Windows.Internal.Management.dll
v10.0.19041.6456
32-bit
Windows NT
Analyzed
Security warning
This file has been flagged as potentially dangerous, and downloads are disabled.
Reason: Detected potentially dangerous functions used for process injection: OpenProcess
Exported functions 4
ServiceMain
#1 · 0x307c0
DllCanUnloadNow
#2 · 0x2cc90
DllGetActivationFactory
#3 · 0x2cb60
DllGetClassObject
#4 · 0x2cb80
No function matches your filter.
Imported DLLs & functions 447
CLSIDFromString
0x100ba154
CoAddRefServerProcess
0x100ba174
CoCreateFreeThreadedMarshaler
0x100ba16c
CoCreateGuid
0x100ba120
CoCreateInstance
0x100ba15c
CoGetApartmentType
0x100ba140
CoGetInterfaceAndReleaseStream
0x100ba138
CoImpersonateClient
0x100ba118
CoInitializeEx
0x100ba144
CoInitializeSecurity
0x100ba150
CoMarshalInterface
0x100ba134
CoRegisterClassObject
0x100ba168
CoReleaseMarshalData
0x100ba12c
CoReleaseServerProcess
0x100ba178
CoResumeClassObjects
0x100ba164
CoRevertToSelf
0x100ba11c
CoRevokeClassObject
0x100ba170
CoTaskMemAlloc
0x100ba160
CoTaskMemFree
0x100ba13c
CoUninitialize
0x100ba148
CoWaitForMultipleHandles
0x100ba128
CreateStreamOnHGlobal
0x100ba130
IIDFromString
0x100ba14c
StringFromCLSID
0x100ba158
StringFromGUID2
0x100ba124
RoGetAgileReference
0x100ba180
DebugBreak
0x100ba18c
IsDebuggerPresent
0x100ba190
OutputDebugStringW
0x100ba188
GetLastError
0x100ba1a4
RaiseException
0x100ba198
SetLastError
0x100ba1a8
SetUnhandledExceptionFilter
0x100ba19c
UnhandledExceptionFilter
0x100ba1a0
CreateFileW
0x100ba1b0
DeleteFileW
0x100ba1bc
FindClose
0x100ba1c8
FindFirstFileW
0x100ba1c0
FindNextFileW
0x100ba1cc
GetFileAttributesW
0x100ba1c4
GetFileSizeEx
0x100ba1b8
ReadFile
0x100ba1b4
CloseHandle
0x100ba1d4
GetProcessHeap
0x100ba1e0
HeapAlloc
0x100ba1e4
HeapFree
0x100ba1dc
DisableThreadLibraryCalls
0x100ba204
FreeLibrary
0x100ba214
GetModuleFileNameA
0x100ba200
GetModuleFileNameW
0x100ba21c
GetModuleHandleExW
0x100ba208
GetModuleHandleW
0x100ba1fc
GetProcAddress
0x100ba1f8
LoadLibraryExA
0x100ba210
LoadLibraryExW
0x100ba20c
LoadStringW
0x100ba218
FormatMessageW
0x100ba224
PathAllocCombine
0x100ba240
PathCchAppend
0x100ba24c
PathCchAppendEx
0x100ba250
PathCchCanonicalizeEx
0x100ba238
PathCchCombine
0x100ba248
PathCchCombineEx
0x100ba244
PathCchFindExtension
0x100ba23c
ExpandEnvironmentStringsW
0x100ba258
CreateProcessW
0x100ba260
GetCurrentProcess
0x100ba268
GetCurrentProcessId
0x100ba27c
GetCurrentThread
0x100ba278
GetCurrentThreadId
0x100ba264
GetExitCodeProcess
0x100ba280
OpenProcessToken
0x100ba270
OpenThreadToken
0x100ba274
TerminateProcess
0x100ba26c
GetProcessMitigationPolicy
0x100ba288
OpenProcess
0x100ba28c
QueryPerformanceCounter
0x100ba294
QueryFullProcessImageNameW
0x100ba29c
RegCloseKey
0x100ba2cc
RegCreateKeyExW
0x100ba2b4
RegDeleteKeyExW
0x100ba2a8
RegDeleteTreeW
0x100ba2d4
RegDeleteValueW
0x100ba2b0
RegEnumKeyExW
0x100ba2a4
RegEnumValueW
0x100ba2d0
RegGetValueW
0x100ba2c4
RegNotifyChangeKeyValue
0x100ba2b8
RegOpenCurrentUser
0x100ba2c8
RegOpenKeyExW
0x100ba2ac
RegQueryInfoKeyW
0x100ba2d8
RegQueryValueExW
