vles.dll

Description: VNPT Endpoint Sensor

Authors: (C) VNPT. All rights reserved

Version: 1.1.1.3

Architecture: 64-bit

Operating System: Windows NT

SHA256: 0b88dad08f2f55ee24d2bceffb7a173e

File Size: 2.6 MB

Uploaded At: June 28, 2026, 1:54 p.m.

Views: 26

Security Warning

This file has been flagged as potentially dangerous.

Reason: Detected potentially dangerous functions used for process injection: OpenProcess

Exported Functions

  • I (Ordinal: 1, Address: 0xb580)
  • ServiceMain (Ordinal: 2, Address: 0xb9a0)

Imported DLLs & Functions

ADVAPI32.dll
  • AllocateAndInitializeSid (Address: 0x18020d128)
  • ChangeServiceConfig2W (Address: 0x18020d010)
  • CloseServiceHandle (Address: 0x18020d030)
  • ControlService (Address: 0x18020d150)
  • ConvertStringSecurityDescriptorToSecurityDescriptorW (Address: 0x18020d118)
  • CreateProcessAsUserW (Address: 0x18020d0e8)
  • CreateServiceA (Address: 0x18020d040)
  • CryptAcquireContextA (Address: 0x18020d058)
  • CryptAcquireContextW (Address: 0x18020d0d0)
  • CryptCreateHash (Address: 0x18020d0b0)
  • CryptDecrypt (Address: 0x18020d098)
  • CryptDeriveKey (Address: 0x18020d0a0)
  • CryptDestroyHash (Address: 0x18020d0c0)
  • CryptDestroyKey (Address: 0x18020d088)
  • CryptEncrypt (Address: 0x18020d090)
  • CryptGenRandom (Address: 0x18020d0d8)
  • CryptGetHashParam (Address: 0x18020d0c8)
  • CryptHashData (Address: 0x18020d0b8)
  • CryptImportKey (Address: 0x18020d0a8)
  • CryptReleaseContext (Address: 0x18020d000)
  • DuplicateTokenEx (Address: 0x18020d0f0)
  • EnumDependentServicesW (Address: 0x18020d158)
  • EnumServicesStatusW (Address: 0x18020d078)
  • FreeSid (Address: 0x18020d140)
  • GetNamedSecurityInfoW (Address: 0x18020d138)
  • GetTokenInformation (Address: 0x18020d0f8)
  • ImpersonateLoggedOnUser (Address: 0x18020d0e0)
  • OpenSCManagerW (Address: 0x18020d020)
  • OpenServiceW (Address: 0x18020d170)
  • QueryServiceConfigW (Address: 0x18020d168)
  • QueryServiceStatusEx (Address: 0x18020d120)
  • RegCloseKey (Address: 0x18020d038)
  • RegCreateKeyExA (Address: 0x18020d008)
  • RegEnumKeyExW (Address: 0x18020d110)
  • RegEnumValueW (Address: 0x18020d080)
  • RegGetValueA (Address: 0x18020d108)
  • RegGetValueW (Address: 0x18020d068)
  • RegisterServiceCtrlHandlerExA (Address: 0x18020d178)
  • RegOpenKeyExA (Address: 0x18020d050)
  • RegOpenKeyExW (Address: 0x18020d070)
  • RegQueryValueExA (Address: 0x18020d028)
  • RegQueryValueExW (Address: 0x18020d048)
  • RegSetValueExA (Address: 0x18020d060)
  • RevertToSelf (Address: 0x18020d100)
  • SetEntriesInAclW (Address: 0x18020d148)
  • SetNamedSecurityInfoW (Address: 0x18020d130)
  • SetServiceStatus (Address: 0x18020d018)
  • StartServiceW (Address: 0x18020d160)
CRYPT32.dll
  • CertAddCertificateContextToStore (Address: 0x18020d1e0)
  • CertCloseStore (Address: 0x18020d198)
