TokenBroker.dll
v10.0.19041.5848
32-bit
Windows NT
Analyzed
Security warning
This file has been flagged as potentially dangerous, and downloads are disabled.
Reason: Detected potentially dangerous functions used for process injection: OpenProcess
Exported functions 1
ServiceMain
#1 · 0x54580
No function matches your filter.
Imported DLLs & functions 361
GetPackageFamilyNameFromToken
0x1011c008
GetPackageFullNameFromToken
0x1011c00c
CloseState
0x1011c01c
GetStateRootFolder
0x1011c018
OpenStateExplicit
0x1011c014
ApiSetQueryApiSetPresence
0x1011c02c
DebugBreak
0x1011c03c
IsDebuggerPresent
0x1011c034
OutputDebugStringW
0x1011c038
DelayLoadFailureHook
0x1011c044
ResolveDelayLoadedAPI
0x1011c04c
GetLastError
0x1011c05c
RaiseException
0x1011c054
SetLastError
0x1011c058
SetUnhandledExceptionFilter
0x1011c060
UnhandledExceptionFilter
0x1011c064
CompareFileTime
0x1011c09c
CreateDirectoryW
0x1011c08c
CreateFileW
0x1011c070
FindClose
0x1011c078
FindFirstFileW
0x1011c094
FindNextFileW
0x1011c098
GetFileSizeEx
0x1011c07c
GetFileTime
0x1011c088
ReadFile
0x1011c090
SetEndOfFile
0x1011c084
SetFileInformationByHandle
0x1011c074
SetFilePointer
0x1011c06c
WriteFile
0x1011c080
CloseHandle
0x1011c0a4
GetProcessHeap
0x1011c0b0
HeapAlloc
0x1011c0ac
HeapFree
0x1011c0b4
InitializeSListHead
0x1011c0c8
InterlockedPushEntrySList
0x1011c0cc
MulDiv
0x1011c0d4
FreeLibrary
0x1011c0e0
GetModuleFileNameA
0x1011c0ec
GetModuleHandleExW
0x1011c0dc
GetModuleHandleW
0x1011c0e4
GetProcAddress
0x1011c0e8
FormatMessageW
0x1011c0f4
ExpandEnvironmentStringsW
0x1011c0fc
GetEnvironmentVariableW
0x1011c100
CreateProcessAsUserW
0x1011c124
DeleteProcThreadAttributeList
0x1011c130
GetCurrentProcess
0x1011c140
GetCurrentProcessId
0x1011c128
GetCurrentThread
0x1011c108
GetCurrentThreadId
0x1011c118
GetProcessId
0x1011c13c
InitializeProcThreadAttributeList
0x1011c120
OpenProcessToken
0x1011c10c
OpenThreadToken
0x1011c138
SetThreadToken
0x1011c110
TerminateProcess
0x1011c144
TlsAlloc
0x1011c114
TlsFree
0x1011c134
TlsGetValue
0x1011c148
TlsSetValue
0x1011c11c
UpdateProcThreadAttribute
0x1011c12c
IsProcessorFeaturePresent
0x1011c150
OpenProcess
0x1011c154
QueryPerformanceCounter
0x1011c15c
QueryFullProcessImageNameW
0x1011c164
RegCloseKey
0x1011c170
RegCreateKeyExW
0x1011c178
RegDeleteValueW
0x1011c174
RegEnumKeyExW
0x1011c18c
RegGetValueW
0x1011c188
RegOpenKeyExW
0x1011c180
RegQueryInfoKeyW
0x1011c17c
RegQueryValueExW
0x1011c184
RegSetValueExW
0x1011c16c
RegOpenKeyW
0x1011c194
CompareStringOrdinal
0x1011c1a8
CharLowerW
0x1011c1b0
AcquireSRWLockExclusive
0x1011c1ec
AcquireSRWLockShared
0x1011c208
CreateEventExW
0x1011c1c8
CreateEventW
0x1011c1e0
CreateMutexExW
0x1011c1b8
CreateSemaphoreExW
0x1011c1d4
DeleteCriticalSection
0x1011c1bc
EnterCriticalSection
0x1011c1d0
InitializeCriticalSectionEx
0x1011c1cc
InitializeSRWLock
0x1011c1f4
LeaveCriticalSection
0x1011c1c4
OpenSemaphoreW
0x1011c204
ReleaseMutex
0x1011c1dc
ReleaseSemaphore
0x1011c1c0
ReleaseSRWLockExclusive
0x1011c1e4
ReleaseSRWLockShared
0x1011c1fc
SetEvent
0x1011c1e8
TryAcquireSRWLockExclusive
0x1011c1f8
WaitForMultipleObjectsEx
0x1011c200
WaitForSingleObject
0x1011c1d8
WaitForSingleObjectEx
0x1011c1f0
InitOnceBeginInitialize
0x1011c210
InitOnceComplete
0x1011c214
InitOnceExecuteOnce
0x1011c21c
Sleep
0x1011c220