0x100ba2bc
RegSetValueExW
0x100ba2c0
PathFindFileNameW
0x100ba2f8
MultiByteToWideChar
0x100ba300
lstrlenA
0x100ba308
AcquireSRWLockExclusive
0x100ba328
AcquireSRWLockShared
0x100ba314
CreateEventA
0x100ba354
CreateEventExW
0x100ba364
CreateEventW
0x100ba358
CreateMutexExW
0x100ba320
CreateSemaphoreExW
0x100ba34c
DeleteCriticalSection
0x100ba338
EnterCriticalSection
0x100ba32c
InitializeCriticalSectionEx
0x100ba35c
InitializeSRWLock
0x100ba368
LeaveCriticalSection
0x100ba324
OpenEventW
0x100ba330
OpenSemaphoreW
0x100ba340
ReleaseMutex
0x100ba318
ReleaseSemaphore
0x100ba350
ReleaseSRWLockExclusive
0x100ba310
ReleaseSRWLockShared
0x100ba31c
ResetEvent
0x100ba360
SetEvent
0x100ba348
TryAcquireSRWLockShared
0x100ba334
WaitForSingleObject
0x100ba33c
WaitForSingleObjectEx
0x100ba344
InitOnceBeginInitialize
0x100ba37c
InitOnceComplete
0x100ba384
InitOnceExecuteOnce
0x100ba378
Sleep
0x100ba374
SleepConditionVariableSRW
0x100ba370
WakeAllConditionVariable
0x100ba380
GetLocalTime
0x100ba38c
GetSystemInfo
0x100ba398
GetSystemTime
0x100ba39c
GetSystemTimeAsFileTime
0x100ba390
GetTickCount
0x100ba3a0
GetTickCount64
0x100ba394
CloseThreadpoolTimer
0x100ba3b4
CloseThreadpoolWork
0x100ba3b0
CreateThreadpoolTimer
0x100ba3c0
CreateThreadpoolWork
0x100ba3bc
FreeLibraryWhenCallbackReturns
0x100ba3a8
SetThreadpoolTimer
0x100ba3ac
SubmitThreadpoolWork
0x100ba3c4
WaitForThreadpoolTimerCallbacks
0x100ba3b8
CreateTimerQueueTimer
0x100ba3d0
DeleteTimerQueueTimer
0x100ba3cc
FileTimeToSystemTime
0x100ba3dc
SystemTimeToFileTime
0x100ba3d8
UrlEscapeW
0x100ba3e4
GetRestrictedErrorInfo
0x100ba408
RoOriginateError
0x100ba3f8
RoOriginateErrorW
0x100ba404
RoTransformError
0x100ba400
SetRestrictedErrorInfo
0x100ba3fc
IsErrorPropagationEnabled
0x100ba410
RoGetMatchingRestrictedErrorInfo
0x100ba414
RoReportFailedDelegate
0x100ba418
RoActivateInstance
0x100ba424
RoGetActivationFactory
0x100ba428
RoInitialize
0x100ba42c
RoRegisterActivationFactories
0x100ba434
RoRevokeActivationFactories
0x100ba430
RoUninitialize
0x100ba420
HSTRING_UserFree
0x100ba454
HSTRING_UserMarshal
0x100ba45c
HSTRING_UserSize
0x100ba464
HSTRING_UserUnmarshal
0x100ba450
WindowsConcatString
0x100ba46c
WindowsCreateString
0x100ba468
WindowsCreateStringReference
0x100ba44c
WindowsDeleteString
0x100ba43c
WindowsDuplicateString
0x100ba440
WindowsGetStringLen
0x100ba458
WindowsGetStringRawBuffer
0x100ba460
WindowsIsStringEmpty
0x100ba444
WindowsStringHasEmbeddedNull
0x100ba448
EventActivityIdControl
0x100ba480
EventRegister
0x100ba47c
EventSetInformation
0x100ba474
EventUnregister
0x100ba484
EventWriteTransfer
0x100ba478
OOBEComplete
0x100ba48c
AllocateAndInitializeSid
0x100ba49c
DuplicateTokenEx
0x100ba498
FreeSid
0x100ba4a0
GetTokenInformation
0x100ba4a4
IsWellKnownSid
0x100ba494
CheckTokenMembershipEx
0x100ba4ac
CapabilityCheck
0x100ba4b4
ConvertSidToStringSidW
0x100ba4c4
ConvertStringSecurityDescriptorToSecurityDescriptorW
0x100ba4c0
ConvertStringSidToSidW
0x100ba4bc
SetServiceStatus
0x100ba4cc
RegisterServiceCtrlHandlerA
0x100ba4d4
