mfdetours.dll

Description: Media Foundation Detours Tracing DLL

Version: 1.1.0.1

Architecture: Unknown (0xaa64)

Operating System: Windows

SHA256: 503f34e8787adc46bda9b98c489cbaf3

File Size: 685.5 KB

Uploaded At: Dec. 3, 2025, 2:36 a.m.

Views: 6

Security Warning

This file has been flagged as potentially dangerous.

Reason: Detected potentially dangerous functions used for process injection: WriteProcessMemory, VirtualAllocEx

Exported Functions

Shutdown (Ordinal: 1, Address: 0x6e30)
Startup (Ordinal: 2, Address: 0x70a0)
DllGetMFDebugHlp (Ordinal: 3, Address: 0x9840)

Imported DLLs & Functions

api-ms-win-core-com-l1-1-0.dll

CoTaskMemAlloc (Address: 0x18004b050)
CoTaskMemFree (Address: 0x18004b048)
PropVariantClear (Address: 0x18004b040)
StringFromGUID2 (Address: 0x18004b058)

api-ms-win-core-debug-l1-1-0.dll

DebugBreak (Address: 0x18004b068)

api-ms-win-core-errorhandling-l1-1-0.dll

GetLastError (Address: 0x18004b080)
RaiseException (Address: 0x18004b078)
SetLastError (Address: 0x18004b088)

api-ms-win-core-handle-l1-1-0.dll

CloseHandle (Address: 0x18004b098)

api-ms-win-core-heap-l1-1-0.dll

GetProcessHeap (Address: 0x18004b0c0)
HeapAlloc (Address: 0x18004b0c8)
HeapDestroy (Address: 0x18004b0a8)
HeapFree (Address: 0x18004b0b8)
HeapReAlloc (Address: 0x18004b0d0)
HeapSize (Address: 0x18004b0b0)

api-ms-win-core-interlocked-l1-1-0.dll

InitializeSListHead (Address: 0x18004b0e0)

api-ms-win-core-libraryloader-l1-2-0.dll

DisableThreadLibraryCalls (Address: 0x18004b100)
FindResourceExW (Address: 0x18004b0f8)
FreeLibrary (Address: 0x18004b128)
GetModuleFileNameA (Address: 0x18004b0f0)
GetModuleHandleExW (Address: 0x18004b108)
GetModuleHandleW (Address: 0x18004b120)
GetProcAddress (Address: 0x18004b110)
LoadResource (Address: 0x18004b130)
LockResource (Address: 0x18004b138)
SizeofResource (Address: 0x18004b118)

api-ms-win-core-libraryloader-l1-2-1.dll

LoadLibraryA (Address: 0x18004b148)

api-ms-win-core-memory-l1-1-0.dll

ReadProcessMemory (Address: 0x18004b190)
VirtualAlloc (Address: 0x18004b198)
VirtualAllocEx (Address: 0x18004b188)
VirtualFree (Address: 0x18004b160)
VirtualProtect (Address: 0x18004b178)
VirtualProtectEx (Address: 0x18004b180)
VirtualQuery (Address: 0x18004b168)
VirtualQueryEx (Address: 0x18004b170)
WriteProcessMemory (Address: 0x18004b158)

api-ms-win-core-processenvironment-l1-1-0.dll

GetEnvironmentVariableA (Address: 0x18004b1b0)
GetEnvironmentVariableW (Address: 0x18004b1b8)
SetEnvironmentVariableW (Address: 0x18004b1a8)

api-ms-win-core-processthreads-l1-1-0.dll

CreateProcessA (Address: 0x18004b1c8)
CreateProcessW (Address: 0x18004b1f8)
GetCurrentProcess (Address: 0x18004b1e8)
GetCurrentProcessId (Address: 0x18004b1e0)
GetCurrentThreadId (Address: 0x18004b1d0)
ResumeThread (Address: 0x18004b1d8)
TerminateProcess (Address: 0x18004b1f0)

api-ms-win-core-processthreads-l1-1-1.dll

FlushInstructionCache (Address: 0x18004b208)
GetThreadContext (Address: 0x18004b210)
SetThreadContext (Address: 0x18004b218)

api-ms-win-core-profile-l1-1-0.dll

QueryPerformanceCounter (Address: 0x18004b228)

