wdc.dll

Description: Performance Monitor

Authors: © Microsoft Corporation. All rights reserved.

Version: 10.0.19041.1

Architecture: 32-bit

Operating System: Windows NT

SHA256: 94245a29976767bd7ac55f08e955da2c

File Size: 572.5 KB

Uploaded At: Dec. 1, 2025, 8:06 a.m.

Views: 14

Security Warning

This file has been flagged as potentially dangerous.

Reason: Detected potentially dangerous functions used for process injection: OpenProcess

Exported Functions

  • WdcParseLegacyFile (Ordinal: 1, Address: 0x6d9e0)
  • WdcRunTaskAsInteractiveUser (Ordinal: 2, Address: 0x6ded0)
  • DllCanUnloadNow (Ordinal: 3, Address: 0x32280)
  • DllGetClassObject (Ordinal: 4, Address: 0x30840)
  • DllRegisterServer (Ordinal: 5, Address: 0x41370)
  • DllUnregisterServer (Ordinal: 6, Address: 0x41370)

Imported DLLs & Functions

ADVAPI32.dll
  • AdjustTokenPrivileges (Address: 0x10087070)
  • AllocateAndInitializeSid (Address: 0x10087080)
  • CheckTokenMembership (Address: 0x1008707c)
  • CloseServiceHandle (Address: 0x10087034)
  • CloseThreadWaitChainSession (Address: 0x10087050)
  • CloseTrace (Address: 0x1008706c)
  • ControlService (Address: 0x1008702c)
  • ConvertSecurityDescriptorToStringSecurityDescriptorW (Address: 0x10087090)
  • ConvertStringSecurityDescriptorToSecurityDescriptorW (Address: 0x10087078)
  • CreateWellKnownSid (Address: 0x10087084)
  • EnableTraceEx (Address: 0x10087058)
  • EnumServicesStatusExW (Address: 0x10087028)
  • EventRegister (Address: 0x1008701c)
  • EventUnregister (Address: 0x10087014)
  • EventWriteTransfer (Address: 0x10087088)
  • FreeSid (Address: 0x10087000)
  • GetSecurityDescriptorDacl (Address: 0x100870a0)
  • GetSecurityDescriptorGroup (Address: 0x100870b0)
  • GetSecurityDescriptorOwner (Address: 0x100870a8)
  • GetSecurityDescriptorSacl (Address: 0x10087098)
  • GetThreadWaitChain (Address: 0x10087048)
  • I_QueryTagInformation (Address: 0x10087018)
  • IsValidSid (Address: 0x10087020)
  • MakeAbsoluteSD (Address: 0x100870b4)
  • MapGenericMask (Address: 0x1008708c)
  • OpenProcessToken (Address: 0x10087074)
  • OpenSCManagerW (Address: 0x10087040)
  • OpenServiceW (Address: 0x1008703c)
  • OpenThreadWaitChainSession (Address: 0x1008704c)
  • OpenTraceW (Address: 0x10087060)
  • ProcessTrace (Address: 0x10087054)
  • QueryServiceConfigW (Address: 0x10087024)
  • QueryServiceStatus (Address: 0x10087038)
  • QueryTraceW (Address: 0x10087068)
  • RegCloseKey (Address: 0x10087004)
  • RegEnumValueW (Address: 0x1008700c)
  • RegGetValueW (Address: 0x100870b8)
  • RegisterWaitChainCOMCallback (Address: 0x10087044)
  • RegOpenKeyExW (Address: 0x10087010)
  • RegQueryValueExW (Address: 0x10087008)
  • SetSecurityDescriptorDacl (Address: 0x1008709c)
  • SetSecurityDescriptorGroup (Address: 0x100870ac)
  • SetSecurityDescriptorOwner (Address: 0x100870a4)
  • SetSecurityDescriptorSacl (Address: 0x10087094)
  • StartServiceW (Address: 0x10087030)
  • StartTraceW (Address: 0x1008705c)
  • StopTraceW (Address: 0x10087064)
api-ms-win-core-appcompat-l1-1-1.dll
  • BaseFreeAppCompatDataForProcess (Address: 0x100875bc)
  • BaseReadAppCompatDataForProcess (Address: 0x100875b8)
COMCTL32.dll
  • (Address: 0x100870c0)
  • (Address: 0x100870c4)
  • (Address: 0x100870c8)
  • (Address: 0x100870cc)
