iisw3adm.dll

Description: IIS Web Admin Service

Version: 10.0.19041.3636

Architecture: 32-bit

Operating System: Windows NT

SHA256: 6fd2df27c2944356f1dcd3fc45da2904

File Size: 483.0 KB

Uploaded At: Dec. 1, 2025, 8:32 a.m.

Views: 14

Security Warning

This file has been flagged as potentially dangerous.

Reason: Detected potentially dangerous functions used for process injection: OpenProcess

Exported Functions

ServiceMain (Ordinal: 1, Address: 0x1b650)
??0?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PBUAPP_POOL_HASH@@VCLKRHashTable@@@@QAE@PBDNKK_N@Z (Ordinal: 2, Address: 0x1b080)
??0?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PBGVCLKRHashTable@@@@QAE@PBDNKK_N@Z (Ordinal: 3, Address: 0x1b150)
??0HASH_POOL_HASH@@QAE@XZ (Ordinal: 4, Address: 0x1ad00)
??0IPM_MESSAGE_PIPE@@QAE@ABV0@@Z (Ordinal: 5, Address: 0x1a9d0)
??0POOL_HASH_HASH@@QAE@XZ (Ordinal: 6, Address: 0x1ab40)
??1?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PBUAPP_POOL_HASH@@VCLKRHashTable@@@@QAE@XZ (Ordinal: 7, Address: 0x1acf0)
??1?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PBGVCLKRHashTable@@@@QAE@XZ (Ordinal: 8, Address: 0x1acf0)
??1HASH_POOL_HASH@@QAE@XZ (Ordinal: 9, Address: 0x1acf0)
??1POOL_HASH_HASH@@QAE@XZ (Ordinal: 10, Address: 0x1acf0)
??4CSecurityDispenser@@QAEAAV0@ABV0@@Z (Ordinal: 11, Address: 0x1aae0)
??4IPM_MESSAGE_PIPE@@QAEAAV0@ABV0@@Z (Ordinal: 12, Address: 0x1aa30)
??_7IPM_MESSAGE_PIPE@@6B@ (Ordinal: 13, Address: 0x1008)
?AddRefRecord@HASH_POOL_HASH@@SGXPAVPOOL_HASH_ENTRY@@H@Z (Ordinal: 14, Address: 0x1ac00)
?AddRefRecord@POOL_HASH_HASH@@SGXPAVPOOL_HASH_ENTRY@@H@Z (Ordinal: 15, Address: 0x1ac00)
?Apply@?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PBUAPP_POOL_HASH@@VCLKRHashTable@@@@QAEKP6G?AW4LK_ACTION@@PAVPOOL_HASH_ENTRY@@PAX@Z1W4LK_LOCKTYPE@@@Z (Ordinal: 16, Address: 0x1af80)
?Apply@?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PBGVCLKRHashTable@@@@QAEKP6G?AW4LK_ACTION@@PAVPOOL_HASH_ENTRY@@PAX@Z1W4LK_LOCKTYPE@@@Z (Ordinal: 17, Address: 0x1af80)
?ApplyIf@?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PBUAPP_POOL_HASH@@VCLKRHashTable@@@@QAEKP6G?AW4LK_PREDICATE@@PAVPOOL_HASH_ENTRY@@PAX@ZP6G?AW4LK_ACTION@@01@Z1W4LK_LOCKTYPE@@@Z (Ordinal: 18, Address: 0x1af30)
?ApplyIf@?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PBGVCLKRHashTable@@@@QAEKP6G?AW4LK_PREDICATE@@PAVPOOL_HASH_ENTRY@@PAX@ZP6G?AW4LK_ACTION@@01@Z1W4LK_LOCKTYPE@@@Z (Ordinal: 19, Address: 0x1af30)
?CalcKeyHash@HASH_POOL_HASH@@SGKPBUAPP_POOL_HASH@@@Z (Ordinal: 20, Address: 0x1ad60)
?CalcKeyHash@POOL_HASH_HASH@@SGKPBG@Z (Ordinal: 21, Address: 0x1aba0)
?ClearHash@HASH_POOL_HASH@@SGXPAV1@@Z (Ordinal: 22, Address: 0x1ac60)
?ClearHash@POOL_HASH_HASH@@SGXPAV1@@Z (Ordinal: 23, Address: 0x1ac60)
?DeleteIf@?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PBUAPP_POOL_HASH@@VCLKRHashTable@@@@QAEKP6G?AW4LK_PREDICATE@@PAVPOOL_HASH_ENTRY@@PAX@Z1@Z (Ordinal: 24, Address: 0x1aef0)
?DeleteIf@?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PBGVCLKRHashTable@@@@QAEKP6G?AW4LK_PREDICATE@@PAVPOOL_HASH_ENTRY@@PAX@Z1@Z (Ordinal: 25, Address: 0x1aef0)
?DeleteKey@?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PBUAPP_POOL_HASH@@VCLKRHashTable@@@@QAE?AW4LK_RETCODE@@QBUAPP_POOL_HASH@@@Z (Ordinal: 26, Address: 0x1b040)
?DeleteKey@?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PBGVCLKRHashTable@@@@QAE?AW4LK_RETCODE@@QBG@Z (Ordinal: 27, Address: 0x1b040)
?DeletePoolHashEntriesAction@HASH_POOL_HASH@@SG?AW4LK_ACTION@@PAVPOOL_HASH_ENTRY@@PAX@Z (Ordinal: 28, Address: 0x1ac30)
?DeletePoolHashEntriesAction@POOL_HASH_HASH@@SG?AW4LK_ACTION@@PAVPOOL_HASH_ENTRY@@PAX@Z (Ordinal: 29, Address: 0x1ac30)
?DeleteRecord@?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PBUAPP_POOL_HASH@@VCLKRHashTable@@@@QAE?AW4LK_RETCODE@@PBVPOOL_HASH_ENTRY@@@Z (Ordinal: 30, Address: 0x1b020)
?DeleteRecord@?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PBGVCLKRHashTable@@@@QAE?AW4LK_RETCODE@@PBVPOOL_HASH_ENTRY@@@Z (Ordinal: 31, Address: 0x1b020)
?EqualKeys@HASH_POOL_HASH@@SG_NPBUAPP_POOL_HASH@@0@Z (Ordinal: 32, Address: 0x1ad90)
?EqualKeys@POOL_HASH_HASH@@SG_NPBG0@Z (Ordinal: 33, Address: 0x1abd0)
?EqualRange@?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PBUAPP_POOL_HASH@@VCLKRHashTable@@@@QAE_NQBUAPP_POOL_HASH@@AAViterator@1@1@Z (Ordinal: 34, Address: 0x1add0)
?EqualRange@?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PBGVCLKRHashTable@@@@QAE_NQBGAAViterator@1@1@Z (Ordinal: 35, Address: 0x1add0)
?Erase@?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PBUAPP_POOL_HASH@@VCLKRHashTable@@@@QAE_NAAViterator@1@0@Z (Ordinal: 36, Address: 0x1ae10)
?Erase@?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PBUAPP_POOL_HASH@@VCLKRHashTable@@@@QAE_NAAViterator@1@@Z (Ordinal: 37, Address: 0x1ae30)
