PackageStateRoaming.dll

Description: Package State Roaming

Version: 10.0.19041.4355

Architecture: 64-bit

Operating System: Windows NT

SHA256: 5d1311c47031da8dfcee00e7e649d9c5

File Size: 235.5 KB

Uploaded At: Dec. 1, 2025, 7:36 a.m.

Views: 4

Security Warning

This file has been flagged as potentially dangerous.

Reason: Detected potentially dangerous functions used for process injection: OpenProcess

Exported Functions

DllCanUnloadNow (Ordinal: 1, Address: 0x12b80)
DllGetClassObject (Ordinal: 2, Address: 0x12bc0)

Imported DLLs & Functions

api-ms-win-appmodel-runtime-internal-l1-1-1.dll

GetPackageStatus (Address: 0x180028b48)

api-ms-win-appmodel-runtime-l1-1-0.dll

GetApplicationUserModelId (Address: 0x180028b58)
GetPackagesByPackageFamily (Address: 0x180028b60)

api-ms-win-appmodel-runtime-l1-1-1.dll

GetStagedPackageOrigin (Address: 0x180028b70)

api-ms-win-core-debug-l1-1-0.dll

DebugBreak (Address: 0x180028b90)
IsDebuggerPresent (Address: 0x180028b88)
OutputDebugStringW (Address: 0x180028b80)

api-ms-win-core-delayload-l1-1-0.dll

DelayLoadFailureHook (Address: 0x180028ba0)

api-ms-win-core-delayload-l1-1-1.dll

ResolveDelayLoadedAPI (Address: 0x180028bb0)

api-ms-win-core-errorhandling-l1-1-0.dll

GetLastError (Address: 0x180028bd0)
SetLastError (Address: 0x180028bc8)
SetUnhandledExceptionFilter (Address: 0x180028bd8)
UnhandledExceptionFilter (Address: 0x180028bc0)

api-ms-win-core-file-l1-1-0.dll

CompareFileTime (Address: 0x180028c00)
FindClose (Address: 0x180028be8)
FindFirstFileW (Address: 0x180028c08)
FindNextFileW (Address: 0x180028bf0)
GetFileAttributesW (Address: 0x180028bf8)

api-ms-win-core-handle-l1-1-0.dll

CloseHandle (Address: 0x180028c18)

api-ms-win-core-heap-l1-1-0.dll

GetProcessHeap (Address: 0x180028c30)
HeapAlloc (Address: 0x180028c38)
HeapFree (Address: 0x180028c28)

api-ms-win-core-heap-l2-1-0.dll

LocalAlloc (Address: 0x180028c50)
LocalFree (Address: 0x180028c48)

api-ms-win-core-libraryloader-l1-2-0.dll

DisableThreadLibraryCalls (Address: 0x180028c88)
FreeLibrary (Address: 0x180028c60)
GetModuleFileNameA (Address: 0x180028c78)
GetModuleHandleExW (Address: 0x180028c80)
GetModuleHandleW (Address: 0x180028c70)
GetProcAddress (Address: 0x180028c68)

api-ms-win-core-localization-l1-2-0.dll

FormatMessageW (Address: 0x180028c98)

api-ms-win-core-path-l1-1-0.dll

PathAllocCombine (Address: 0x180028cb0)
PathCchCombine (Address: 0x180028ca8)

api-ms-win-core-processenvironment-l1-1-0.dll

ExpandEnvironmentStringsW (Address: 0x180028cc0)

api-ms-win-core-processthreads-l1-1-0.dll

GetCurrentProcess (Address: 0x180028cf8)
GetCurrentProcessId (Address: 0x180028cf0)
GetCurrentThread (Address: 0x180028ce8)
GetCurrentThreadId (Address: 0x180028cd0)
ProcessIdToSessionId (Address: 0x180028cd8)
SetThreadPriority (Address: 0x180028ce0)
TerminateProcess (Address: 0x180028d00)

api-ms-win-core-processthreads-l1-1-1.dll

OpenProcess (Address: 0x180028d10)

api-ms-win-core-profile-l1-1-0.dll

QueryPerformanceCounter (Address: 0x180028d20)

api-ms-win-core-registry-l1-1-0.dll

RegCloseKey (Address: 0x180028d48)
RegCreateKeyExW (Address: 0x180028d68)
RegDeleteValueW (Address: 0x180028d40)
RegGetValueW (Address: 0x180028d30)
RegOpenCurrentUser (Address: 0x180028d60)
RegOpenKeyExW (Address: 0x180028d50)
RegQueryValueExW (Address: 0x180028d58)
RegSetValueExW (Address: 0x180028d38)

api-ms-win-core-rtlsupport-l1-1-0.dll

RtlCaptureContext (Address: 0x180028d80)
RtlLookupFunctionEntry (Address: 0x180028d78)
RtlVirtualUnwind (Address: 0x180028d88)

api-ms-win-core-shlwapi-legacy-l1-1-0.dll

PathFindFileNameW (Address: 0x180028da0)
PathRemoveBackslashW (Address: 0x180028d98)

api-ms-win-core-shlwapi-obsolete-l1-1-0.dll

QISearch (Address: 0x180028db0)
StrRChrW (Address: 0x180028db8)
StrStrIW (Address: 0x180028dc0)

api-ms-win-core-string-l1-1-0.dll

CompareStringOrdinal (Address: 0x180028dd0)