  • (Address: 0x100870d0)
credui.dll
  • CredUIPromptForCredentialsW (Address: 0x100875c4)
DUser.dll
  • ForwardGadgetMessage (Address: 0x100870d8)
GDI32.dll
  • BitBlt (Address: 0x100870e0)
  • CreateCompatibleBitmap (Address: 0x100870f4)
  • CreateCompatibleDC (Address: 0x100870f8)
  • CreateDIBSection (Address: 0x1008710c)
  • CreateFontIndirectW (Address: 0x1008711c)
  • CreatePen (Address: 0x10087108)
  • CreateSolidBrush (Address: 0x100870f0)
  • DeleteObject (Address: 0x10087124)
  • EndDoc (Address: 0x1008712c)
  • EndPage (Address: 0x10087110)
  • GetDeviceCaps (Address: 0x10087120)
  • GetStockObject (Address: 0x10087100)
  • LineTo (Address: 0x100870ec)
  • MoveToEx (Address: 0x10087128)
  • Polygon (Address: 0x100870e4)
  • Polyline (Address: 0x100870fc)
  • SelectObject (Address: 0x10087104)
  • SetROP2 (Address: 0x100870e8)
  • StartDocW (Address: 0x10087118)
  • StartPage (Address: 0x10087114)
IPHLPAPI.DLL
  • GetAdaptersAddresses (Address: 0x10087148)
  • GetExtendedTcpTable (Address: 0x10087138)
  • GetExtendedUdpTable (Address: 0x10087144)
  • GetIfEntry2 (Address: 0x10087154)
  • GetPerTcp6ConnectionEStats (Address: 0x10087134)
  • GetPerTcpConnectionEStats (Address: 0x1008713c)
  • NhGetInterfaceNameFromDeviceGuid (Address: 0x1008714c)
  • SetPerTcp6ConnectionEStats (Address: 0x10087140)
  • SetPerTcpConnectionEStats (Address: 0x10087150)
KERNEL32.dll
  • AcquireSRWLockExclusive (Address: 0x10087174)
  • CancelSynchronousIo (Address: 0x10087268)
  • CloseHandle (Address: 0x10087244)
  • CreateEventW (Address: 0x10087294)
  • CreateFileMappingW (Address: 0x100871ec)
  • CreateFileW (Address: 0x1008727c)
  • CreateMutexW (Address: 0x100871fc)
  • CreateThread (Address: 0x1008723c)
  • DebugBreak (Address: 0x10087208)
  • DelayLoadFailureHook (Address: 0x10087190)
  • DeleteCriticalSection (Address: 0x10087234)
  • DeleteFileW (Address: 0x100872ac)
  • DeviceIoControl (Address: 0x100871ac)
  • DuplicateHandle (Address: 0x10087228)
  • EnterCriticalSection (Address: 0x10087284)
  • ExpandEnvironmentStringsW (Address: 0x100872d4)
  • FileTimeToLocalFileTime (Address: 0x100872b0)
  • FileTimeToSystemTime (Address: 0x100872b4)
  • FindClose (Address: 0x10087314)
  • FindFirstFileW (Address: 0x1008730c)
  • FindNextFileW (Address: 0x10087310)
  • FindResourceExW (Address: 0x100871a8)
  • FindResourceW (Address: 0x100872f8)
  • FormatMessageW (Address: 0x100872f0)
  • FreeLibrary (Address: 0x100872c8)
  • FreeResource (Address: 0x10087308)
  • GetActiveProcessorGroupCount (Address: 0x100871cc)
  • GetCommandLineW (Address: 0x100872c0)
  • GetComputerNameW (Address: 0x100872d0)
  • GetCurrentProcess (Address: 0x10087328)
  • GetCurrentProcessId (Address: 0x10087330)
  • GetCurrentThread (Address: 0x1008720c)
  • GetCurrentThreadId (Address: 0x100872a0)
  • GetDateFormatW (Address: 0x100872b8)
  • GetDiskFreeSpaceExW (Address: 0x100871bc)
  • GetErrorMode (Address: 0x10087338)
  • GetFileAttributesW (Address: 0x100872a8)
  • GetFileSize (Address: 0x10087324)
  • GetLastError (Address: 0x10087240)
  • GetLocaleInfoW (Address: 0x100872a4)
  • GetLocalTime (Address: 0x100872cc)
  • GetLogicalDriveStringsW (Address: 0x100871b4)
  • GetModuleFileNameW (Address: 0x1008725c)
