keymgr.dll

Description: Stored User Names and Passwords

Version: 10.0.19041.3636

Architecture: 64-bit

Operating System: Windows NT

SHA256: 6c0fca174fbf27013053111a16b9e2f2

File Size: 58.5 KB

Uploaded At: Dec. 1, 2025, 7:31 a.m.

Views: 4

Exported Functions

CPlApplet (Ordinal: 1, Address: 0x2c80)
DllCanUnloadNow (Ordinal: 2, Address: 0x1b30)
DllGetClassObject (Ordinal: 3, Address: 0x1b50)
DllMain (Ordinal: 4, Address: 0x2d40)
KRShowKeyMgr (Ordinal: 5, Address: 0x2dc0)
PRShowRestoreFromMsginaW (Ordinal: 6, Address: 0x7ee0)
PRShowRestoreWizardExW (Ordinal: 7, Address: 0x7ee0)
PRShowRestoreWizardW (Ordinal: 8, Address: 0x7ab0)
PRShowSaveFromMsginaW (Ordinal: 9, Address: 0x7e90)
PRShowSaveWizardExW (Ordinal: 10, Address: 0x7e00)

Imported DLLs & Functions

ADVAPI32.dll

CredRenameW (Address: 0x18000b668)
CryptAcquireContextW (Address: 0x18000b6a0)
CryptDestroyKey (Address: 0x18000b6a8)
CryptExportKey (Address: 0x18000b698)
CryptGenKey (Address: 0x18000b688)
CryptReleaseContext (Address: 0x18000b648)
GetLengthSid (Address: 0x18000b690)
GetUserNameW (Address: 0x18000b670)
LogonUserW (Address: 0x18000b678)
LookupAccountNameW (Address: 0x18000b680)
LsaClose (Address: 0x18000b650)
LsaFreeMemory (Address: 0x18000b658)
LsaOpenPolicy (Address: 0x18000b6b0)
LsaQueryInformationPolicy (Address: 0x18000b660)

api-ms-win-core-com-l1-1-0.dll

CoCreateInstance (Address: 0x18000b900)

api-ms-win-core-debug-l1-1-0.dll

OutputDebugStringW (Address: 0x18000b910)

api-ms-win-core-delayload-l1-1-0.dll

DelayLoadFailureHook (Address: 0x18000b920)

api-ms-win-core-delayload-l1-1-1.dll

ResolveDelayLoadedAPI (Address: 0x18000b930)

api-ms-win-core-errorhandling-l1-1-0.dll

GetLastError (Address: 0x18000b960)
SetErrorMode (Address: 0x18000b958)
SetLastError (Address: 0x18000b950)
SetUnhandledExceptionFilter (Address: 0x18000b940)
UnhandledExceptionFilter (Address: 0x18000b948)

api-ms-win-core-file-l1-1-0.dll

CreateFileW (Address: 0x18000b9b8)
DeleteFileW (Address: 0x18000b978)
GetDiskFreeSpaceW (Address: 0x18000b990)
GetDriveTypeW (Address: 0x18000b998)
GetFileAttributesExW (Address: 0x18000b9a0)
GetLogicalDriveStringsW (Address: 0x18000b970)
ReadFile (Address: 0x18000b988)
SetFileAttributesW (Address: 0x18000b9b0)
SetFilePointer (Address: 0x18000b9a8)
WriteFile (Address: 0x18000b980)

api-ms-win-core-handle-l1-1-0.dll

CloseHandle (Address: 0x18000b9c8)

api-ms-win-core-heap-l2-1-0.dll

LocalAlloc (Address: 0x18000b9d8)
LocalFree (Address: 0x18000b9e0)

api-ms-win-core-io-l1-1-0.dll

DeviceIoControl (Address: 0x18000b9f0)

api-ms-win-core-libraryloader-l1-2-0.dll

DisableThreadLibraryCalls (Address: 0x18000ba00)
GetModuleFileNameW (Address: 0x18000ba08)
GetModuleHandleW (Address: 0x18000ba20)
GetProcAddress (Address: 0x18000ba28)
LoadLibraryExW (Address: 0x18000ba10)
LoadStringW (Address: 0x18000ba18)

