AarSvc.dll

Description: Agent Activation Runtime Service

Version: 10.0.19041.5794

Architecture: 64-bit

Operating System: Windows NT

SHA256: 25f44901e8c28b127b402004e1e5d080

File Size: 451.0 KB

Uploaded At: Dec. 1, 2025, 7:21 a.m.

Views: 13

Security Warning

This file has been flagged as potentially dangerous.

Reason: Detected potentially dangerous functions used for process injection: OpenProcess

Exported Functions

DllCanUnloadNow (Ordinal: 1, Address: 0x51c0)
DllGetActivationFactory (Ordinal: 2, Address: 0x4ef0)
DllGetClassObject (Ordinal: 3, Address: 0x50d0)
ServiceMain (Ordinal: 4, Address: 0x5370)

Imported DLLs & Functions

agentactivationruntime.dll

?CreateAgentActivationRuntime@@YA?AV?$shared_ptr@VIAgentActivationRuntime@VoiceAgentServices@Microsoft@@@std@@XZ (Address: 0x18003c198)
?GetAgentActivationRuntime@@YA?AV?$shared_ptr@VIAgentActivationRuntime@VoiceAgentServices@Microsoft@@@std@@XZ (Address: 0x18003c190)
?GetLoggerInstance@@YAAEAVLogger@VoiceAgentServices@Microsoft@@XZ (Address: 0x18003c188)
?ReleaseAgentActivationRuntime@@YAXXZ (Address: 0x18003c180)

api-ms-win-core-com-l1-1-0.dll

CoAddRefServerProcess (Address: 0x18003c200)
CoCreateFreeThreadedMarshaler (Address: 0x18003c208)
CoCreateInstance (Address: 0x18003c1e8)
CoDecrementMTAUsage (Address: 0x18003c1d0)
CoDisconnectContext (Address: 0x18003c218)
CoInitializeEx (Address: 0x18003c1d8)
CoInitializeSecurity (Address: 0x18003c1b0)
CoRegisterClassObject (Address: 0x18003c1f0)
CoReleaseServerProcess (Address: 0x18003c1c0)
CoResumeClassObjects (Address: 0x18003c210)
CoRevokeClassObject (Address: 0x18003c1a8)
CoTaskMemAlloc (Address: 0x18003c1c8)
CoTaskMemFree (Address: 0x18003c1e0)
CoUninitialize (Address: 0x18003c1f8)
CoWaitForMultipleHandles (Address: 0x18003c1b8)

api-ms-win-core-com-l1-1-1.dll

RoGetAgileReference (Address: 0x18003c228)

api-ms-win-core-debug-l1-1-0.dll

DebugBreak (Address: 0x18003c240)
IsDebuggerPresent (Address: 0x18003c248)
OutputDebugStringW (Address: 0x18003c238)

api-ms-win-core-errorhandling-l1-1-0.dll

GetLastError (Address: 0x18003c258)
RaiseException (Address: 0x18003c270)
SetLastError (Address: 0x18003c278)
SetUnhandledExceptionFilter (Address: 0x18003c260)
UnhandledExceptionFilter (Address: 0x18003c268)

api-ms-win-core-handle-l1-1-0.dll

CloseHandle (Address: 0x18003c288)

api-ms-win-core-heap-l1-1-0.dll

GetProcessHeap (Address: 0x18003c2a0)
HeapAlloc (Address: 0x18003c298)
HeapFree (Address: 0x18003c2a8)

api-ms-win-core-interlocked-l1-1-0.dll

InitializeSListHead (Address: 0x18003c2b8)

api-ms-win-core-libraryloader-l1-2-0.dll

DisableThreadLibraryCalls (Address: 0x18003c2e0)
GetModuleFileNameA (Address: 0x18003c2c8)
GetModuleHandleExW (Address: 0x18003c2d8)
GetModuleHandleW (Address: 0x18003c2d0)
GetProcAddress (Address: 0x18003c2e8)

api-ms-win-core-localization-l1-2-0.dll

FormatMessageW (Address: 0x18003c2f8)

api-ms-win-core-processthreads-l1-1-0.dll

CreateThread (Address: 0x18003c320)
GetCurrentProcess (Address: 0x18003c318)
GetCurrentProcessId (Address: 0x18003c328)
GetCurrentThreadId (Address: 0x18003c330)
OpenProcessToken (Address: 0x18003c338)
TerminateProcess (Address: 0x18003c310)
TerminateThread (Address: 0x18003c308)

api-ms-win-core-processthreads-l1-1-1.dll

IsProcessorFeaturePresent (Address: 0x18003c348)
OpenProcess (Address: 0x18003c350)