  • CertCreateCertificateChainEngine (Address: 0x18020d1c0)
  • CertEnumCertificatesInStore (Address: 0x18020d200)
  • CertFindCertificateInStore (Address: 0x18020d190)
  • CertFindExtension (Address: 0x18020d1d8)
  • CertFreeCertificateChain (Address: 0x18020d1a8)
  • CertFreeCertificateChainEngine (Address: 0x18020d1b8)
  • CertFreeCertificateContext (Address: 0x18020d208)
  • CertGetCertificateChain (Address: 0x18020d1b0)
  • CertGetNameStringA (Address: 0x18020d1d0)
  • CertOpenStore (Address: 0x18020d1f8)
  • CryptBinaryToStringA (Address: 0x18020d1e8)
  • CryptDecodeObjectEx (Address: 0x18020d210)
  • CryptHashPublicKeyInfo (Address: 0x18020d1f0)
  • CryptQueryObject (Address: 0x18020d1c8)
  • CryptStringToBinaryA (Address: 0x18020d1a0)
  • PFXImportCertStore (Address: 0x18020d188)
IPHLPAPI.DLL
  • GetAdaptersAddresses (Address: 0x18020d228)
  • GetAdaptersInfo (Address: 0x18020d220)
KERNEL32.dll
  • AcquireSRWLockExclusive (Address: 0x18020d610)
  • AreFileApisANSI (Address: 0x18020d4c0)
  • CancelIo (Address: 0x18020d368)
  • CloseHandle (Address: 0x18020d270)
  • CompareStringEx (Address: 0x18020d640)
  • CompareStringW (Address: 0x18020d798)
  • ConnectNamedPipe (Address: 0x18020d338)
  • CreateDirectoryA (Address: 0x18020d410)
  • CreateDirectoryW (Address: 0x18020d898)
  • CreateEventW (Address: 0x18020d260)
  • CreateFileA (Address: 0x18020d370)
  • CreateFileMappingW (Address: 0x18020d5c0)
  • CreateFileW (Address: 0x18020d2a0)
  • CreateMutexW (Address: 0x18020d518)
  • CreateNamedPipeW (Address: 0x18020d320)
  • CreatePipe (Address: 0x18020d438)
  • CreateProcessW (Address: 0x18020d450)
  • CreateThread (Address: 0x18020d278)
  • CreateToolhelp32Snapshot (Address: 0x18020d3b8)
  • DecodePointer (Address: 0x18020d458)
  • DeleteCriticalSection (Address: 0x18020d238)
  • DeleteFileA (Address: 0x18020d3e0)
  • DeleteFileW (Address: 0x18020d2a8)
  • DisconnectNamedPipe (Address: 0x18020d328)
  • DuplicateHandle (Address: 0x18020d760)
  • EncodePointer (Address: 0x18020d630)
  • EnterCriticalSection (Address: 0x18020d4d8)
  • EnumSystemLocalesW (Address: 0x18020d7c0)
  • ExitProcess (Address: 0x18020d728)
  • ExitThread (Address: 0x18020d768)
  • ExpandEnvironmentStringsA (Address: 0x18020d340)
  • ExpandEnvironmentStringsW (Address: 0x18020d2d0)
  • FileTimeToSystemTime (Address: 0x18020d758)
  • FindClose (Address: 0x18020d448)
  • FindFirstFileExW (Address: 0x18020d808)
  • FindFirstFileW (Address: 0x18020d420)
  • FindNextFileW (Address: 0x18020d428)
  • FindResourceExW (Address: 0x18020d3f8)
  • FindResourceW (Address: 0x18020d408)
  • FlushFileBuffers (Address: 0x18020d310)
  • FlushViewOfFile (Address: 0x18020d560)
  • FormatMessageA (Address: 0x18020d5b8)
  • FormatMessageW (Address: 0x18020d348)
  • FreeEnvironmentStringsW (Address: 0x18020d840)
  • FreeLibrary (Address: 0x18020d2c0)
