w3logsvc.dll
Description: IIS Logging Service
Authors: © Microsoft Corporation. All rights reserved.
Version: 10.0.19041.3636
Architecture: 64-bit
Operating System: Windows NT
SHA256: 28c192eed18eb2c3d178af1c6a479a39
File Size: 94.5 KB
Uploaded At: Dec. 1, 2025, 8:28 a.m.
Views: 15
Security Warning
This file has been flagged as potentially dangerous.
Reason: Detected potentially dangerous functions used for process injection: OpenProcess
Exported Functions
- ServiceMain (Ordinal: 1, Address: 0x15d0)
Imported DLLs & Functions
api-ms-win-core-com-l1-1-0.dll
- CoCreateInstance (Address: 0x180011358)
- CoInitializeEx (Address: 0x180011350)
- CoUninitialize (Address: 0x180011348)
api-ms-win-core-datetime-l1-1-0.dll
- GetDateFormatW (Address: 0x180011368)
api-ms-win-core-datetime-l1-1-1.dll
- GetTimeFormatEx (Address: 0x180011378)
api-ms-win-core-debug-l1-1-0.dll
- OutputDebugStringA (Address: 0x180011388)
api-ms-win-core-errorhandling-l1-1-0.dll
- GetLastError (Address: 0x180011398)
- SetUnhandledExceptionFilter (Address: 0x1800113a8)
- UnhandledExceptionFilter (Address: 0x1800113a0)
api-ms-win-core-file-l1-1-0.dll
- CreateDirectoryW (Address: 0x1800113d8)
- CreateFileW (Address: 0x1800113c0)
- GetFileAttributesExW (Address: 0x1800113e0)
- GetFileAttributesW (Address: 0x1800113e8)
- GetFileSizeEx (Address: 0x1800113d0)
- GetFileTime (Address: 0x1800113c8)
- WriteFile (Address: 0x1800113b8)
api-ms-win-core-handle-l1-1-0.dll
- CloseHandle (Address: 0x1800113f8)
- DuplicateHandle (Address: 0x180011400)
api-ms-win-core-heap-l1-1-0.dll
- GetProcessHeap (Address: 0x180011418)
- HeapAlloc (Address: 0x180011420)
- HeapFree (Address: 0x180011410)
api-ms-win-core-heap-l2-1-0.dll
- LocalAlloc (Address: 0x180011438)
- LocalFree (Address: 0x180011430)
api-ms-win-core-libraryloader-l1-2-0.dll
- DisableThreadLibraryCalls (Address: 0x180011448)
api-ms-win-core-path-l1-1-0.dll
- PathAllocCombine (Address: 0x180011458)
api-ms-win-core-processthreads-l1-1-0.dll
- CreateThread (Address: 0x180011490)
- GetCurrentProcess (Address: 0x180011468)
- GetCurrentProcessId (Address: 0x180011488)
- GetCurrentThreadId (Address: 0x180011478)
- GetExitCodeThread (Address: 0x180011498)
- SetThreadPriority (Address: 0x180011470)
- TerminateProcess (Address: 0x180011480)
api-ms-win-core-processthreads-l1-1-1.dll
- OpenProcess (Address: 0x1800114a8)
api-ms-win-core-profile-l1-1-0.dll
- QueryPerformanceCounter (Address: 0x1800114b8)
api-ms-win-core-synch-l1-1-0.dll
- AcquireSRWLockExclusive (Address: 0x1800114e8)
- AcquireSRWLockShared (Address: 0x180011518)
- CreateEventW (Address: 0x1800114f8)
- DeleteCriticalSection (Address: 0x180011500)
- EnterCriticalSection (Address: 0x180011510)
