Search.ProtocolHandler.MAPI2.dll

Description: Microsoft Search Protocol Handler for MAPI2

Version: 7.0.19041.6456

Architecture: 64-bit

Operating System: Windows NT

SHA256: dc237c9485555db5c2c462b37ac4f371

File Size: 417.5 KB

Uploaded At: Dec. 1, 2025, 7:38 a.m.

Views: 4

Security Warning

This file has been flagged as potentially dangerous.

Reason: Detected potentially dangerous functions used for process injection: OpenProcess

Exported Functions

DllCanUnloadNow (Ordinal: 1, Address: 0x46f0)
DllGetClassObject (Ordinal: 2, Address: 0x4710)
DllRegisterServer (Ordinal: 3, Address: 0x4840)
DllUnregisterServer (Ordinal: 4, Address: 0x4930)

Imported DLLs & Functions

api-ms-win-core-com-l2-1-1.dll

StgOpenStorageOnILockBytes (Address: 0x160047650)

api-ms-win-core-debug-l1-1-0.dll

DebugBreak (Address: 0x160047660)
IsDebuggerPresent (Address: 0x160047678)
OutputDebugStringA (Address: 0x160047668)
OutputDebugStringW (Address: 0x160047670)

api-ms-win-core-delayload-l1-1-0.dll

DelayLoadFailureHook (Address: 0x160047688)

api-ms-win-core-delayload-l1-1-1.dll

ResolveDelayLoadedAPI (Address: 0x160047698)

api-ms-win-core-errorhandling-l1-1-0.dll

GetLastError (Address: 0x1600476c8)
RaiseException (Address: 0x1600476a8)
SetLastError (Address: 0x1600476c0)
SetUnhandledExceptionFilter (Address: 0x1600476b8)
UnhandledExceptionFilter (Address: 0x1600476b0)

api-ms-win-core-file-l1-1-0.dll

CreateFileW (Address: 0x1600476e0)
DeleteFileW (Address: 0x1600476d8)
FileTimeToLocalFileTime (Address: 0x160047718)
FindClose (Address: 0x1600476e8)
FindFirstFileW (Address: 0x160047708)
FindNextFileW (Address: 0x160047710)
FlushFileBuffers (Address: 0x160047700)
GetFileSize (Address: 0x1600476f0)
WriteFile (Address: 0x1600476f8)

api-ms-win-core-handle-l1-1-0.dll

CloseHandle (Address: 0x160047728)
DuplicateHandle (Address: 0x160047730)

api-ms-win-core-heap-l1-1-0.dll

GetProcessHeap (Address: 0x160047740)
HeapAlloc (Address: 0x160047750)
HeapDestroy (Address: 0x160047758)
HeapFree (Address: 0x160047760)
HeapReAlloc (Address: 0x160047748)
HeapSize (Address: 0x160047768)

api-ms-win-core-heap-l2-1-0.dll

GlobalAlloc (Address: 0x160047780)
GlobalFree (Address: 0x160047788)
LocalAlloc (Address: 0x160047778)
LocalFree (Address: 0x160047790)

api-ms-win-core-kernel32-legacy-l1-1-0.dll

MoveFileW (Address: 0x1600477a0)

api-ms-win-core-libraryloader-l1-2-0.dll

DisableThreadLibraryCalls (Address: 0x1600477b8)
FindResourceExW (Address: 0x160047800)
FreeLibrary (Address: 0x1600477e0)
GetModuleFileNameA (Address: 0x160047808)
GetModuleFileNameW (Address: 0x1600477f8)
GetModuleHandleExW (Address: 0x1600477d8)
GetModuleHandleW (Address: 0x1600477d0)
GetProcAddress (Address: 0x1600477c8)
LoadLibraryExW (Address: 0x1600477f0)
LoadResource (Address: 0x1600477b0)
LoadStringW (Address: 0x1600477c0)
LockResource (Address: 0x1600477e8)
SizeofResource (Address: 0x160047810)

api-ms-win-core-libraryloader-l1-2-1.dll

LoadLibraryW (Address: 0x160047820)

api-ms-win-core-localization-l1-2-0.dll

FormatMessageW (Address: 0x160047848)
GetLocaleInfoW (Address: 0x160047838)
GetSystemDefaultLCID (Address: 0x160047840)
IsValidCodePage (Address: 0x160047830)

api-ms-win-core-localization-obsolete-l1-2-0.dll

GetSystemDefaultUILanguage (Address: 0x160047860)
GetUserDefaultUILanguage (Address: 0x160047858)

api-ms-win-core-memory-l1-1-0.dll

CreateFileMappingW (Address: 0x160047888)
MapViewOfFile (Address: 0x160047878)
OpenFileMappingW (Address: 0x160047870)
UnmapViewOfFile (Address: 0x160047880)

