mfdetours.dll

Description: Media Foundation Detours Tracing DLL

Version: 1.1.0.1

Architecture: 32-bit

Operating System: Windows

SHA256: 41742657abb258e982daf142c2339c96

File Size: 523.1 KB

Uploaded At: Dec. 3, 2025, 2:37 a.m.

Views: 6

Security Warning

This file has been flagged as potentially dangerous.

Reason: Detected potentially dangerous functions used for process injection: WriteProcessMemory, VirtualAllocEx

Exported Functions

Shutdown (Ordinal: 1, Address: 0x4d060)
Startup (Ordinal: 2, Address: 0x4d1b0)
DllGetMFDebugHlp (Ordinal: 3, Address: 0x4f480)

Imported DLLs & Functions

api-ms-win-core-com-l1-1-0.dll

CoTaskMemAlloc (Address: 0x10079028)
CoTaskMemFree (Address: 0x10079020)
PropVariantClear (Address: 0x1007902c)
StringFromGUID2 (Address: 0x10079024)

api-ms-win-core-debug-l1-1-0.dll

DebugBreak (Address: 0x10079038)
IsDebuggerPresent (Address: 0x10079034)

api-ms-win-core-errorhandling-l1-1-0.dll

GetLastError (Address: 0x10079040)
RaiseException (Address: 0x10079050)
SetLastError (Address: 0x1007904c)
SetUnhandledExceptionFilter (Address: 0x10079044)
UnhandledExceptionFilter (Address: 0x10079048)

api-ms-win-core-handle-l1-1-0.dll

CloseHandle (Address: 0x10079058)

api-ms-win-core-heap-l1-1-0.dll

GetProcessHeap (Address: 0x1007906c)
HeapAlloc (Address: 0x10079068)
HeapDestroy (Address: 0x10079070)
HeapFree (Address: 0x10079060)
HeapReAlloc (Address: 0x10079074)
HeapSize (Address: 0x10079064)

api-ms-win-core-interlocked-l1-1-0.dll

InitializeSListHead (Address: 0x1007907c)

api-ms-win-core-libraryloader-l1-2-0.dll

DisableThreadLibraryCalls (Address: 0x10079094)
FindResourceExW (Address: 0x10079098)
FreeLibrary (Address: 0x1007909c)
GetModuleFileNameA (Address: 0x10079088)
GetModuleHandleExW (Address: 0x100790a0)
GetModuleHandleW (Address: 0x100790a8)
GetProcAddress (Address: 0x10079084)
LoadResource (Address: 0x100790a4)
LockResource (Address: 0x10079090)
SizeofResource (Address: 0x1007908c)

api-ms-win-core-libraryloader-l1-2-1.dll

LoadLibraryA (Address: 0x100790b0)

api-ms-win-core-memory-l1-1-0.dll

ReadProcessMemory (Address: 0x100790bc)
VirtualAlloc (Address: 0x100790c8)
VirtualAllocEx (Address: 0x100790c4)
VirtualFree (Address: 0x100790cc)
VirtualProtect (Address: 0x100790c0)
VirtualProtectEx (Address: 0x100790d0)
VirtualQuery (Address: 0x100790d4)
VirtualQueryEx (Address: 0x100790b8)
WriteProcessMemory (Address: 0x100790d8)

api-ms-win-core-processenvironment-l1-1-0.dll

GetEnvironmentVariableA (Address: 0x100790e4)
GetEnvironmentVariableW (Address: 0x100790e8)
SetEnvironmentVariableW (Address: 0x100790e0)

api-ms-win-core-processthreads-l1-1-0.dll

CreateProcessA (Address: 0x100790fc)
CreateProcessW (Address: 0x10079108)
GetCurrentProcess (Address: 0x100790f0)
GetCurrentProcessId (Address: 0x10079100)
GetCurrentThreadId (Address: 0x100790f4)
ResumeThread (Address: 0x100790f8)
TerminateProcess (Address: 0x10079104)

api-ms-win-core-processthreads-l1-1-1.dll

FlushInstructionCache (Address: 0x10079110)
GetThreadContext (Address: 0x10079114)
IsProcessorFeaturePresent (Address: 0x10079118)
SetThreadContext (Address: 0x1007911c)