  • FreeLibraryAndExitThread (Address: 0x18020d770)
  • GetACP (Address: 0x18020d818)
  • GetCommandLineA (Address: 0x18020d828)
  • GetCommandLineW (Address: 0x18020d830)
  • GetComputerNameA (Address: 0x18020d360)
  • GetConsoleMode (Address: 0x18020d7e0)
  • GetConsoleOutputCP (Address: 0x18020d7d8)
  • GetCPInfo (Address: 0x18020d648)
  • GetCurrentDirectoryW (Address: 0x18020d7f0)
  • GetCurrentProcess (Address: 0x18020d398)
  • GetCurrentProcessId (Address: 0x18020d598)
  • GetCurrentThreadId (Address: 0x18020d520)
  • GetDateFormatW (Address: 0x18020d788)
  • GetDiskFreeSpaceA (Address: 0x18020d540)
  • GetDiskFreeSpaceW (Address: 0x18020d4e0)
  • GetDriveTypeW (Address: 0x18020d738)
  • GetEnvironmentStringsW (Address: 0x18020d838)
  • GetEnvironmentVariableA (Address: 0x18020d870)
  • GetExitCodeProcess (Address: 0x18020d418)
  • GetFileAttributesA (Address: 0x18020d548)
  • GetFileAttributesExW (Address: 0x18020d550)
  • GetFileAttributesW (Address: 0x18020d460)
  • GetFileInformationByHandle (Address: 0x18020d740)
  • GetFileSize (Address: 0x18020d2f8)
  • GetFileSizeEx (Address: 0x18020d7c8)
  • GetFileType (Address: 0x18020d748)
  • GetFullPathNameA (Address: 0x18020d500)
  • GetFullPathNameW (Address: 0x18020d390)
  • GetLastError (Address: 0x18020d670)
  • GetLocaleInfoEx (Address: 0x18020d628)
  • GetLocaleInfoW (Address: 0x18020d7a8)
  • GetLocalTime (Address: 0x18020d2f0)
  • GetModuleFileNameA (Address: 0x18020d248)
  • GetModuleFileNameW (Address: 0x18020d778)
  • GetModuleHandleA (Address: 0x18020d868)
  • GetModuleHandleExW (Address: 0x18020d730)
  • GetModuleHandleW (Address: 0x18020d350)
  • GetNativeSystemInfo (Address: 0x18020d3f0)
  • GetOEMCP (Address: 0x18020d820)
  • GetOverlappedResult (Address: 0x18020d378)
  • GetProcAddress (Address: 0x18020d2b8)
  • GetProcessHeap (Address: 0x18020d240)
  • GetStartupInfoW (Address: 0x18020d380)
  • GetStdHandle (Address: 0x18020d780)
  • GetStringTypeW (Address: 0x18020d618)
  • GetSystemDirectoryA (Address: 0x18020d860)
  • GetSystemInfo (Address: 0x18020d578)
  • GetSystemTime (Address: 0x18020d5b0)
  • GetSystemTimeAsFileTime (Address: 0x18020d5a8)
  • GetTempPathA (Address: 0x18020d538)
  • GetTempPathW (Address: 0x18020d510)
  • GetTickCount (Address: 0x18020d2c8)
  • GetTimeFormatW (Address: 0x18020d790)
  • GetTimeZoneInformation (Address: 0x18020d800)
  • GetUserDefaultLCID (Address: 0x18020d7b8)
  • HeapAlloc (Address: 0x18020d658)
  • HeapCompact (Address: 0x18020d580)
  • HeapCreate (Address: 0x18020d4d0)
  • HeapDestroy (Address: 0x18020d888)
  • HeapFree (Address: 0x18020d690)
  • HeapReAlloc (Address: 0x18020d668)
  • HeapSize (Address: 0x18020d680)
  • HeapValidate (Address: 0x18020d530)
  • InitializeConditionVariable (Address: 0x18020d5d8)
  • InitializeCriticalSection (Address: 0x18020d4f8)
