ExecModelClient.dll

Description: ExecModelClient

Version: 10.0.19041.5794

Architecture: 64-bit

Operating System: Windows NT

SHA256: 77613879b25f1abd108865aecbaa3a73

File Size: 376.9 KB

Uploaded At: Dec. 1, 2025, 7:27 a.m.

Views: 8

Security Warning

This file has been flagged as potentially dangerous.

Reason: Detected potentially dangerous functions used for process injection: OpenProcess

Exported Functions

CreateForegroundTaskManager (Ordinal: 1, Address: 0xd620)
TestHook_CancelShutdown (Ordinal: 2, Address: 0x1f930)
CreateModernVoipPolicy (Ordinal: 3, Address: 0x38450)
DllCanUnloadNow (Ordinal: 4, Address: 0xb630)
DllGetActivationFactory (Ordinal: 5, Address: 0xb4e0)
DllGetClassObject (Ordinal: 6, Address: 0xa7b0)

Imported DLLs & Functions

api-ms-win-core-apiquery-l1-1-0.dll

ApiSetQueryApiSetPresence (Address: 0x1800445b0)

api-ms-win-core-com-l1-1-0.dll

CLSIDFromString (Address: 0x180044640)
CoCreateFreeThreadedMarshaler (Address: 0x1800445c0)
CoCreateGuid (Address: 0x180044648)
CoCreateInstance (Address: 0x1800445f0)
CoGetApartmentType (Address: 0x1800445d0)
CoGetCallContext (Address: 0x180044608)
CoGetCallerTID (Address: 0x180044618)
CoGetClassObject (Address: 0x180044610)
CoInitializeEx (Address: 0x180044638)
CoMarshalInterface (Address: 0x180044620)
CoReleaseMarshalData (Address: 0x180044630)
CoTaskMemAlloc (Address: 0x1800445d8)
CoTaskMemFree (Address: 0x180044600)
CoTaskMemRealloc (Address: 0x1800445e0)
CoUninitialize (Address: 0x1800445f8)
CoWaitForMultipleHandles (Address: 0x1800445c8)
CreateStreamOnHGlobal (Address: 0x180044628)
StringFromGUID2 (Address: 0x1800445e8)

api-ms-win-core-com-l1-1-1.dll

RoGetAgileReference (Address: 0x180044658)

api-ms-win-core-debug-l1-1-0.dll

DebugBreak (Address: 0x180044668)
IsDebuggerPresent (Address: 0x180044678)
OutputDebugStringW (Address: 0x180044670)

api-ms-win-core-delayload-l1-1-0.dll

DelayLoadFailureHook (Address: 0x180044688)

api-ms-win-core-delayload-l1-1-1.dll

ResolveDelayLoadedAPI (Address: 0x180044698)

api-ms-win-core-errorhandling-l1-1-0.dll

GetLastError (Address: 0x1800446a8)
RaiseException (Address: 0x1800446b0)
SetLastError (Address: 0x1800446c0)
SetUnhandledExceptionFilter (Address: 0x1800446c8)
UnhandledExceptionFilter (Address: 0x1800446b8)

api-ms-win-core-handle-l1-1-0.dll

CloseHandle (Address: 0x1800446d8)

api-ms-win-core-heap-l1-1-0.dll

GetProcessHeap (Address: 0x1800446f8)
HeapAlloc (Address: 0x1800446f0)
HeapFree (Address: 0x1800446e8)

api-ms-win-core-heap-l2-1-0.dll

LocalAlloc (Address: 0x180044718)
LocalFree (Address: 0x180044708)
LocalReAlloc (Address: 0x180044710)

api-ms-win-core-interlocked-l1-1-0.dll

InitializeSListHead (Address: 0x180044728)

api-ms-win-core-libraryloader-l1-2-0.dll

DisableThreadLibraryCalls (Address: 0x180044750)
FindResourceExW (Address: 0x180044740)
GetModuleFileNameA (Address: 0x180044748)
GetModuleHandleExW (Address: 0x180044770)
GetModuleHandleW (Address: 0x180044760)
GetProcAddress (Address: 0x180044758)
LoadLibraryExW (Address: 0x180044768)
LoadResource (Address: 0x180044738)
LockResource (Address: 0x180044778)

