ncryptprov.dll
v10.0.19041.6456
32-bit
Windows NT
Analyzed
Security warning
This file has been flagged as potentially dangerous, and downloads are disabled.
Reason: Detected potentially dangerous functions used for process injection: OpenProcess
Exported functions 3
GetKeyStorageInterface
#1 · 0xd870
SKCacheFlush
#2 · 0xdf80
SetAuditingInterface
#3 · 0x17d10
No function matches your filter.
Imported DLLs & functions 190
ApiSetQueryApiSetPresence
0x10040000
DelayLoadFailureHook
0x10040014
ResolveDelayLoadedAPI
0x1004001c
GetLastError
0x10040024
CreateFileW
0x1004003c
DeleteFileW
0x10040040
FindClose
0x1004002c
FindCloseChangeNotification
0x10040034
FindFirstChangeNotificationW
0x10040038
FindFirstFileExW
0x10040054
FindNextChangeNotification
0x10040050
FindNextFileW
0x1004004c
GetFileSize
0x10040048
GetTempFileNameW
0x10040058
ReadFile
0x10040030
WriteFile
0x10040044
GetTempPathW
0x10040060
MoveFileExW
0x10040068
CloseHandle
0x10040070
GetProcessHeap
0x10040080
HeapAlloc
0x1004007c
HeapFree
0x10040078
FreeLibrary
0x10040094
GetModuleFileNameW
0x100400a4
GetModuleHandleExW
0x100400a8
GetModuleHandleW
0x10040098
GetProcAddress
0x100400a0
LoadLibraryExW
0x1004009c
LoadStringW
0x100400ac
VirtualAlloc
0x100400b8
VirtualProtect
0x100400b4
VirtualQuery
0x100400bc
ExpandEnvironmentStringsW
0x100400c4
GetCurrentProcess
0x100400e4
GetCurrentProcessId
0x100400e8
GetCurrentThread
0x100400d4
GetCurrentThreadId
0x100400dc
OpenProcessToken
0x100400e0
OpenThreadToken
0x100400cc
SetThreadStackGuarantee
0x100400d8
SetThreadToken
0x100400d0
OpenProcess
0x100400f0
QueryFullProcessImageNameW
0x100400f8
RegCloseKey
0x10040100
RegCreateKeyExW
0x10040104
RegOpenKeyExA
0x1004010c
RegOpenKeyExW
0x10040110
RegQueryValueExA
0x10040114
RegQueryValueExW
0x10040108
CreateEventW
0x1004013c
DeleteCriticalSection
0x10040128
EnterCriticalSection
0x10040130
InitializeCriticalSection
0x10040138
LeaveCriticalSection
0x1004012c
SetEvent
0x10040134
Sleep
0x10040144
GetSystemInfo
0x1004014c
GetSystemTimeAsFileTime
0x10040150
GetTickCount
0x10040154
CallbackMayRunLong
0x10040160
TrySubmitThreadpoolCallback
0x1004015c
GetEnabledXStateFeatures
0x10040168
GetTraceEnableFlags
0x10040180
GetTraceEnableLevel
0x10040178
GetTraceLoggerHandle
0x10040174
TraceMessage
0x10040170
UnregisterTraceGuids
0x1004017c
RegisterTraceGuidsA
0x10040188
EventRegister
0x10040194
EventSetInformation
0x10040190
EventUnregister
0x10040198
EventWriteTransfer
0x1004019c
CopySid
0x100401b8
EqualSid
0x100401a4
GetAce
0x100401c0
GetAclInformation
0x100401c8
GetFileSecurityW
0x100401b0
GetLengthSid
0x100401e0
GetSecurityDescriptorControl
0x100401bc
GetSecurityDescriptorDacl
0x100401dc
GetSecurityDescriptorLength
0x100401a8
GetSidIdentifierAuthority
0x100401c4
GetSidSubAuthority
0x100401d0
GetSidSubAuthorityCount
0x100401d8
GetTokenInformation
0x100401e4
IsValidSecurityDescriptor
0x100401b4
IsValidSid
0x100401ac
PrivilegeCheck
0x100401e8
RevertToSelf
0x100401d4
SetFileSecurityW
0x100401cc