  • GetModuleHandleA (Address: 0x1008724c)
  • GetModuleHandleW (Address: 0x10087250)
  • GetNumberFormatW (Address: 0x10087214)
  • GetPhysicallyInstalledSystemMemory (Address: 0x10087218)
  • GetProcAddress (Address: 0x10087254)
  • GetProcessHeap (Address: 0x100872e4)
  • GetProcessorSystemCycleTime (Address: 0x100871c8)
  • GetProcessTimes (Address: 0x100871dc)
  • GetSystemTimeAsFileTime (Address: 0x10087168)
  • GetSystemWindowsDirectoryW (Address: 0x10087224)
  • GetTempFileNameW (Address: 0x1008731c)
  • GetTempPathW (Address: 0x10087318)
  • GetTickCount (Address: 0x1008719c)
  • GetTimeFormatW (Address: 0x100872bc)
  • GetVersionExW (Address: 0x100871c4)
  • GlobalAlloc (Address: 0x1008726c)
  • GlobalFree (Address: 0x10087278)
  • GlobalLock (Address: 0x10087270)
  • GlobalUnlock (Address: 0x10087274)
  • HeapAlloc (Address: 0x100872e0)
  • HeapFree (Address: 0x100872e8)
  • HeapReAlloc (Address: 0x100872f4)
  • HeapSetInformation (Address: 0x1008722c)
  • HeapSize (Address: 0x100871a0)
  • InitializeCriticalSection (Address: 0x10087320)
  • K32EnumDeviceDrivers (Address: 0x10087184)
  • K32EnumProcessModulesEx (Address: 0x10087180)
  • K32GetDeviceDriverBaseNameW (Address: 0x1008717c)
  • K32GetDeviceDriverFileNameW (Address: 0x10087178)
  • K32GetModuleBaseNameW (Address: 0x10087220)
  • K32GetModuleFileNameExW (Address: 0x1008721c)
  • LeaveCriticalSection (Address: 0x10087290)
  • LoadLibraryA (Address: 0x10087264)
  • LoadLibraryW (Address: 0x10087258)
  • LoadResource (Address: 0x100872fc)
  • LocalAlloc (Address: 0x100872dc)
  • LocalFree (Address: 0x100872c4)
  • LockResource (Address: 0x10087300)
  • lstrlenW (Address: 0x100871d4)
  • MapViewOfFile (Address: 0x100871e8)
  • MulDiv (Address: 0x1008733c)
  • MultiByteToWideChar (Address: 0x100871c0)
  • OpenProcess (Address: 0x100871e0)
  • OutputDebugStringA (Address: 0x10087260)
  • OutputDebugStringW (Address: 0x100872ec)
  • ProcessIdToSessionId (Address: 0x1008732c)
  • QueryDosDeviceW (Address: 0x100871b0)
  • QueryFullProcessImageNameW (Address: 0x100871d8)
  • QueryPerformanceCounter (Address: 0x10087164)
  • QueryPerformanceFrequency (Address: 0x100871b8)
  • ReadFile (Address: 0x10087280)
  • ReadProcessMemory (Address: 0x100871a4)
  • ReleaseMutex (Address: 0x100871f8)
  • ReleaseSRWLockExclusive (Address: 0x10087188)
  • ResetEvent (Address: 0x10087298)
  • ResolveDelayLoadedAPI (Address: 0x10087194)
  • SetErrorMode (Address: 0x10087334)
  • SetEvent (Address: 0x10087288)
  • SetLastError (Address: 0x10087248)
  • SetProcessWorkingSetSize (Address: 0x100871f0)
  • SetThreadPriority (Address: 0x10087210)
  • SetUnhandledExceptionFilter (Address: 0x10087160)
  • SizeofResource (Address: 0x10087304)
  • Sleep (Address: 0x10087198)
  • SleepConditionVariableSRW (Address: 0x1008716c)
  • TerminateProcess (Address: 0x100871d0)
  • TerminateThread (Address: 0x1008718c)
  • TlsAlloc (Address: 0x10087230)
  • TlsFree (Address: 0x10087238)
  • TlsGetValue (Address: 0x10087200)
  • TlsSetValue (Address: 0x100871e4)
  • TryEnterCriticalSection (Address: 0x10087204)
  • UnhandledExceptionFilter (Address: 0x1008715c)
  • UnmapViewOfFile (Address: 0x100871f4)
  • WaitForMultipleObjects (Address: 0x1008729c)
  • WaitForSingleObject (Address: 0x1008728c)