api-ms-win-core-localization-l1-2-0.dll

FormatMessageW (Address: 0x180044788)

api-ms-win-core-processthreads-l1-1-0.dll

CreateThread (Address: 0x1800447a0)
GetCurrentProcess (Address: 0x1800447c8)
GetCurrentProcessId (Address: 0x1800447a8)
GetCurrentThreadId (Address: 0x1800447c0)
GetProcessId (Address: 0x1800447b8)
GetThreadId (Address: 0x180044798)
OpenProcessToken (Address: 0x1800447b0)
TerminateProcess (Address: 0x1800447d0)

api-ms-win-core-processthreads-l1-1-1.dll

IsProcessorFeaturePresent (Address: 0x1800447e0)
OpenProcess (Address: 0x1800447e8)

api-ms-win-core-profile-l1-1-0.dll

QueryPerformanceCounter (Address: 0x1800447f8)

api-ms-win-core-psapi-l1-1-0.dll

K32GetProcessImageFileNameW (Address: 0x180044808)

api-ms-win-core-psm-key-l1-1-0.dll

PsmGetKeyFromProcess (Address: 0x180044818)

api-ms-win-core-quirks-l1-1-0.dll

QuirkIsEnabledForPackage (Address: 0x180044828)

api-ms-win-core-registry-l1-1-0.dll

RegGetValueW (Address: 0x180044838)

api-ms-win-core-rtlsupport-l1-1-0.dll

RtlCaptureContext (Address: 0x180044858)
RtlLookupFunctionEntry (Address: 0x180044848)
RtlVirtualUnwind (Address: 0x180044850)

api-ms-win-core-string-l1-1-0.dll

CompareStringOrdinal (Address: 0x180044868)

api-ms-win-core-synch-l1-1-0.dll

AcquireSRWLockExclusive (Address: 0x1800448d8)
AcquireSRWLockShared (Address: 0x1800448c8)
CreateEventExW (Address: 0x1800448b8)
CreateEventW (Address: 0x1800448c0)
CreateMutexExW (Address: 0x1800448e8)
CreateSemaphoreExW (Address: 0x180044918)
DeleteCriticalSection (Address: 0x1800448a0)
EnterCriticalSection (Address: 0x180044888)
InitializeCriticalSection (Address: 0x180044898)
InitializeCriticalSectionAndSpinCount (Address: 0x180044920)
InitializeCriticalSectionEx (Address: 0x1800448a8)
InitializeSRWLock (Address: 0x180044890)
LeaveCriticalSection (Address: 0x180044880)
OpenSemaphoreW (Address: 0x1800448f0)
ReleaseMutex (Address: 0x180044900)
ReleaseSemaphore (Address: 0x180044910)
ReleaseSRWLockExclusive (Address: 0x1800448e0)
ReleaseSRWLockShared (Address: 0x1800448d0)
ResetEvent (Address: 0x180044928)
SetEvent (Address: 0x180044878)
WaitForMultipleObjectsEx (Address: 0x1800448b0)
WaitForSingleObject (Address: 0x180044908)
WaitForSingleObjectEx (Address: 0x1800448f8)

api-ms-win-core-synch-l1-2-0.dll

InitializeConditionVariable (Address: 0x180044940)
InitOnceBeginInitialize (Address: 0x180044968)
InitOnceComplete (Address: 0x180044950)
InitOnceExecuteOnce (Address: 0x180044958)
InitOnceInitialize (Address: 0x180044960)
Sleep (Address: 0x180044948)
WakeConditionVariable (Address: 0x180044938)

api-ms-win-core-sysinfo-l1-1-0.dll

GetSystemTimeAsFileTime (Address: 0x180044980)
GetTickCount (Address: 0x180044978)