?Erase@?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PBGVCLKRHashTable@@@@QAE_NAAViterator@1@0@Z (Ordinal: 38, Address: 0x1ae10)
?Erase@?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PBGVCLKRHashTable@@@@QAE_NAAViterator@1@@Z (Ordinal: 39, Address: 0x1ae30)
?ExtractKey@HASH_POOL_HASH@@SGPBUAPP_POOL_HASH@@PBVPOOL_HASH_ENTRY@@@Z (Ordinal: 40, Address: 0x1ad40)
?ExtractKey@POOL_HASH_HASH@@SGPBGPBVPOOL_HASH_ENTRY@@@Z (Ordinal: 41, Address: 0x1ab80)
?Find@?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PBUAPP_POOL_HASH@@VCLKRHashTable@@@@QAE_NQBUAPP_POOL_HASH@@AAViterator@1@@Z (Ordinal: 42, Address: 0x1adf0)
?Find@?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PBGVCLKRHashTable@@@@QAE_NQBGAAViterator@1@@Z (Ordinal: 43, Address: 0x1adf0)
?FindKey@?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PBUAPP_POOL_HASH@@VCLKRHashTable@@@@QBE?AW4LK_RETCODE@@QBUAPP_POOL_HASH@@PAPAVPOOL_HASH_ENTRY@@@Z (Ordinal: 44, Address: 0x1afe0)
?FindKey@?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PBGVCLKRHashTable@@@@QBE?AW4LK_RETCODE@@QBGPAPAVPOOL_HASH_ENTRY@@@Z (Ordinal: 45, Address: 0x1afe0)
?FindRecord@?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PBUAPP_POOL_HASH@@VCLKRHashTable@@@@QBE?AW4LK_RETCODE@@PBVPOOL_HASH_ENTRY@@@Z (Ordinal: 46, Address: 0x1afc0)
?FindRecord@?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PBGVCLKRHashTable@@@@QBE?AW4LK_RETCODE@@PBVPOOL_HASH_ENTRY@@@Z (Ordinal: 47, Address: 0x1afc0)
HostedW3SVCStart (Ordinal: 48, Address: 0x1b760)
HostedW3SVCStop (Ordinal: 49, Address: 0x1bb80)
?Insert@?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PBUAPP_POOL_HASH@@VCLKRHashTable@@@@QAE_NPBVPOOL_HASH_ENTRY@@AAViterator@1@_N@Z (Ordinal: 50, Address: 0x1ae50)
?Insert@?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PBGVCLKRHashTable@@@@QAE_NPBVPOOL_HASH_ENTRY@@AAViterator@1@_N@Z (Ordinal: 51, Address: 0x1ae50)
?InsertRecord@?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PBUAPP_POOL_HASH@@VCLKRHashTable@@@@QAE?AW4LK_RETCODE@@PBVPOOL_HASH_ENTRY@@_N@Z (Ordinal: 52, Address: 0x1b060)
?InsertRecord@?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PBGVCLKRHashTable@@@@QAE?AW4LK_RETCODE@@PBVPOOL_HASH_ENTRY@@_N@Z (Ordinal: 53, Address: 0x1b060)
?QueryState@HTTP_WRAPPER@@QBE?AW4HTTP_WRAPPER_STATE@@XZ (Ordinal: 54, Address: 0x1ab00)
?_Action@?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PBUAPP_POOL_HASH@@VCLKRHashTable@@@@CG?AW4LK_ACTION@@PBXPAX@Z (Ordinal: 55, Address: 0x1b0d0)
?_Action@?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PBGVCLKRHashTable@@@@CG?AW4LK_ACTION@@PBXPAX@Z (Ordinal: 56, Address: 0x1b0d0)
?_AddRefRecord@?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PBUAPP_POOL_HASH@@VCLKRHashTable@@@@CGXPBXH@Z (Ordinal: 57, Address: 0x1b130)
?_AddRefRecord@?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PBGVCLKRHashTable@@@@CGXPBXH@Z (Ordinal: 58, Address: 0x1b130)
?_CalcKeyHash@?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PBUAPP_POOL_HASH@@VCLKRHashTable@@@@CGKK@Z (Ordinal: 59, Address: 0x1ad60)
?_CalcKeyHash@?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PBGVCLKRHashTable@@@@CGKK@Z (Ordinal: 60, Address: 0x1aba0)
?_EqualKeys@?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PBUAPP_POOL_HASH@@VCLKRHashTable@@@@CG_NKK@Z (Ordinal: 61, Address: 0x1b140)
?_EqualKeys@?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PBGVCLKRHashTable@@@@CG_NKK@Z (Ordinal: 62, Address: 0x1abd0)
?_ExtractKey@?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PBUAPP_POOL_HASH@@VCLKRHashTable@@@@CG?BKPBX@Z (Ordinal: 63, Address: 0x1ad40)
?_ExtractKey@?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PBGVCLKRHashTable@@@@CG?BKPBX@Z (Ordinal: 64, Address: 0x1ab80)
?_Pred@?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PBUAPP_POOL_HASH@@VCLKRHashTable@@@@CG?AW4LK_PREDICATE@@PBXPAX@Z (Ordinal: 65, Address: 0x1b100)
?_Pred@?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PBGVCLKRHashTable@@@@CG?AW4LK_PREDICATE@@PBXPAX@Z (Ordinal: 66, Address: 0x1b100)
?begin@?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PBUAPP_POOL_HASH@@VCLKRHashTable@@@@QAE?AViterator@1@XZ (Ordinal: 67, Address: 0x1aeb0)
?begin@?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PBGVCLKRHashTable@@@@QAE?AViterator@1@XZ (Ordinal: 68, Address: 0x1aeb0)
?end@?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PBUAPP_POOL_HASH@@VCLKRHashTable@@@@QAE?AViterator@1@XZ (Ordinal: 69, Address: 0x1ae70)
?end@?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PBGVCLKRHashTable@@@@QAE?AViterator@1@XZ (Ordinal: 70, Address: 0x1ae70)
DllRegisterServer (Ordinal: 71, Address: 0x1bdd0)
DllUnregisterServer (Ordinal: 72, Address: 0x1bde0)