WakeByAddressAll
0x1011c218
GetSystemDirectoryW
0x1011c22c
GetSystemTimeAsFileTime
0x1011c230
GetTickCount
0x1011c234
GetTickCount64
0x1011c228
GetProductInfo
0x1011c23c
CloseThreadpool
0x1011c24c
CloseThreadpoolTimer
0x1011c260
CloseThreadpoolWork
0x1011c250
CreateThreadpool
0x1011c268
CreateThreadpoolTimer
0x1011c25c
CreateThreadpoolWork
0x1011c264
FreeLibraryWhenCallbackReturns
0x1011c248
SetThreadpoolTimer
0x1011c258
SubmitThreadpoolWork
0x1011c244
WaitForThreadpoolTimerCallbacks
0x1011c254
QueueUserWorkItem
0x1011c270
GetRestrictedErrorInfo
0x1011c290
RoOriginateError
0x1011c288
RoOriginateErrorW
0x1011c284
RoTransformError
0x1011c294
SetRestrictedErrorInfo
0x1011c28c
IsErrorPropagationEnabled
0x1011c2a8
RoGetMatchingRestrictedErrorInfo
0x1011c2a4
RoOriginateLanguageException
0x1011c2a0
RoReportFailedDelegate
0x1011c29c
RoActivateInstance
0x1011c2b8
RoGetActivationFactory
0x1011c2bc
RoInitialize
0x1011c2c0
RoRegisterActivationFactories
0x1011c2b0
RoRevokeActivationFactories
0x1011c2c4
RoUninitialize
0x1011c2b4
RoCreatePropertySetSerializer
0x1011c2cc
WindowsCompareStringOrdinal
0x1011c2f8
WindowsConcatString
0x1011c2e4
WindowsCreateString
0x1011c2f4
WindowsCreateStringReference
0x1011c2e0
WindowsDeleteString
0x1011c2d4
WindowsDuplicateString
0x1011c2d8
WindowsGetStringLen
0x1011c2dc
WindowsGetStringRawBuffer
0x1011c2e8
WindowsIsStringEmpty
0x1011c2ec
WindowsStringHasEmbeddedNull
0x1011c2f0
WindowsSubstringWithSpecifiedLength
0x1011c2fc
__CxxFrameHandler3
0x1011c3d8
__std_terminate
0x1011c3d4
_CxxThrowException
0x1011c3a0
_except_handler4_common
0x1011c39c
_o___std_exception_copy
0x1011c3c8
_o___std_exception_destroy
0x1011c3c0
_o___std_type_info_destroy_list
0x1011c3bc
_o___stdio_common_vsnprintf_s
0x1011c3b4
_o___stdio_common_vswprintf
0x1011c3b0
_o__callnewh
0x1011c3a8
_o__cexit
0x1011c3a4
_o__configure_narrow_argv
0x1011c3b8
_o__crt_atexit
0x1011c3ac
_o__errno
0x1011c3cc
_o__execute_onexit_table
0x1011c3c4
_o__fseeki64
0x1011c304
_o__initialize_narrow_environment
0x1011c308
_o__initialize_onexit_table
0x1011c30c
_o__invalid_parameter_noinfo
0x1011c310
_o__invalid_parameter_noinfo_noreturn
0x1011c314
_o__itow_s
0x1011c318
_o__lock_file
0x1011c31c
_o__purecall
0x1011c320
_o__register_onexit_function
0x1011c324
_o__seh_filter_dll
0x1011c328
_o__unlock_file
0x1011c32c
_o__wcsicmp
0x1011c330
_o__wcsnicmp
0x1011c334
_o__wsplitpath_s
0x1011c33c
_o_ceil
0x1011c340
_o_fclose
0x1011c344
_o_fflush
0x1011c348
_o_fgetc
0x1011c34c
_o_fgetpos
0x1011c350
_o_fgetwc
0x1011c354
_o_fputwc
0x1011c358
_o_free
0x1011c35c
_o_fsetpos
0x1011c360
_o_fwrite
0x1011c364
_o_iswspace
0x1011c368
_o_malloc
0x1011c36c
_o_realloc
0x1011c370
_o_setvbuf
0x1011c374
_o_terminate
0x1011c378
_o_tolower
0x1011c37c
_o_toupper
0x1011c380
_o_towlower
0x1011c384
_o_ungetc
0x1011c388
_o_ungetwc
0x1011c38c
_o_wcscat_s
0x1011c390
_o_wcscpy_s
0x1011c394
_o_wcstoul
0x1011c398
memcmp
0x1011c3dc
memcpy
0x1011c3e0
memmove
0x1011c338
wcsstr
0x1011c3d0
TraceMessage
0x1011c400
EventActivityIdControl
0x1011c40c
EventProviderEnabled
0x1011c408
EventRegister
0x1011c410
EventSetInformation
0x1011c418
EventUnregister
0x1011c414
EventWriteTransfer
0x1011c41c
AccessCheck
0x1011c43c
AllocateAndInitializeSid
0x1011c430
CreateWellKnownSid
0x1011c444
DuplicateTokenEx
0x1011c438
FreeSid
