FileTracker64.dll

Description: FileTracker

Authors: © Microsoft Corporation. All rights reserved.

Version: 17.0.36015.10

Architecture: 64-bit

Operating System: Windows

SHA256: 745845ddf45a2393976a23eecaeedc18

File Size: 307.5 KB

Uploaded At: Dec. 2, 2025, 2:44 p.m.

Views: 5

Security Warning

This file has been flagged as potentially dangerous.


Reason: Detected potentially dangerous functions used for process injection: WriteProcessMemory, OpenProcess, VirtualAllocEx

Exported Functions

  • (Ordinal: 1, Address: 0xf950)
  • StartTrackingContext (Ordinal: 2, Address: 0x9240)
  • StartTrackingContextWithRoot (Ordinal: 3, Address: 0x9350)
  • EndTrackingContext (Ordinal: 4, Address: 0x9470)
  • StopTrackingAndCleanup (Ordinal: 5, Address: 0x9500)
  • SuspendTracking (Ordinal: 6, Address: 0x9550)
  • ResumeTracking (Ordinal: 7, Address: 0x9590)
  • WriteAllTLogs (Ordinal: 8, Address: 0x95e0)
  • WriteContextTLogs (Ordinal: 9, Address: 0x96d0)
  • SetThreadCount (Ordinal: 10, Address: 0x9830)