Imported DLLs & Functions

api-ms-win-core-com-l1-1-0.dll

CoCreateInstance (Address: 0x1006e068)
CoFreeUnusedLibrariesEx (Address: 0x1006e078)
CoInitializeEx (Address: 0x1006e064)
CoInitializeSecurity (Address: 0x1006e07c)
CoRegisterClassObject (Address: 0x1006e074)
CoRevokeClassObject (Address: 0x1006e06c)
CoTaskMemAlloc (Address: 0x1006e060)
CoTaskMemFree (Address: 0x1006e070)
CoUninitialize (Address: 0x1006e05c)

api-ms-win-core-debug-l1-1-0.dll

OutputDebugStringA (Address: 0x1006e088)
OutputDebugStringW (Address: 0x1006e084)

api-ms-win-core-debug-l1-1-1.dll

CheckRemoteDebuggerPresent (Address: 0x1006e090)

api-ms-win-core-delayload-l1-1-0.dll

DelayLoadFailureHook (Address: 0x1006e098)

api-ms-win-core-delayload-l1-1-1.dll

ResolveDelayLoadedAPI (Address: 0x1006e0a0)

api-ms-win-core-errorhandling-l1-1-0.dll

GetLastError (Address: 0x1006e0a8)
SetLastError (Address: 0x1006e0b0)
SetUnhandledExceptionFilter (Address: 0x1006e0b4)
UnhandledExceptionFilter (Address: 0x1006e0ac)

api-ms-win-core-file-l1-1-0.dll

CreateDirectoryW (Address: 0x1006e0d8)
CreateFileW (Address: 0x1006e0cc)
DeleteFileW (Address: 0x1006e0dc)
GetFileAttributesW (Address: 0x1006e0d4)
GetTempFileNameW (Address: 0x1006e0c8)
ReadFile (Address: 0x1006e0c4)
RemoveDirectoryW (Address: 0x1006e0c0)
SetEndOfFile (Address: 0x1006e0bc)
SetFileAttributesW (Address: 0x1006e0e0)
WriteFile (Address: 0x1006e0d0)