0x1011c44c
GetLengthSid
0x1011c458
GetSidLengthRequired
0x1011c424
GetSidSubAuthority
0x1011c428
GetTokenInformation
0x1011c440
ImpersonateLoggedOnUser
0x1011c454
InitializeSid
0x1011c434
IsWellKnownSid
0x1011c448
MakeAbsoluteSD
0x1011c42c
RevertToSelf
0x1011c450
SetTokenInformation
0x1011c45c
CheckTokenMembershipEx
0x1011c464
CreateAppContainerToken
0x1011c46c
CapabilityCheck
0x1011c474
ConvertSidToStringSidW
0x1011c47c
ConvertStringSecurityDescriptorToSecurityDescriptorW
0x1011c480
ConvertStringSidToSidW
0x1011c484
RegisterServiceCtrlHandlerExW
0x1011c490
SetServiceStatus
0x1011c48c
I_QueryTagInformation
0x1011c498
CreateRandomAccessStreamOverStream
0x1011c4a0
CreateStreamOverRandomAccessStream
0x1011c4a4
SHTaskPoolAllowThreadReuse
0x1011c4b0
SHTaskPoolQueueTask
0x1011c4ac
_Cnd_broadcast
0x1011c5bc
_Cnd_destroy_in_situ
0x1011c584
_Cnd_init_in_situ
0x1011c580
_Cnd_timedwait
0x1011c548
_Mtx_current_owns
0x1011c550
_Mtx_destroy_in_situ
0x1011c574
_Mtx_init_in_situ
0x1011c578
_Mtx_lock
0x1011c530
_Mtx_unlock
0x1011c538
_Query_perf_counter
0x1011c540
_Query_perf_frequency
0x1011c544
_Xtime_get_ticks
0x1011c554
?_Fiopen@std@@YAPAU_iobuf@@PBGHH@Z
0x1011c4d4
?_Getcat@?$codecvt@GDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
0x1011c4e0
?_Getcat@?$ctype@G@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
0x1011c560
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
0x1011c56c
?_Gndec@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEPAGXZ
0x1011c51c
?_Gninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEPAGXZ
0x1011c604
?_Init@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXXZ
0x1011c504
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAEXXZ
0x1011c5ac
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEXXZ
0x1011c5cc
?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEPAGXZ
0x1011c5f8
?_Throw_C_error@std@@YAXH@Z
0x1011c534
?_Throw_Cpp_error@std@@YAXH@Z
0x1011c54c
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAEXXZ
0x1011c5b8
?_Xbad_function_call@std@@YAXXZ
0x1011c588
?_Xlength_error@std@@YAXPBD@Z
0x1011c564
?_Xout_of_range@std@@YAXPBD@Z
0x1011c570
??0_Lockit@std@@QAE@H@Z
0x1011c57c
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IAE@XZ
0x1011c508
??0?$basic_ostream@GU?$char_traits@G@std@@@std@@QAE@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N@Z
0x1011c524
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAE@XZ
0x1011c4f4
??1_Lockit@std@@QAE@XZ
0x1011c58c
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UAE@XZ
0x1011c590
??1?$basic_ostream@GU?$char_traits@G@std@@@std@@UAE@XZ
0x1011c5b0
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAE@XZ
0x1011c5f0
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@_K@Z
0x1011c52c
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@K@Z
0x1011c528
??Bid@locale@std@@QAEIXZ
0x1011c568
?always_noconv@codecvt_base@std@@QBE_NXZ
0x1011c53c
?eback@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
0x1011c50c
?egptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
0x1011c510
?epptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
0x1011c518
?fill@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEGXZ
0x1011c5a4
?flags@ios_base@std@@QBEHXZ
0x1011c5c4
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@XZ
0x1011c5e4