- InitializeCriticalSectionAndSpinCount (Address: 0x1800114d0)
- InitializeSRWLock (Address: 0x1800114f0)
- LeaveCriticalSection (Address: 0x180011508)
- ReleaseSRWLockExclusive (Address: 0x1800114c8)
- ReleaseSRWLockShared (Address: 0x180011520)
- SetEvent (Address: 0x1800114e0)
- WaitForSingleObject (Address: 0x1800114d8)
api-ms-win-core-synch-l1-2-0.dll
- Sleep (Address: 0x180011530)
api-ms-win-core-sysinfo-l1-1-0.dll
- GetComputerNameExW (Address: 0x180011548)
- GetLocalTime (Address: 0x180011560)
- GetSystemTime (Address: 0x180011558)
- GetSystemTimeAsFileTime (Address: 0x180011550)
- GetTickCount (Address: 0x180011540)
- GetTickCount64 (Address: 0x180011568)
api-ms-win-core-threadpool-l1-2-0.dll
- CloseThreadpool (Address: 0x180011598)
- CloseThreadpoolCleanupGroup (Address: 0x180011590)
- CloseThreadpoolCleanupGroupMembers (Address: 0x1800115a0)
- CloseThreadpoolTimer (Address: 0x1800115d8)
- CloseThreadpoolWait (Address: 0x1800115c0)
- CreateThreadpool (Address: 0x180011588)
- CreateThreadpoolCleanupGroup (Address: 0x180011580)
- CreateThreadpoolTimer (Address: 0x1800115f0)
- CreateThreadpoolWait (Address: 0x1800115b8)
- SetThreadpoolThreadMaximum (Address: 0x180011578)
- SetThreadpoolThreadMinimum (Address: 0x1800115a8)
- SetThreadpoolTimer (Address: 0x1800115e8)
- SetThreadpoolWait (Address: 0x1800115d0)
- TrySubmitThreadpoolCallback (Address: 0x1800115b0)
- WaitForThreadpoolTimerCallbacks (Address: 0x1800115e0)
- WaitForThreadpoolWaitCallbacks (Address: 0x1800115c8)
api-ms-win-core-timezone-l1-1-0.dll
- FileTimeToSystemTime (Address: 0x180011600)
- SystemTimeToTzSpecificLocalTime (Address: 0x180011608)
api-ms-win-eventing-consumer-l1-1-0.dll
- CloseTrace (Address: 0x180011628)
- OpenTraceW (Address: 0x180011618)
- ProcessTrace (Address: 0x180011620)
api-ms-win-eventing-controller-l1-1-0.dll
- ControlTraceW (Address: 0x180011638)
- EnableTraceEx2 (Address: 0x180011640)
- StartTraceW (Address: 0x180011648)
- StopTraceW (Address: 0x180011650)
api-ms-win-eventing-legacy-l1-1-0.dll
- QueryTraceW (Address: 0x180011660)
api-ms-win-eventing-provider-l1-1-0.dll
- EventRegister (Address: 0x180011670)
- EventUnregister (Address: 0x180011678)
- EventWriteTransfer (Address: 0x180011680)
api-ms-win-security-base-l1-1-0.dll
- AllocateAndInitializeSid (Address: 0x180011690)
- FreeSid (Address: 0x1800116b0)
- InitializeSecurityDescriptor (Address: 0x180011698)
- SetSecurityDescriptorDacl (Address: 0x1800116a0)
- SetSecurityDescriptorOwner (Address: 0x1800116a8)
api-ms-win-security-lsapolicy-l1-1-0.dll
- LsaClose (Address: 0x1800116c8)
- LsaFreeMemory (Address: 0x1800116d0)
- LsaLookupNames2 (Address: 0x1800116d8)
- LsaOpenPolicy (Address: 0x1800116c0)
api-ms-win-security-provider-l1-1-0.dll