api-ms-win-core-file-l2-1-0.dll

MoveFileExW (Address: 0x1006e0e8)

api-ms-win-core-handle-l1-1-0.dll

CloseHandle (Address: 0x1006e0f0)
DuplicateHandle (Address: 0x1006e0f4)

api-ms-win-core-heap-l1-1-0.dll

GetProcessHeap (Address: 0x1006e100)
HeapAlloc (Address: 0x1006e108)
HeapFree (Address: 0x1006e104)
HeapReAlloc (Address: 0x1006e0fc)

api-ms-win-core-heap-l2-1-0.dll

GlobalAlloc (Address: 0x1006e118)
GlobalFree (Address: 0x1006e11c)
LocalAlloc (Address: 0x1006e114)
LocalFree (Address: 0x1006e110)

api-ms-win-core-io-l1-1-0.dll

CreateIoCompletionPort (Address: 0x1006e128)
GetQueuedCompletionStatus (Address: 0x1006e124)
PostQueuedCompletionStatus (Address: 0x1006e12c)

api-ms-win-core-job-l2-1-0.dll

AssignProcessToJobObject (Address: 0x1006e140)
CreateJobObjectW (Address: 0x1006e138)
QueryInformationJobObject (Address: 0x1006e13c)
SetInformationJobObject (Address: 0x1006e134)

api-ms-win-core-kernel32-legacy-l1-1-0.dll

CreateFileMappingA (Address: 0x1006e154)
GetComputerNameW (Address: 0x1006e150)
RegisterWaitForSingleObject (Address: 0x1006e14c)
UnregisterWait (Address: 0x1006e148)

api-ms-win-core-kernel32-legacy-l1-1-1.dll

GetNumaAvailableMemoryNodeEx (Address: 0x1006e15c)
SetDllDirectoryW (Address: 0x1006e160)

api-ms-win-core-kernel32-legacy-l1-1-2.dll

OpenFileMappingA (Address: 0x1006e168)

api-ms-win-core-libraryloader-l1-2-0.dll

DisableThreadLibraryCalls (Address: 0x1006e17c)
FreeLibrary (Address: 0x1006e180)
GetModuleFileNameW (Address: 0x1006e174)
GetModuleHandleW (Address: 0x1006e184)
GetProcAddress (Address: 0x1006e178)
LoadLibraryExW (Address: 0x1006e170)

api-ms-win-core-libraryloader-l1-2-1.dll

LoadLibraryW (Address: 0x1006e18c)

api-ms-win-core-memory-l1-1-0.dll

CreateFileMappingW (Address: 0x1006e194)
MapViewOfFile (Address: 0x1006e1a0)
OpenFileMappingW (Address: 0x1006e19c)
UnmapViewOfFile (Address: 0x1006e198)

api-ms-win-core-normalization-l1-1-0.dll

IdnToNameprepUnicode (Address: 0x1006e1a8)

api-ms-win-core-perfcounters-l1-1-0.dll

PerfCreateInstance (Address: 0x1006e1c8)
PerfDeleteInstance (Address: 0x1006e1b4)
PerfSetCounterRefValue (Address: 0x1006e1c0)
PerfSetCounterSetInfo (Address: 0x1006e1b0)
PerfSetULongLongCounterValue (Address: 0x1006e1bc)
PerfStartProvider (Address: 0x1006e1b8)
PerfStopProvider (Address: 0x1006e1c4)

api-ms-win-core-processenvironment-l1-1-0.dll

ExpandEnvironmentStringsW (Address: 0x1006e1d4)
FreeEnvironmentStringsW (Address: 0x1006e1d0)
GetEnvironmentStringsW (Address: 0x1006e1d8)

api-ms-win-core-processthreads-l1-1-0.dll

CreateProcessAsUserW (Address: 0x1006e208)
CreateProcessW (Address: 0x1006e1e8)
CreateThread (Address: 0x1006e210)
DeleteProcThreadAttributeList (Address: 0x1006e218)
GetCurrentProcess (Address: 0x1006e1ec)
GetCurrentProcessId (Address: 0x1006e204)
GetCurrentThread (Address: 0x1006e1e0)
GetCurrentThreadId (Address: 0x1006e21c)
GetExitCodeProcess (Address: 0x1006e1f0)
GetExitCodeThread (Address: 0x1006e200)
InitializeProcThreadAttributeList (Address: 0x1006e1e4)
OpenProcessToken (Address: 0x1006e1f4)
ResumeThread (Address: 0x1006e214)
SetThreadPriority (Address: 0x1006e1f8)
TerminateProcess (Address: 0x1006e1fc)
UpdateProcThreadAttribute (Address: 0x1006e20c)

api-ms-win-core-processthreads-l1-1-1.dll

OpenProcess (Address: 0x1006e224)