api-ms-win-core-profile-l1-1-0.dll

QueryPerformanceCounter (Address: 0x18003c360)

api-ms-win-core-registry-l1-1-0.dll

RegCloseKey (Address: 0x18003c370)
RegCreateKeyExW (Address: 0x18003c388)
RegFlushKey (Address: 0x18003c390)
RegGetValueW (Address: 0x18003c380)
RegQueryValueExW (Address: 0x18003c398)
RegSetValueExW (Address: 0x18003c378)

api-ms-win-core-registry-l2-1-0.dll

RegCreateKeyW (Address: 0x18003c3b0)
RegOpenKeyW (Address: 0x18003c3a8)

api-ms-win-core-rtlsupport-l1-1-0.dll

RtlCaptureContext (Address: 0x18003c3c8)
RtlLookupFunctionEntry (Address: 0x18003c3c0)
RtlVirtualUnwind (Address: 0x18003c3d0)

api-ms-win-core-synch-l1-1-0.dll

AcquireSRWLockExclusive (Address: 0x18003c410)
AcquireSRWLockShared (Address: 0x18003c450)
CreateEventExW (Address: 0x18003c420)
CreateEventW (Address: 0x18003c3e0)
CreateMutexExW (Address: 0x18003c448)
CreateMutexW (Address: 0x18003c460)
CreateSemaphoreExW (Address: 0x18003c478)
DeleteCriticalSection (Address: 0x18003c400)
EnterCriticalSection (Address: 0x18003c440)
InitializeCriticalSectionEx (Address: 0x18003c480)
InitializeSRWLock (Address: 0x18003c458)
LeaveCriticalSection (Address: 0x18003c408)
OpenSemaphoreW (Address: 0x18003c430)
ReleaseMutex (Address: 0x18003c428)
ReleaseSemaphore (Address: 0x18003c470)
ReleaseSRWLockExclusive (Address: 0x18003c3e8)
ReleaseSRWLockShared (Address: 0x18003c438)
ResetEvent (Address: 0x18003c3f0)
SetEvent (Address: 0x18003c3f8)
WaitForSingleObject (Address: 0x18003c468)
WaitForSingleObjectEx (Address: 0x18003c418)

api-ms-win-core-synch-l1-2-0.dll

InitOnceBeginInitialize (Address: 0x18003c4a0)
InitOnceComplete (Address: 0x18003c498)
InitOnceExecuteOnce (Address: 0x18003c490)

api-ms-win-core-sysinfo-l1-1-0.dll

GetSystemTimeAsFileTime (Address: 0x18003c4b0)

api-ms-win-core-threadpool-l1-2-0.dll

CloseThreadpoolTimer (Address: 0x18003c4c0)
CreateThreadpoolTimer (Address: 0x18003c4c8)
SetThreadpoolTimer (Address: 0x18003c4d8)
WaitForThreadpoolTimerCallbacks (Address: 0x18003c4d0)

api-ms-win-core-util-l1-1-0.dll

DecodePointer (Address: 0x18003c4e8)
EncodePointer (Address: 0x18003c4f0)

api-ms-win-core-winrt-error-l1-1-0.dll

RoOriginateError (Address: 0x18003c500)
RoOriginateErrorW (Address: 0x18003c508)
RoTransformError (Address: 0x18003c510)

api-ms-win-core-winrt-error-l1-1-1.dll

IsErrorPropagationEnabled (Address: 0x18003c528)
RoGetMatchingRestrictedErrorInfo (Address: 0x18003c520)
RoReportFailedDelegate (Address: 0x18003c530)

api-ms-win-core-winrt-l1-1-0.dll

RoGetActivationFactory (Address: 0x18003c548)
RoInitialize (Address: 0x18003c550)
RoRegisterActivationFactories (Address: 0x18003c560)
RoRevokeActivationFactories (Address: 0x18003c558)
RoUninitialize (Address: 0x18003c540)

api-ms-win-core-winrt-string-l1-1-0.dll

WindowsCreateString (Address: 0x18003c598)
WindowsCreateStringReference (Address: 0x18003c5a0)
WindowsDeleteString (Address: 0x18003c570)
WindowsDuplicateString (Address: 0x18003c578)
WindowsGetStringRawBuffer (Address: 0x18003c580)
WindowsIsStringEmpty (Address: 0x18003c588)
WindowsStringHasEmbeddedNull (Address: 0x18003c590)