  • WakeAllConditionVariable (Address: 0x10087170)
  • WriteFile (Address: 0x100872d8)
msvcrt.dll
  • __CxxFrameHandler3 (Address: 0x100875fc)
  • __dllonexit (Address: 0x100875cc)
  • _amsg_exit (Address: 0x10087614)
  • _callnewh (Address: 0x10087628)
  • _except_handler4_common (Address: 0x100875e0)
  • _ftol2 (Address: 0x100875f8)
  • _ftol2_sse (Address: 0x10087600)
  • _initterm (Address: 0x10087610)
  • _lock (Address: 0x10087644)
  • _onexit (Address: 0x10087638)
  • _purecall (Address: 0x100875ec)
  • _unlock (Address: 0x10087634)
  • _vsnwprintf (Address: 0x100875f0)
  • _wcsicmp (Address: 0x10087640)
  • _wcsnicmp (Address: 0x100875e8)
  • _wtoi (Address: 0x1008763c)
  • _XcptFilter (Address: 0x10087618)
  • ??1type_info@@UAE@XZ (Address: 0x1008760c)
  • ceil (Address: 0x10087604)
  • floor (Address: 0x10087608)
  • free (Address: 0x10087624)
  • iswdigit (Address: 0x10087648)
  • malloc (Address: 0x10087630)
  • mbstowcs (Address: 0x100875d8)
  • memcmp (Address: 0x1008761c)
  • memcpy (Address: 0x10087620)
  • memmove (Address: 0x1008762c)
  • memset (Address: 0x10087654)
  • towlower (Address: 0x100875dc)
  • wcschr (Address: 0x10087650)
  • wcsrchr (Address: 0x100875e4)
  • wcsstr (Address: 0x1008764c)
  • wcstok (Address: 0x100875f4)
  • wcstombs (Address: 0x100875d4)
  • wcstoul (Address: 0x100875d0)
ntdll.dll
  • NtOpenFile (Address: 0x10087694)
  • NtQueryInformationProcess (Address: 0x10087668)
  • NtQueryInformationThread (Address: 0x10087680)
  • NtQueryInformationToken (Address: 0x100876a0)
  • NtQueryObject (Address: 0x10087684)
  • NtQuerySystemInformation (Address: 0x10087698)
  • NtQuerySystemInformationEx (Address: 0x1008769c)
  • NtQuerySystemTime (Address: 0x1008765c)
  • NtResumeProcess (Address: 0x1008767c)
  • NtSuspendProcess (Address: 0x10087678)
  • RtlInitUnicodeString (Address: 0x10087690)
  • RtlIpv4AddressToStringW (Address: 0x10087688)
  • RtlIpv6AddressToStringExW (Address: 0x10087674)
  • RtlIpv6AddressToStringW (Address: 0x1008768c)
  • RtlNtStatusToDosError (Address: 0x10087660)
  • WinSqmAddToAverageDWORD (Address: 0x10087670)
  • WinSqmAddToStream (Address: 0x1008766c)
  • WinSqmIncrementDWORD (Address: 0x10087664)
ODBC32.dll
  • (Address: 0x10087350)
  • (Address: 0x1008734c)
  • (Address: 0x10087348)
  • (Address: 0x10087344)
ole32.dll
  • CoCreateInstance (Address: 0x100876cc)
  • CoCreateInstanceEx (Address: 0x100876ac)
  • CoGetActivationState (Address: 0x100876b8)
  • CoGetCallState (Address: 0x100876bc)
  • CoInitialize (Address: 0x100876ec)
  • CoInitializeEx (Address: 0x100876e0)
  • CoSetProxyBlanket (Address: 0x100876d8)
  • CoTaskMemAlloc (Address: 0x100876d0)
  • CoTaskMemFree (Address: 0x100876e4)
  • CoTaskMemRealloc (Address: 0x100876e8)
  • CoUninitialize (Address: 0x100876a8)
  • CreateOleAdviseHolder (Address: 0x100876dc)
  • CreateStreamOnHGlobal (Address: 0x100876b0)
  • GetHGlobalFromStream (Address: 0x100876b4)
  • ReadClassStm (Address: 0x100876c4)
  • StringFromCLSID (Address: 0x100876c0)
  • StringFromGUID2 (Address: 0x100876d4)
  • WriteClassStm (Address: 0x100876c8)
OLEAUT32.dll
  • SafeArrayAccessData (Address: 0x10087374)
  • SafeArrayCreate (Address: 0x1008735c)
  • SafeArrayDestroy (Address: 0x10087358)
