Windows.Cortana.Desktop.dll

Description: Windows.Cortana.Desktop

Version: 10.0.19041.5794

Architecture: 64-bit

Operating System: Windows NT

SHA256: a7436e8585431d30b81d9937de230689

File Size: 615.0 KB

Uploaded At: Dec. 1, 2025, 7:43 a.m.

Views: 4

Security Warning

This file has been flagged as potentially dangerous.

Reason: Detected potentially dangerous functions used for process injection: OpenProcess

Exported Functions

DllCanUnloadNow (Ordinal: 1, Address: 0xf3f0)
DllGetActivationFactory (Ordinal: 2, Address: 0xf170)
DllGetClassObject (Ordinal: 3, Address: 0x2c4c0)

Imported DLLs & Functions

api-ms-win-appmodel-runtime-l1-1-0.dll

GetPackageFamilyName (Address: 0x180073fc8)
GetPackagesByPackageFamily (Address: 0x180073fc0)

api-ms-win-core-apiquery-l1-1-0.dll

ApiSetQueryApiSetPresence (Address: 0x180073fd8)

api-ms-win-core-debug-l1-1-0.dll

DebugBreak (Address: 0x180073ff8)
IsDebuggerPresent (Address: 0x180073ff0)
OutputDebugStringW (Address: 0x180073fe8)

api-ms-win-core-delayload-l1-1-0.dll

DelayLoadFailureHook (Address: 0x180074008)

api-ms-win-core-delayload-l1-1-1.dll

ResolveDelayLoadedAPI (Address: 0x180074018)

api-ms-win-core-errorhandling-l1-1-0.dll

GetLastError (Address: 0x180074048)
RaiseException (Address: 0x180074038)
SetLastError (Address: 0x180074040)
SetUnhandledExceptionFilter (Address: 0x180074028)
UnhandledExceptionFilter (Address: 0x180074030)

api-ms-win-core-file-l1-1-0.dll

CreateFileW (Address: 0x180074060)
GetDiskFreeSpaceExW (Address: 0x180074070)
GetDriveTypeW (Address: 0x180074078)
GetLogicalDriveStringsW (Address: 0x180074080)
GetLongPathNameW (Address: 0x180074058)
GetTempFileNameW (Address: 0x180074068)

api-ms-win-core-file-l1-2-0.dll

GetTempPathW (Address: 0x180074090)

api-ms-win-core-handle-l1-1-0.dll

CloseHandle (Address: 0x1800740a0)
DuplicateHandle (Address: 0x1800740a8)

api-ms-win-core-heap-l1-1-0.dll

GetProcessHeap (Address: 0x1800740c0)
HeapAlloc (Address: 0x1800740c8)
HeapFree (Address: 0x1800740b8)

api-ms-win-core-heap-l2-1-0.dll

LocalFree (Address: 0x1800740d8)

api-ms-win-core-libraryloader-l1-2-0.dll

DisableThreadLibraryCalls (Address: 0x180074100)
GetModuleFileNameA (Address: 0x1800740f8)
GetModuleHandleExW (Address: 0x180074108)
GetModuleHandleW (Address: 0x1800740e8)
GetProcAddress (Address: 0x1800740f0)

api-ms-win-core-localization-l1-2-0.dll

FormatMessageW (Address: 0x180074120)
LocaleNameToLCID (Address: 0x180074128)
ResolveLocaleName (Address: 0x180074118)

api-ms-win-core-path-l1-1-0.dll

PathAllocCombine (Address: 0x180074138)
PathCchAppend (Address: 0x180074140)
PathCchCombine (Address: 0x180074148)

api-ms-win-core-processenvironment-l1-1-0.dll

ExpandEnvironmentStringsW (Address: 0x180074158)

api-ms-win-core-processthreads-l1-1-0.dll

GetCurrentProcess (Address: 0x180074190)
GetCurrentProcessId (Address: 0x1800741a0)
GetCurrentThread (Address: 0x180074180)
GetCurrentThreadId (Address: 0x180074178)
GetProcessId (Address: 0x180074170)
OpenProcessToken (Address: 0x180074188)
OpenThreadToken (Address: 0x180074198)
TerminateProcess (Address: 0x180074168)

api-ms-win-core-processthreads-l1-1-1.dll

OpenProcess (Address: 0x1800741b0)

api-ms-win-core-profile-l1-1-0.dll

QueryPerformanceCounter (Address: 0x1800741c0)

api-ms-win-core-psapi-l1-1-0.dll

QueryFullProcessImageNameW (Address: 0x1800741d0)