  • InitializeCriticalSectionAndSpinCount (Address: 0x18020d698)
  • InitializeCriticalSectionEx (Address: 0x18020d688)
  • InitializeSListHead (Address: 0x18020d6d8)
  • InitializeSRWLock (Address: 0x18020d600)
  • InterlockedFlushSList (Address: 0x18020d6e8)
  • IsDebuggerPresent (Address: 0x18020d650)
  • IsProcessorFeaturePresent (Address: 0x18020d6d0)
  • IsValidCodePage (Address: 0x18020d810)
  • IsValidLocale (Address: 0x18020d7b0)
  • K32EnumProcesses (Address: 0x18020d498)
  • K32EnumProcessModules (Address: 0x18020d4a0)
  • K32GetModuleFileNameExW (Address: 0x18020d470)
  • LCMapStringEx (Address: 0x18020d638)
  • LCMapStringW (Address: 0x18020d7a0)
  • LeaveCriticalSection (Address: 0x18020d4f0)
  • LoadLibraryA (Address: 0x18020d568)
  • LoadLibraryExW (Address: 0x18020d720)
  • LoadLibraryW (Address: 0x18020d2b0)
  • LoadResource (Address: 0x18020d400)
  • LocalFree (Address: 0x18020d288)
  • LockFile (Address: 0x18020d2d8)
  • LockFileEx (Address: 0x18020d590)
  • LockResource (Address: 0x18020d3d8)
  • lstrcmpiA (Address: 0x18020d280)
  • lstrlenA (Address: 0x18020d250)
  • lstrlenW (Address: 0x18020d318)
  • MapViewOfFile (Address: 0x18020d5c8)
  • MoveFileExA (Address: 0x18020d3d0)
  • MoveFileExW (Address: 0x18020d300)
  • MoveFileW (Address: 0x18020d308)
  • MultiByteToWideChar (Address: 0x18020d468)
  • OpenProcess (Address: 0x18020d3b0)
  • OpenThread (Address: 0x18020d4a8)
  • OutputDebugStringA (Address: 0x18020d4e8)
  • OutputDebugStringW (Address: 0x18020d558)
  • PeekNamedPipe (Address: 0x18020d440)
  • Process32FirstW (Address: 0x18020d3e8)
  • Process32NextW (Address: 0x18020d3c8)
  • QueryPerformanceCounter (Address: 0x18020d5d0)
  • QueryPerformanceFrequency (Address: 0x18020d620)
  • RaiseException (Address: 0x18020d660)
  • ReadConsoleW (Address: 0x18020d7e8)
  • ReadFile (Address: 0x18020d290)
  • ReleaseSRWLockExclusive (Address: 0x18020d608)
  • RemoveDirectoryW (Address: 0x18020d430)
  • ResetEvent (Address: 0x18020d6a0)
  • ResumeThread (Address: 0x18020d490)
  • RtlCaptureContext (Address: 0x18020d6a8)
  • RtlLookupFunctionEntry (Address: 0x18020d6b0)
  • RtlPcToFileHeader (Address: 0x18020d6f0)
  • RtlUnwind (Address: 0x18020d8a0)
  • RtlUnwindEx (Address: 0x18020d6e0)
  • RtlVirtualUnwind (Address: 0x18020d6b8)
  • SetEndOfFile (Address: 0x18020d2e8)
  • SetEnvironmentVariableW (Address: 0x18020d848)
  • SetEvent (Address: 0x18020d268)
  • SetFilePointer (Address: 0x18020d2e0)
  • SetFilePointerEx (Address: 0x18020d7d0)
  • SetLastError (Address: 0x18020d6f8)
  • SetNamedPipeHandleState (Address: 0x18020d4b0)
  • SetStdHandle (Address: 0x18020d7f8)
  • SetUnhandledExceptionFilter (Address: 0x18020d6c8)
  • SizeofResource (Address: 0x18020d388)
  • Sleep (Address: 0x18020d678)
  • SleepConditionVariableCS (Address: 0x18020d5f0)
  • SleepConditionVariableSRW (Address: 0x18020d5f8)