api-ms-win-core-threadpool-l1-2-0.dll

CloseThreadpoolTimer (Address: 0x180044990)
CreateThreadpoolTimer (Address: 0x1800449a8)
SetThreadpoolTimer (Address: 0x1800449a0)
WaitForThreadpoolTimerCallbacks (Address: 0x180044998)

api-ms-win-core-util-l1-1-0.dll

DecodePointer (Address: 0x1800449b8)
EncodePointer (Address: 0x1800449c0)

api-ms-win-core-winrt-error-l1-1-0.dll

GetRestrictedErrorInfo (Address: 0x1800449d8)
RoOriginateError (Address: 0x1800449f0)
RoOriginateErrorW (Address: 0x1800449d0)
RoTransformError (Address: 0x1800449e8)
SetRestrictedErrorInfo (Address: 0x1800449e0)

api-ms-win-core-winrt-error-l1-1-1.dll

IsErrorPropagationEnabled (Address: 0x180044a08)
RoGetMatchingRestrictedErrorInfo (Address: 0x180044a10)
RoReportFailedDelegate (Address: 0x180044a00)

api-ms-win-core-winrt-l1-1-0.dll

RoActivateInstance (Address: 0x180044a28)
RoGetActivationFactory (Address: 0x180044a20)

api-ms-win-core-winrt-string-l1-1-0.dll

WindowsConcatString (Address: 0x180044a78)
WindowsCreateString (Address: 0x180044a40)
WindowsCreateStringReference (Address: 0x180044a60)
WindowsDeleteString (Address: 0x180044a68)
WindowsDuplicateString (Address: 0x180044a58)
WindowsGetStringLen (Address: 0x180044a70)
WindowsGetStringRawBuffer (Address: 0x180044a38)
WindowsIsStringEmpty (Address: 0x180044a50)
WindowsStringHasEmbeddedNull (Address: 0x180044a48)

api-ms-win-crt-private-l1-1-0.dll

__C_specific_handler (Address: 0x180044b10)
__CxxFrameHandler3 (Address: 0x180044b18)
__CxxFrameHandler4 (Address: 0x180044b80)
__std_terminate (Address: 0x180044b78)
_CxxThrowException (Address: 0x180044b20)
_o___std_exception_copy (Address: 0x180044b70)
_o___std_exception_destroy (Address: 0x180044b68)
_o___std_type_info_destroy_list (Address: 0x180044b60)
_o___stdio_common_vsnprintf_s (Address: 0x180044b58)
_o___stdio_common_vswprintf (Address: 0x180044b48)
_o__callnewh (Address: 0x180044b28)
_o__cexit (Address: 0x180044ac0)
_o__configure_narrow_argv (Address: 0x180044b40)
_o__crt_atexit (Address: 0x180044b30)
_o__errno (Address: 0x180044b50)
_o__execute_onexit_table (Address: 0x180044b38)
_o__initialize_narrow_environment (Address: 0x180044a88)
_o__initialize_onexit_table (Address: 0x180044a90)
_o__invalid_parameter_noinfo (Address: 0x180044a98)
_o__invalid_parameter_noinfo_noreturn (Address: 0x180044aa0)
_o__purecall (Address: 0x180044aa8)
_o__register_onexit_function (Address: 0x180044ab0)
_o__seh_filter_dll (Address: 0x180044ab8)
_o__ui64tow_s (Address: 0x180044ac8)
_o_free (Address: 0x180044ad8)
_o_malloc (Address: 0x180044ae0)
_o_realloc (Address: 0x180044ae8)
_o_terminate (Address: 0x180044af0)
_o_toupper (Address: 0x180044af8)
_o_wcscpy_s (Address: 0x180044b00)
_o_wcstok_s (Address: 0x180044b08)
memcmp (Address: 0x180044b88)
memcpy (Address: 0x180044b90)
memmove (Address: 0x180044ad0)

api-ms-win-crt-runtime-l1-1-0.dll

_initterm (Address: 0x180044ba8)
_initterm_e (Address: 0x180044ba0)

api-ms-win-crt-string-l1-1-0.dll

memset (Address: 0x180044bb8)