api-ms-win-core-registry-l1-1-0.dll

RegCloseKey (Address: 0x1800741f8)
RegCreateKeyExW (Address: 0x1800741e8)
RegGetValueW (Address: 0x180074200)
RegOpenKeyExW (Address: 0x1800741f0)
RegSetValueExW (Address: 0x1800741e0)

api-ms-win-core-registry-l2-1-0.dll

RegEnumKeyW (Address: 0x180074210)
RegOpenKeyW (Address: 0x180074218)

api-ms-win-core-rtlsupport-l1-1-0.dll

RtlCaptureContext (Address: 0x180074238)
RtlLookupFunctionEntry (Address: 0x180074230)
RtlVirtualUnwind (Address: 0x180074228)

api-ms-win-core-shlwapi-legacy-l1-1-0.dll

PathCommonPrefixW (Address: 0x180074268)
PathGetArgsW (Address: 0x180074258)
PathStripPathW (Address: 0x180074248)
PathUnquoteSpacesW (Address: 0x180074260)
SHExpandEnvironmentStringsW (Address: 0x180074250)

api-ms-win-core-shlwapi-obsolete-l1-1-0.dll

StrChrW (Address: 0x180074278)
StrToIntW (Address: 0x180074288)
StrTrimW (Address: 0x180074280)

api-ms-win-core-string-l1-1-0.dll

CompareStringOrdinal (Address: 0x1800742b0)
GetStringTypeW (Address: 0x1800742a0)
MultiByteToWideChar (Address: 0x180074298)
WideCharToMultiByte (Address: 0x1800742a8)

api-ms-win-core-string-l2-1-1.dll

SHLoadIndirectString (Address: 0x1800742c0)

api-ms-win-core-string-obsolete-l1-1-0.dll

lstrlenW (Address: 0x1800742d0)

api-ms-win-core-synch-l1-1-0.dll

AcquireSRWLockExclusive (Address: 0x180074348)
AcquireSRWLockShared (Address: 0x180074320)
CreateEventExW (Address: 0x1800742f0)
CreateMutexExW (Address: 0x180074338)
CreateMutexW (Address: 0x180074328)
CreateSemaphoreExW (Address: 0x180074318)
DeleteCriticalSection (Address: 0x1800742e0)
EnterCriticalSection (Address: 0x180074370)
InitializeCriticalSectionEx (Address: 0x180074330)
InitializeSRWLock (Address: 0x180074360)
LeaveCriticalSection (Address: 0x180074368)
OpenEventW (Address: 0x1800742f8)
OpenSemaphoreW (Address: 0x180074358)
ReleaseMutex (Address: 0x1800742e8)
ReleaseSemaphore (Address: 0x180074350)
ReleaseSRWLockExclusive (Address: 0x180074378)
ReleaseSRWLockShared (Address: 0x180074340)
SetEvent (Address: 0x180074300)
WaitForSingleObject (Address: 0x180074310)
WaitForSingleObjectEx (Address: 0x180074308)

api-ms-win-core-synch-l1-2-0.dll

InitOnceBeginInitialize (Address: 0x180074390)
InitOnceComplete (Address: 0x180074388)
InitOnceExecuteOnce (Address: 0x1800743a8)
Sleep (Address: 0x1800743a0)
SleepConditionVariableSRW (Address: 0x1800743b0)
WakeAllConditionVariable (Address: 0x180074398)

api-ms-win-core-sysinfo-l1-1-0.dll

GetSystemDirectoryW (Address: 0x1800743d0)
GetSystemTimeAsFileTime (Address: 0x1800743c0)
GetSystemWindowsDirectoryW (Address: 0x1800743c8)
GetTickCount (Address: 0x1800743d8)

api-ms-win-core-sysinfo-l1-2-0.dll

GetSystemTimePreciseAsFileTime (Address: 0x1800743e8)

api-ms-win-core-threadpool-l1-2-0.dll

CloseThreadpoolTimer (Address: 0x180074400)
CreateThreadpoolTimer (Address: 0x180074410)
SetThreadpoolTimer (Address: 0x1800743f8)
WaitForThreadpoolTimerCallbacks (Address: 0x180074408)

api-ms-win-core-timezone-l1-1-0.dll

FileTimeToSystemTime (Address: 0x180074420)
SystemTimeToFileTime (Address: 0x180074428)

api-ms-win-core-url-l1-1-0.dll

UrlGetPartW (Address: 0x180074438)