api-ms-win-core-memory-l1-1-0.dll

VirtualAlloc (Address: 0x18000ba40)
VirtualFree (Address: 0x18000ba38)

api-ms-win-core-processthreads-l1-1-0.dll

CreateProcessW (Address: 0x18000ba68)
CreateThread (Address: 0x18000ba78)
GetCurrentProcess (Address: 0x18000ba50)
GetCurrentProcessId (Address: 0x18000ba60)
GetCurrentThreadId (Address: 0x18000ba58)
TerminateProcess (Address: 0x18000ba70)

api-ms-win-core-profile-l1-1-0.dll

QueryPerformanceCounter (Address: 0x18000ba88)

api-ms-win-core-registry-l1-1-0.dll

RegCloseKey (Address: 0x18000bab8)
RegOpenKeyExA (Address: 0x18000baa0)
RegOpenKeyExW (Address: 0x18000ba98)
RegQueryValueExA (Address: 0x18000baa8)
RegQueryValueExW (Address: 0x18000bab0)

api-ms-win-core-rtlsupport-l1-1-0.dll

RtlCaptureContext (Address: 0x18000bad0)
RtlLookupFunctionEntry (Address: 0x18000bad8)
RtlVirtualUnwind (Address: 0x18000bac8)

api-ms-win-core-synch-l1-1-0.dll

CreateMutexW (Address: 0x18000baf0)
WaitForSingleObject (Address: 0x18000bae8)

api-ms-win-core-synch-l1-2-0.dll

Sleep (Address: 0x18000bb00)

api-ms-win-core-sysinfo-l1-1-0.dll

GetComputerNameExW (Address: 0x18000bb18)
GetSystemDirectoryW (Address: 0x18000bb10)
GetSystemTimeAsFileTime (Address: 0x18000bb20)
GetTickCount (Address: 0x18000bb28)
GetVersionExW (Address: 0x18000bb30)

api-ms-win-security-credentials-l1-1-0.dll

CredDeleteW (Address: 0x18000bb58)
CredEnumerateW (Address: 0x18000bb48)
CredFree (Address: 0x18000bb70)
CredGetSessionTypes (Address: 0x18000bb40)
CredIsMarshaledCredentialW (Address: 0x18000bb60)
CredReadW (Address: 0x18000bb50)
CredWriteW (Address: 0x18000bb68)

CRYPT32.dll

CertCreateCertificateContext (Address: 0x18000b6c0)
CertFreeCertificateContext (Address: 0x18000b6d0)
CryptEncodeObject (Address: 0x18000b6e0)
CryptExportPublicKeyInfo (Address: 0x18000b6c8)
CryptSignAndEncodeCertificate (Address: 0x18000b6d8)

GDI32.dll

CreateFontIndirectW (Address: 0x18000b700)
DeleteObject (Address: 0x18000b6f0)
GetDeviceCaps (Address: 0x18000b6f8)

KERNEL32.dll

ActivateActCtx (Address: 0x18000b740)
CreateActCtxW (Address: 0x18000b720)
DeactivateActCtx (Address: 0x18000b738)
ExpandEnvironmentStringsA (Address: 0x18000b710)
GetComputerNameW (Address: 0x18000b730)
LoadLibraryExA (Address: 0x18000b728)
ReleaseActCtx (Address: 0x18000b718)

msvcrt.dll

__C_specific_handler (Address: 0x18000bba0)
_amsg_exit (Address: 0x18000bb98)
_callnewh (Address: 0x18000bb80)
_initterm (Address: 0x18000bb88)
_vsnwprintf (Address: 0x18000bbc0)
_waccess (Address: 0x18000bbe0)
_wcsicmp (Address: 0x18000bbe8)
_wcsnicmp (Address: 0x18000bbc8)
_XcptFilter (Address: 0x18000bb90)
free (Address: 0x18000bbd0)
malloc (Address: 0x18000bbb8)
memcpy (Address: 0x18000bbb0)
memset (Address: 0x18000bbf8)
wcschr (Address: 0x18000bbd8)
wcsncmp (Address: 0x18000bbf0)
wcstol (Address: 0x18000bba8)

