Windows.Internal.Management.SecureAssessment.dll

Description: Windows Internal Runtime Secure Assessment DLL

Version: 10.0.19041.4355

Architecture: 64-bit

Operating System: Windows NT

SHA256: 9d177c18f44619af049b71eaa1b93473

File Size: 143.0 KB

Uploaded At: Dec. 1, 2025, 7:43 a.m.

Views: 4

Security Warning

This file has been flagged as potentially dangerous.

Reason: Detected potentially dangerous functions used for process injection: OpenProcess

Exported Functions

DllCanUnloadNow (Ordinal: 1, Address: 0x5770)
DllGetActivationFactory (Ordinal: 2, Address: 0x5510)
DllGetClassObject (Ordinal: 3, Address: 0x57f0)

Imported DLLs & Functions

api-ms-win-core-com-l1-1-0.dll

CoCreateFreeThreadedMarshaler (Address: 0x18001a4a0)
CoCreateInstance (Address: 0x18001a468)
CoGetCallContext (Address: 0x18001a488)
CoImpersonateClient (Address: 0x18001a478)
CoRevertToSelf (Address: 0x18001a490)
CoTaskMemAlloc (Address: 0x18001a498)
CoTaskMemFree (Address: 0x18001a480)
CoWaitForMultipleHandles (Address: 0x18001a470)

api-ms-win-core-debug-l1-1-0.dll

DebugBreak (Address: 0x18001a4b8)
IsDebuggerPresent (Address: 0x18001a4b0)
OutputDebugStringW (Address: 0x18001a4c0)

api-ms-win-core-errorhandling-l1-1-0.dll

GetLastError (Address: 0x18001a4e0)
RaiseException (Address: 0x18001a4d8)
SetLastError (Address: 0x18001a4e8)
SetUnhandledExceptionFilter (Address: 0x18001a4d0)
UnhandledExceptionFilter (Address: 0x18001a4f0)

api-ms-win-core-handle-l1-1-0.dll

CloseHandle (Address: 0x18001a500)

api-ms-win-core-heap-l1-1-0.dll

GetProcessHeap (Address: 0x18001a520)
HeapAlloc (Address: 0x18001a518)
HeapFree (Address: 0x18001a510)

api-ms-win-core-heap-l2-1-0.dll

LocalAlloc (Address: 0x18001a538)
LocalFree (Address: 0x18001a530)

api-ms-win-core-libraryloader-l1-2-0.dll

DisableThreadLibraryCalls (Address: 0x18001a560)
GetModuleFileNameA (Address: 0x18001a548)
GetModuleHandleExW (Address: 0x18001a550)
GetModuleHandleW (Address: 0x18001a558)
GetProcAddress (Address: 0x18001a568)

api-ms-win-core-localization-l1-2-0.dll

FormatMessageW (Address: 0x18001a578)

api-ms-win-core-processenvironment-l1-1-0.dll

ExpandEnvironmentStringsW (Address: 0x18001a588)

api-ms-win-core-processthreads-l1-1-0.dll

GetCurrentProcess (Address: 0x18001a5d0)
GetCurrentProcessId (Address: 0x18001a5d8)
GetCurrentThread (Address: 0x18001a5b8)
GetCurrentThreadId (Address: 0x18001a598)
GetProcessId (Address: 0x18001a5a0)
OpenProcessToken (Address: 0x18001a5c0)
OpenThreadToken (Address: 0x18001a5a8)
SetThreadToken (Address: 0x18001a5b0)
TerminateProcess (Address: 0x18001a5c8)

api-ms-win-core-processthreads-l1-1-1.dll

OpenProcess (Address: 0x18001a5e8)

api-ms-win-core-profile-l1-1-0.dll

QueryPerformanceCounter (Address: 0x18001a5f8)

api-ms-win-core-psapi-l1-1-0.dll

QueryFullProcessImageNameW (Address: 0x18001a608)

api-ms-win-core-registry-l1-1-0.dll

RegCloseKey (Address: 0x18001a638)
RegCreateKeyExW (Address: 0x18001a630)
RegGetValueW (Address: 0x18001a620)
RegOpenCurrentUser (Address: 0x18001a618)
RegSetValueExW (Address: 0x18001a628)

api-ms-win-core-registry-l2-1-0.dll

RegDeleteKeyW (Address: 0x18001a648)

api-ms-win-core-rtlsupport-l1-1-0.dll

RtlCaptureContext (Address: 0x18001a668)
RtlLookupFunctionEntry (Address: 0x18001a660)
RtlVirtualUnwind (Address: 0x18001a658)

