termsrv.dll
v10.0.19041.6926
64-bit
Windows NT
Analyzed
Security warning
This file has been flagged as potentially dangerous, and downloads are disabled.
Reason: Detected potentially dangerous functions used for process injection: OpenProcess
Exported functions 2
ServiceMain
#1 · 0x38960
SvchostPushServiceGlobals
#2 · 0x39960
No function matches your filter.
Imported DLLs & functions 306
ApiSetQueryApiSetPresence
0x1800d0820
DebugBreak
0x1800d0848
IsDebuggerPresent
0x1800d0838
OutputDebugStringA
0x1800d0840
OutputDebugStringW
0x1800d0830
DelayLoadFailureHook
0x1800d0858
ResolveDelayLoadedAPI
0x1800d0868
GetLastError
0x1800d0898
RaiseException
0x1800d0878
SetLastError
0x1800d0888
SetUnhandledExceptionFilter
0x1800d0880
UnhandledExceptionFilter
0x1800d0890
CompareFileTime
0x1800d08a8
CreateDirectoryW
0x1800d08b0
CreateFileW
0x1800d08c0
QueryDosDeviceW
0x1800d08b8
GetProcessHeap
0x1800d08f0
HeapAlloc
0x1800d08f8
HeapFree
0x1800d08e8
LocalSize
0x1800d0920
DeviceIoControl
0x1800d0930
GetComputerNameW
0x1800d0948
RegisterWaitForSingleObject
0x1800d0940
UnregisterWait
0x1800d0950
VerifyVersionInfoW
0x1800d0960
CheckElevationEnabled
0x1800d0970
DisableThreadLibraryCalls
0x1800d09b8
FindResourceExW
0x1800d0980
FreeLibrary
0x1800d09c0
GetModuleFileNameA
0x1800d09a8
GetModuleFileNameW
0x1800d0990
GetModuleHandleExW
0x1800d09d8
GetModuleHandleW
0x1800d09d0
GetProcAddress
0x1800d0988
LoadLibraryExW
0x1800d09c8
LoadResource
0x1800d0998
LoadStringW
0x1800d09a0
SizeofResource
0x1800d09b0
LoadLibraryW
0x1800d09e8
FormatMessageW
0x1800d09f8
ExpandEnvironmentStringsW
0x1800d0a08
CreateProcessAsUserW
0x1800d0a88
CreateProcessW
0x1800d0a38
CreateThread
0x1800d0a78
ExitThread
0x1800d0a18
GetCurrentProcess
0x1800d0a98
GetCurrentProcessId
0x1800d0a30
GetCurrentThread
0x1800d0a60
GetCurrentThreadId
0x1800d0a68
GetExitCodeThread
0x1800d0a90
OpenProcessToken
0x1800d0a50
OpenThreadToken
0x1800d0a58
ProcessIdToSessionId
0x1800d0a80
TerminateProcess
0x1800d0a48
TlsAlloc
0x1800d0a40
TlsFree
0x1800d0a28
TlsGetValue
0x1800d0a70
TlsSetValue
0x1800d0a20
OpenProcess
0x1800d0aa8
QueryPerformanceCounter
0x1800d0ab8
K32EnumProcessModules
0x1800d0ac8
RegCloseKey
0x1800d0af0
RegCreateKeyExW
0x1800d0b18
RegDeleteValueW
0x1800d0ae0
RegEnumKeyExW
0x1800d0ad8
RegGetValueW
0x1800d0b08
RegOpenKeyExW
0x1800d0af8
RegQueryInfoKeyW
0x1800d0ae8
RegQueryValueExW
0x1800d0b00
RegSetValueExW
0x1800d0b10
MultiByteToWideChar
0x1800d0b28
CharNextW
0x1800d0b38
AcquireSRWLockExclusive
0x1800d0ba0
AcquireSRWLockShared
0x1800d0bd8
CreateEventW
0x1800d0c00
CreateMutexExW
0x1800d0bf8
CreateSemaphoreExW
0x1800d0bf0
DeleteCriticalSection
0x1800d0ba8
EnterCriticalSection
0x1800d0b90
InitializeCriticalSection
0x1800d0c10
InitializeCriticalSectionAndSpinCount
0x1800d0bc0
InitializeCriticalSectionEx
0x1800d0b98
InitializeSRWLock
0x1800d0b88
LeaveCriticalSection
0x1800d0c08
OpenEventW
0x1800d0b68
OpenSemaphoreW
0x1800d0bd0
ReleaseMutex
0x1800d0bb0
ReleaseSemaphore
0x1800d0b70
ReleaseSRWLockExclusive
0x1800d0b78
ReleaseSRWLockShared
0x1800d0b80
ResetEvent
0x1800d0bb8
SetEvent
0x1800d0b60
WaitForMultipleObjectsEx
0x1800d0be8
WaitForSingleObject
0x1800d0bc8
