schannel.dll

Description: TLS / SSL Security Provider

Version: 10.0.19041.6328

Architecture: 64-bit

Operating System: Windows NT

SHA256: 640f0deaa6c2d6549b02735c5d919378

File Size: 581.0 KB

Uploaded At: Dec. 1, 2025, 7:38 a.m.

Views: 3

Security Warning

This file has been flagged as potentially dangerous.

Reason: Detected potentially dangerous functions used for process injection: OpenProcess

Exported Functions

SpLsaModeInitialize (Ordinal: 1, Address: 0x271c0)
AcceptSecurityContext (Ordinal: 2, Address: 0x885e7)
AcquireCredentialsHandleA (Ordinal: 3, Address: 0x8861f)
AcquireCredentialsHandleW (Ordinal: 4, Address: 0x8865b)
ApplyControlToken (Ordinal: 5, Address: 0x8868f)
CompleteAuthToken (Ordinal: 6, Address: 0x886bb)
DeleteSecurityContext (Ordinal: 7, Address: 0x886eb)
EnumerateSecurityPackagesA (Ordinal: 8, Address: 0x88724)
EnumerateSecurityPackagesW (Ordinal: 9, Address: 0x88762)
FreeContextBuffer (Ordinal: 10, Address: 0x88797)
FreeCredentialsHandle (Ordinal: 11, Address: 0x887c7)
ImpersonateSecurityContext (Ordinal: 12, Address: 0x88800)
InitSecurityInterfaceA (Ordinal: 13, Address: 0x8883a)
InitSecurityInterfaceW (Ordinal: 14, Address: 0x88870)
InitializeSecurityContextA (Ordinal: 15, Address: 0x888aa)
InitializeSecurityContextW (Ordinal: 16, Address: 0x888e8)
MakeSignature (Ordinal: 17, Address: 0x88919)
QueryContextAttributesA (Ordinal: 18, Address: 0x88947)
QueryContextAttributesW (Ordinal: 19, Address: 0x8897f)
QuerySecurityPackageInfoA (Ordinal: 20, Address: 0x889b9)
QuerySecurityPackageInfoW (Ordinal: 21, Address: 0x889f5)
RevertSecurityContext (Ordinal: 22, Address: 0x88a2d)
SealMessage (Ordinal: 23, Address: 0x88a57)
SpUserModeInitialize (Ordinal: 24, Address: 0x140d0)
SslCrackCertificate (Ordinal: 25, Address: 0x44aa0)
SslEmptyCacheA (Ordinal: 26, Address: 0x4a610)
SslEmptyCacheW (Ordinal: 27, Address: 0x4a6b0)
SslFreeCertificate (Ordinal: 28, Address: 0x44d80)
SslFreeCustomBuffer (Ordinal: 29, Address: 0x43ab0)
SslGenerateRandomBits (Ordinal: 30, Address: 0x44db0)
SslGetExtensions (Ordinal: 31, Address: 0x4bee0)
SslGetMaximumKeySize (Ordinal: 32, Address: 0x44dc0)
SslGetServerIdentity (Ordinal: 33, Address: 0x4c3d0)
SslLoadCertificate (Ordinal: 34, Address: 0x17fc0)
UnsealMessage (Ordinal: 35, Address: 0x88b4b)
VerifySignature (Ordinal: 36, Address: 0x88b71)

Imported DLLs & Functions

api-ms-win-core-apiquery-l1-1-0.dll

ApiSetQueryApiSetPresence (Address: 0x18007b108)

api-ms-win-core-debug-l1-1-0.dll

DebugBreak (Address: 0x18007b128)
IsDebuggerPresent (Address: 0x18007b118)
OutputDebugStringW (Address: 0x18007b120)

api-ms-win-core-delayload-l1-1-0.dll

DelayLoadFailureHook (Address: 0x18007b138)

api-ms-win-core-delayload-l1-1-1.dll

ResolveDelayLoadedAPI (Address: 0x18007b148)

api-ms-win-core-errorhandling-l1-1-0.dll

GetLastError (Address: 0x18007b168)
SetLastError (Address: 0x18007b160)
SetUnhandledExceptionFilter (Address: 0x18007b170)
UnhandledExceptionFilter (Address: 0x18007b158)

api-ms-win-core-file-l1-1-0.dll

CompareFileTime (Address: 0x18007b180)
CreateDirectoryW (Address: 0x18007b188)

api-ms-win-core-file-l2-1-0.dll

MoveFileExW (Address: 0x18007b198)

api-ms-win-core-handle-l1-1-0.dll

CloseHandle (Address: 0x18007b1a8)

api-ms-win-core-heap-l1-1-0.dll

GetProcessHeap (Address: 0x18007b1c0)
HeapAlloc (Address: 0x18007b1b8)
HeapFree (Address: 0x18007b1c8)