?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXH@Z
0x1011c600
?getloc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QBE?AVlocale@2@XZ
0x1011c4f8
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
0x1011c5a8
?good@ios_base@std@@QBE_NXZ
0x1011c5ec
?gptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
0x1011c5b4
?id@?$codecvt@GDU_Mbstatet@@@std@@2V0locale@2@A
0x1011c4dc
?id@?$ctype@G@std@@2V0locale@2@A
0x1011c55c
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEXABVlocale@2@@Z
0x1011c4ec
?in@?$codecvt@GDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAG3AAPAG@Z
0x1011c5fc
?out@?$codecvt@GDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBG1AAPBGPAD3AAPAD@Z
0x1011c5f4
?pbase@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
0x1011c4fc
?pptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
0x1011c5d0
?rdbuf@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEPAV?$basic_streambuf@GU?$char_traits@G@std@@@2@XZ
0x1011c5e0
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEPAV12@PAG_J@Z
0x1011c4e8
?setg@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXPAG00@Z
0x1011c514
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXPAG0@Z
0x1011c500
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXPAG00@Z
0x1011c520
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEXH_N@Z
0x1011c594
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JXZ
0x1011c4e4
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGG@Z
0x1011c5a0
?sputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAE_JPBG_J@Z
0x1011c4f0
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEHXZ
0x1011c5d8
?tie@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEPAV?$basic_ostream@GU?$char_traits@G@std@@@2@XZ
0x1011c5e8
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEGXZ
0x1011c5dc
?uncaught_exception@std@@YA_NXZ
0x1011c5c0
?unshift@?$codecvt@GDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
0x1011c558
?widen@?$ctype@G@std@@QBEGD@Z
0x1011c4d8
?width@ios_base@std@@QAE_J_J@Z
0x1011c59c
?width@ios_base@std@@QBE_JXZ
0x1011c598
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JPAG_J@Z
0x1011c5d4
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JPBG_J@Z
0x1011c5c8
ntdll.dll
29
DbgPrint
0x1011c664
NtClose
0x1011c634
NtCreateFile
0x1011c638
NtQueryInformationToken
0x1011c670
NtQueryWnfStateData
0x1011c628
RtlAcquireResourceExclusive
0x1011c610
RtlAllocateHeap
0x1011c674
RtlDeleteResource
0x1011c67c
RtlDosPathNameToRelativeNtPathName_U
0x1011c62c
RtlEqualSid
0x1011c640
RtlFreeHeap
0x1011c66c
RtlFreeSid
0x1011c61c
RtlGetDeviceFamilyInfoEnum
0x1011c65c
RtlInitializeResource
0x1011c60c
RtlIsMultiSessionSku
0x1011c618
RtlIsMultiUsersInSessionSku
0x1011c660
RtlLoadString
0x1011c668
RtlNtStatusToDosError
0x1011c624
RtlPublishWnfStateData
0x1011c63c
RtlQueryPackageClaims
0x1011c658
RtlQueryWnfStateData
0x1011c654
RtlReleaseRelativeName
0x1011c630
RtlReleaseResource
0x1011c614
RtlSetEnvironmentVar
0x1011c648
RtlSubscribeWnfStateChangeNotification
0x1011c64c
RtlUnsubscribeWnfNotificationWaitForCompletion
0x1011c644
RtlUnsubscribeWnfStateChangeNotification
0x1011c650
wcsnlen
0x1011c678
ZwQueryWnfStateData
0x1011c620
RmAccessCheck
0x1011c000
TokenBindingGenerateIDForUri
0x1011c024
No function matches your filter.