Windows.Internal.Management.SecureAssessment.dll
v10.0.19041.4355
64-bit
Windows NT
Analyzed
Security warning
This file has been flagged as potentially dangerous, and downloads are disabled.
Reason: Detected potentially dangerous functions used for process injection: OpenProcess
Exported functions 3
DllCanUnloadNow
#1 · 0x5770
DllGetActivationFactory
#2 · 0x5510
DllGetClassObject
#3 · 0x57f0
No function matches your filter.
Imported DLLs & functions 188
CoCreateFreeThreadedMarshaler
0x18001a4a0
CoCreateInstance
0x18001a468
CoGetCallContext
0x18001a488
CoImpersonateClient
0x18001a478
CoRevertToSelf
0x18001a490
CoTaskMemAlloc
0x18001a498
CoTaskMemFree
0x18001a480
CoWaitForMultipleHandles
0x18001a470
DebugBreak
0x18001a4b8
IsDebuggerPresent
0x18001a4b0
OutputDebugStringW
0x18001a4c0
GetLastError
0x18001a4e0
RaiseException
0x18001a4d8
SetLastError
0x18001a4e8
SetUnhandledExceptionFilter
0x18001a4d0
UnhandledExceptionFilter
0x18001a4f0
CloseHandle
0x18001a500
GetProcessHeap
0x18001a520
HeapAlloc
0x18001a518
HeapFree
0x18001a510
DisableThreadLibraryCalls
0x18001a560
GetModuleFileNameA
0x18001a548
GetModuleHandleExW
0x18001a550
GetModuleHandleW
0x18001a558
GetProcAddress
0x18001a568
FormatMessageW
0x18001a578
ExpandEnvironmentStringsW
0x18001a588
GetCurrentProcess
0x18001a5d0
GetCurrentProcessId
0x18001a5d8
GetCurrentThread
0x18001a5b8
GetCurrentThreadId
0x18001a598
GetProcessId
0x18001a5a0
OpenProcessToken
0x18001a5c0
OpenThreadToken
0x18001a5a8
SetThreadToken
0x18001a5b0
TerminateProcess
0x18001a5c8
OpenProcess
0x18001a5e8
QueryPerformanceCounter
0x18001a5f8
QueryFullProcessImageNameW
0x18001a608
RegCloseKey
0x18001a638
RegCreateKeyExW
0x18001a630
RegGetValueW
0x18001a620
RegOpenCurrentUser
0x18001a618
RegSetValueExW
0x18001a628
RegDeleteKeyW
0x18001a648
RtlCaptureContext
0x18001a668
RtlLookupFunctionEntry
0x18001a660
RtlVirtualUnwind
0x18001a658
CompareStringOrdinal
0x18001a678
AcquireSRWLockExclusive
0x18001a6d8
AcquireSRWLockShared
0x18001a6c0
CreateEventExW
0x18001a6b8
CreateMutexExW
0x18001a6d0
CreateSemaphoreExW
0x18001a708
DeleteCriticalSection
0x18001a6b0
EnterCriticalSection
0x18001a698
InitializeCriticalSectionEx
0x18001a6a8
InitializeSRWLock
0x18001a6c8
LeaveCriticalSection
0x18001a688
OpenSemaphoreW
0x18001a710
ReleaseMutex
0x18001a6f8
ReleaseSemaphore
0x18001a700
ReleaseSRWLockExclusive
0x18001a6f0
ReleaseSRWLockShared
0x18001a6e0
SetEvent
0x18001a690
WaitForSingleObject
0x18001a6a0
WaitForSingleObjectEx
0x18001a6e8
InitOnceBeginInitialize
0x18001a720
InitOnceComplete
0x18001a730
InitOnceExecuteOnce
0x18001a738
Sleep
0x18001a728
CreateToolhelp32Snapshot
0x18001a770
Process32FirstW
0x18001a760
Process32NextW
0x18001a768
RoOriginateError
0x18001a7a8
RoOriginateErrorW
0x18001a798
RoTransformError
0x18001a7a0
RoActivateInstance
0x18001a7c0
RoGetActivationFactory
0x18001a7b8
HSTRING_UserFree
0x18001a7e8
HSTRING_UserFree64