api-ms-win-core-processtopology-private-l1-1-0.dll

SetProcessGroupAffinity (Address: 0x1006e22c)

api-ms-win-core-profile-l1-1-0.dll

QueryPerformanceCounter (Address: 0x1006e234)

api-ms-win-core-registry-l1-1-0.dll

RegCloseKey (Address: 0x1006e250)
RegCreateKeyExW (Address: 0x1006e254)
RegDeleteKeyExW (Address: 0x1006e24c)
RegEnumKeyExW (Address: 0x1006e248)
RegNotifyChangeKeyValue (Address: 0x1006e258)
RegOpenKeyExW (Address: 0x1006e244)
RegQueryValueExW (Address: 0x1006e23c)
RegSetKeySecurity (Address: 0x1006e240)

api-ms-win-core-synch-l1-1-0.dll

AcquireSRWLockExclusive (Address: 0x1006e298)
AcquireSRWLockShared (Address: 0x1006e2a0)
CreateEventA (Address: 0x1006e268)
CreateEventW (Address: 0x1006e280)
CreateMutexA (Address: 0x1006e28c)
DeleteCriticalSection (Address: 0x1006e260)
EnterCriticalSection (Address: 0x1006e278)
InitializeCriticalSection (Address: 0x1006e290)
InitializeCriticalSectionAndSpinCount (Address: 0x1006e26c)
InitializeSRWLock (Address: 0x1006e27c)
LeaveCriticalSection (Address: 0x1006e274)
ReleaseMutex (Address: 0x1006e288)
ReleaseSRWLockExclusive (Address: 0x1006e284)
ReleaseSRWLockShared (Address: 0x1006e29c)
ResetEvent (Address: 0x1006e264)
SetEvent (Address: 0x1006e270)
WaitForSingleObject (Address: 0x1006e294)

api-ms-win-core-synch-l1-2-0.dll

Sleep (Address: 0x1006e2a8)

api-ms-win-core-sysinfo-l1-1-0.dll

GetLogicalProcessorInformationEx (Address: 0x1006e2b8)
GetSystemDirectoryW (Address: 0x1006e2bc)
GetSystemInfo (Address: 0x1006e2b4)
GetSystemTimeAsFileTime (Address: 0x1006e2c0)
GetTickCount (Address: 0x1006e2c4)
GetVersionExW (Address: 0x1006e2b0)

api-ms-win-core-threadpool-l1-2-0.dll

CloseThreadpool (Address: 0x1006e2f0)
CloseThreadpoolCleanupGroup (Address: 0x1006e2ec)
CloseThreadpoolCleanupGroupMembers (Address: 0x1006e2dc)
CloseThreadpoolIo (Address: 0x1006e2d8)
CloseThreadpoolTimer (Address: 0x1006e2cc)
CreateThreadpool (Address: 0x1006e2fc)
CreateThreadpoolCleanupGroup (Address: 0x1006e2e4)
CreateThreadpoolIo (Address: 0x1006e2e0)
CreateThreadpoolTimer (Address: 0x1006e2e8)
SetThreadpoolThreadMaximum (Address: 0x1006e2f8)
SetThreadpoolThreadMinimum (Address: 0x1006e2f4)
SetThreadpoolTimer (Address: 0x1006e2d0)
StartThreadpoolIo (Address: 0x1006e308)
TrySubmitThreadpoolCallback (Address: 0x1006e304)
WaitForThreadpoolIoCallbacks (Address: 0x1006e2d4)
WaitForThreadpoolTimerCallbacks (Address: 0x1006e300)

api-ms-win-core-threadpool-legacy-l1-1-0.dll

CreateTimerQueueTimer (Address: 0x1006e314)
DeleteTimerQueueTimer (Address: 0x1006e310)
UnregisterWaitEx (Address: 0x1006e318)

api-ms-win-core-wow64-l1-1-1.dll

GetSystemWow64DirectoryW (Address: 0x1006e320)

api-ms-win-eventing-provider-l1-1-0.dll

EventRegister (Address: 0x1006e330)
EventSetInformation (Address: 0x1006e328)
EventUnregister (Address: 0x1006e32c)
EventWriteTransfer (Address: 0x1006e334)

api-ms-win-security-base-l1-1-0.dll

AddAccessAllowedAce (Address: 0x1006e36c)
AllocateAndInitializeSid (Address: 0x1006e33c)
AllocateLocallyUniqueId (Address: 0x1006e344)
CopySid (Address: 0x1006e370)
CreateRestrictedToken (Address: 0x1006e360)
CreateWellKnownSid (Address: 0x1006e34c)
DuplicateTokenEx (Address: 0x1006e378)
EqualSid (Address: 0x1006e340)
FreeSid (Address: 0x1006e368)
GetLengthSid (Address: 0x1006e350)
GetSecurityDescriptorDacl (Address: 0x1006e35c)
GetTokenInformation (Address: 0x1006e358)
InitializeAcl (Address: 0x1006e374)
InitializeSecurityDescriptor (Address: 0x1006e348)
IsValidSid (Address: 0x1006e37c)
SetSecurityDescriptorDacl (Address: 0x1006e354)
SetTokenInformation (Address: 0x1006e364)