api-ms-win-core-processenvironment-l1-1-0.dll

ExpandEnvironmentStringsW (Address: 0x160047898)
SearchPathW (Address: 0x1600478a0)

api-ms-win-core-processthreads-l1-1-0.dll

CreateThread (Address: 0x1600478c8)
GetCurrentProcess (Address: 0x1600478c0)
GetCurrentProcessId (Address: 0x1600478d0)
GetCurrentThreadId (Address: 0x1600478d8)
OpenProcessToken (Address: 0x1600478b8)
SetPriorityClass (Address: 0x1600478e0)
TerminateProcess (Address: 0x1600478b0)

api-ms-win-core-processthreads-l1-1-1.dll

OpenProcess (Address: 0x1600478f0)

api-ms-win-core-profile-l1-1-0.dll

QueryPerformanceCounter (Address: 0x160047900)

api-ms-win-core-registry-l1-1-0.dll

RegCloseKey (Address: 0x160047950)
RegCreateKeyExW (Address: 0x160047920)
RegDeleteKeyExW (Address: 0x160047958)
RegDeleteValueW (Address: 0x160047928)
RegEnumKeyExW (Address: 0x160047930)
RegEnumValueW (Address: 0x160047960)
RegGetValueW (Address: 0x160047938)
RegOpenKeyExW (Address: 0x160047948)
RegQueryInfoKeyW (Address: 0x160047940)
RegQueryValueExW (Address: 0x160047918)
RegSetValueExW (Address: 0x160047910)

api-ms-win-core-rtlsupport-l1-1-0.dll

RtlCaptureContext (Address: 0x160047980)
RtlLookupFunctionEntry (Address: 0x160047978)
RtlVirtualUnwind (Address: 0x160047970)

api-ms-win-core-shlwapi-obsolete-l1-1-0.dll

StrCmpNIA (Address: 0x160047998)
StrCmpNIW (Address: 0x160047990)

api-ms-win-core-string-l1-1-0.dll

CompareStringOrdinal (Address: 0x1600479b8)
CompareStringW (Address: 0x1600479b0)
MultiByteToWideChar (Address: 0x1600479a8)
WideCharToMultiByte (Address: 0x1600479c0)

api-ms-win-core-string-l2-1-0.dll

CharNextW (Address: 0x1600479d0)

api-ms-win-core-string-obsolete-l1-1-0.dll

lstrcmpiW (Address: 0x1600479e0)

api-ms-win-core-synch-l1-1-0.dll

AcquireSRWLockExclusive (Address: 0x160047a48)
AcquireSRWLockShared (Address: 0x160047a68)
CreateEventW (Address: 0x160047a20)
CreateMutexExW (Address: 0x160047a38)
CreateSemaphoreExW (Address: 0x160047a58)
DeleteCriticalSection (Address: 0x1600479f8)
EnterCriticalSection (Address: 0x160047a00)
InitializeCriticalSection (Address: 0x160047a10)
InitializeCriticalSectionEx (Address: 0x160047a18)
LeaveCriticalSection (Address: 0x1600479f0)
OpenMutexW (Address: 0x160047a08)
OpenSemaphoreW (Address: 0x160047a40)
ReleaseMutex (Address: 0x160047a50)
ReleaseSemaphore (Address: 0x160047a70)
ReleaseSRWLockExclusive (Address: 0x160047a60)
ReleaseSRWLockShared (Address: 0x160047a30)
SetEvent (Address: 0x160047a28)
WaitForSingleObject (Address: 0x160047a78)
WaitForSingleObjectEx (Address: 0x160047a80)

api-ms-win-core-synch-l1-2-0.dll

InitOnceExecuteOnce (Address: 0x160047aa0)
Sleep (Address: 0x160047aa8)
SleepConditionVariableSRW (Address: 0x160047a98)
WakeAllConditionVariable (Address: 0x160047a90)

api-ms-win-core-synch-l1-2-1.dll

CreateSemaphoreW (Address: 0x160047ab8)

api-ms-win-core-sysinfo-l1-1-0.dll

GetSystemTimeAsFileTime (Address: 0x160047ad8)
GetTickCount (Address: 0x160047ac8)
GetVersionExW (Address: 0x160047ad0)

api-ms-win-core-threadpool-l1-2-0.dll

CloseThreadpoolTimer (Address: 0x160047af8)
CreateThreadpoolTimer (Address: 0x160047af0)
SetThreadpoolTimer (Address: 0x160047ae8)
WaitForThreadpoolTimerCallbacks (Address: 0x160047b00)

