dms.dll

Description:

Authors:

Version:

Architecture: 64-bit

Operating System:

SHA256: 3f1e3d0788c206aaf79d3e54662f9baa

File Size: 4.4 MB

Uploaded At: Sept. 18, 2026, 6:20 a.m.

Views: 8

Security Warning

This file has been flagged as potentially dangerous.

Reason: Detected potentially dangerous functions used for process injection: VirtualAllocEx

Exported Functions

ServiceMain (Ordinal: 1, Address: 0x20a0)
run (Ordinal: 2, Address: 0x1a20)

Imported DLLs & Functions

ADVAPI32.dll

RegGetValueW (Address: 0x18000d008)
RegisterServiceCtrlHandlerExW (Address: 0x18000d010)
SetServiceStatus (Address: 0x18000d000)

KERNEL32.dll

CloseHandle (Address: 0x18000d070)
CreateFileW (Address: 0x18000d050)
CreateMutexW (Address: 0x18000d0a0)
CreateProcessW (Address: 0x18000d080)
DeleteCriticalSection (Address: 0x18000d170)
EnterCriticalSection (Address: 0x18000d160)
ExitProcess (Address: 0x18000d1b0)
FindClose (Address: 0x18000d200)
FindFirstFileExW (Address: 0x18000d208)
FindNextFileW (Address: 0x18000d210)
FlushFileBuffers (Address: 0x18000d1e8)
FreeEnvironmentStringsW (Address: 0x18000d0d0)
FreeLibrary (Address: 0x18000d038)
GetACP (Address: 0x18000d220)
GetCommandLineA (Address: 0x18000d238)
GetCommandLineW (Address: 0x18000d0e0)
GetConsoleCP (Address: 0x18000d1f0)
GetConsoleMode (Address: 0x18000d1f8)
GetCPInfo (Address: 0x18000d230)
GetCurrentProcess (Address: 0x18000d0f8)
GetCurrentProcessId (Address: 0x18000d118)
GetCurrentThreadId (Address: 0x18000d120)
GetEnvironmentStringsW (Address: 0x18000d0d8)
GetFileType (Address: 0x18000d1e0)
GetLastError (Address: 0x18000d068)
GetModuleFileNameW (Address: 0x18000d1c0)
GetModuleHandleExW (Address: 0x18000d1b8)
GetModuleHandleW (Address: 0x18000d148)
GetOEMCP (Address: 0x18000d228)
GetProcAddress (Address: 0x18000d028)
GetProcessHeap (Address: 0x18000d030)
GetStartupInfoW (Address: 0x18000d140)
GetStdHandle (Address: 0x18000d1d8)
GetStringTypeW (Address: 0x18000d0c8)
GetSystemTimeAsFileTime (Address: 0x18000d128)
HeapAlloc (Address: 0x18000d020)
HeapFree (Address: 0x18000d098)
HeapReAlloc (Address: 0x18000d1c8)
HeapSize (Address: 0x18000d0b0)
InitializeCriticalSectionAndSpinCount (Address: 0x18000d178)
InitializeSListHead (Address: 0x18000d130)
InterlockedFlushSList (Address: 0x18000d158)
IsDebuggerPresent (Address: 0x18000d138)
IsProcessorFeaturePresent (Address: 0x18000d108)
IsValidCodePage (Address: 0x18000d218)
LCMapStringW (Address: 0x18000d1d0)
LeaveCriticalSection (Address: 0x18000d168)
LoadLibraryExW (Address: 0x18000d1a0)
MultiByteToWideChar (Address: 0x18000d058)
QueryPerformanceCounter (Address: 0x18000d110)
RaiseException (Address: 0x18000d1a8)
RtlUnwindEx (Address: 0x18000d150)
SetFilePointerEx (Address: 0x18000d0b8)
SetLastError (Address: 0x18000d090)
SetStdHandle (Address: 0x18000d0c0)
SetUnhandledExceptionFilter (Address: 0x18000d0f0)
Sleep (Address: 0x18000d060)
TerminateProcess (Address: 0x18000d100)
TlsAlloc (Address: 0x18000d180)
TlsFree (Address: 0x18000d198)
TlsGetValue (Address: 0x18000d188)
TlsSetValue (Address: 0x18000d190)
UnhandledExceptionFilter (Address: 0x18000d0e8)
VirtualAllocEx (Address: 0x18000d078)
WaitForSingleObject (Address: 0x18000d048)
WideCharToMultiByte (Address: 0x18000d088)
WriteConsoleW (Address: 0x18000d0a8)
WriteFile (Address: 0x18000d040)

ntdll.dll

NtClose (Address: 0x18000d288)
NtGetContextThread (Address: 0x18000d298)
NtReadVirtualMemory (Address: 0x18000d290)
NtResumeThread (Address: 0x18000d258)
NtSetContextThread (Address: 0x18000d280)
NtTerminateProcess (Address: 0x18000d260)
NtUnmapViewOfSection (Address: 0x18000d2a0)
NtWaitForSingleObject (Address: 0x18000d268)
NtWriteVirtualMemory (Address: 0x18000d278)
RtlCaptureContext (Address: 0x18000d250)
RtlLookupFunctionEntry (Address: 0x18000d248)
RtlVirtualUnwind (Address: 0x18000d270)