api-ms-win-core-synch-l1-1-0.dll

AcquireSRWLockExclusive (Address: 0x180028e20)
AcquireSRWLockShared (Address: 0x180028e28)
CreateEventExW (Address: 0x180028e18)
CreateMutexExW (Address: 0x180028de8)
CreateSemaphoreExW (Address: 0x180028e08)
DeleteCriticalSection (Address: 0x180028e50)
EnterCriticalSection (Address: 0x180028e60)
InitializeCriticalSectionEx (Address: 0x180028e58)
InitializeSRWLock (Address: 0x180028e30)
LeaveCriticalSection (Address: 0x180028e48)
OpenSemaphoreW (Address: 0x180028de0)
ReleaseMutex (Address: 0x180028e00)
ReleaseSemaphore (Address: 0x180028e70)
ReleaseSRWLockExclusive (Address: 0x180028e38)
ReleaseSRWLockShared (Address: 0x180028e10)
ResetEvent (Address: 0x180028e68)
SetEvent (Address: 0x180028e40)
WaitForSingleObject (Address: 0x180028df0)
WaitForSingleObjectEx (Address: 0x180028df8)

api-ms-win-core-synch-l1-2-0.dll

InitOnceExecuteOnce (Address: 0x180028e80)
Sleep (Address: 0x180028e88)

api-ms-win-core-sysinfo-l1-1-0.dll

GetSystemTimeAsFileTime (Address: 0x180028e98)
GetTickCount (Address: 0x180028ea0)

api-ms-win-core-threadpool-legacy-l1-1-0.dll

QueueUserWorkItem (Address: 0x180028eb0)

api-ms-win-core-util-l1-1-0.dll

DecodePointer (Address: 0x180028ec0)

api-ms-win-core-winrt-error-l1-1-0.dll

RoOriginateError (Address: 0x180028ed8)
RoTransformError (Address: 0x180028ed0)

api-ms-win-core-winrt-string-l1-1-0.dll

WindowsCreateString (Address: 0x180028ee8)

api-ms-win-eventing-provider-l1-1-0.dll

EventProviderEnabled (Address: 0x180028f18)
EventRegister (Address: 0x180028f00)
EventSetInformation (Address: 0x180028f10)
EventUnregister (Address: 0x180028ef8)
EventWriteTransfer (Address: 0x180028f08)

api-ms-win-security-base-l1-1-0.dll

CopySid (Address: 0x180028f38)
GetLengthSid (Address: 0x180028f48)
GetTokenInformation (Address: 0x180028f40)
IsValidSecurityDescriptor (Address: 0x180028f30)
IsValidSid (Address: 0x180028f28)

api-ms-win-shcore-stream-l1-1-0.dll

IStream_Read (Address: 0x180028f68)
IStream_Reset (Address: 0x180028f60)
IStream_Size (Address: 0x180028f78)
IStream_Write (Address: 0x180028f70)
SHCreateMemStream (Address: 0x180028f58)

msvcrt.dll

__C_specific_handler (Address: 0x180028fb8)
__CxxFrameHandler3 (Address: 0x180028fc8)
__dllonexit (Address: 0x180028fa0)
_amsg_exit (Address: 0x180028fe0)
_callnewh (Address: 0x180028ff0)
_initterm (Address: 0x180028fd8)
_lock (Address: 0x180028fb0)
_onexit (Address: 0x180028f98)
_purecall (Address: 0x180029018)
_unlock (Address: 0x180028fa8)
_vsnwprintf (Address: 0x180028fd0)
_XcptFilter (Address: 0x180028fe8)
free (Address: 0x180029000)
malloc (Address: 0x180029008)
memcpy (Address: 0x180029020)
memcpy_s (Address: 0x180028fc0)
memmove (Address: 0x180028f88)
memmove_s (Address: 0x180029010)
memset (Address: 0x180029028)
realloc (Address: 0x180028ff8)
toupper (Address: 0x180028f90)

ntdll.dll

EtwEventEnabled (Address: 0x180029048)
EtwEventRegister (Address: 0x180029078)
EtwEventUnregister (Address: 0x180029060)
EtwEventWrite (Address: 0x180029040)
RtlAcquireSRWLockExclusive (Address: 0x180029070)
RtlAcquireSRWLockShared (Address: 0x180029068)
RtlAllocateHeap (Address: 0x180029050)
RtlDeleteCriticalSection (Address: 0x180029088)
RtlEnterCriticalSection (Address: 0x1800290a8)
RtlFreeHeap (Address: 0x1800290b0)
RtlInitializeCriticalSection (Address: 0x180029098)
RtlLeaveCriticalSection (Address: 0x1800290a0)
RtlReleaseSRWLockExclusive (Address: 0x180029058)
RtlReleaseSRWLockShared (Address: 0x180029038)
RtlTryEnterCriticalSection (Address: 0x180029090)
WinSqmIncrementDWORD (Address: 0x180029080)

RPCRT4.dll

I_RpcExceptionFilter (Address: 0x180028ac8)
NdrClientCall3 (Address: 0x180028af8)
NdrServerCall2 (Address: 0x180028ae0)
NdrServerCallAll (Address: 0x180028ae8)
RpcBindingFromStringBindingW (Address: 0x180028ad8)
RpcBindingSetAuthInfoExW (Address: 0x180028af0)
RpcBindingVectorFree (Address: 0x180028b30)
RpcEpRegisterW (Address: 0x180028b00)
RpcEpUnregister (Address: 0x180028ab0)
RpcImpersonateClient (Address: 0x180028ad0)
RpcRevertToSelf (Address: 0x180028ab8)
RpcServerInqBindings (Address: 0x180028b18)
RpcServerInqCallAttributesW (Address: 0x180028b38)
RpcServerRegisterIf3 (Address: 0x180028b10)
RpcServerUnregisterIf (Address: 0x180028b28)
RpcServerUseProtseqW (Address: 0x180028b20)
RpcStringBindingComposeW (Address: 0x180028aa8)
RpcStringFreeW (Address: 0x180028ac0)
UuidFromStringW (Address: 0x180028b08)