api-ms-win-core-heap-l2-1-0.dll

LocalAlloc (Address: 0x18007b1e8)
LocalFree (Address: 0x18007b1e0)
LocalReAlloc (Address: 0x18007b1d8)

api-ms-win-core-interlocked-l1-1-0.dll

InitializeSListHead (Address: 0x18007b208)
InterlockedFlushSList (Address: 0x18007b200)
InterlockedPopEntrySList (Address: 0x18007b210)
InterlockedPushEntrySList (Address: 0x18007b1f8)

api-ms-win-core-libraryloader-l1-2-0.dll

DisableThreadLibraryCalls (Address: 0x18007b228)
FreeLibrary (Address: 0x18007b220)
GetModuleFileNameA (Address: 0x18007b238)
GetModuleFileNameW (Address: 0x18007b248)
GetModuleHandleExW (Address: 0x18007b230)
GetModuleHandleW (Address: 0x18007b258)
GetProcAddress (Address: 0x18007b250)
LoadLibraryExW (Address: 0x18007b240)

api-ms-win-core-localization-l1-2-0.dll

FormatMessageW (Address: 0x18007b268)

api-ms-win-core-memory-l1-1-0.dll

CreateFileMappingW (Address: 0x18007b2b0)
MapViewOfFileEx (Address: 0x18007b298)
OpenFileMappingW (Address: 0x18007b278)
UnmapViewOfFile (Address: 0x18007b290)
VirtualAlloc (Address: 0x18007b2a0)
VirtualFree (Address: 0x18007b288)
VirtualProtect (Address: 0x18007b2a8)
VirtualQuery (Address: 0x18007b280)

api-ms-win-core-processenvironment-l1-1-0.dll

ExpandEnvironmentStringsW (Address: 0x18007b2d0)
GetCurrentDirectoryW (Address: 0x18007b2c0)
SetCurrentDirectoryW (Address: 0x18007b2c8)

api-ms-win-core-processthreads-l1-1-0.dll

GetCurrentProcess (Address: 0x18007b300)
GetCurrentProcessId (Address: 0x18007b2e0)
GetCurrentThread (Address: 0x18007b2f8)
GetCurrentThreadId (Address: 0x18007b2e8)
OpenThreadToken (Address: 0x18007b310)
SetThreadStackGuarantee (Address: 0x18007b2f0)
TerminateProcess (Address: 0x18007b308)

api-ms-win-core-processthreads-l1-1-1.dll

IsProcessorFeaturePresent (Address: 0x18007b328)
OpenProcess (Address: 0x18007b320)

api-ms-win-core-profile-l1-1-0.dll

QueryPerformanceCounter (Address: 0x18007b338)
QueryPerformanceFrequency (Address: 0x18007b340)

api-ms-win-core-psapi-l1-1-0.dll

QueryFullProcessImageNameW (Address: 0x18007b350)

api-ms-win-core-registry-l1-1-0.dll

RegCloseKey (Address: 0x18007b368)
RegCreateKeyExW (Address: 0x18007b370)
RegFlushKey (Address: 0x18007b360)
RegNotifyChangeKeyValue (Address: 0x18007b388)
RegOpenKeyExA (Address: 0x18007b380)
RegOpenKeyExW (Address: 0x18007b378)
RegQueryValueExW (Address: 0x18007b390)
RegSetValueExW (Address: 0x18007b398)

api-ms-win-core-rtlsupport-l1-1-0.dll

RtlCaptureContext (Address: 0x18007b3a8)
RtlCompareMemory (Address: 0x18007b3c0)
RtlLookupFunctionEntry (Address: 0x18007b3b0)
RtlVirtualUnwind (Address: 0x18007b3b8)

api-ms-win-core-string-l1-1-0.dll

MultiByteToWideChar (Address: 0x18007b3d8)
WideCharToMultiByte (Address: 0x18007b3d0)

api-ms-win-core-string-obsolete-l1-1-0.dll

lstrlenW (Address: 0x18007b3e8)