api-ms-win-core-util-l1-1-0.dll

DecodePointer (Address: 0x180074448)
EncodePointer (Address: 0x180074450)

api-ms-win-core-winrt-error-l1-1-0.dll

GetRestrictedErrorInfo (Address: 0x180074480)
RoOriginateError (Address: 0x180074468)
RoOriginateErrorW (Address: 0x180074470)
RoTransformError (Address: 0x180074478)
SetRestrictedErrorInfo (Address: 0x180074460)

api-ms-win-core-winrt-error-l1-1-1.dll

IsErrorPropagationEnabled (Address: 0x180074498)
RoGetMatchingRestrictedErrorInfo (Address: 0x180074490)
RoReportFailedDelegate (Address: 0x1800744a0)

api-ms-win-core-winrt-l1-1-0.dll

RoActivateInstance (Address: 0x1800744b8)
RoGetActivationFactory (Address: 0x1800744b0)

api-ms-win-core-winrt-string-l1-1-0.dll

WindowsCompareStringOrdinal (Address: 0x180074518)
WindowsCreateString (Address: 0x1800744e0)
WindowsCreateStringReference (Address: 0x1800744f8)
WindowsDeleteString (Address: 0x180074508)
WindowsDuplicateString (Address: 0x180074500)
WindowsGetStringLen (Address: 0x1800744d0)
WindowsGetStringRawBuffer (Address: 0x180074510)
WindowsIsStringEmpty (Address: 0x1800744d8)
WindowsStringHasEmbeddedNull (Address: 0x1800744e8)
WindowsSubstring (Address: 0x1800744c8)
WindowsSubstringWithSpecifiedLength (Address: 0x1800744f0)

api-ms-win-eventing-provider-l1-1-0.dll

EventActivityIdControl (Address: 0x180074540)
EventRegister (Address: 0x180074548)
EventSetInformation (Address: 0x180074528)
EventUnregister (Address: 0x180074530)
EventWriteTransfer (Address: 0x180074538)

api-ms-win-ntuser-sysparams-l1-1-0.dll

GetSystemMetrics (Address: 0x180074558)

api-ms-win-rtcore-ntuser-window-l1-1-0.dll

EnableWindow (Address: 0x1800745b8)
EnumWindows (Address: 0x180074588)
FindWindowExW (Address: 0x180074580)
FindWindowW (Address: 0x1800745a0)
GetPropW (Address: 0x180074590)
GetWindow (Address: 0x180074570)
GetWindowLongPtrW (Address: 0x1800745b0)
GetWindowTextW (Address: 0x180074578)
PostMessageW (Address: 0x1800745c0)
SendNotifyMessageW (Address: 0x1800745a8)
SetForegroundWindow (Address: 0x180074598)
ShowWindow (Address: 0x180074568)

api-ms-win-shcore-comhelpers-l1-1-0.dll

IUnknown_GetSite (Address: 0x1800745e0)
IUnknown_QueryService (Address: 0x1800745d8)
IUnknown_SetSite (Address: 0x1800745d0)

api-ms-win-shcore-obsolete-l1-1-0.dll

SHStrDupA (Address: 0x1800745f8)
SHStrDupW (Address: 0x1800745f0)

api-ms-win-shcore-registry-l1-1-0.dll

SHRegGetValueW (Address: 0x180074608)

api-ms-win-shcore-stream-l1-1-0.dll

SHCreateMemStream (Address: 0x180074620)
SHCreateStreamOnFileEx (Address: 0x180074618)

api-ms-win-shcore-stream-winrt-l1-1-0.dll

CreateRandomAccessStreamOverStream (Address: 0x180074630)

api-ms-win-shcore-taskpool-l1-1-0.dll

SHTaskPoolAllowThreadReuse (Address: 0x180074640)
SHTaskPoolGetUniqueContext (Address: 0x180074650)
SHTaskPoolQueueTask (Address: 0x180074648)

api-ms-win-shcore-thread-l1-1-0.dll

SHGetThreadRef (Address: 0x180074660)

api-ms-win-shcore-unicodeansi-l1-1-0.dll

SHUnicodeToAnsi (Address: 0x180074670)

api-ms-win-shell-namespace-l1-1-0.dll

SHCreateItemFromIDList (Address: 0x180074688)
SHCreateItemFromParsingName (Address: 0x180074690)
SHGetIDListFromObject (Address: 0x180074698)
SHGetNameFromIDList (Address: 0x180074680)

