950
__CxxFrameHandler3
0x180048988
__CxxFrameHandler4
0x1800489d0
__std_terminate
0x1800489c8
_CxxThrowException
0x1800489d8
_o___std_exception_copy
0x1800489b0
_o___std_exception_destroy
0x1800489a8
_o___std_type_info_destroy_list
0x1800489a0
_o___stdio_common_vsnprintf_s
0x180048998
_o___stdio_common_vsnwprintf_s
0x180048990
_o___stdio_common_vswprintf
0x180048970
_o___stdio_common_vswprintf_s
0x180048968
_o__cexit
0x1800489c0
_o__configure_narrow_argv
0x1800489b8
_o__crt_atexit
0x180048960
_o__errno
0x180048958
_o__execute_onexit_table
0x180048918
_o__initialize_narrow_environment
0x1800488e0
_o__initialize_onexit_table
0x1800488e8
_o__invalid_parameter_noinfo
0x1800488f0
_o__invalid_parameter_noinfo_noreturn
0x1800488f8
_o__purecall
0x180048900
_o__register_onexit_function
0x180048908
_o__seh_filter_dll
0x180048910
_o__wcsicmp
0x180048920
_o__wcslwr_s
0x180048928
_o__wsplitpath_s
0x180048938
_o_wcscpy_s
0x180048940
_o_wcsncpy_s
0x180048948
memcmp
0x1800489e0
memcpy
0x1800489e8
memmove
0x180048930
wcschr
0x180048978
wcsstr
0x180048980
GetTraceEnableFlags
0x180048a38
GetTraceEnableLevel
0x180048a40
GetTraceLoggerHandle
0x180048a28
RegisterTraceGuidsW
0x180048a48
TraceMessage
0x180048a30
UnregisterTraceGuids
0x180048a50
EventRegister
0x180048a60
EventSetInformation
0x180048a78
EventUnregister
0x180048a70
EventWriteTransfer
0x180048a68
AccessCheck
0x180048ad0
AdjustTokenPrivileges
0x180048af0
AllocateAndInitializeSid
0x180048ac0
CopySid
0x180048aa0
DuplicateTokenEx
0x180048ab0
EqualSid
0x180048a98
FreeSid
0x180048b00
GetLengthSid
0x180048ae0
GetSidIdentifierAuthority
0x180048a88
GetSidSubAuthority
0x180048ae8
GetSidSubAuthorityCount
0x180048af8
GetTokenInformation
0x180048ad8
ImpersonateLoggedOnUser
0x180048a90
ImpersonateSelf
0x180048aa8
IsValidSid
0x180048ac8
RevertToSelf
0x180048ab8
CheckTokenCapability
0x180048b10
CredDeleteW
0x180048b30
CredEnumerateW
0x180048b48
CredFree
0x180048b38
CredIsProtectedW
0x180048b58
CredProtectW
0x180048b40
CredReadW
0x180048b20
CredUnprotectW
0x180048b50
CredWriteW
0x180048b28
LsaClose
0x180048b80
LsaFreeMemory
0x180048b78
LsaOpenPolicy
0x180048b68
LsaQueryInformationPolicy
0x180048b70
ConvertSidToStringSidW
0x180048b98
ConvertStringSecurityDescriptorToSecurityDescriptorW
0x180048ba0
ConvertStringSidToSidW
0x180048b90
RegisterServiceCtrlHandlerExW
0x180048bb8
SetServiceStatus
0x180048bb0
I_QueryTagInformation
0x180048bc8
bcrypt.dll
15
BCryptCloseAlgorithmProvider
0x180048c38
BCryptCreateHash
0x180048be0
BCryptDecrypt
0x180048bf8
BCryptDestroyHash
0x180048c10
BCryptDestroyKey
0x180048c20
BCryptEncrypt
0x180048c00
BCryptExportKey
0x180048c48
BCryptFinishHash
0x180048c18
BCryptGenerateSymmetricKey
0x180048c28
BCryptGenRandom
0x180048c40
BCryptGetProperty
0x180048bd8
BCryptHashData
0x180048c08
BCryptImportKey
0x180048c30
BCryptOpenAlgorithmProvider
0x180048bf0
BCryptSetProperty
0x180048be8
LSASRV.dll
11
LsaICryptProtectData
0x1800483f8
LsaICryptUnprotectData
0x180048400
LsaILookupUserAccountType
0x1800483e8
LsaIRegisterLogonSessionCallback
0x1800483d0
LsaIUnregisterLogonSessionCallback
0x1800483e0
LsapAdtAuditingEnabledByLogonId
0x180048418
LsapAdtGetCallerProcessInfo
0x180048410
LsapAdtInitParametersArray
0x180048408
LsapAdtWriteLog
0x1800483f0
LsapAuditFailed
0x1800483d8
LsapQueryClientInfo
0x180048420
?_Xlength_error@std@@YAXPEBD@Z
0x180048c58
ntdll.dll
38
NtClose
0x180048c78
NtDuplicateToken
0x180048cf0
NtOpenThreadToken
0x180048d50
NtQueryInformationToken
0x180048d48
NtSetInformationThread
0x180048cd0
NtSetInformationToken
0x180048cf8
RtlAcquireResourceExclusive
0x180048d18
RtlAcquireResourceShared
0x180048d10
RtlAllocateHeap
0x180048cc0
RtlConvertSharedToExclusive
0x180048cb8
RtlCopySid
0x180048d28
RtlDeleteCriticalSection
0x180048cc8
RtlDeleteResource
0x180048d20
RtlEnterCriticalSection
0x180048d80
RtlEqualSid
0x180048c80
RtlFreeHeap
0x180048d30
RtlGetActiveConsoleId
0x180048d88
RtlGetNtProductType
0x180048d40
RtlInitializeCriticalSection
0x180048d78
RtlInitializeResource
0x180048d90
RtlInitializeSid
0x180048cd8
RtlInitUnicodeString
0x180048c68
RtlIsPackageSid
0x180048d00
RtlLeaveCriticalSection
0x180048d68
RtlLengthSid
0x180048d38
RtlNtStatusToDosError
0x180048d58
RtlPublishWnfStateData
0x180048c70
RtlReleaseResource
0x180048d08
RtlSidDominates
0x180048ce8
RtlSubAuthoritySid
0x180048ce0
RtlSubscribeWnfStateChangeNotification
0x180048d60
RtlUnsubscribeWnfNotificationWaitForCompletion
0x180048d70
RtlValidSid
0x180048c88
TpAllocTimer
0x180048c90
TpIsTimerSet
0x180048c98
TpReleaseTimer
0x180048cb0
TpSetTimer
0x180048ca8
TpWaitForTimer
0x180048ca0
0x180048da0
NdrServerCall2
0x180048438
NdrServerCallAll
0x180048440
RpcImpersonateClient
0x180048468
RpcRevertToSelf
0x180048470
RpcServerInqCallAttributesW
0x180048460
RpcServerRegisterIf3
0x180048450
RpcServerUnregisterIfEx
0x180048448
RpcServerUseProtseqEpW
0x180048458
UuidFromStringW
0x180048430
GetUserNameExW
0x180048480
No function matches your filter.