ConvertSidToStringSidW
0x100401f0
ConvertStringSecurityDescriptorToSecurityDescriptorW
0x100401f4
ConvertStringSidToSidW
0x100401f8
I_QueryTagInformation
0x10040200
bcrypt.dll
26
BCryptCloseAlgorithmProvider
0x1004025c
BCryptCreateHash
0x10040250
BCryptDecrypt
0x1004023c
BCryptDeriveKey
0x10040220
BCryptDestroyHash
0x10040258
BCryptDestroyKey
0x10040240
BCryptDestroySecret
0x1004021c
BCryptDuplicateKey
0x1004024c
BCryptEncrypt
0x10040244
BCryptExportKey
0x10040268
BCryptFinalizeKeyPair
0x1004022c
BCryptFinishHash
0x10040264
BCryptGenerateKeyPair
0x10040228
BCryptGenerateSymmetricKey
0x10040208
BCryptGenRandom
0x10040238
BCryptGetProperty
0x10040260
BCryptHash
0x10040248
BCryptHashData
0x10040254
BCryptImportKey
0x10040224
BCryptImportKeyPair
0x10040218
BCryptKeyDerivation
0x10040234
BCryptOpenAlgorithmProvider
0x1004026c
BCryptSecretAgreement
0x10040210
BCryptSetProperty
0x10040214
BCryptSignHash
0x1004020c
BCryptVerifySignature
0x10040230
msvcrt.dll
11
_except_handler4_common
0x1004028c
_strlwr
0x1004027c
_vsnwprintf
0x10040274
_wcsicmp
0x10040288
_wcslwr
0x10040278
memcmp
0x10040294
memcpy
0x10040298
memset
0x1004029c
wcscat_s
0x10040290
wcsncmp
0x10040280
wcsncpy_s
0x10040284
NCryptCloseProtectionDescriptor
0x100402ac
NCryptCreateProtectionDescriptor
0x100402a8
NCryptProtectSecret
0x100402a4
NCryptUnprotectSecret
0x100402b0
ntdll.dll
48
EtwTraceMessage
0x10040360
LdrDisableThreadCalloutsForDll
0x10040374
NtClose
0x10040344
NtCreateFile
0x10040320
NtDuplicateToken
0x1004031c
NtOpenKey
0x100402e4
NtQueryInformationProcess
0x100402f4
NtQueryInformationToken
0x1004030c
NtQuerySystemInformationEx
0x100402e8
NtQueryValueKey
0x100402ec
NtSetInformationThread
0x10040314
NtSetInformationToken
0x10040318
NtTerminateProcess
0x100402bc
RtlAbsoluteToSelfRelativeSD
0x1004032c
RtlAcquireResourceExclusive
0x1004033c
RtlAcquireResourceShared
0x1004034c
RtlAcquireSRWLockExclusive
0x10040354
RtlAllocateAndInitializeSid
0x10040310
RtlAllocateHeap
0x100402dc
RtlAnsiStringToUnicodeString
0x100402d0
RtlAppendUnicodeToString
0x100402f0
RtlCheckTokenCapability
0x10040300
RtlCompareMemory
0x100402d8
RtlDeleteCriticalSection
0x10040370
RtlDeleteResource
0x10040350
RtlDosPathNameToRelativeNtPathName_U
0x10040334
RtlEnterCriticalSection
0x1004036c
RtlFreeAnsiString
0x100402d4
RtlFreeHeap
0x10040328
RtlFreeSid
0x10040308
RtlFreeUnicodeString
0x100402cc
RtlGetControlSecurityDescriptor
0x10040338
RtlImageNtHeader
0x100402e0
RtlInitAnsiString
0x100402c0
RtlInitializeCriticalSection
0x10040368
RtlInitializeResource
0x10040340
RtlInitializeSRWLock
0x1004035c
RtlInitUnicodeString
0x100402c8
RtlLeaveCriticalSection
0x10040364
RtlNtStatusToDosError
0x10040324
RtlReleaseRelativeName
0x10040330
RtlReleaseResource
0x10040348
RtlReleaseSRWLockExclusive
0x10040358
RtlSidDominates
0x10040304
RtlUnhandledExceptionFilter
0x100402b8
RtlUnicodeStringToAnsiString
0x100402c4
WinSqmIncrementDWORD
0x100402f8
WinSqmSetString
0x100402fc
0x1004037c
No function matches your filter.