api-ms-win-shlwapi-winrt-storage-l1-1-1.dll

(Address: 0x1800746b8)
AssocCreate (Address: 0x1800746c8)
AssocQueryStringW (Address: 0x1800746a8)
IUnknown_GetWindow (Address: 0x1800746b0)
PathRemoveArgsW (Address: 0x1800746c0)

msvcrt.dll

___lc_codepage_func (Address: 0x180074860)
___lc_collate_cp_func (Address: 0x180074848)
___lc_handle_func (Address: 0x180074840)
___mb_cur_max_func (Address: 0x180074870)
__C_specific_handler (Address: 0x180074710)
__crtCompareStringW (Address: 0x1800748a8)
__crtLCMapStringW (Address: 0x1800748b0)
__CxxFrameHandler3 (Address: 0x1800746d8)
__dllonexit (Address: 0x1800746f0)
__pctype_func (Address: 0x180074858)
_amsg_exit (Address: 0x180074730)
_callnewh (Address: 0x180074880)
_CxxThrowException (Address: 0x180074820)
_errno (Address: 0x180074838)
_get_errno (Address: 0x1800747c8)
_initterm (Address: 0x180074718)
_ismbblead (Address: 0x180074878)
_lock (Address: 0x180074700)
_onexit (Address: 0x1800746e8)
_purecall (Address: 0x180074760)
_set_errno (Address: 0x1800747c0)
_unlock (Address: 0x1800746f8)
_vsnprintf_s (Address: 0x180074740)
_vsnwprintf (Address: 0x180074778)
_wcsdup (Address: 0x1800748a0)
_wcsicmp (Address: 0x180074800)
_wcsnicmp (Address: 0x1800747b8)
_wsetlocale (Address: 0x1800748b8)
_XcptFilter (Address: 0x180074738)
??_V@YAXPEAX@Z (Address: 0x180074780)
??0bad_cast@@QEAA@AEBV0@@Z (Address: 0x1800747d8)
??0bad_cast@@QEAA@PEBD@Z (Address: 0x1800747d0)
??0exception@@QEAA@AEBQEBD@Z (Address: 0x180074798)
??0exception@@QEAA@AEBQEBDH@Z (Address: 0x180074888)
??0exception@@QEAA@AEBV0@@Z (Address: 0x180074748)
??0exception@@QEAA@XZ (Address: 0x180074750)
??1bad_cast@@UEAA@XZ (Address: 0x1800747e0)
??1exception@@UEAA@XZ (Address: 0x180074758)
??1type_info@@UEAA@XZ (Address: 0x1800746e0)
??3@YAXPEAX@Z (Address: 0x180074768)
?terminate@@YAXXZ (Address: 0x180074708)
?what@exception@@UEBAPEBDXZ (Address: 0x1800747f0)
abort (Address: 0x180074890)
calloc (Address: 0x180074868)
free (Address: 0x180074728)
iswspace (Address: 0x1800747b0)
malloc (Address: 0x180074720)
memcmp (Address: 0x180074850)
memcpy (Address: 0x180074828)
memcpy_s (Address: 0x180074770)
memmove (Address: 0x180074830)
memmove_s (Address: 0x180074788)
memset (Address: 0x180074898)
realloc (Address: 0x180074790)
setlocale (Address: 0x180074818)
strchr (Address: 0x1800747e8)
wcschr (Address: 0x1800747a8)
wcscmp (Address: 0x1800748c0)
wcscspn (Address: 0x180074808)
wcsncmp (Address: 0x1800747a0)
wcsncpy_s (Address: 0x1800747f8)
wcsrchr (Address: 0x180074810)

ntdll.dll

NtCreateSection (Address: 0x1800748e0)
NtQuerySection (Address: 0x1800748d8)
NtQueryWnfStateData (Address: 0x1800748d0)

OLEAUT32.dll

SysAllocString (Address: 0x180073f48)
SysFreeString (Address: 0x180073f38)
SysStringLen (Address: 0x180073f30)
VariantClear (Address: 0x180073f40)
VariantInit (Address: 0x180073f50)

USER32.dll

CreatePopupMenu (Address: 0x180073fa0)
DestroyIcon (Address: 0x180073f70)
DestroyMenu (Address: 0x180073f90)
ExitWindowsEx (Address: 0x180073fb0)
GetDC (Address: 0x180073f60)
GetMenuDefaultItem (Address: 0x180073f98)
GetWindowDisplayAffinity (Address: 0x180073f78)
GetWindowTextLengthW (Address: 0x180073f68)
LockWorkStation (Address: 0x180073f80)
ReleaseDC (Address: 0x180073fa8)
SendInput (Address: 0x180073f88)