SHCreateMemStream
0x100ba4e4
SHCreateStreamOnFileEx
0x100ba4e0
SHCreateStreamOnFileW
0x100ba4dc
SHTaskPoolAllowThreadReuse
0x100ba4f0
SHTaskPoolQueueTask
0x100ba4ec
combase.dll
43
0x100ba4f8
0x100ba508
0x100ba510
0x100ba51c
0x100ba520
0x100ba524
0x100ba52c
0x100ba530
0x100ba534
0x100ba538
0x100ba540
0x100ba548
0x100ba54c
0x100ba550
0x100ba554
0x100ba558
0x100ba568
0x100ba56c
0x100ba574
0x100ba57c
0x100ba580
0x100ba584
0x100ba588
0x100ba58c
0x100ba590
0x100ba594
0x100ba59c
0x100ba5a0
CStdStubBuffer_AddRef
0x100ba504
CStdStubBuffer_Connect
0x100ba518
CStdStubBuffer_CountRefs
0x100ba578
CStdStubBuffer_DebugServerQueryInterface
0x100ba560
CStdStubBuffer_DebugServerRelease
0x100ba564
CStdStubBuffer_Disconnect
0x100ba544
CStdStubBuffer_Invoke
0x100ba598
CStdStubBuffer_IsIIDSupported
0x100ba50c
CStdStubBuffer_QueryInterface
0x100ba570
CStdStubBuffer2_Connect
0x100ba514
CStdStubBuffer2_CountRefs
0x100ba55c
CStdStubBuffer2_Disconnect
0x100ba500
CStdStubBuffer2_QueryInterface
0x100ba4fc
NdrCStdStubBuffer_Release
0x100ba53c
NdrCStdStubBuffer2_Release
0x100ba528
CopyString
0x100ba048
DmDeleteTask
0x100ba054
DmDisableTask
0x100ba000
DmGetAadUserToken
0x100ba028
DmGetActiveUserSid
0x100ba060
DmGetCurrentUserSid
0x100ba020
DmGetCurrentUserToken
0x100ba058
DmGetUserSidFromToken
0x100ba050
DmImpersonate
0x100ba068
DmInvalidateAadUserToken
0x100ba024
DmIsRunningInSystemContext
0x100ba018
DmIsSystemOrAdmin
0x100ba004
DmIsSystemOrUserIsAdmin
0x100ba044
DmRaiseToastNotification
0x100ba03c
DmRaiseToastNotificationAndWait
0x100ba014
DmRequestAadUserToken
0x100ba02c
DmRevertToSelf
0x100ba040
DmRunTask
0x100ba05c
HexStringToBinary
0x100ba00c
InvStrCmpIW
0x100ba008
IsPhoneOS
0x100ba064
MBToUnicode
0x100ba06c
OmaDmRegistryGetBinary
0x100ba038
OmaDmRegistryGetDWORD
0x100ba04c
OmaDmRegistryGetString
0x100ba01c
OmaDmRegistrySetBinary
0x100ba030
OmaDmRegistrySetDWORD
0x100ba034
UnicodeToMB
0x100ba010
Icmp6CreateFile
0x100ba078
Icmp6SendEcho2
0x100ba074
IcmpCloseHandle
0x100ba084
IcmpCreateFile
0x100ba07c
IcmpSendEcho
0x100ba080
?_Add_vtordisp1@?$basic_istream@DU?$char_traits@D@std@@@std@@UAEXXZ
0x100ba60c
?_Add_vtordisp1@?$basic_istream@GU?$char_traits@G@std@@@std@@UAEXXZ
0x100ba67c
?_Add_vtordisp2@?$basic_ios@DU?$char_traits@D@std@@@std@@UAEXXZ
0x100ba5d8
?_Add_vtordisp2@?$basic_ostream@DU?$char_traits@D@std@@@std@@UAEXXZ
0x100ba610
?_Add_vtordisp2@?$basic_ostream@GU?$char_traits@G@std@@@std@@UAEXXZ
0x100ba680
?_BADOFF@std@@3_JB
0x100ba690
?_Fiopen@std@@YAPAU_iobuf@@PBGHH@Z
0x100ba688
?_Getcat@?$codecvt@DDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
0x100ba5ac
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
0x100ba694
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
0x100ba5bc
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
0x100ba5b0
?_Ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QAE_N_N@Z
0x100ba640
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
0x100ba5e4
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAEXXZ
0x100ba658
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