api-ms-win-security-logon-l1-1-0.dll

LogonUserExW (Address: 0x1006e384)

api-ms-win-security-lsalookup-l2-1-0.dll

LookupAccountNameW (Address: 0x1006e38c)

api-ms-win-security-lsalookup-l2-1-1.dll

LsaManageSidNameMapping (Address: 0x1006e394)

api-ms-win-security-lsapolicy-l1-1-0.dll

LsaAddAccountRights (Address: 0x1006e3a8)
LsaClose (Address: 0x1006e39c)
LsaFreeMemory (Address: 0x1006e3a0)
LsaOpenPolicy (Address: 0x1006e3a4)

api-ms-win-security-provider-l1-1-0.dll

GetSecurityInfo (Address: 0x1006e3b8)
SetEntriesInAclW (Address: 0x1006e3b4)
SetNamedSecurityInfoW (Address: 0x1006e3bc)
SetSecurityInfo (Address: 0x1006e3b0)

api-ms-win-service-core-l1-1-0.dll

SetServiceStatus (Address: 0x1006e3c4)

api-ms-win-service-management-l1-1-0.dll

CloseServiceHandle (Address: 0x1006e3d0)
OpenSCManagerW (Address: 0x1006e3cc)
OpenServiceW (Address: 0x1006e3d8)
StartServiceW (Address: 0x1006e3d4)

api-ms-win-service-winsvc-l1-1-0.dll

ControlService (Address: 0x1006e3e0)
QueryServiceStatus (Address: 0x1006e3e4)
RegisterServiceCtrlHandlerW (Address: 0x1006e3e8)

bcrypt.dll

BCryptCreateHash (Address: 0x1006e3f0)
BCryptDestroyHash (Address: 0x1006e3f4)
BCryptFinishHash (Address: 0x1006e3f8)
BCryptHashData (Address: 0x1006e3fc)

DNSAPI.dll

GetCurrentTimeInSeconds (Address: 0x1006e000)