  • SafeArrayUnaccessData (Address: 0x1008736c)
  • SysAllocString (Address: 0x1008738c)
  • SysAllocStringLen (Address: 0x1008737c)
  • SysFreeString (Address: 0x10087388)
  • SysStringByteLen (Address: 0x10087370)
  • SystemTimeToVariantTime (Address: 0x10087364)
  • VariantChangeType (Address: 0x10087384)
  • VariantClear (Address: 0x10087368)
  • VariantCopy (Address: 0x10087380)
  • VariantInit (Address: 0x10087378)
  • VariantTimeToSystemTime (Address: 0x10087360)
pdh.dll
  • PdhAddEnglishCounterW (Address: 0x10087708)
  • PdhCloseQuery (Address: 0x10087704)
  • PdhCollectQueryData (Address: 0x10087700)
  • PdhExpandWildCardPathW (Address: 0x100876f4)
  • PdhGetFormattedCounterArrayW (Address: 0x100876f8)
  • PdhGetFormattedCounterValue (Address: 0x1008770c)
  • PdhOpenQueryW (Address: 0x100876fc)
pdhui.dll
  • PdhUiBrowseCountersExHW (Address: 0x10087714)
PLA.dll
  • PlaDeleteReport (Address: 0x100873a4)
  • PlaExpandTaskArguments (Address: 0x10087394)
  • PlaGetLegacyAlertActionsFlagsFromString (Address: 0x10087398)
  • PlaGetLegacyAlertActionsStringFromFlags (Address: 0x1008739c)
  • PlaGetServerCapabilities (Address: 0x100873a0)
Secur32.dll
  • GetUserNameExW (Address: 0x100873e0)
SHELL32.dll
  • (Address: 0x100873b4)
  • CommandLineToArgvW (Address: 0x100873b8)
  • DragQueryFileW (Address: 0x100873c0)
  • SHBrowseForFolderW (Address: 0x100873cc)
  • ShellExecuteExW (Address: 0x100873ac)
  • ShellExecuteW (Address: 0x100873b0)
  • SHGetMalloc (Address: 0x100873c8)
  • SHGetPathFromIDListW (Address: 0x100873c4)
  • SHGetSpecialFolderLocation (Address: 0x100873bc)
SHLWAPI.dll
  • (Address: 0x100873d4)
  • AssocQueryStringW (Address: 0x100873d8)
USER32.dll
  • AppendMenuW (Address: 0x10087518)
  • BeginPaint (Address: 0x10087500)
  • CallWindowProcW (Address: 0x10087460)
  • CharLowerW (Address: 0x100873ec)
  • CheckDlgButton (Address: 0x10087438)
  • CheckMenuItem (Address: 0x100874a4)
  • CheckMenuRadioItem (Address: 0x100874b8)
  • CheckRadioButton (Address: 0x1008745c)
  • CloseClipboard (Address: 0x100874d0)
  • CloseDesktop (Address: 0x10087568)
  • CloseWindowStation (Address: 0x100873f4)
  • CreateWindowExW (Address: 0x100874f0)
  • DefWindowProcW (Address: 0x10087480)
  • DeleteMenu (Address: 0x1008751c)
  • DestroyIcon (Address: 0x100874d4)
  • DestroyMenu (Address: 0x100874b0)
  • DestroyWindow (Address: 0x100874ec)
  • DialogBoxParamW (Address: 0x1008743c)
  • EmptyClipboard (Address: 0x1008753c)
  • EnableMenuItem (Address: 0x100874a8)
  • EnableWindow (Address: 0x10087424)
  • EndDialog (Address: 0x10087430)
  • EndPaint (Address: 0x10087504)
  • EnumDesktopsW (Address: 0x100873f8)
  • EnumDesktopWindows (Address: 0x10087564)
  • EnumWindowStationsW (Address: 0x100873f0)
  • FillRect (Address: 0x100874f4)
  • FlashWindow (Address: 0x10087484)
  • GetClassNameW (Address: 0x100874d8)
  • GetClientRect (Address: 0x10087420)
  • GetClipboardData (Address: 0x100874cc)
  • GetDC (Address: 0x10087464)
  • GetDlgItem (Address: 0x10087414)
  • GetDlgItemTextW (Address: 0x10087448)
  • GetFocus (Address: 0x10087548)
  • GetKeyState (Address: 0x10087494)
  • GetMenu (Address: 0x10087510)
  • GetMenuItemCount (Address: 0x100874b4)
  • GetMenuItemID (Address: 0x10087514)
  • GetMenuStringW (Address: 0x100874bc)
