wscsvc.dll
v10.0.19041.5794
64-bit
Windows NT
Analyzed
Security warning
This file has been flagged as potentially dangerous, and downloads are disabled.
Reason: Detected potentially dangerous functions used for process injection: OpenProcess
Exported functions 2
ServiceMain
#1 · 0x3f20
SvchostPushServiceGlobals
#2 · 0xfb60
No function matches your filter.
Imported DLLs & functions 193
DebugBreak
0x180041bf8
IsDebuggerPresent
0x180041c08
OutputDebugStringW
0x180041c00
DelayLoadFailureHook
0x180041c18
ResolveDelayLoadedAPI
0x180041c28
GetLastError
0x180041c38
SetLastError
0x180041c40
SetUnhandledExceptionFilter
0x180041c48
UnhandledExceptionFilter
0x180041c50
GetProcessHeap
0x180041c90
HeapAlloc
0x180041ca0
HeapFree
0x180041c98
UnregisterWait
0x180041cc8
FreeLibrary
0x180041cf0
GetModuleFileNameA
0x180041d00
GetModuleFileNameW
0x180041cf8
GetModuleHandleExW
0x180041d08
GetModuleHandleW
0x180041ce8
GetProcAddress
0x180041ce0
LoadLibraryExW
0x180041cd8
FormatMessageW
0x180041d18
ExpandEnvironmentStringsW
0x180041d28
CreateThread
0x180041d40
GetCurrentProcess
0x180041d48
GetCurrentProcessId
0x180041d38
GetCurrentThreadId
0x180041d50
OpenThreadToken
0x180041d58
TerminateProcess
0x180041d60
GetProcessMitigationPolicy
0x180041d70
QueryPerformanceCounter
0x180041d80
RegCloseKey
0x180041da0
RegCreateKeyExW
0x180041dc0
RegDeleteKeyExW
0x180041db0
RegDeleteValueW
0x180041dd0
RegEnumKeyExW
0x180041d98
RegEnumValueW
0x180041dc8
RegGetValueW
0x180041d90
RegNotifyChangeKeyValue
0x180041de8
RegOpenKeyExW
0x180041de0
RegQueryInfoKeyW
0x180041dd8
RegQueryValueExW
0x180041da8
RegSetValueExW
0x180041db8
AcquireSRWLockExclusive
0x180041e48
AcquireSRWLockShared
0x180041e90
CancelWaitableTimer
0x180041e68
CreateEventW
0x180041e18
CreateMutexExW
0x180041e80
CreateSemaphoreExW
0x180041e38
DeleteCriticalSection
0x180041e98
EnterCriticalSection
0x180041e30
InitializeCriticalSection
0x180041e58
InitializeCriticalSectionAndSpinCount
0x180041e40
InitializeCriticalSectionEx
0x180041df8
LeaveCriticalSection
0x180041e10
OpenSemaphoreW
0x180041e60
ReleaseMutex
0x180041e00
ReleaseSemaphore
0x180041e28
ReleaseSRWLockExclusive
0x180041e08
ReleaseSRWLockShared
0x180041e70
SetEvent
0x180041ea0
SetWaitableTimer
0x180041e78
WaitForMultipleObjectsEx
0x180041e88
WaitForSingleObject
0x180041e20
WaitForSingleObjectEx
0x180041e50
Sleep
0x180041eb0
CreateWaitableTimerW
0x180041ec8
WaitForMultipleObjects
0x180041ec0
GetSystemTimeAsFileTime
0x180041ee0
GetTickCount
0x180041ee8
GetTickCount64
0x180041ed8
CloseThreadpoolTimer
0x180041ef8
CreateThreadpoolTimer
0x180041f10
SetThreadpoolTimer
0x180041f00
WaitForThreadpoolTimerCallbacks
0x180041f08
EncodePointer
0x180041f20
VerQueryValueW
0x180041f30
GetFileVersionInfoSizeW
0x180041f48
GetFileVersionInfoW
0x180041f40
TraceMessage
0x180041f58
EventActivityIdControl
0x180041f78
EventRegister
0x180041f90
EventSetInformation
0x180041f80
EventUnregister
0x180041f68
EventWrite
0x180041f88
EventWriteTransfer
0x180041f70
AllocateAndInitializeSid
0x180041fb0
CheckTokenMembership