api-ms-win-core-synch-l1-1-0.dll

AcquireSRWLockExclusive (Address: 0x18007b488)
AcquireSRWLockShared (Address: 0x18007b458)
CreateEventA (Address: 0x18007b478)
CreateEventW (Address: 0x18007b400)
CreateMutexExW (Address: 0x18007b4a8)
CreateSemaphoreExW (Address: 0x18007b438)
DeleteCriticalSection (Address: 0x18007b490)
EnterCriticalSection (Address: 0x18007b408)
InitializeCriticalSection (Address: 0x18007b4a0)
InitializeCriticalSectionAndSpinCount (Address: 0x18007b450)
InitializeCriticalSectionEx (Address: 0x18007b410)
InitializeSRWLock (Address: 0x18007b498)
LeaveCriticalSection (Address: 0x18007b430)
OpenSemaphoreW (Address: 0x18007b428)
ReleaseMutex (Address: 0x18007b3f8)
ReleaseSemaphore (Address: 0x18007b418)
ReleaseSRWLockExclusive (Address: 0x18007b468)
ReleaseSRWLockShared (Address: 0x18007b448)
ResetEvent (Address: 0x18007b470)
SetEvent (Address: 0x18007b440)
TryAcquireSRWLockExclusive (Address: 0x18007b460)
WaitForSingleObject (Address: 0x18007b420)
WaitForSingleObjectEx (Address: 0x18007b480)

api-ms-win-core-synch-l1-2-0.dll

Sleep (Address: 0x18007b4b8)

api-ms-win-core-sysinfo-l1-1-0.dll

GetComputerNameExW (Address: 0x18007b4e0)
GetSystemInfo (Address: 0x18007b4f8)
GetSystemTimeAsFileTime (Address: 0x18007b4d0)
GetTickCount (Address: 0x18007b4e8)
GetTickCount64 (Address: 0x18007b4f0)
GetVersionExW (Address: 0x18007b4d8)
GetWindowsDirectoryW (Address: 0x18007b4c8)

api-ms-win-core-threadpool-l1-2-0.dll

CloseThreadpoolTimer (Address: 0x18007b510)
CreateThreadpoolTimer (Address: 0x18007b508)
SetThreadpoolTimer (Address: 0x18007b518)
WaitForThreadpoolTimerCallbacks (Address: 0x18007b520)

api-ms-win-core-threadpool-legacy-l1-1-0.dll

ChangeTimerQueueTimer (Address: 0x18007b548)
CreateTimerQueueTimer (Address: 0x18007b530)
DeleteTimerQueueTimer (Address: 0x18007b538)
UnregisterWaitEx (Address: 0x18007b540)

api-ms-win-core-threadpool-private-l1-1-0.dll

RegisterWaitForSingleObjectEx (Address: 0x18007b558)

api-ms-win-core-version-l1-1-0.dll

GetFileVersionInfoExW (Address: 0x18007b570)
GetFileVersionInfoSizeExW (Address: 0x18007b578)
VerQueryValueW (Address: 0x18007b568)

api-ms-win-core-wow64-l1-1-1.dll

GetSystemWow64DirectoryW (Address: 0x18007b588)

api-ms-win-crt-private-l1-1-0.dll

__C_specific_handler (Address: 0x18007b660)
__CxxFrameHandler3 (Address: 0x18007b678)
__std_terminate (Address: 0x18007b680)
_o___std_type_info_destroy_list (Address: 0x18007b650)
_o___stdio_common_vsnwprintf_s (Address: 0x18007b648)
_o___stdio_common_vswprintf (Address: 0x18007b640)
_o__callnewh (Address: 0x18007b638)
_o__cexit (Address: 0x18007b630)
_o__configure_narrow_argv (Address: 0x18007b628)
_o__crt_atexit (Address: 0x18007b620)
_o__execute_onexit_table (Address: 0x18007b618)
_o__initialize_narrow_environment (Address: 0x18007b598)
_o__initialize_onexit_table (Address: 0x18007b5a0)
_o__purecall (Address: 0x18007b5a8)
_o__register_onexit_function (Address: 0x18007b5b0)
_o__seh_filter_dll (Address: 0x18007b5b8)
_o__stricmp (Address: 0x18007b5c0)
_o__wcsicmp (Address: 0x18007b5d0)
_o__wcsnicmp (Address: 0x18007b5d8)
_o__wsplitpath_s (Address: 0x18007b5e0)
_o_free (Address: 0x18007b5e8)
_o_malloc (Address: 0x18007b5f0)
_o_memcpy_s (Address: 0x18007b5f8)
_o_wcscat_s (Address: 0x18007b600)
_o_wcscpy_s (Address: 0x18007b608)
_o_wcsncpy_s (Address: 0x18007b610)
memcmp (Address: 0x18007b668)
memcpy (Address: 0x18007b670)
memmove (Address: 0x18007b5c8)
wcschr (Address: 0x18007b658)
wcsrchr (Address: 0x18007b688)
wcsstr (Address: 0x18007b690)

api-ms-win-crt-runtime-l1-1-0.dll

_initterm (Address: 0x18007b6a8)
_initterm_e (Address: 0x18007b6a0)

api-ms-win-crt-string-l1-1-0.dll

memmove_s (Address: 0x18007b6e0)
memset (Address: 0x18007b6b8)
strcmp (Address: 0x18007b6c0)
wcscmp (Address: 0x18007b6c8)
wcsncmp (Address: 0x18007b6d0)
wcsnlen (Address: 0x18007b6d8)