0x100ba5c0
?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEPAGXZ
0x100ba63c
?_Syserror_map@std@@YAPBDH@Z
0x100ba6a8
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
0x100ba5e8
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAEXXZ
0x100ba65c
?_Winerror_map@std@@YAPBDH@Z
0x100ba6b0
?_Xbad_alloc@std@@YAXXZ
0x100ba6a4
?_Xlength_error@std@@YAXPBD@Z
0x100ba6ac
?_Xout_of_range@std@@YAXPBD@Z
0x100ba6b4
??0_Lockit@std@@QAE@H@Z
0x100ba698
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
0x100ba5b8
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IAE@XZ
0x100ba628
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
0x100ba5c8
??0?$basic_iostream@GU?$char_traits@G@std@@@std@@QAE@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z
0x100ba62c
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
0x100ba5c4
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
0x100ba5a8
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAE@XZ
0x100ba624
??1_Lockit@std@@QAE@XZ
0x100ba69c
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
0x100ba5d4
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UAE@XZ
0x100ba644
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
0x100ba618
??1?$basic_iostream@GU?$char_traits@G@std@@@std@@UAE@XZ
0x100ba684
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
0x100ba608
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
0x100ba5e0
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAE@XZ
0x100ba64c
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
0x100ba614
??Bid@locale@std@@QAEIXZ
0x100ba620
?always_noconv@codecvt_base@std@@QBE_NXZ
0x100ba61c
?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXH@Z
0x100ba634
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
0x100ba6b8
?id@?$codecvt@DDH@std@@2V0locale@2@A
0x100ba68c
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
0x100ba604
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEXABVlocale@2@@Z
0x100ba678
?in@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
0x100ba5cc
?out@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
0x100ba5d0
?pbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXH@Z
0x100ba638
?sbumpc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ
0x100ba630
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
0x100ba5fc
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEPAV12@PAG_J@Z
0x100ba670
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
0x100ba5dc
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEXH_N@Z
0x100ba648
?sgetc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ
0x100ba650
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
0x100ba5ec
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JXZ
0x100ba660
?snextc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ
0x100ba654
?swap@?$basic_istream@DU?$char_traits@D@std@@@std@@IAEXAAV12@@Z
0x100ba6a0
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
0x100ba600
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEHXZ
0x100ba674