api-ms-win-crt-private-l1-1-0.dll

__C_specific_handler (Address: 0x18003c620)
__CxxFrameHandler3 (Address: 0x18003c628)
__CxxFrameHandler4 (Address: 0x18003c690)
__RTDynamicCast (Address: 0x18003c6a0)
__std_terminate (Address: 0x18003c688)
_CxxThrowException (Address: 0x18003c630)
_o___std_exception_copy (Address: 0x18003c658)
_o___std_exception_destroy (Address: 0x18003c650)
_o___std_type_info_destroy_list (Address: 0x18003c648)
_o___stdio_common_vsnprintf_s (Address: 0x18003c640)
_o___stdio_common_vswprintf (Address: 0x18003c638)
_o__callnewh (Address: 0x18003c698)
_o__cexit (Address: 0x18003c680)
_o__configure_narrow_argv (Address: 0x18003c668)
_o__crt_atexit (Address: 0x18003c660)
_o__errno (Address: 0x18003c5f0)
_o__execute_onexit_table (Address: 0x18003c670)
_o__initialize_narrow_environment (Address: 0x18003c5b0)
_o__initialize_onexit_table (Address: 0x18003c5b8)
_o__invalid_parameter_noinfo (Address: 0x18003c5c0)
_o__invalid_parameter_noinfo_noreturn (Address: 0x18003c5c8)
_o__purecall (Address: 0x18003c5d0)
_o__register_onexit_function (Address: 0x18003c5d8)
_o__seh_filter_dll (Address: 0x18003c5e0)
_o_free (Address: 0x18003c5f8)
_o_malloc (Address: 0x18003c600)
_o_realloc (Address: 0x18003c608)
_o_terminate (Address: 0x18003c610)
_o_toupper (Address: 0x18003c618)
memcmp (Address: 0x18003c6a8)
memcpy (Address: 0x18003c6b0)
memmove (Address: 0x18003c5e8)
wcschr (Address: 0x18003c678)

api-ms-win-crt-runtime-l1-1-0.dll

_initterm (Address: 0x18003c6c0)
_initterm_e (Address: 0x18003c6c8)

api-ms-win-crt-string-l1-1-0.dll

memset (Address: 0x18003c6d8)

api-ms-win-eventing-provider-l1-1-0.dll

EventRegister (Address: 0x18003c700)
EventSetInformation (Address: 0x18003c6f0)
EventUnregister (Address: 0x18003c6f8)
EventWriteTransfer (Address: 0x18003c6e8)

api-ms-win-security-base-l1-1-0.dll

MakeAbsoluteSD (Address: 0x18003c710)

api-ms-win-security-sddl-l1-1-0.dll

ConvertStringSecurityDescriptorToSecurityDescriptorW (Address: 0x18003c720)

api-ms-win-service-core-l1-1-0.dll

RegisterServiceCtrlHandlerExW (Address: 0x18003c738)
SetServiceStatus (Address: 0x18003c730)

combase.dll

(Address: 0x18003c760)
(Address: 0x18003c758)
(Address: 0x18003c750)
(Address: 0x18003c748)

msvcp_win.dll

?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z (Address: 0x18003c7c0)
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ (Address: 0x18003c7c8)
?_Incref@facet@locale@std@@UEAAXXZ (Address: 0x18003c7d0)
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z (Address: 0x18003c788)
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z (Address: 0x18003c778)
?_Xlength_error@std@@YAXPEBD@Z (Address: 0x18003c780)
?_Xout_of_range@std@@YAXPEBD@Z (Address: 0x18003c7b0)
??0?$codecvt@GDU_Mbstatet@@@std@@QEAA@_K@Z (Address: 0x18003c7a0)
??1?$codecvt@GDU_Mbstatet@@@std@@MEAA@XZ (Address: 0x18003c798)
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z (Address: 0x18003c770)
??Bid@locale@std@@QEAA_KXZ (Address: 0x18003c790)
?id@?$codecvt@GDU_Mbstatet@@@std@@2V0locale@2@A (Address: 0x18003c7a8)
?out@?$codecvt@GDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBG1AEAPEBGPEAD3AEAPEAD@Z (Address: 0x18003c7b8)

ntdll.dll

NtQueryInformationToken (Address: 0x18003c7e8)
RtlAllocateHeap (Address: 0x18003c7f8)
RtlCompareUnicodeString (Address: 0x18003c808)
RtlFreeHeap (Address: 0x18003c7e0)
RtlInitUnicodeString (Address: 0x18003c7f0)
RtlNtStatusToDosErrorNoTeb (Address: 0x18003c800)

SystemEventsBrokerClient.dll

SebEnumerateEventsByType (Address: 0x18003c168)
SebQueryEventPackage (Address: 0x18003c170)