api-ms-win-core-registry-l1-1-0.dll

RegGetValueA (Address: 0x18004b240)
RegGetValueW (Address: 0x18004b238)

api-ms-win-core-string-l1-1-0.dll

MultiByteToWideChar (Address: 0x18004b250)
WideCharToMultiByte (Address: 0x18004b258)

api-ms-win-core-synch-l1-1-0.dll

AcquireSRWLockExclusive (Address: 0x18004b290)
AcquireSRWLockShared (Address: 0x18004b2a8)
DeleteCriticalSection (Address: 0x18004b280)
EnterCriticalSection (Address: 0x18004b278)
InitializeCriticalSection (Address: 0x18004b288)
InitializeSRWLock (Address: 0x18004b2a0)
LeaveCriticalSection (Address: 0x18004b270)
ReleaseSRWLockExclusive (Address: 0x18004b298)
ReleaseSRWLockShared (Address: 0x18004b268)

api-ms-win-core-sysinfo-l1-1-0.dll

GetSystemTimeAsFileTime (Address: 0x18004b2b8)

api-ms-win-crt-private-l1-1-0.dll

__C_specific_handler (Address: 0x18004b348)
__CxxFrameHandler3 (Address: 0x18004b3a0)
_o___std_type_info_destroy_list (Address: 0x18004b380)
_o___stdio_common_vsprintf (Address: 0x18004b370)
_o___stdio_common_vsprintf_s (Address: 0x18004b368)
_o___stdio_common_vswprintf (Address: 0x18004b360)
_o___stdio_common_vswprintf_s (Address: 0x18004b358)
_o__callnewh (Address: 0x18004b388)
_o__cexit (Address: 0x18004b378)
_o__configure_narrow_argv (Address: 0x18004b350)
_o__crt_atexit (Address: 0x18004b390)
_o__errno (Address: 0x18004b2c8)
_o__execute_onexit_table (Address: 0x18004b2d0)
_o__gcvt_s (Address: 0x18004b2d8)
_o__initialize_narrow_environment (Address: 0x18004b2e0)
_o__initialize_onexit_table (Address: 0x18004b2e8)
_o__invalid_parameter_noinfo (Address: 0x18004b2f0)
_o__mbsinc (Address: 0x18004b2f8)
_o__recalloc (Address: 0x18004b300)
_o__register_onexit_function (Address: 0x18004b308)
_o__seh_filter_dll (Address: 0x18004b310)
_o__ultoa_s (Address: 0x18004b318)
_o__wtoi (Address: 0x18004b320)
_o_calloc (Address: 0x18004b328)
_o_free (Address: 0x18004b330)
_o_malloc (Address: 0x18004b338)
_o_wmemcpy_s (Address: 0x18004b340)
memcmp (Address: 0x18004b398)
memcpy (Address: 0x18004b3b0)
memmove (Address: 0x18004b3a8)

api-ms-win-crt-runtime-l1-1-0.dll

_initterm (Address: 0x18004b3c8)
_initterm_e (Address: 0x18004b3c0)

api-ms-win-crt-string-l1-1-0.dll

memset (Address: 0x18004b3d8)
strcmp (Address: 0x18004b3e0)

api-ms-win-eventing-provider-l1-1-0.dll

EventRegister (Address: 0x18004b3f0)
EventUnregister (Address: 0x18004b3f8)
EventWrite (Address: 0x18004b400)

dbghelp.dll

ImagehlpApiVersionEx (Address: 0x18004b420)
SymCleanup (Address: 0x18004b450)
SymFromName (Address: 0x18004b448)
SymGetModuleInfo64 (Address: 0x18004b428)
SymGetOptions (Address: 0x18004b418)
SymInitialize (Address: 0x18004b430)
SymLoadModuleEx (Address: 0x18004b438)
SymRegisterCallback64 (Address: 0x18004b440)
SymSetOptions (Address: 0x18004b410)

MF.dll

MFCreateMediaSession (Address: 0x18004b010)
MFCreateTopology (Address: 0x18004b008)
MFGetService (Address: 0x18004b000)

MFPlat.DLL

MFCreateAttributes (Address: 0x18004b020)
MFShutdown (Address: 0x18004b030)
MFStartup (Address: 0x18004b028)