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
0x100ba5f0
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEGXZ
0x100ba664
?unshift@?$codecvt@DDH@std@@QBEHAAHPAD1AAPAD@Z
0x100ba5b4
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
0x100ba5f4
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JPAG_J@Z
0x100ba668
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
0x100ba5f8
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JPBG_J@Z
0x100ba66c
msvcrt.dll
58
__CxxFrameHandler3
0x100ba79c
__dllonexit
0x100ba750
_amsg_exit
0x100ba768
_callnewh
0x100ba770
_CxxThrowException
0x100ba734
_errno
0x100ba704
_except_handler4_common
0x100ba744
_fseeki64
0x100ba6d0
_initterm
0x100ba760
_lock
0x100ba758
_onexit
0x100ba74c
_purecall
0x100ba790
_set_errno
0x100ba708
_unlock
0x100ba754
_vsnprintf_s
0x100ba780
_vsnwprintf
0x100ba798
_wcsicmp
0x100ba720
_wcsnicmp
0x100ba73c
_XcptFilter
0x100ba76c
??_V@YAXPAX@Z
0x100ba778
??0bad_cast@@QAE@ABV0@@Z
0x100ba6e8
??0bad_cast@@QAE@PBD@Z
0x100ba6ec
??0exception@@QAE@ABV0@@Z
0x100ba784
??0exception@@QAE@XZ
0x100ba788
??1bad_cast@@UAE@XZ
0x100ba6f0
??1exception@@UAE@XZ
0x100ba78c
??1type_info@@UAE@XZ
0x100ba748
??3@YAXPAX@Z
0x100ba7a0
?terminate@@YAXXZ
0x100ba75c
fclose
0x100ba6dc
fflush
0x100ba6e0
fgetc
0x100ba6d8
fgetpos
0x100ba6c0
fputc
0x100ba6e4
free
0x100ba764
fsetpos
0x100ba6cc
fwrite
0x100ba7a4
malloc
0x100ba774
memcmp
0x100ba730
memcpy
0x100ba72c
memcpy_s
0x100ba794
memmove
0x100ba728
memmove_s
0x100ba77c
memset
0x100ba740
realloc
0x100ba718
setvbuf
0x100ba6c4
sprintf_s
0x100ba724
strchr
0x100ba6fc
strncpy_s
0x100ba70c
strrchr
0x100ba6f8
strtol
0x100ba700
swprintf_s
0x100ba738
towlower
0x100ba6d4
ungetc
0x100ba6c8
wcschr
0x100ba6f4
wcsrchr
0x100ba71c
wcsstr
0x100ba714
wcstoul
0x100ba710
NtQueryWnfStateData
0x100ba7b8
RtlIpv4StringToAddressW
0x100ba7b0
RtlIpv6StringToAddressW
0x100ba7ac
RtlIsMultiSessionSku
0x100ba7c0
RtlIsMultiUsersInSessionSku
0x100ba7c4
RtlIsStateSeparationEnabled
0x100ba7cc
RtlPublishWnfStateData
0x100ba7c8
RtlSubscribeWnfStateChangeNotification
0x100ba7bc
RtlUnsubscribeWnfNotificationWaitForCompletion
0x100ba7b4
OLEAUT32.dll
12
SafeArrayCreate
0x100ba0a8
SafeArrayDestroy
0x100ba094
SafeArrayGetLBound
0x100ba0a0
SafeArrayGetUBound
0x100ba08c
SafeArrayLock
0x100ba0a4
SafeArrayUnlock
0x100ba090
SysAllocString
0x100ba0ac
SysAllocStringLen
0x100ba0b4
SysFreeString
0x100ba098
VariantChangeType
0x100ba09c
VariantClear
0x100ba0b0
VariantInit
0x100ba0b8
RPCRT4.dll
14
I_RpcBindingInqLocalClientPID
0x100ba0cc
IUnknown_AddRef_Proxy
0x100ba0c4
IUnknown_QueryInterface_Proxy
0x100ba0e4
IUnknown_Release_Proxy
0x100ba0d0
NdrDllCanUnloadNow
0x100ba0f0
NdrDllGetClassObject
0x100ba0ec
NdrOleAllocate
0x100ba0d4
NdrOleFree
0x100ba0c8
NdrStubCall2
0x100ba0c0
NdrStubForwardingFunction
0x100ba0e8
RpcStringFreeW
0x100ba0e0
UuidCreate
0x100ba0d8
UuidFromStringW
0x100ba0f4
UuidToStringW
0x100ba0dc
closesocket
0x100ba0fc
socket
0x100ba10c
WSACleanup
0x100ba100
WSAGetLastError
0x100ba108
WSAIoctl
0x100ba104
WSAStartup
0x100ba110
No function matches your filter.