WaitForSingleObjectEx
0x1800d0be0
Sleep
0x1800d0c20
GetSystemDirectoryW
0x1800d0c50
GetSystemTime
0x1800d0c58
GetSystemTimeAsFileTime
0x1800d0c68
GetTickCount
0x1800d0c48
GetTickCount64
0x1800d0c60
GetVersionExW
0x1800d0c70
GetProductInfo
0x1800d0c80
CloseThreadpool
0x1800d0cd0
CloseThreadpoolCleanupGroup
0x1800d0c98
CloseThreadpoolCleanupGroupMembers
0x1800d0cc0
CloseThreadpoolTimer
0x1800d0ce0
CreateThreadpool
0x1800d0cb8
CreateThreadpoolCleanupGroup
0x1800d0ca0
CreateThreadpoolTimer
0x1800d0c90
SetThreadpoolThreadMaximum
0x1800d0cb0
SetThreadpoolThreadMinimum
0x1800d0cd8
SetThreadpoolTimer
0x1800d0ce8
TrySubmitThreadpoolCallback
0x1800d0cc8
WaitForThreadpoolTimerCallbacks
0x1800d0ca8
CreateTimerQueue
0x1800d0d10
CreateTimerQueueTimer
0x1800d0d20
DeleteTimerQueueEx
0x1800d0cf8
DeleteTimerQueueTimer
0x1800d0d18
QueueUserWorkItem
0x1800d0d08
UnregisterWaitEx
0x1800d0d00
SystemTimeToFileTime
0x1800d0d30
DevCloseObjectQuery
0x1800d0d60
DevCreateObjectQuery
0x1800d0d40
DevFindProperty
0x1800d0d48
DevFreeObjectProperties
0x1800d0d58
DevGetObjectProperties
0x1800d0d50
TraceMessage
0x1800d0d70
ControlTraceW
0x1800d0d80
EnableTraceEx2
0x1800d0d90
StartTraceW
0x1800d0d88
EventActivityIdControl
0x1800d0da0
EventProviderEnabled
0x1800d0dc0
EventRegister
0x1800d0da8
EventSetInformation
0x1800d0db0
EventUnregister
0x1800d0db8
EventWriteTransfer
0x1800d0dc8
AccessCheckAndAuditAlarmW
0x1800d0df0
AddAce
0x1800d0df8
AllocateAndInitializeSid
0x1800d0e58
AllocateLocallyUniqueId
0x1800d0e40
CheckTokenMembership
0x1800d0ea8
CopySid
0x1800d0e28
CreateWellKnownSid
0x1800d0e48
DuplicateToken
0x1800d0eb0
DuplicateTokenEx
0x1800d0de0
EqualSid
0x1800d0e20
FreeSid
0x1800d0dd8
GetAce
0x1800d0e18
GetAclInformation
0x1800d0e70
GetFileSecurityW
0x1800d0e00
GetLengthSid
0x1800d0e30
GetSecurityDescriptorControl
0x1800d0e98
GetSecurityDescriptorDacl
0x1800d0e90
GetSecurityDescriptorLength
0x1800d0e50
GetTokenInformation
0x1800d0ea0
ImpersonateLoggedOnUser
0x1800d0e10
InitializeAcl
0x1800d0de8
InitializeSecurityDescriptor
0x1800d0e60
IsValidSecurityDescriptor
0x1800d0e08
IsValidSid
0x1800d0e38
MakeAbsoluteSD
0x1800d0e78
MakeSelfRelativeSD
0x1800d0e80
RevertToSelf
0x1800d0e88
SetSecurityDescriptorDacl
0x1800d0e68
DeriveCapabilitySidsFromName
0x1800d0ec0
OOBEComplete
0x1800d06e8
WTSIsServerContainer
0x1800d06f8
msvcrt.dll
49
__C_specific_handler
0x1800d0ed0
__CxxFrameHandler3
0x1800d0ff8
__dllonexit
0x1800d0f38
_amsg_exit
0x1800d0ee0
_callnewh
0x1800d1020
_CxxThrowException
0x1800d1000
_errno
0x1800d0f48
_initterm
0x1800d0ef0
_lock
0x1800d0f20
_onexit
0x1800d0f40
_purecall
0x1800d0ed8
_resetstkoflw
0x1800d1030
_stricmp
0x1800d0fc0
_unlock
0x1800d0f30
_vscwprintf
0x1800d0fc8
_vsnprintf
0x1800d0fb0
_vsnprintf_s
0x1800d0ef8
_vsnwprintf
0x1800d0ee8
_wcsicmp
0x1800d0f88
_wcsnicmp
0x1800d0f60
_XcptFilter
0x1800d0fe8
??_V@YAXPEAX@Z
0x1800d0ff0
??0exception@@QEAA@AEBQEBD@Z
0x1800d1018
??0exception@@QEAA@AEBQEBDH@Z
0x1800d1010
??0exception@@QEAA@AEBV0@@Z
0x1800d0f78
??0exception@@QEAA@XZ
0x1800d0f68
??1exception@@UEAA@XZ
0x1800d0f70
??1type_info@@UEAA@XZ
0x1800d0f10
??3@YAXPEAX@Z
0x1800d1028
?terminate@@YAXXZ
0x1800d0f08