api-ms-win-core-string-l1-1-0.dll

CompareStringOrdinal (Address: 0x18001a678)

api-ms-win-core-synch-l1-1-0.dll

AcquireSRWLockExclusive (Address: 0x18001a6d8)
AcquireSRWLockShared (Address: 0x18001a6c0)
CreateEventExW (Address: 0x18001a6b8)
CreateMutexExW (Address: 0x18001a6d0)
CreateSemaphoreExW (Address: 0x18001a708)
DeleteCriticalSection (Address: 0x18001a6b0)
EnterCriticalSection (Address: 0x18001a698)
InitializeCriticalSectionEx (Address: 0x18001a6a8)
InitializeSRWLock (Address: 0x18001a6c8)
LeaveCriticalSection (Address: 0x18001a688)
OpenSemaphoreW (Address: 0x18001a710)
ReleaseMutex (Address: 0x18001a6f8)
ReleaseSemaphore (Address: 0x18001a700)
ReleaseSRWLockExclusive (Address: 0x18001a6f0)
ReleaseSRWLockShared (Address: 0x18001a6e0)
SetEvent (Address: 0x18001a690)
WaitForSingleObject (Address: 0x18001a6a0)
WaitForSingleObjectEx (Address: 0x18001a6e8)

api-ms-win-core-synch-l1-2-0.dll

InitOnceBeginInitialize (Address: 0x18001a720)
InitOnceComplete (Address: 0x18001a730)
InitOnceExecuteOnce (Address: 0x18001a738)
Sleep (Address: 0x18001a728)

api-ms-win-core-sysinfo-l1-1-0.dll

GetSystemTimeAsFileTime (Address: 0x18001a750)
GetTickCount (Address: 0x18001a748)

api-ms-win-core-toolhelp-l1-1-0.dll

CreateToolhelp32Snapshot (Address: 0x18001a770)
Process32FirstW (Address: 0x18001a760)
Process32NextW (Address: 0x18001a768)

api-ms-win-core-util-l1-1-0.dll

DecodePointer (Address: 0x18001a780)
EncodePointer (Address: 0x18001a788)

api-ms-win-core-winrt-error-l1-1-0.dll

RoOriginateError (Address: 0x18001a7a8)
RoOriginateErrorW (Address: 0x18001a798)
RoTransformError (Address: 0x18001a7a0)

api-ms-win-core-winrt-l1-1-0.dll

RoActivateInstance (Address: 0x18001a7c0)
RoGetActivationFactory (Address: 0x18001a7b8)

api-ms-win-core-winrt-string-l1-1-0.dll

HSTRING_UserFree (Address: 0x18001a7e8)
HSTRING_UserFree64 (Address: 0x18001a7f0)
HSTRING_UserMarshal (Address: 0x18001a7f8)
HSTRING_UserMarshal64 (Address: 0x18001a7e0)
HSTRING_UserSize (Address: 0x18001a800)
HSTRING_UserSize64 (Address: 0x18001a838)
HSTRING_UserUnmarshal (Address: 0x18001a7d0)
HSTRING_UserUnmarshal64 (Address: 0x18001a7d8)
WindowsCreateString (Address: 0x18001a820)
WindowsCreateStringReference (Address: 0x18001a830)
WindowsDeleteString (Address: 0x18001a840)
WindowsDuplicateString (Address: 0x18001a828)
WindowsGetStringRawBuffer (Address: 0x18001a810)
WindowsIsStringEmpty (Address: 0x18001a808)
WindowsStringHasEmbeddedNull (Address: 0x18001a818)

api-ms-win-eventing-provider-l1-1-0.dll

EventActivityIdControl (Address: 0x18001a858)
EventRegister (Address: 0x18001a868)
EventSetInformation (Address: 0x18001a860)
EventUnregister (Address: 0x18001a870)
EventWriteTransfer (Address: 0x18001a850)

api-ms-win-security-base-l1-1-0.dll

DestroyPrivateObjectSecurity (Address: 0x18001a898)
DuplicateTokenEx (Address: 0x18001a890)
EqualSid (Address: 0x18001a880)
GetTokenInformation (Address: 0x18001a888)

api-ms-win-security-capability-l1-1-0.dll

CapabilityCheck (Address: 0x18001a8a8)

api-ms-win-security-sddl-l1-1-0.dll

ConvertSidToStringSidW (Address: 0x18001a8b8)
ConvertStringSecurityDescriptorToSecurityDescriptorW (Address: 0x18001a8c0)