api-ms-win-crt-time-l1-1-0.dll

_time32 (Address: 0x18007b6f0)

api-ms-win-eventing-classicprovider-l1-1-0.dll

TraceMessage (Address: 0x18007b700)

api-ms-win-eventing-provider-l1-1-0.dll

EventRegister (Address: 0x18007b728)
EventSetInformation (Address: 0x18007b720)
EventUnregister (Address: 0x18007b718)
EventWriteTransfer (Address: 0x18007b710)

api-ms-win-security-base-l1-1-0.dll

AllocateLocallyUniqueId (Address: 0x18007b760)
CreateWellKnownSid (Address: 0x18007b738)
EqualSid (Address: 0x18007b748)
GetLengthSid (Address: 0x18007b750)
GetTokenInformation (Address: 0x18007b740)
RevertToSelf (Address: 0x18007b758)

ntdll.dll

EtwEventRegister (Address: 0x18007b850)
EtwEventUnregister (Address: 0x18007b848)
EtwEventWrite (Address: 0x18007b840)
EtwEventWriteTransfer (Address: 0x18007b898)
EtwGetTraceEnableFlags (Address: 0x18007b920)
EtwGetTraceEnableLevel (Address: 0x18007b928)
EtwGetTraceLoggerHandle (Address: 0x18007b930)
EtwRegisterTraceGuidsW (Address: 0x18007b918)
EtwTraceMessage (Address: 0x18007b8a0)
EtwUnregisterTraceGuids (Address: 0x18007b7e0)
NtAllocateVirtualMemory (Address: 0x18007b8f0)
NtClose (Address: 0x18007b870)
NtCreateEvent (Address: 0x18007b788)
NtDuplicateObject (Address: 0x18007b878)
NtEnumerateKey (Address: 0x18007b8b8)
NtFreeVirtualMemory (Address: 0x18007b8f8)
NtOpenEvent (Address: 0x18007b780)
NtOpenKey (Address: 0x18007b7f0)
NtQuerySystemInformation (Address: 0x18007b778)
NtQuerySystemTime (Address: 0x18007b770)
NtQueryValueKey (Address: 0x18007b8d0)
NtSetEvent (Address: 0x18007b790)
NtSetInformationThread (Address: 0x18007b8e8)
NtWaitForSingleObject (Address: 0x18007b7a0)
RtlAcquireResourceExclusive (Address: 0x18007b838)
RtlAcquireResourceShared (Address: 0x18007b860)
RtlAllocateHeap (Address: 0x18007b8b0)
RtlAnsiStringToUnicodeString (Address: 0x18007b890)
RtlAppendUnicodeToString (Address: 0x18007b8a8)
RtlCompareUnicodeString (Address: 0x18007b8c0)
RtlConvertSharedToExclusive (Address: 0x18007b8c8)
RtlCopySid (Address: 0x18007b810)
RtlDeleteCriticalSection (Address: 0x18007b7d0)
RtlDeleteResource (Address: 0x18007b900)
RtlDeregisterWait (Address: 0x18007b7c0)
RtlDuplicateUnicodeString (Address: 0x18007b798)
RtlEnterCriticalSection (Address: 0x18007b7c8)
RtlEqualUnicodeString (Address: 0x18007b800)
RtlFreeHeap (Address: 0x18007b7e8)
RtlFreeUnicodeString (Address: 0x18007b950)
RtlGetNtProductType (Address: 0x18007b808)
RtlImageNtHeader (Address: 0x18007b7b8)
RtlInitAnsiString (Address: 0x18007b908)
RtlInitializeCriticalSection (Address: 0x18007b7d8)
RtlInitializeResource (Address: 0x18007b7f8)
RtlInitializeSid (Address: 0x18007b828)
RtlInitString (Address: 0x18007b830)
RtlInitUnicodeString (Address: 0x18007b888)
RtlIpv4StringToAddressExW (Address: 0x18007b8e0)
RtlIpv6StringToAddressExW (Address: 0x18007b8d8)
RtlLeaveCriticalSection (Address: 0x18007b910)
RtlLengthSid (Address: 0x18007b818)
RtlNtStatusToDosError (Address: 0x18007b880)
RtlNtStatusToDosErrorNoTeb (Address: 0x18007b868)
RtlPublishWnfStateData (Address: 0x18007b938)
RtlRegisterWait (Address: 0x18007b948)
RtlReleaseResource (Address: 0x18007b858)
RtlSubAuthorityCountSid (Address: 0x18007b7b0)
RtlSubAuthoritySid (Address: 0x18007b820)
RtlValidSid (Address: 0x18007b7a8)
WinSqmSetDWORD (Address: 0x18007b940)