0x18001a7f0
HSTRING_UserMarshal
0x18001a7f8
HSTRING_UserMarshal64
0x18001a7e0
HSTRING_UserSize
0x18001a800
HSTRING_UserSize64
0x18001a838
HSTRING_UserUnmarshal
0x18001a7d0
HSTRING_UserUnmarshal64
0x18001a7d8
WindowsCreateString
0x18001a820
WindowsCreateStringReference
0x18001a830
WindowsDeleteString
0x18001a840
WindowsDuplicateString
0x18001a828
WindowsGetStringRawBuffer
0x18001a810
WindowsIsStringEmpty
0x18001a808
WindowsStringHasEmbeddedNull
0x18001a818
EventActivityIdControl
0x18001a858
EventRegister
0x18001a868
EventSetInformation
0x18001a860
EventUnregister
0x18001a870
EventWriteTransfer
0x18001a850
DestroyPrivateObjectSecurity
0x18001a898
DuplicateTokenEx
0x18001a890
EqualSid
0x18001a880
GetTokenInformation
0x18001a888
CapabilityCheck
0x18001a8a8
ConvertSidToStringSidW
0x18001a8b8
ConvertStringSecurityDescriptorToSecurityDescriptorW
0x18001a8c0
combase.dll
19
0x18001a8e0
0x18001a900
0x18001a910
0x18001a928
0x18001a930
0x18001a940
0x18001a948
0x18001a950
0x18001a958
CStdStubBuffer_AddRef
0x18001a938
CStdStubBuffer_DebugServerQueryInterface
0x18001a8e8
CStdStubBuffer_DebugServerRelease
0x18001a918
CStdStubBuffer_Invoke
0x18001a8d0
CStdStubBuffer_IsIIDSupported
0x18001a8f8
CStdStubBuffer2_Connect
0x18001a960
CStdStubBuffer2_CountRefs
0x18001a8d8
CStdStubBuffer2_Disconnect
0x18001a8f0
CStdStubBuffer2_QueryInterface
0x18001a908
NdrCStdStubBuffer2_Release
0x18001a920
?_Xbad_alloc@std@@YAXXZ
0x18001a970
?_Xlength_error@std@@YAXPEBD@Z
0x18001a978
?_Xout_of_range@std@@YAXPEBD@Z
0x18001a980
msvcrt.dll
32
__C_specific_handler
0x18001a9c8
__CxxFrameHandler3
0x18001aa08
__dllonexit
0x18001a9a8
_amsg_exit
0x18001a9f0
_callnewh
0x18001aa68
_CxxThrowException
0x18001aa20
_initterm
0x18001a9d0
_lock
0x18001a9b8
_onexit
0x18001a9a0
_purecall
0x18001aa40
_unlock
0x18001a9b0
_vsnprintf_s
0x18001aa00
_vsnwprintf
0x18001aa70
_XcptFilter
0x18001a9f8
??_V@YAXPEAX@Z
0x18001aa78
??0exception@@QEAA@AEBV0@@Z
0x18001aa10
??0exception@@QEAA@XZ
0x18001aa30
??1exception@@UEAA@XZ
0x18001aa38
??1type_info@@UEAA@XZ
0x18001a998
??3@YAXPEAX@Z
0x18001aa48
?terminate@@YAXXZ
0x18001a9c0
free
0x18001aa80
malloc
0x18001a9e0
memcmp
0x18001aa18
memcpy
0x18001a9d8
memcpy_s
0x18001aa50
memmove
0x18001a990
memmove_s
0x18001aa58
memset
0x18001aa88
realloc
0x18001a9e8
swprintf_s
0x18001aa28
wcschr
0x18001aa60
NtQueryInformationToken
0x18001aac0
RtlAllocateHeap
0x18001aaa8
RtlCompareUnicodeString
0x18001aab8
RtlFreeHeap
0x18001aaa0
RtlInitUnicodeString
0x18001aa98
RtlNtStatusToDosErrorNoTeb
0x18001aab0
RPCRT4.dll
10
I_RpcBindingInqLocalClientPID
0x18001a410
IUnknown_AddRef_Proxy
0x18001a3e0
IUnknown_QueryInterface_Proxy
0x18001a3e8
IUnknown_Release_Proxy
0x18001a408
NdrDllCanUnloadNow
0x18001a418
NdrDllGetClassObject
0x18001a420
NdrOleAllocate
0x18001a400
NdrOleFree
0x18001a428
NdrStubCall3
0x18001a3f0
NdrStubForwardingFunction
0x18001a3f8
No function matches your filter.