RstrtMgr.dll
v10.0.19041.4355
32-bit
Windows NT
Analyzed
Security warning
This file has been flagged as potentially dangerous, and downloads are disabled.
Reason: Detected potentially dangerous functions used for process injection: OpenProcess
Exported functions 12
RmAddFilter
#1 · 0x7710
RmCancelCurrentTask
#2 · 0x7780
RmEndSession
#3 · 0x77e0
RmGetFilterList
#4 · 0x7840
RmGetList
#5 · 0x78b0
RmJoinSession
#6 · 0x7910
RmRegisterResources
#7 · 0x7a20
RmRemoveFilter
#8 · 0x7a90
RmReserveHeap
#9 · 0x7b00
RmRestart
#10 · 0x7c30
RmShutdown
#11 · 0x7c90
RmStartSession
#12 · 0x7cf0
No function matches your filter.
Imported DLLs & functions 192
ADVAPI32.dll
40
CloseServiceHandle
0x10026050
ControlService
0x10026020
ConvertSecurityDescriptorToStringSecurityDescriptorW
0x10026008
ConvertSidToStringSidW
0x10026010
ConvertStringSecurityDescriptorToSecurityDescriptorW
0x1002600c
CopySid
0x10026038
CreateProcessAsUserW
0x10026028
DuplicateTokenEx
0x10026030
EnumDependentServicesW
0x10026048
EnumServicesStatusExW
0x10026000
EqualSid
0x10026034
EventRegister
0x10026064
EventUnregister
0x1002605c
EventWrite
0x10026060
GetKernelObjectSecurity
0x1002602c
GetTokenInformation
0x1002603c
GetTraceEnableFlags
0x10026080
GetTraceEnableLevel
0x1002607c
GetTraceLoggerHandle
0x10026004
I_QueryTagInformation
0x10026044
LookupAccountSidW
0x10026014
OpenProcessToken
0x10026040
OpenSCManagerW
0x10026058
OpenServiceW
0x1002604c
QueryServiceStatus
0x10026024
QueryServiceStatusEx
0x1002601c
RegCloseKey
0x10026090
RegCreateKeyExW
0x10026088
RegDeleteKeyW
0x10026078
RegDeleteValueW
0x1002606c
RegEnumValueW
0x10026070
RegisterTraceGuidsW
0x10026084
RegOpenKeyExW
0x10026098
RegQueryInfoKeyW
0x10026074
RegQueryMultipleValuesW
0x10026068
RegQueryValueExW
0x10026094
RegSetValueExW
0x1002608c
StartServiceW
0x10026018
TraceMessage
0x10026054
UnregisterTraceGuids
0x1002609c
ApiSetQueryApiSetPresence
0x10026238
KERNEL32.dll
82
AttachConsole
0x100261a0
CloseHandle
0x100260f8
CompareFileTime
0x10026138
ConnectNamedPipe
0x100261c8
CreateEventW
0x100261c4
CreateFileMappingW
0x100260ec
CreateFileW
0x100260e8
CreateMutexExW
0x10026188
CreateMutexW
0x10026128
CreateNamedPipeW
0x100261c0
CreateSemaphoreExW
0x1002618c
DebugBreak
0x1002614c
DelayLoadFailureHook
0x100260a4
DeleteCriticalSection
0x100260c0
DisableThreadLibraryCalls
0x100260b8
DuplicateHandle
0x100261d8
EnterCriticalSection
0x100260b0
ExpandEnvironmentStringsW
0x100260e4
FileTimeToSystemTime
0x100261bc
FormatMessageW
0x1002613c
FreeConsole
0x1002619c
GenerateConsoleCtrlEvent
0x100261a4
GetApplicationRestartSettings
0x1002617c
GetApplicationUserModelId
0x10026180
GetConsoleProcessList
0x10026198
GetCurrentProcess
0x100260e0
GetCurrentProcessId
0x10026114
GetCurrentThreadId
0x10026140
GetFileInformationByHandle
0x10026108
GetFileType
0x10026104
GetLastError
0x100260cc
GetModuleFileNameA
0x10026148
GetModuleFileNameW
0x10026120
GetModuleHandleExW
0x10026144
GetModuleHandleW
0x10026150
GetNamedPipeClientProcessId
0x100261d0
GetOverlappedResult
0x100261e4
GetPackageId
0x10026184
GetProcAddress
0x10026154
GetProcessHeap
0x100260d8
GetProcessTimes