  • GetMessagePos (Address: 0x10087538)
  • GetParent (Address: 0x10087458)
  • GetProcessWindowStation (Address: 0x10087400)
  • GetScrollPos (Address: 0x10087534)
  • GetSubMenu (Address: 0x100874a0)
  • GetSysColor (Address: 0x10087544)
  • GetSystemMetrics (Address: 0x100874e4)
  • GetThreadDesktop (Address: 0x1008755c)
  • GetWindow (Address: 0x100874dc)
  • GetWindowLongW (Address: 0x1008742c)
  • GetWindowRect (Address: 0x10087498)
  • GetWindowTextW (Address: 0x10087444)
  • GetWindowThreadProcessId (Address: 0x10087554)
  • GhostWindowFromHungWindow (Address: 0x100873e8)
  • HungWindowFromGhostWindow (Address: 0x10087404)
  • InvalidateRect (Address: 0x100874fc)
  • IsClipboardFormatAvailable (Address: 0x100874c8)
  • IsDlgButtonChecked (Address: 0x10087434)
  • IsHungAppWindow (Address: 0x10087550)
  • IsWindowEnabled (Address: 0x10087488)
  • IsWindowVisible (Address: 0x1008754c)
  • KillTimer (Address: 0x10087474)
  • LoadBitmapW (Address: 0x10087468)
  • LoadCursorW (Address: 0x10087490)
  • LoadIconW (Address: 0x1008740c)
  • LoadImageW (Address: 0x10087408)
  • LoadMenuW (Address: 0x1008749c)
  • LoadStringW (Address: 0x10087410)
  • MapWindowPoints (Address: 0x1008750c)
  • MessageBeep (Address: 0x100874e0)
  • OpenClipboard (Address: 0x100874c4)
  • OpenDesktopW (Address: 0x10087558)
  • OpenWindowStationW (Address: 0x1008756c)
  • PostMessageW (Address: 0x10087454)
  • PostThreadMessageW (Address: 0x10087470)
  • PtInRect (Address: 0x10087530)
  • RegisterClassW (Address: 0x100874f8)
  • RegisterClipboardFormatW (Address: 0x1008747c)
  • ReleaseDC (Address: 0x10087528)
  • RemoveMenu (Address: 0x1008752c)
  • SendDlgItemMessageW (Address: 0x10087450)
  • SendMessageTimeoutW (Address: 0x1008746c)
  • SendMessageW (Address: 0x10087418)
  • SetActiveWindow (Address: 0x100874c0)
  • SetClipboardData (Address: 0x10087540)
  • SetCursor (Address: 0x1008748c)
  • SetDlgItemTextW (Address: 0x1008744c)
  • SetFocus (Address: 0x10087440)
  • SetProcessWindowStation (Address: 0x100873fc)
  • SetRect (Address: 0x10087520)
  • SetThreadDesktop (Address: 0x10087560)
  • SetTimer (Address: 0x10087478)
  • SetWindowLongW (Address: 0x10087428)
  • SetWindowPos (Address: 0x10087524)
  • SetWindowTextW (Address: 0x1008741c)
  • ShowWindow (Address: 0x100874e8)
  • TrackPopupMenuEx (Address: 0x100874ac)
  • UpdateWindow (Address: 0x10087508)
UTILDLL.dll
  • CachedGetUserFromSid (Address: 0x10087574)
UxTheme.dll
  • SetWindowTheme (Address: 0x1008757c)
VDMDBG.dll
  • VDMEnumProcessWOW (Address: 0x10087588)
  • VDMEnumTaskWOWEx (Address: 0x1008758c)
  • VDMTerminateTaskWOW (Address: 0x10087584)
VERSION.dll
  • GetFileVersionInfoSizeW (Address: 0x10087594)
  • GetFileVersionInfoW (Address: 0x1008759c)
  • VerQueryValueW (Address: 0x10087598)
wevtapi.dll
  • EvtClose (Address: 0x1008771c)
  • EvtCreateRenderContext (Address: 0x10087730)
  • EvtNext (Address: 0x10087720)
  • EvtOpenPublisherMetadata (Address: 0x10087734)
  • EvtOpenSession (Address: 0x10087728)
  • EvtRender (Address: 0x10087724)
  • EvtSubscribe (Address: 0x1008772c)
WINSTA.dll
  • WinStationGetProcessSid (Address: 0x100875a4)
WTSAPI32.dll
  • WTSFreeMemory (Address: 0x100875b0)
  • WTSQuerySessionInformationW (Address: 0x100875ac)