iisutil.dll

??0ALLOC_CACHE_HANDLER@@QAE@PBDPBUALLOC_CACHE_CONFIGURATION@@H@Z (Address: 0x1006e5b0)
??0BUFFER@@QAE@XZ (Address: 0x1006e47c)
??0CLKRHashTable_Iterator@@QAE@ABV0@@Z (Address: 0x1006e44c)
??0CLKRHashTable@@QAE@PBDP6G?BKPBX@ZP6GKK@ZP6G_NKK@ZP6GX1H@ZNKK_N@Z (Address: 0x1006e448)
??0CSecurityDispenser@@QAE@XZ (Address: 0x1006e48c)
??0EVENT_LOG@@QAE@PBG@Z (Address: 0x1006e470)
??0MULTISZ@@QAE@PBG@Z (Address: 0x1006e588)
??0MULTISZ@@QAE@XZ (Address: 0x1006e4c4)
??0STRA@@QAE@PADK@Z (Address: 0x1006e5c8)
??0STRA@@QAE@XZ (Address: 0x1006e5d0)
??0STRU@@QAE@PAGK@Z (Address: 0x1006e4d4)
??0STRU@@QAE@XZ (Address: 0x1006e474)
??1ALLOC_CACHE_HANDLER@@QAE@XZ (Address: 0x1006e5b4)
??1BUFFER@@QAE@XZ (Address: 0x1006e478)
??1CLKRHashTable_Iterator@@QAE@XZ (Address: 0x1006e454)
??1CLKRHashTable@@QAE@XZ (Address: 0x1006e444)
??1CSecurityDispenser@@QAE@XZ (Address: 0x1006e490)
??1CSmallSpinLock@@QAE@XZ (Address: 0x1006e488)
??1IPM_MESSAGE_PIPE@@EAE@XZ (Address: 0x1006e404)
??1MULTISZ@@QAE@XZ (Address: 0x1006e4c8)
??1STRA@@QAE@XZ (Address: 0x1006e484)
??1STRU@@QAE@XZ (Address: 0x1006e450)
??9CLKRHashTable_Iterator@@QBE_NABV0@@Z (Address: 0x1006e52c)
?AdjustTokenForAdministrators@CSecurityDispenser@@QAEKPAX@Z (Address: 0x1006e590)
?Alloc@ALLOC_CACHE_HANDLER@@QAEPAXXZ (Address: 0x1006e5b8)
?Append@MULTISZ@@QAEHAAVSTRU@@@Z (Address: 0x1006e5a8)
?Append@MULTISZ@@QAEHPBG@Z (Address: 0x1006e4d0)
?Append@STRA@@QAEJPBD@Z (Address: 0x1006e51c)
?Append@STRU@@QAEJABV1@@Z (Address: 0x1006e548)
?Append@STRU@@QAEJG@Z (Address: 0x1006e4f0)
?Append@STRU@@QAEJPBG@Z (Address: 0x1006e49c)
?Append@STRU@@QAEJPBGK@Z (Address: 0x1006e5a4)
?AppendW@STRA@@QAEJPBG@Z (Address: 0x1006e520)
?Apply@CLKRHashTable@@QAEKP6G?AW4LK_ACTION@@PBXPAX@Z1W4LK_LOCKTYPE@@@Z (Address: 0x1006e42c)
?ApplyIf@CLKRHashTable@@QAEKP6G?AW4LK_PREDICATE@@PBXPAX@ZP6G?AW4LK_ACTION@@01@Z1W4LK_LOCKTYPE@@@Z (Address: 0x1006e428)
?Begin@CLKRHashTable@@QAE?AVCLKRHashTable_Iterator@@XZ (Address: 0x1006e41c)
?Clear@CLKRHashTable@@QAEXXZ (Address: 0x1006e4b8)
?Clone@MULTISZ@@QBEHPAV1@@Z (Address: 0x1006e594)
?Copy@MULTISZ@@QAEHABV1@@Z (Address: 0x1006e4e8)
?Copy@STRU@@QAEJABV1@@Z (Address: 0x1006e4f8)
?Copy@STRU@@QAEJPBG@Z (Address: 0x1006e494)
?Copy@STRU@@QAEJPBGK@Z (Address: 0x1006e4e4)
?Copy@STRU@@QAEJPBV1@@Z (Address: 0x1006e510)
?CreateIpmMessagePipe@IPM_MESSAGE_PIPE@@SGJPAVIPM_MESSAGE_ACCEPTOR@@PBGHPAU_SECURITY_ATTRIBUTES@@PAPAV1@@Z (Address: 0x1006e560)
?DeleteIf@CLKRHashTable@@QAEKP6G?AW4LK_PREDICATE@@PBXPAX@Z1@Z (Address: 0x1006e424)
?DeleteKey@CLKRHashTable@@QAE?AW4LK_RETCODE@@K@Z (Address: 0x1006e43c)
?DeleteRecord@CLKRHashTable@@QAE?AW4LK_RETCODE@@PBX@Z (Address: 0x1006e438)
?DestroyIpmMessagePipe@IPM_MESSAGE_PIPE@@QAGXXZ (Address: 0x1006e568)
?End@CLKRHashTable@@QAE?AVCLKRHashTable_Iterator@@XZ (Address: 0x1006e458)
?EqualRange@CLKRHashTable@@QAE_NKAAVCLKRHashTable_Iterator@@0@Z (Address: 0x1006e408)
?Equals@MULTISZ@@QAEHPAV1@@Z (Address: 0x1006e59c)
?Equals@STRA@@QBE_NABV1@@Z (Address: 0x1006e5c4)
?Equals@STRU@@QBE_NABV1@@Z (Address: 0x1006e598)
?EqualsNoCase@STRU@@QBE_NABV1@@Z (Address: 0x1006e500)
?EqualsNoCase@STRU@@QBE_NPBG@Z (Address: 0x1006e524)
?Erase@CLKRHashTable@@QAE_NAAVCLKRHashTable_Iterator@@@Z (Address: 0x1006e410)
?Erase@CLKRHashTable@@QAE_NAAVCLKRHashTable_Iterator@@0@Z (Address: 0x1006e414)
?FastAppend@MULTISZ@@QAEHPBG@Z (Address: 0x1006e514)
?Find@CLKRHashTable@@QAE_NKAAVCLKRHashTable_Iterator@@@Z (Address: 0x1006e40c)
?FindKey@CLKRHashTable@@QBE?AW4LK_RETCODE@@KPAPBX@Z (Address: 0x1006e434)
?FindRecord@CLKRHashTable@@QBE?AW4LK_RETCODE@@PBX@Z (Address: 0x1006e430)
?FindStringNoCase@MULTISZ@@QAEHPBG@Z (Address: 0x1006e4d8)
?First@MULTISZ@@QBEPBGXZ (Address: 0x1006e4e0)
?Free@ALLOC_CACHE_HANDLER@@QAEHPAX@Z (Address: 0x1006e480)
?GetIisIusrsSID@CSecurityDispenser@@QAEKPAPAX@Z (Address: 0x1006e4b4)
?GetLocalGroupSID@CSecurityDispenser@@QAEKPAPAX@Z (Address: 0x1006e4b0)
?GetSID@CSecurityDispenser@@QAEKW4WELL_KNOWN_SID_TYPE@@PAPAX@Z (Address: 0x1006e4a0)
?GetStringizedIpmOpcode@IPM_MESSAGE_PIPE@@SGPBGW4IPM_OPCODE@@@Z (Address: 0x1006e554)
?Increment@CLKRHashTable_Iterator@@QAE_NXZ (Address: 0x1006e530)
?Insert@CLKRHashTable@@QAE_NPBXAAVCLKRHashTable_Iterator@@_N@Z (Address: 0x1006e418)
?InsertRecord@CLKRHashTable@@QAE?AW4LK_RETCODE@@PBX_N@Z (Address: 0x1006e440)
?IsValid@CLKRHashTable@@QBE_NXZ (Address: 0x1006e54c)
?LogEvent@EVENT_LOG@@QAEXKGQAPBGK@Z (Address: 0x1006e4c0)
?ReadLock@CReaderWriterLock3@@QAEXXZ (Address: 0x1006e504)
?ReadUnlock@CReaderWriterLock3@@QAEXXZ (Address: 0x1006e508)
?Record@CLKRHashTable_Iterator@@QBEPBXXZ (Address: 0x1006e528)
?Reset@MULTISZ@@QAEXXZ (Address: 0x1006e5a0)
?Resize@BUFFER@@QAE_NK@Z (Address: 0x1006e4ac)
?Resize@STRA@@QAEJK@Z (Address: 0x1006e5c0)
?Resize@STRU@@QAEJK@Z (Address: 0x1006e518)
?SetLen@STRU@@QAE_NK@Z (Address: 0x1006e4dc)
?Size@CLKRHashTable@@QBEKXZ (Address: 0x1006e420)
?SyncWithBuffer@STRU@@QAEXXZ (Address: 0x1006e550)
?WriteLock@CReaderWriterLock3@@QAEXXZ (Address: 0x1006e4f4)
?WriteLock@CSmallSpinLock@@QAEXXZ (Address: 0x1006e50c)
?WriteMessage@IPM_MESSAGE_PIPE@@QAGJW4IPM_OPCODE@@KPAX@Z (Address: 0x1006e56c)
?WriteUnlock@CReaderWriterLock3@@QAEXXZ (Address: 0x1006e4fc)
?WriteUnlock@CSmallSpinLock@@QAEXXZ (Address: 0x1006e5ac)
AllocateAndCreateWellKnownSid (Address: 0x1006e534)
CreateSubkey (Address: 0x1006e570)
DisableTokenBackupPrivilege (Address: 0x1006e5bc)
DupTokenAddAccess (Address: 0x1006e53c)
FreeSecurityAttributes (Address: 0x1006e564)
FreeTokenUserSID (Address: 0x1006e544)
FreeWellKnownSid (Address: 0x1006e540)
GenerateNameWithGUID (Address: 0x1006e55c)
GetSecurityAttributesForSid (Address: 0x1006e558)
GetTokenSID (Address: 0x1006e58c)
GetTokenUserSID (Address: 0x1006e538)
HandleKeyGeneration (Address: 0x1006e57c)
HandleMigration (Address: 0x1006e578)
InitializeIISUtil (Address: 0x1006e498)
IsPathUnc (Address: 0x1006e4ec)
IsStringEqualOrdinalIgnoreCase (Address: 0x1006e5cc)
MakeAllProcessHeapsLFH (Address: 0x1006e580)
PuCreateDebugPrintsObject (Address: 0x1006e45c)
PuDbgPrint (Address: 0x1006e464)
PuDbgPrintError (Address: 0x1006e468)
PuDeleteDebugPrintsObject (Address: 0x1006e46c)
PuLoadDebugFlagsFromRegStr (Address: 0x1006e460)
ReadDwordParameterValueFromAnyService (Address: 0x1006e4a4)
ReadMultiStringParameterValueFromAnyService (Address: 0x1006e4cc)
ReadStringParameterValueFromAnyService (Address: 0x1006e4a8)
SetExplicitAccessSettings (Address: 0x1006e584)
SetStringParameterValueInAnyService (Address: 0x1006e574)
TerminateIISUtil (Address: 0x1006e4bc)