api-ms-win-core-profile-l1-1-0.dll

QueryPerformanceCounter (Address: 0x10079124)

api-ms-win-core-registry-l1-1-0.dll

RegGetValueA (Address: 0x10079130)
RegGetValueW (Address: 0x1007912c)

api-ms-win-core-string-l1-1-0.dll

MultiByteToWideChar (Address: 0x1007913c)
WideCharToMultiByte (Address: 0x10079138)

api-ms-win-core-synch-l1-1-0.dll

AcquireSRWLockExclusive (Address: 0x10079164)
AcquireSRWLockShared (Address: 0x10079160)
DeleteCriticalSection (Address: 0x10079158)
EnterCriticalSection (Address: 0x10079154)
InitializeCriticalSection (Address: 0x1007915c)
InitializeSRWLock (Address: 0x10079148)
LeaveCriticalSection (Address: 0x10079150)
ReleaseSRWLockExclusive (Address: 0x10079144)
ReleaseSRWLockShared (Address: 0x1007914c)

api-ms-win-core-sysinfo-l1-1-0.dll

GetSystemTimeAsFileTime (Address: 0x1007916c)

api-ms-win-crt-private-l1-1-0.dll

__CxxFrameHandler3 (Address: 0x100791d8)
_except_handler4_common (Address: 0x100791c4)
_o___std_type_info_destroy_list (Address: 0x100791d4)
_o___stdio_common_vsprintf (Address: 0x100791cc)
_o___stdio_common_vsprintf_s (Address: 0x100791c8)
_o___stdio_common_vswprintf (Address: 0x100791a4)
_o___stdio_common_vswprintf_s (Address: 0x100791dc)
_o__callnewh (Address: 0x100791d0)
_o__cexit (Address: 0x100791a8)
_o__configure_narrow_argv (Address: 0x10079174)
_o__crt_atexit (Address: 0x10079178)
_o__errno (Address: 0x1007917c)
_o__execute_onexit_table (Address: 0x10079180)
_o__gcvt_s (Address: 0x10079184)
_o__initialize_narrow_environment (Address: 0x10079188)
_o__initialize_onexit_table (Address: 0x1007918c)
_o__invalid_parameter_noinfo (Address: 0x10079190)
_o__mbsinc (Address: 0x10079194)
_o__recalloc (Address: 0x10079198)
_o__register_onexit_function (Address: 0x1007919c)
_o__seh_filter_dll (Address: 0x100791a0)
_o__ultoa_s (Address: 0x100791ac)
_o__wtoi (Address: 0x100791b0)
_o_calloc (Address: 0x100791b4)
_o_free (Address: 0x100791b8)
_o_malloc (Address: 0x100791bc)
_o_wmemcpy_s (Address: 0x100791c0)
memcpy (Address: 0x100791e4)
memmove (Address: 0x100791e0)

api-ms-win-crt-runtime-l1-1-0.dll

_initterm (Address: 0x100791f0)
_initterm_e (Address: 0x100791ec)

api-ms-win-crt-string-l1-1-0.dll

memmove_s (Address: 0x100791fc)
memset (Address: 0x100791f8)

api-ms-win-eventing-provider-l1-1-0.dll

EventRegister (Address: 0x10079208)
EventUnregister (Address: 0x10079204)
EventWrite (Address: 0x1007920c)

dbghelp.dll

ImagehlpApiVersionEx (Address: 0x10079214)
SymCleanup (Address: 0x10079220)
SymFromName (Address: 0x10079234)
SymGetModuleInfo64 (Address: 0x10079224)
SymGetOptions (Address: 0x1007921c)
SymInitialize (Address: 0x10079228)
SymLoadModuleEx (Address: 0x1007922c)
SymRegisterCallback64 (Address: 0x10079230)
SymSetOptions (Address: 0x10079218)

MF.dll

MFCreateMediaSession (Address: 0x10079008)
MFCreateTopology (Address: 0x10079000)
MFGetService (Address: 0x10079004)

MFPlat.DLL

MFCreateAttributes (Address: 0x10079010)
MFShutdown (Address: 0x10079014)
MFStartup (Address: 0x10079018)