combase.dll

(Address: 0x18001a8e0)
(Address: 0x18001a900)
(Address: 0x18001a910)
(Address: 0x18001a928)
(Address: 0x18001a930)
(Address: 0x18001a940)
(Address: 0x18001a948)
(Address: 0x18001a950)
(Address: 0x18001a958)
CStdStubBuffer_AddRef (Address: 0x18001a938)
CStdStubBuffer_DebugServerQueryInterface (Address: 0x18001a8e8)
CStdStubBuffer_DebugServerRelease (Address: 0x18001a918)
CStdStubBuffer_Invoke (Address: 0x18001a8d0)
CStdStubBuffer_IsIIDSupported (Address: 0x18001a8f8)
CStdStubBuffer2_Connect (Address: 0x18001a960)
CStdStubBuffer2_CountRefs (Address: 0x18001a8d8)
CStdStubBuffer2_Disconnect (Address: 0x18001a8f0)
CStdStubBuffer2_QueryInterface (Address: 0x18001a908)
NdrCStdStubBuffer2_Release (Address: 0x18001a920)

IPHLPAPI.DLL

GetAdaptersAddresses (Address: 0x18001a3d0)
GetIfEntry2 (Address: 0x18001a3c8)

msvcp110_win.dll

?_Xbad_alloc@std@@YAXXZ (Address: 0x18001a970)
?_Xlength_error@std@@YAXPEBD@Z (Address: 0x18001a978)
?_Xout_of_range@std@@YAXPEBD@Z (Address: 0x18001a980)

msvcrt.dll

__C_specific_handler (Address: 0x18001a9c8)
__CxxFrameHandler3 (Address: 0x18001aa08)
__dllonexit (Address: 0x18001a9a8)
_amsg_exit (Address: 0x18001a9f0)
_callnewh (Address: 0x18001aa68)
_CxxThrowException (Address: 0x18001aa20)
_initterm (Address: 0x18001a9d0)
_lock (Address: 0x18001a9b8)
_onexit (Address: 0x18001a9a0)
_purecall (Address: 0x18001aa40)
_unlock (Address: 0x18001a9b0)
_vsnprintf_s (Address: 0x18001aa00)
_vsnwprintf (Address: 0x18001aa70)
_XcptFilter (Address: 0x18001a9f8)
??_V@YAXPEAX@Z (Address: 0x18001aa78)
??0exception@@QEAA@AEBV0@@Z (Address: 0x18001aa10)
??0exception@@QEAA@XZ (Address: 0x18001aa30)
??1exception@@UEAA@XZ (Address: 0x18001aa38)
??1type_info@@UEAA@XZ (Address: 0x18001a998)
??3@YAXPEAX@Z (Address: 0x18001aa48)
?terminate@@YAXXZ (Address: 0x18001a9c0)
free (Address: 0x18001aa80)
malloc (Address: 0x18001a9e0)
memcmp (Address: 0x18001aa18)
memcpy (Address: 0x18001a9d8)
memcpy_s (Address: 0x18001aa50)
memmove (Address: 0x18001a990)
memmove_s (Address: 0x18001aa58)
memset (Address: 0x18001aa88)
realloc (Address: 0x18001a9e8)
swprintf_s (Address: 0x18001aa28)
wcschr (Address: 0x18001aa60)

ntdll.dll

NtQueryInformationToken (Address: 0x18001aac0)
RtlAllocateHeap (Address: 0x18001aaa8)
RtlCompareUnicodeString (Address: 0x18001aab8)
RtlFreeHeap (Address: 0x18001aaa0)
RtlInitUnicodeString (Address: 0x18001aa98)
RtlNtStatusToDosErrorNoTeb (Address: 0x18001aab0)

RPCRT4.dll

I_RpcBindingInqLocalClientPID (Address: 0x18001a410)
IUnknown_AddRef_Proxy (Address: 0x18001a3e0)
IUnknown_QueryInterface_Proxy (Address: 0x18001a3e8)
IUnknown_Release_Proxy (Address: 0x18001a408)
NdrDllCanUnloadNow (Address: 0x18001a418)
NdrDllGetClassObject (Address: 0x18001a420)
NdrOleAllocate (Address: 0x18001a400)
NdrOleFree (Address: 0x18001a428)
NdrStubCall3 (Address: 0x18001a3f0)
NdrStubForwardingFunction (Address: 0x18001a3f8)

TWINAPI.dll

(Address: 0x18001a438)
(Address: 0x18001a440)

USER32.dll

GetSystemMetrics (Address: 0x18001a458)
LockWorkStation (Address: 0x18001a450)