api-ms-win-eventing-provider-l1-1-0.dll

EventActivityIdControl (Address: 0x180044be8)
EventProviderEnabled (Address: 0x180044bf0)
EventRegister (Address: 0x180044bd0)
EventSetInformation (Address: 0x180044bd8)
EventUnregister (Address: 0x180044bc8)
EventWriteTransfer (Address: 0x180044be0)

api-ms-win-security-accesshlpr-l1-1-0.dll

BuildSecurityDescriptorForSharingAccess (Address: 0x180044c00)
FreeTransientObjectSecurityDescriptor (Address: 0x180044c08)
QueryTransientObjectSecurityDescriptor (Address: 0x180044c10)

api-ms-win-security-base-l1-1-0.dll

CopySid (Address: 0x180044c20)
EqualSid (Address: 0x180044c30)
GetLengthSid (Address: 0x180044c28)
GetTokenInformation (Address: 0x180044c38)

api-ms-win-security-sddl-l1-1-0.dll

ConvertSidToStringSidW (Address: 0x180044c58)
ConvertStringSecurityDescriptorToSecurityDescriptorW (Address: 0x180044c50)
ConvertStringSidToSidW (Address: 0x180044c48)

api-ms-win-service-management-l1-1-0.dll

CloseServiceHandle (Address: 0x180044c70)
OpenSCManagerW (Address: 0x180044c68)
OpenServiceW (Address: 0x180044c78)

api-ms-win-service-private-l1-1-0.dll

SubscribeServiceChangeNotifications (Address: 0x180044c88)
UnsubscribeServiceChangeNotifications (Address: 0x180044c90)

api-ms-win-service-winsvc-l1-1-0.dll

QueryServiceStatus (Address: 0x180044ca0)

api-ms-win-shcore-taskpool-l1-1-0.dll

SHTaskPoolAllowThreadReuse (Address: 0x180044cb0)
SHTaskPoolQueueTask (Address: 0x180044cb8)

CoreMessaging.dll

CoreUICreate (Address: 0x180044540)

msvcp_win.dll

?_Xlength_error@std@@YAXPEBD@Z (Address: 0x180044cc8)
?_Xout_of_range@std@@YAXPEBD@Z (Address: 0x180044cd0)

ntdll.dll

NtQueryInformationToken (Address: 0x180044d28)
NtQuerySystemInformation (Address: 0x180044ce8)
RtlAcquireSRWLockExclusive (Address: 0x180044d58)
RtlAcquireSRWLockShared (Address: 0x180044d00)
RtlAllocateHeap (Address: 0x180044cf8)
RtlCopySid (Address: 0x180044d30)
RtlDeriveCapabilitySidsFromName (Address: 0x180044d20)
RtlFreeHeap (Address: 0x180044d38)
RtlGetDeviceFamilyInfoEnum (Address: 0x180044ce0)
RtlInitializeSRWLock (Address: 0x180044cf0)
RtlQueryUnbiasedInterruptTime (Address: 0x180044d40)
RtlReleaseSRWLockExclusive (Address: 0x180044d18)
RtlReleaseSRWLockShared (Address: 0x180044d48)
RtlRunOnceBeginInitialize (Address: 0x180044d08)
RtlRunOnceExecuteOnce (Address: 0x180044d10)
RtlSleepConditionVariableSRW (Address: 0x180044d60)
RtlValidSid (Address: 0x180044d50)

PROPSYS.dll

(Address: 0x180044550)

RPCRT4.dll

I_RpcExceptionFilter (Address: 0x1800445a0)
I_RpcMapWin32Status (Address: 0x180044568)
NdrClientCall3 (Address: 0x180044590)
RpcBindingBind (Address: 0x180044578)
RpcBindingCreateW (Address: 0x180044580)
RpcBindingFree (Address: 0x180044588)
RpcBindingFromStringBindingW (Address: 0x180044570)
RpcStringBindingComposeW (Address: 0x180044598)
RpcStringFreeW (Address: 0x180044560)