api-ms-win-core-timezone-l1-1-0.dll

FileTimeToSystemTime (Address: 0x160047b10)

api-ms-win-core-version-l1-1-0.dll

GetFileVersionInfoExW (Address: 0x160047b20)
GetFileVersionInfoSizeExW (Address: 0x160047b30)
VerQueryValueW (Address: 0x160047b28)

api-ms-win-eventing-provider-l1-1-0.dll

EventProviderEnabled (Address: 0x160047b50)
EventRegister (Address: 0x160047b48)
EventSetInformation (Address: 0x160047b58)
EventUnregister (Address: 0x160047b40)
EventWriteTransfer (Address: 0x160047b60)

api-ms-win-rtcore-ntuser-synch-l1-1-0.dll

MsgWaitForMultipleObjects (Address: 0x160047b70)

api-ms-win-rtcore-ntuser-window-l1-1-0.dll

DispatchMessageW (Address: 0x160047b80)
PeekMessageW (Address: 0x160047b88)
TranslateMessage (Address: 0x160047b90)

msvcrt.dll

__C_specific_handler (Address: 0x160047cd8)
__CxxFrameHandler3 (Address: 0x160047c08)
__dllonexit (Address: 0x160047ba8)
_amsg_exit (Address: 0x160047bc8)
_CxxThrowException (Address: 0x160047ce0)
_errno (Address: 0x160047d60)
_initterm (Address: 0x160047bf0)
_localtime64 (Address: 0x160047d50)
_lock (Address: 0x160047cf0)
_ltow (Address: 0x160047c18)
_mktime64 (Address: 0x160047c28)
_onexit (Address: 0x160047ba0)
_purecall (Address: 0x160047c98)
_time64 (Address: 0x160047d58)
_unlock (Address: 0x160047ce8)
_vscwprintf (Address: 0x160047c88)
_vsnprintf (Address: 0x160047c30)
_vsnprintf_s (Address: 0x160047cf8)
_vsnwprintf (Address: 0x160047d48)
_wcsicmp (Address: 0x160047c90)
_wcsnicmp (Address: 0x160047c20)
_wcsupr (Address: 0x160047bd0)
_wcsupr_s (Address: 0x160047be8)
_wtoi (Address: 0x160047bf8)
_wtol (Address: 0x160047c78)
_XcptFilter (Address: 0x160047bb0)
??0exception@@QEAA@AEBV0@@Z (Address: 0x160047d00)
??0exception@@QEAA@XZ (Address: 0x160047d08)
??1exception@@UEAA@XZ (Address: 0x160047d10)
??1type_info@@UEAA@XZ (Address: 0x160047bc0)
?terminate@@YAXXZ (Address: 0x160047d20)
bsearch (Address: 0x160047d28)
calloc (Address: 0x160047bb8)
free (Address: 0x160047cb8)
iswdigit (Address: 0x160047c50)
iswspace (Address: 0x160047c48)
malloc (Address: 0x160047cc8)
memcmp (Address: 0x160047c10)
memcpy (Address: 0x160047c38)
memcpy_s (Address: 0x160047d40)
memmove (Address: 0x160047cd0)
memmove_s (Address: 0x160047c70)
memset (Address: 0x160047be0)
realloc (Address: 0x160047bd8)
strrchr (Address: 0x160047d30)
toupper (Address: 0x160047d18)
vswprintf_s (Address: 0x160047c80)
wcscat_s (Address: 0x160047ca0)
wcschr (Address: 0x160047c60)
wcscmp (Address: 0x160047d68)
wcscpy_s (Address: 0x160047cb0)
wcsftime (Address: 0x160047cc0)
wcsncmp (Address: 0x160047c40)
wcsncpy_s (Address: 0x160047ca8)
wcsrchr (Address: 0x160047c58)
wcsstr (Address: 0x160047c68)
wcstoul (Address: 0x160047c00)
wctomb (Address: 0x160047d38)

ntdll.dll

EtwEventRegister (Address: 0x160047d98)
EtwEventUnregister (Address: 0x160047d90)
EtwEventWriteTransfer (Address: 0x160047d88)
RtlGetPersistedStateLocation (Address: 0x160047d78)
RtlIsStateSeparationEnabled (Address: 0x160047d80)
RtlNtStatusToDosError (Address: 0x160047da0)

OLEAUT32.dll

SysAllocString (Address: 0x160047628)
SysFreeString (Address: 0x160047608)
SysStringLen (Address: 0x160047600)
VariantClear (Address: 0x160047618)
VariantInit (Address: 0x160047620)
VarUI4FromStr (Address: 0x160047610)

TQUERY.DLL

ciDelete (Address: 0x160047638)
ciNewNoThrow (Address: 0x160047640)