Imported DLLs & Functions

KERNEL32.dll
  • CloseHandle (Address: 0x180034260)
  • CompareFileTime (Address: 0x1800342a0)
  • CopyFileA (Address: 0x180034060)
  • CopyFileExA (Address: 0x180034070)
  • CopyFileExW (Address: 0x180034078)
  • CopyFileW (Address: 0x180034068)
  • CreateDirectoryA (Address: 0x180034110)
  • CreateDirectoryW (Address: 0x180034108)
  • CreateEventW (Address: 0x180034258)
  • CreateFile2 (Address: 0x180034058)
  • CreateFileA (Address: 0x180034048)
  • CreateFileW (Address: 0x180034050)
  • CreateHardLinkA (Address: 0x1800340b0)
  • CreateHardLinkW (Address: 0x1800340b8)
  • CreateProcessA (Address: 0x1800340c0)
  • CreateProcessW (Address: 0x1800340c8)
  • CreateThread (Address: 0x1800340d0)
  • DeleteCriticalSection (Address: 0x180034238)
  • DeleteFileA (Address: 0x180034120)
  • DeleteFileW (Address: 0x180034118)
  • DeleteProcThreadAttributeList (Address: 0x180034420)
  • DisableThreadLibraryCalls (Address: 0x180034138)
  • EncodePointer (Address: 0x180034330)
  • EnterCriticalSection (Address: 0x180034038)
  • ExitProcess (Address: 0x180034130)
  • FindClose (Address: 0x180034390)
  • FindFirstFileExW (Address: 0x180034398)
  • FindFirstFileW (Address: 0x180034498)
  • FindNextFileW (Address: 0x1800343a0)
  • FindResourceExW (Address: 0x1800341b8)
  • FindResourceW (Address: 0x1800341b0)
  • FlushFileBuffers (Address: 0x180034360)
  • FlushInstructionCache (Address: 0x180034480)
  • FormatMessageW (Address: 0x1800344b0)
  • FreeEnvironmentStringsA (Address: 0x180034230)
  • FreeEnvironmentStringsW (Address: 0x180034218)
  • FreeLibrary (Address: 0x180034348)
  • GetACP (Address: 0x1800343b0)
  • GetCommandLineA (Address: 0x1800343c8)
  • GetCommandLineW (Address: 0x1800341f8)
  • GetConsoleCP (Address: 0x180034368)
  • GetConsoleMode (Address: 0x180034370)
  • GetConsoleOutputCP (Address: 0x1800344c0)
  • GetCPInfo (Address: 0x1800343c0)
  • GetCurrentProcess (Address: 0x1800342e0)
  • GetCurrentProcessId (Address: 0x180034148)
  • GetCurrentThread (Address: 0x180034190)
  • GetCurrentThreadId (Address: 0x1800341d0)
  • GetEnvironmentStrings (Address: 0x180034228)
  • GetEnvironmentStringsW (Address: 0x180034210)
  • GetEnvironmentVariableA (Address: 0x180034220)
  • GetEnvironmentVariableW (Address: 0x180034030)
  • GetExitCodeProcess (Address: 0x180034450)
  • GetFileAttributesA (Address: 0x1800340e0)
  • GetFileAttributesExA (Address: 0x1800340f0)
  • GetFileAttributesExW (Address: 0x1800340e8)
  • GetFileAttributesW (Address: 0x1800340d8)
  • GetFileType (Address: 0x180034160)
  • GetFinalPathNameByHandleW (Address: 0x180034170)
  • GetFullPathNameW (Address: 0x1800344a0)
  • GetLastError (Address: 0x180034158)
  • GetLocaleInfoW (Address: 0x180034380)
  • GetModuleFileNameA (Address: 0x180034208)
  • GetModuleFileNameW (Address: 0x180034188)
  • GetModuleHandleExW (Address: 0x180034358)
  • GetModuleHandleW (Address: 0x180034308)
  • GetOEMCP (Address: 0x1800343b8)
  • GetProcAddress (Address: 0x180034250)
  • GetProcessHeap (Address: 0x180034028)
  • GetProcessId (Address: 0x180034178)
  • GetStartupInfoW (Address: 0x180034300)
  • GetStdHandle (Address: 0x180034388)
  • GetStringTypeW (Address: 0x1800343d0)
  • GetSystemTimeAsFileTime (Address: 0x180034280)
  • GetThreadContext (Address: 0x180034478)
  • GetUserDefaultUILanguage (Address: 0x1800344b8)
  • HeapAlloc (Address: 0x180034020)
  • HeapDestroy (Address: 0x180034000)
  • HeapFree (Address: 0x180034018)
  • HeapReAlloc (Address: 0x180034010)
  • HeapSize (Address: 0x180034008)
  • InitializeCriticalSection (Address: 0x1800341f0)
  • InitializeCriticalSectionAndSpinCount (Address: 0x180034338)
  • InitializeCriticalSectionEx (Address: 0x1800342a8)
  • InitializeProcThreadAttributeList (Address: 0x180034408)
  • InitializeSListHead (Address: 0x1800342f0)
  • InterlockedFlushSList (Address: 0x180034318)
  • IsDebuggerPresent (Address: 0x1800342f8)
  • IsProcessorFeaturePresent (Address: 0x1800342e8)
  • IsValidCodePage (Address: 0x1800343a8)
  • IsWow64Process (Address: 0x180034440)
  • LCMapStringW (Address: 0x180034378)
  • LeaveCriticalSection (Address: 0x180034040)
  • LoadLibraryExW (Address: 0x180034350)
  • LoadLibraryW (Address: 0x180034180)
  • LoadResource (Address: 0x1800341a8)
  • LocalFree (Address: 0x1800344a8)
  • LockResource (Address: 0x1800341a0)
  • MoveFileA (Address: 0x180034090)
  • MoveFileExA (Address: 0x180034080)
  • MoveFileExW (Address: 0x180034088)
  • MoveFileW (Address: 0x180034098)
  • MultiByteToWideChar (Address: 0x180034240)
  • OpenProcess (Address: 0x180034410)
  • OutputDebugStringA (Address: 0x180034400)
  • OutputDebugStringW (Address: 0x1800343f0)
  • QueryPerformanceCounter (Address: 0x1800341d8)
  • QueryPerformanceFrequency (Address: 0x1800341e0)
  • RaiseException (Address: 0x180034328)
  • ReadConsoleW (Address: 0x1800342b0)
  • ReadFile (Address: 0x180034290)
  • ReadProcessMemory (Address: 0x180034438)
  • RemoveDirectoryA (Address: 0x180034100)
  • RemoveDirectoryW (Address: 0x1800340f8)
  • ReplaceFileW (Address: 0x1800340a8)
  • ResetEvent (Address: 0x180034270)
  • ResumeThread (Address: 0x180034150)
  • RtlCaptureContext (Address: 0x1800342b8)
  • RtlLookupFunctionEntry (Address: 0x1800342c0)
  • RtlPcToFileHeader (Address: 0x180034320)
  • RtlUnwindEx (Address: 0x180034310)
  • RtlVirtualUnwind (Address: 0x1800342c8)
  • SetDllDirectoryW (Address: 0x180034200)
  • SetEndOfFile (Address: 0x1800344c8)
  • SetEnvironmentVariableW (Address: 0x180034140)
  • SetEvent (Address: 0x180034278)
  • SetFileInformationByHandle (Address: 0x1800340a0)
  • SetFilePointer (Address: 0x180034298)
  • SetFilePointerEx (Address: 0x1800343e0)
  • SetLastError (Address: 0x180034168)
  • SetStdHandle (Address: 0x1800343d8)
  • SetThreadContext (Address: 0x180034488)
  • SetUnhandledExceptionFilter (Address: 0x1800342d8)
  • SizeofResource (Address: 0x180034198)
  • SuspendThread (Address: 0x180034470)
  • TerminateProcess (Address: 0x180034128)
  • TlsAlloc (Address: 0x1800341e8)
  • TlsFree (Address: 0x180034340)
  • TlsGetValue (Address: 0x1800341c0)
  • TlsSetValue (Address: 0x1800341c8)
  • UnhandledExceptionFilter (Address: 0x1800342d0)
  • UpdateProcThreadAttribute (Address: 0x180034418)
  • VirtualAlloc (Address: 0x180034468)
  • VirtualAllocEx (Address: 0x180034430)
  • VirtualFree (Address: 0x180034460)
  • VirtualProtect (Address: 0x180034458)
  • VirtualProtectEx (Address: 0x180034428)
  • VirtualQuery (Address: 0x180034490)
  • VirtualQueryEx (Address: 0x180034448)
  • WaitForSingleObject (Address: 0x180034268)
  • WideCharToMultiByte (Address: 0x180034248)
  • WriteConsoleW (Address: 0x1800343e8)
  • WriteFile (Address: 0x180034288)
  • WriteProcessMemory (Address: 0x1800343f8)