  • SleepEx (Address: 0x18020d858)
  • SuspendThread (Address: 0x18020d488)
  • SystemTimeToFileTime (Address: 0x18020d5a0)
  • SystemTimeToTzSpecificLocalTime (Address: 0x18020d750)
  • TerminateProcess (Address: 0x18020d3a8)
  • Thread32First (Address: 0x18020d480)
  • Thread32Next (Address: 0x18020d478)
  • TlsAlloc (Address: 0x18020d700)
  • TlsFree (Address: 0x18020d718)
  • TlsGetValue (Address: 0x18020d708)
  • TlsSetValue (Address: 0x18020d710)
  • TryEnterCriticalSection (Address: 0x18020d4c8)
  • UnhandledExceptionFilter (Address: 0x18020d6c0)
  • UnlockFile (Address: 0x18020d588)
  • UnlockFileEx (Address: 0x18020d508)
  • UnmapViewOfFile (Address: 0x18020d528)
  • VerifyVersionInfoW (Address: 0x18020d890)
  • VerSetConditionMask (Address: 0x18020d880)
  • WaitForMultipleObjects (Address: 0x18020d878)
  • WaitForSingleObject (Address: 0x18020d258)
  • WaitForSingleObjectEx (Address: 0x18020d570)
  • WaitNamedPipeW (Address: 0x18020d4b8)
  • WakeAllConditionVariable (Address: 0x18020d5e8)
  • WakeConditionVariable (Address: 0x18020d5e0)
  • WideCharToMultiByte (Address: 0x18020d358)
  • WinExec (Address: 0x18020d330)
  • Wow64DisableWow64FsRedirection (Address: 0x18020d3a0)
  • Wow64RevertWow64FsRedirection (Address: 0x18020d3c0)
  • WriteConsoleW (Address: 0x18020d850)
  • WriteFile (Address: 0x18020d298)
NETAPI32.dll
  • NetApiBufferFree (Address: 0x18020d8b0)
  • NetUserEnum (Address: 0x18020d8b8)
  • NetUserGetInfo (Address: 0x18020d8c8)
  • NetUserModalsGet (Address: 0x18020d8c0)
Normaliz.dll
  • IdnToAscii (Address: 0x18020d8d8)
ole32.dll
  • CoCreateInstance (Address: 0x18020dc48)
  • CoInitialize (Address: 0x18020dc30)
  • CoInitializeEx (Address: 0x18020dc38)
  • CoInitializeSecurity (Address: 0x18020dc40)
  • CoSetProxyBlanket (Address: 0x18020dc20)
  • CoUninitialize (Address: 0x18020dc28)
OLEAUT32.dll
  • SafeArrayAccessData (Address: 0x18020d918)
  • SafeArrayGetElement (Address: 0x18020d920)
  • SafeArrayGetLBound (Address: 0x18020d908)
  • SafeArrayGetUBound (Address: 0x18020d900)
  • SafeArrayUnaccessData (Address: 0x18020d910)
  • SysAllocString (Address: 0x18020d928)
  • SysFreeString (Address: 0x18020d8f8)
  • SysStringLen (Address: 0x18020d8e8)
  • VariantChangeType (Address: 0x18020d938)
  • VariantClear (Address: 0x18020d930)
  • VariantInit (Address: 0x18020d8f0)
SHELL32.dll
  • ShellExecuteA (Address: 0x18020d948)
  • ShellExecuteExA (Address: 0x18020d950)
  • ShellExecuteW (Address: 0x18020d958)
SHLWAPI.dll
  • PathFileExistsA (Address: 0x18020d990)
  • PathFileExistsW (Address: 0x18020d988)
  • PathFindExtensionW (Address: 0x18020d970)
  • PathFindFileNameW (Address: 0x18020d980)
  • PathIsDirectoryA (Address: 0x18020d978)
  • PathIsDirectoryW (Address: 0x18020d968)
USER32.dll
  • wsprintfW (Address: 0x18020d9a0)
USERENV.dll