?what@exception@@UEBAPEBDXZ
0x1800d1008
free
0x1800d0fa8
iswspace
0x1800d0fd8
malloc
0x1800d0fa0
memcmp
0x1800d0fb8
memcpy
0x1800d0fe0
memcpy_s
0x1800d1040
memmove
0x1800d0f00
memmove_s
0x1800d0f80
memset
0x1800d1050
qsort
0x1800d0f28
realloc
0x1800d0f58
swprintf_s
0x1800d1038
toupper
0x1800d0f18
wcschr
0x1800d0fd0
wcscpy_s
0x1800d1048
wcsncpy_s
0x1800d0f98
wcsrchr
0x1800d0f50
wcstok_s
0x1800d0f90
ntdll.dll
50
DbgPrint
0x1800d10c8
EtwEventActivityIdControl
0x1800d1158
EtwEventRegister
0x1800d11d8
EtwEventUnregister
0x1800d11e0
EtwEventWriteFull
0x1800d11c8
EtwEventWriteTransfer
0x1800d1188
NtCreateFile
0x1800d1138
NtDuplicateToken
0x1800d10a0
NtOpenProcess
0x1800d1060
NtOpenProcessToken
0x1800d1068
NtQueryInformationProcess
0x1800d1090
NtQueryInformationToken
0x1800d10b0
NtQuerySystemInformation
0x1800d10e8
NtQuerySystemTime
0x1800d1180
NtQueryVirtualMemory
0x1800d10f0
RtlAcquireResourceExclusive
0x1800d10a8
RtlAcquireResourceShared
0x1800d10b8
RtlAdjustPrivilege
0x1800d1148
RtlAllocateAndInitializeSid
0x1800d11d0
RtlAreBitsSet
0x1800d1168
RtlCaptureContext
0x1800d1118
RtlCaptureStackBackTrace
0x1800d10e0
RtlClearBits
0x1800d1160
RtlCompareMemory
0x1800d1128
RtlCopySecurityDescriptor
0x1800d1078
RtlCopySid
0x1800d11e8
RtlCreateUserSecurityObject
0x1800d1088
RtlDeleteElementGenericTable
0x1800d11a0
RtlDeleteResource
0x1800d11c0
RtlDeleteSecurityObject
0x1800d1070
RtlEnumerateGenericTable
0x1800d1190
RtlEqualSid
0x1800d10d0
RtlFindClearBitsAndSet
0x1800d1170
RtlFreeSid
0x1800d10f8
RtlGetControlSecurityDescriptor
0x1800d1080
RtlInitializeBitMap
0x1800d1178
RtlInitializeGenericTable
0x1800d11b0
RtlInitializeResource
0x1800d11b8
RtlInitString
0x1800d1130
RtlInitUnicodeString
0x1800d1140
RtlInsertElementGenericTable
0x1800d11a8
RtlLengthSid
0x1800d1098
RtlLookupElementGenericTable
0x1800d1198
RtlLookupFunctionEntry
0x1800d1110
RtlNtStatusToDosError
0x1800d10c0
RtlNumberGenericTableElements
0x1800d1150
RtlReleaseResource
0x1800d1100
RtlVerifyVersionInfo
0x1800d10d8
RtlVirtualUnwind
0x1800d1108
VerSetConditionMask
0x1800d1120
RPCRT4.dll
19
I_RpcBindingInqLocalClientPID
0x1800d0770
I_RpcBindingIsClientLocal
0x1800d0788
NdrServerCall2
0x1800d0748
NdrServerCallAll
0x1800d0740
RpcBindingToStringBindingW
0x1800d0720
RpcImpersonateClient
0x1800d0750
RpcRevertToSelf
0x1800d0758
RpcServerInqCallAttributesW
0x1800d0738
RpcServerInqDefaultPrincNameW
0x1800d0768
RpcServerListen
0x1800d0760
RpcServerRegisterAuthInfoW
0x1800d0778
RpcServerRegisterIf3
0x1800d0780
RpcServerRegisterIfEx
0x1800d0710
RpcServerUnregisterIfEx
0x1800d0718
RpcServerUseProtseqEpW
0x1800d0708
RpcStringBindingParseW
0x1800d0728
RpcStringFreeW
0x1800d0730
UuidFromStringW
0x1800d0790
UuidToStringW
0x1800d0798
PdcTaskClientRegister
0x1800d07b8
PdcTaskClientRequest
0x1800d07c0
PdcTaskClientUnregister
0x1800d07d8
Pdcv2ActivationClientActivate
0x1800d07b0
Pdcv2ActivationClientDeactivate
0x1800d07a8
Pdcv2ActivationClientRegister
0x1800d07d0
Pdcv2ActivationClientUnregister
0x1800d07c8
UnregisterDeviceNotification
0x1800d07e8
GetNameInfoW
0x1800d0810
WSACleanup
0x1800d0808
WSAGetLastError
0x1800d0800
WSAStartup
0x1800d07f8
No function matches your filter.