- GetNamedSecurityInfoW (Address: 0x1800116f0)
- SetEntriesInAclW (Address: 0x1800116e8)
api-ms-win-service-core-l1-1-0.dll
- SetServiceStatus (Address: 0x180011700)
api-ms-win-service-winsvc-l1-1-0.dll
- RegisterServiceCtrlHandlerW (Address: 0x180011710)
iisutil.dll
- ??0ALLOC_CACHE_HANDLER@@QEAA@PEBDPEBUALLOC_CACHE_CONFIGURATION@@H@Z (Address: 0x180011798)
- ??0EVENT_LOG@@QEAA@PEBG@Z (Address: 0x180011738)
- ??0MULTISZ@@QEAA@PEBG@Z (Address: 0x180011750)
- ??0MULTISZ@@QEAA@XZ (Address: 0x180011888)
- ??0STRA@@QEAA@PEADK@Z (Address: 0x180011840)
- ??0STRA@@QEAA@XZ (Address: 0x180011830)
- ??0STRU@@QEAA@PEAGK@Z (Address: 0x180011848)
- ??0STRU@@QEAA@XZ (Address: 0x180011820)
- ??1ALLOC_CACHE_HANDLER@@QEAA@XZ (Address: 0x180011778)
- ??1BUFFER@@QEAA@XZ (Address: 0x1800117c8)
- ??1MULTISZ@@QEAA@XZ (Address: 0x180011868)
- ??1STRA@@QEAA@XZ (Address: 0x180011838)
- ??1STRU@@QEAA@XZ (Address: 0x180011828)
- ?Alloc@ALLOC_CACHE_HANDLER@@QEAAPEAXXZ (Address: 0x180011770)
- ?Append@MULTISZ@@QEAAHAEAVSTRU@@@Z (Address: 0x1800117e8)
- ?Append@MULTISZ@@QEAAHPEBG@Z (Address: 0x1800117b8)
- ?Append@STRA@@QEAAJAEBV1@@Z (Address: 0x1800118c8)
- ?Append@STRA@@QEAAJPEBD@Z (Address: 0x180011900)
- ?Append@STRA@@QEAAJPEBDK@Z (Address: 0x1800118f8)
- ?Append@STRU@@QEAAJAEBV1@@Z (Address: 0x1800118a8)
- ?Append@STRU@@QEAAJG@Z (Address: 0x1800118a0)
- ?Append@STRU@@QEAAJPEBG@Z (Address: 0x180011898)
- ?Append@STRU@@QEAAJPEBGK@Z (Address: 0x1800118d0)
- ?AppendA@STRU@@QEAAJPEBDK@Z (Address: 0x180011908)
- ?AppendWSimple@STRA@@QEAAJPEBGK@Z (Address: 0x1800118b8)
- ?CleanupLookaside@ALLOC_CACHE_HANDLER@@QEAAXH@Z (Address: 0x180011788)
- ?Copy@MULTISZ@@QEAAHAEBV1@@Z (Address: 0x180011870)
- ?Copy@STRA@@QEAAJAEBV1@@Z (Address: 0x1800118c0)
- ?Copy@STRA@@QEAAJPEBD@Z (Address: 0x180011858)
- ?Copy@STRA@@QEAAJPEBDK@Z (Address: 0x180011758)
- ?Copy@STRU@@QEAAJAEBV1@@Z (Address: 0x180011878)
- ?Copy@STRU@@QEAAJPEBG@Z (Address: 0x180011860)
- ?Copy@STRU@@QEAAJPEBGK@Z (Address: 0x1800118f0)
- ?CopyA@STRU@@QEAAJPEBD@Z (Address: 0x1800117c0)
- ?CopyA@STRU@@QEAAJPEBDK@Z (Address: 0x180011760)
- ?CopyWToUTF8Unescaped@STRA@@QEAAJAEBVSTRU@@@Z (Address: 0x1800118e0)
- ?CopyWToUTF8Unescaped@STRA@@QEAAJPEBGK@Z (Address: 0x1800118b0)
- ?CreateIpmMessagePipe@IPM2_MESSAGE_PIPE@@SAJPEAVIPM2_MESSAGE_ACCEPTOR@@PEBGHPEAU_SECURITY_ATTRIBUTES@@PEAPEAV1@@Z (Address: 0x1800117a8)
- ?DestroyIpmMessagePipe@IPM2_MESSAGE_PIPE@@QEAAXXZ (Address: 0x1800117b0)
- ?Equals@MULTISZ@@QEAAHPEAV1@@Z (Address: 0x1800117e0)
- ?EqualsNoCase@STRU@@QEBA_NAEBV1@@Z (Address: 0x1800117d8)
- ?EqualsNoCase@STRU@@QEBA_NPEBG@Z (Address: 0x1800118d8)
- ?ExpandEnvironmentVariables@STRU@@SAJPEBGPEAV1@@Z (Address: 0x180011890)