  • CreateEnvironmentBlock (Address: 0x18020d9b0)
  • DestroyEnvironmentBlock (Address: 0x18020d9b8)
VERSION.dll
  • GetFileVersionInfoA (Address: 0x18020d9c8)
  • GetFileVersionInfoSizeA (Address: 0x18020d9d8)
  • VerQueryValueA (Address: 0x18020d9d0)
WINTRUST.dll
  • CryptCATAdminAcquireContext (Address: 0x18020da08)
  • CryptCATAdminCalcHashFromFileHandle (Address: 0x18020da28)
  • CryptCATAdminEnumCatalogFromHash (Address: 0x18020da00)
  • CryptCATAdminReleaseCatalogContext (Address: 0x18020da20)
  • CryptCATAdminReleaseContext (Address: 0x18020da18)
  • CryptCATCatalogInfoFromContext (Address: 0x18020da10)
  • WinVerifyTrust (Address: 0x18020d9f8)
  • WTHelperGetProvSignerFromChain (Address: 0x18020d9e8)
  • WTHelperProvDataFromStateData (Address: 0x18020d9f0)
WLDAP32.dll
  • (Address: 0x18020da68)
  • (Address: 0x18020da70)
  • (Address: 0x18020da78)
  • (Address: 0x18020da80)
  • (Address: 0x18020da88)
  • (Address: 0x18020da90)
  • (Address: 0x18020da98)
  • (Address: 0x18020daa0)
  • (Address: 0x18020daa8)
  • (Address: 0x18020dab0)
  • (Address: 0x18020dab8)
  • (Address: 0x18020dac0)
  • (Address: 0x18020da38)
  • (Address: 0x18020da40)
  • (Address: 0x18020da48)
  • (Address: 0x18020da50)
  • (Address: 0x18020da58)
  • (Address: 0x18020da60)
WS2_32.dll
  • __WSAFDIsSet (Address: 0x18020dae8)
  • accept (Address: 0x18020dad8)
  • bind (Address: 0x18020db60)
  • closesocket (Address: 0x18020dbe0)
  • connect (Address: 0x18020dba0)
  • freeaddrinfo (Address: 0x18020db88)
  • getaddrinfo (Address: 0x18020db38)
  • gethostname (Address: 0x18020dbc0)
  • getpeername (Address: 0x18020db58)
  • getsockname (Address: 0x18020db50)
  • getsockopt (Address: 0x18020db18)
  • htonl (Address: 0x18020dad0)
  • htons (Address: 0x18020db10)
  • inet_ntop (Address: 0x18020db20)
  • ioctlsocket (Address: 0x18020dbb8)
  • listen (Address: 0x18020db30)
  • ntohs (Address: 0x18020dba8)
  • recv (Address: 0x18020db90)
  • recvfrom (Address: 0x18020db28)
  • select (Address: 0x18020dae0)
  • send (Address: 0x18020db80)
  • sendto (Address: 0x18020db78)
  • setsockopt (Address: 0x18020db08)
  • socket (Address: 0x18020dbb0)
  • WSACleanup (Address: 0x18020daf0)
  • WSACloseEvent (Address: 0x18020db48)
  • WSACreateEvent (Address: 0x18020db98)
  • WSAEnumNetworkEvents (Address: 0x18020dbd8)
  • WSAEventSelect (Address: 0x18020dbd0)
  • WSAGetLastError (Address: 0x18020db68)
  • WSAIoctl (Address: 0x18020daf8)
  • WSAResetEvent (Address: 0x18020dbc8)
  • WSASetLastError (Address: 0x18020db00)
  • WSAStartup (Address: 0x18020db40)
  • WSAWaitForMultipleEvents (Address: 0x18020db70)
WTSAPI32.dll
  • WTSEnumerateSessionsA (Address: 0x18020dbf8)
  • WTSEnumerateSessionsW (Address: 0x18020dc00)
  • WTSFreeMemory (Address: 0x18020dbf0)
  • WTSQuerySessionInformationW (Address: 0x18020dc08)
  • WTSQueryUserToken (Address: 0x18020dc10)