netutils.dll

NetApiBufferAllocate (Address: 0x18000bc10)
NetApiBufferFree (Address: 0x18000bc08)

ntdll.dll

NtClose (Address: 0x18000bc30)
NtOpenFile (Address: 0x18000bc38)
NtOpenSymbolicLinkObject (Address: 0x18000bc50)
NtQuerySymbolicLinkObject (Address: 0x18000bc40)
NtQueryVolumeInformationFile (Address: 0x18000bc20)
RtlInitUnicodeString (Address: 0x18000bc68)
WinSqmAddToStream (Address: 0x18000bc48)
WinSqmEndSession (Address: 0x18000bc60)
WinSqmIsOptedIn (Address: 0x18000bc28)
WinSqmSetString (Address: 0x18000bc58)
WinSqmStartSession (Address: 0x18000bc70)

ole32.dll

OleInitialize (Address: 0x18000bc88)
OleUninitialize (Address: 0x18000bc80)

RPCRT4.dll

NdrClientCall3 (Address: 0x18000b760)
RpcBindingFree (Address: 0x18000b750)
RpcBindingFromStringBindingW (Address: 0x18000b780)
RpcEpResolveBinding (Address: 0x18000b770)
RpcStringBindingComposeW (Address: 0x18000b778)
RpcStringFreeW (Address: 0x18000b768)
UuidCreate (Address: 0x18000b758)

SHELL32.dll

ShellExecuteW (Address: 0x18000b798)
SHFormatDrive (Address: 0x18000b790)
SHGetFileInfoW (Address: 0x18000b7a0)

SHLWAPI.dll

(Address: 0x18000b7d8)
PathAppendW (Address: 0x18000b7c8)
PathGetDriveNumberW (Address: 0x18000b7b8)
UrlCanonicalizeW (Address: 0x18000b7d0)
UrlGetPartW (Address: 0x18000b7c0)
UrlIsW (Address: 0x18000b7b0)

USER32.dll

CallWindowProcW (Address: 0x18000b858)
CreateWindowExW (Address: 0x18000b7e8)
DialogBoxParamW (Address: 0x18000b8f0)
EnableWindow (Address: 0x18000b8c8)
EndDialog (Address: 0x18000b8a0)
FindWindowW (Address: 0x18000b818)
GetActiveWindow (Address: 0x18000b7f8)
GetClientRect (Address: 0x18000b888)
GetDC (Address: 0x18000b7f0)
GetDlgItem (Address: 0x18000b8c0)
GetForegroundWindow (Address: 0x18000b808)
GetParent (Address: 0x18000b848)
GetPropW (Address: 0x18000b8d0)
GetWindowRect (Address: 0x18000b890)
IsDlgButtonChecked (Address: 0x18000b8b0)
IsWindow (Address: 0x18000b8d8)
KillTimer (Address: 0x18000b838)
LoadCursorW (Address: 0x18000b820)
LoadIconW (Address: 0x18000b880)
MessageBoxW (Address: 0x18000b8e8)
MoveWindow (Address: 0x18000b810)
PostMessageW (Address: 0x18000b860)
ReleaseDC (Address: 0x18000b850)
SendDlgItemMessageW (Address: 0x18000b878)
SendMessageW (Address: 0x18000b898)
SetCursor (Address: 0x18000b828)
SetFocus (Address: 0x18000b8b8)
SetPropW (Address: 0x18000b8e0)
SetTimer (Address: 0x18000b800)
SetWindowLongPtrW (Address: 0x18000b870)
SetWindowLongW (Address: 0x18000b830)
SetWindowPos (Address: 0x18000b868)
ShowWindow (Address: 0x18000b8a8)
SystemParametersInfoW (Address: 0x18000b840)