0x180041fa8
FreeSid
0x180041fa0
GetSidSubAuthority
0x180041fb8
GetSidSubAuthorityCount
0x180041fc8
GetTokenInformation
0x180041fc0
RegisterServiceCtrlHandlerExW
0x180041fe0
SetServiceStatus
0x180041fd8
FwActivate
0x180041ad0
FwAnalyzeFirewallPolicy
0x180041ad8
FWChangeNotificationCreate
0x180041ac0
FWChangeNotificationDestroy
0x180041ac8
KERNEL32.dll
15
CompareFileTime
0x180041b40
CreateFileMappingW
0x180041af0
CreateFileW
0x180041af8
CreateProcessW
0x180041b58
GetCurrentThread
0x180041b48
GetExitCodeProcess
0x180041b30
GetPrivateProfileStringW
0x180041b50
GetSystemDirectoryW
0x180041b38
GetSystemTime
0x180041b18
GetUserDefaultLangID
0x180041b28
MapViewOfFile
0x180041ae8
OpenProcess
0x180041b08
QueryFullProcessImageNameW
0x180041b00
SystemTimeToFileTime
0x180041b10
UnmapViewOfFile
0x180041b20
msvcrt.dll
38
__C_specific_handler
0x180042010
__CxxFrameHandler3
0x180042110
__dllonexit
0x1800420a8
_amsg_exit
0x1800420b0
_callnewh
0x180042038
_CxxThrowException
0x180042048
_initterm
0x1800420c0
_lock
0x1800420d0
_onexit
0x1800420a0
_purecall
0x1800420f0
_ultow_s
0x180042068
_unlock
0x1800420d8
_vscwprintf
0x180042008
_vsnprintf_s
0x180041ff8
_vsnwprintf
0x180042100
_wcsicmp
0x180042028
_XcptFilter
0x180042098
??_V@YAXPEAX@Z
0x180042108
??0exception@@QEAA@AEBQEBD@Z
0x180042080
??0exception@@QEAA@AEBQEBDH@Z
0x180042088
??0exception@@QEAA@AEBV0@@Z
0x180042000
??0exception@@QEAA@XZ
0x1800420e0
??1exception@@UEAA@XZ
0x1800420e8
??1type_info@@UEAA@XZ
0x180042058
??3@YAXPEAX@Z
0x180042118
?terminate@@YAXXZ
0x1800420c8
?what@exception@@UEBAPEBDXZ
0x180042090
free
0x1800420b8
malloc
0x180042030
memcmp
0x180042040
memcpy
0x180042060
memcpy_s
0x1800420f8
memmove
0x180042078
memmove_s
0x180041ff0
memset
0x180042050
wcscmp
0x180042070
wcsnlen
0x180042018
wcstok_s
0x180042020
NetApiBufferFree
0x180042128
ntdll.dll
19
EtwEventRegister
0x180042178
EtwEventUnregister
0x180042170
EtwEventWrite
0x1800421b8
EtwGetTraceEnableFlags
0x180042190
EtwGetTraceEnableLevel
0x180042198
EtwGetTraceLoggerHandle
0x1800421a0
EtwRegisterTraceGuidsW
0x180042188
EtwTraceMessage
0x1800421c0
EtwUnregisterTraceGuids
0x180042180
NtQueryInformationProcess
0x1800421c8
RtlCaptureContext
0x180042168
RtlLookupFunctionEntry
0x180042160
RtlNtStatusToDosErrorNoTeb
0x1800421a8
RtlPublishWnfStateData
0x1800421b0
RtlVirtualUnwind
0x180042158
ShipAssertMsgA
0x180042150
WinSqmAddToStream
0x180042148
WinSqmIsOptedIn
0x180042138
WinSqmSetDWORD
0x180042140
RPCRT4.dll
17
NdrServerCall2
0x180041b70
NdrServerCallAll
0x180041be8
RpcBindingVectorFree
0x180041b68
RpcEpRegisterW
0x180041b88
RpcEpUnregister
0x180041be0
RpcImpersonateClient
0x180041bb0
RpcRaiseException
0x180041ba8
RpcRevertToSelf
0x180041ba0
RpcServerInqBindings
0x180041b90
RpcServerInqCallAttributesW
0x180041bc0
RpcServerInqDefaultPrincNameW
0x180041bb8
RpcServerListen
0x180041b98
RpcServerRegisterAuthInfoW
0x180041bd0
RpcServerRegisterIfEx
0x180041bc8
RpcServerUnregisterIfEx
0x180041b80
RpcServerUseProtseqW
0x180041bd8
RpcStringFreeW
0x180041b78
No function matches your filter.