0x10026118
GetSystemTime
0x100261b4
GetSystemTimeAsFileTime
0x1002611c
GetSystemWindowsDirectoryW
0x10026178
GetTickCount
0x100261ac
HeapAlloc
0x100260d0
HeapCreate
0x100260c8
HeapDestroy
0x100260c4
HeapFree
0x100260d4
InitializeCriticalSection
0x1002610c
InitializeCriticalSectionAndSpinCount
0x100260bc
IsDebuggerPresent
0x10026158
IsWow64Process
0x100260dc
LeaveCriticalSection
0x100260b4
LocalFree
0x10026170
MapViewOfFile
0x100260f0
OpenMutexW
0x1002612c
OpenProcess
0x10026134
OpenSemaphoreW
0x1002616c
OutputDebugStringW
0x1002615c
ProcessIdToSessionId
0x10026110
QueryFullProcessImageNameW
0x10026174
QueryPerformanceCounter
0x10026100
QueryPerformanceFrequency
0x100260fc
ReadFile
0x100261e0
ReleaseMutex
0x10026124
ReleaseSemaphore
0x10026164
ResetEvent
0x100261dc
ResolveDelayLoadedAPI
0x100260ac
SetConsoleCtrlHandler
0x10026190
SetEvent
0x100261cc
SetLastError
0x10026160
SetUnhandledExceptionFilter
0x100261b8
Sleep
0x100261b0
SystemTimeToFileTime
0x100260a8
TerminateProcess
0x100261a8
UnhandledExceptionFilter
0x100261e8
UnmapViewOfFile
0x100260f4
WaitForMultipleObjects
0x10026194
WaitForSingleObject
0x10026130
WaitForSingleObjectEx
0x10026168
WriteFile
0x100261d4
WTSGetServiceSessionId
0x100261f0
msvcrt.dll
32
__CxxFrameHandler3
0x100262b8
__dllonexit
0x10026294
_amsg_exit
0x100262a4
_CxxThrowException
0x1002624c
_except_handler4_common
0x10026258
_initterm
0x100262a0
_lock
0x1002628c
_onexit
0x10026298
_purecall
0x10026254
_unlock
0x10026290
_vsnprintf_s
0x100262b0
_vsnwprintf
0x100262a8
_wcsicmp
0x10026278
_XcptFilter
0x100262b4
??0exception@@QAE@ABQBD@Z
0x10026250
??0exception@@QAE@ABQBDH@Z
0x10026270
??0exception@@QAE@ABV0@@Z
0x1002626c
??0exception@@QAE@XZ
0x10026260
??1exception@@UAE@XZ
0x10026280
??1type_info@@UAE@XZ
0x10026288
?terminate@@YAXXZ
0x100262ac
?what@exception@@UBEPBDXZ
0x10026274
free
0x10026240
malloc
0x10026268
memcmp
0x1002629c
memcpy
0x10026248
memcpy_s
0x1002625c
memmove
0x10026244
memset
0x100262bc
towlower
0x1002627c
wcschr
0x10026264
wcstoul
0x10026284
BCryptCloseAlgorithmProvider
0x100262c4
BCryptCreateHash
0x100262d0
BCryptDestroyHash
0x100262dc
BCryptFinishHash
0x100262d8
BCryptGetProperty
0x100262cc
BCryptHashData
0x100262d4
BCryptOpenAlgorithmProvider
0x100262c8
ntdll.dll
12
NtQueryInformationFile
0x100262e8
NtQueryInformationProcess
0x100262fc
NtQueryInformationToken
0x10026300
NtQuerySystemInformation
0x10026304
RtlCreateUnicodeString
0x100262f8
RtlFreeUnicodeString
0x100262e4
RtlQueryPackageClaims
0x10026308
WinSqmAddToStreamEx
0x100262f4
WinSqmEndSession
0x100262f0
WinSqmSetDWORD
0x10026310
WinSqmSetString
0x1002630c
WinSqmStartSession
0x100262ec
CoCreateInstance
0x10026320
CoInitializeEx
0x1002631c
CoInitializeSecurity
0x10026324
CoTaskMemFree
0x10026328
CoUninitialize
0x10026318
SysAllocString
0x100261f8
SysFreeString
0x100261fc
VariantClear
0x10026204
VariantInit
0x10026200
UuidCreate
0x1002620c
0x10026214
EnumWindows
0x10026224
GetSystemMetrics
0x10026220
GetWindow
0x1002621c
GetWindowLongW
0x10026228
GetWindowThreadProcessId
0x10026230
SendMessageTimeoutW
0x1002622c
No function matches your filter.