- ?Free@ALLOC_CACHE_HANDLER@@QEAAHPEAX@Z (Address: 0x180011768)
- ?LogEvent@EVENT_LOG@@QEAAXKGQEAPEBGK@Z (Address: 0x1800117f0)
- ?QueryOutstandingAllocationCount@ALLOC_CACHE_HANDLER@@QEBAKXZ (Address: 0x180011790)
- ?Resize@BUFFER@@QEAA_NK@Z (Address: 0x180011748)
- ?Resize@STRA@@QEAAJK@Z (Address: 0x180011850)
- ?Resize@STRU@@QEAAJK@Z (Address: 0x180011910)
- ?SetLen@STRU@@QEAA_NK@Z (Address: 0x1800118e8)
- ?WriteMessage@IPM2_MESSAGE_PIPE@@QEAAJW4IPM2_OPCODE@@HKKPEAXK1@Z (Address: 0x1800117a0)
- DestroyRefTraceLog (Address: 0x180011780)
- IISInitializeCriticalSection (Address: 0x1800117d0)
- InitializeIISUtil (Address: 0x180011728)
- IsStringEqualOrdinalIgnoreCase (Address: 0x180011740)
- PuCreateDebugPrintsObject (Address: 0x1800117f8)
- PuDbgPrint (Address: 0x180011808)
- PuDbgPrintError (Address: 0x180011810)
- PuDeleteDebugPrintsObject (Address: 0x180011818)
- PuLoadDebugFlagsFromRegStr (Address: 0x180011800)
- ReadDwordParameterValueFromAnyService (Address: 0x180011730)
- TerminateIISUtil (Address: 0x180011720)
- WriteRefTraceLog (Address: 0x180011880)
msvcrt.dll
- __C_specific_handler (Address: 0x180011938)
- __CxxFrameHandler3 (Address: 0x1800119e8)
- _amsg_exit (Address: 0x180011948)
- _callnewh (Address: 0x180011960)
- _initterm (Address: 0x180011940)
- _itow_s (Address: 0x180011988)
- _strnicmp (Address: 0x1800119b0)
- _ui64tow_s (Address: 0x180011998)
- _ultow (Address: 0x1800119b8)
- _ultow_s (Address: 0x1800119e0)
- _vsnwprintf_s (Address: 0x1800119d0)
- _wcsicmp (Address: 0x180011950)
- _wcsupr_s (Address: 0x1800119a0)
- _XcptFilter (Address: 0x180011958)
- ?terminate@@YAXXZ (Address: 0x180011930)
- free (Address: 0x180011978)
- malloc (Address: 0x180011970)
- memchr (Address: 0x180011920)
- memcpy (Address: 0x180011928)
- memcpy_s (Address: 0x180011980)
- memset (Address: 0x1800119f0)
- strncpy_s (Address: 0x1800119c8)
- strtoul (Address: 0x1800119c0)
- swprintf_s (Address: 0x1800119d8)
- wcscpy_s (Address: 0x1800119a8)
- wcsnlen (Address: 0x180011990)
- wcsstr (Address: 0x180011968)
ntdll.dll
- RtlCaptureContext (Address: 0x180011a08)
- RtlCreateTimer (Address: 0x180011a20)
- RtlCreateTimerQueue (Address: 0x180011a28)
- RtlDeleteTimer (Address: 0x180011a40)
- RtlDeleteTimerQueueEx (Address: 0x180011a10)
- RtlIpv4AddressToStringExW (Address: 0x180011a38)
- RtlIpv6AddressToStringExW (Address: 0x180011a30)
- RtlLookupFunctionEntry (Address: 0x180011a00)
- RtlVirtualUnwind (Address: 0x180011a18)
OLEAUT32.dll
- SysAllocString (Address: 0x180011318)
- SysFreeString (Address: 0x180011328)
- VariantChangeType (Address: 0x180011310)
- VariantClear (Address: 0x180011308)
- VariantInit (Address: 0x180011320)
WS2_32.dll
- ntohs (Address: 0x180011338)