logoncli.dll

NetGetDCName (Address: 0x1006e5d8)
NetIsServiceAccount (Address: 0x1006e5dc)

msvcrt.dll

__CxxFrameHandler3 (Address: 0x1006e654)
__dllonexit (Address: 0x1006e5f4)
_amsg_exit (Address: 0x1006e608)
_callnewh (Address: 0x1006e610)
_except_handler4_common (Address: 0x1006e600)
_ftol2 (Address: 0x1006e620)
_i64tow_s (Address: 0x1006e634)
_initterm (Address: 0x1006e604)
_lock (Address: 0x1006e5fc)
_ltow_s (Address: 0x1006e630)
_onexit (Address: 0x1006e5f0)
_purecall (Address: 0x1006e66c)
_ultow (Address: 0x1006e670)
_ultow_s (Address: 0x1006e638)
_unlock (Address: 0x1006e5f8)
_vsnprintf (Address: 0x1006e64c)
_vsnwprintf (Address: 0x1006e65c)
_wcsicmp (Address: 0x1006e61c)
_wcslwr_s (Address: 0x1006e618)
_wcsnicmp (Address: 0x1006e664)
_wcsupr (Address: 0x1006e62c)
_XcptFilter (Address: 0x1006e60c)
?terminate@@YAXXZ (Address: 0x1006e678)
free (Address: 0x1006e658)
malloc (Address: 0x1006e650)
memcmp (Address: 0x1006e5e4)
memcpy (Address: 0x1006e5e8)
memcpy_s (Address: 0x1006e640)
memmove (Address: 0x1006e5ec)
memset (Address: 0x1006e67c)
swprintf_s (Address: 0x1006e644)
wcscat_s (Address: 0x1006e614)
wcschr (Address: 0x1006e668)
wcscpy_s (Address: 0x1006e660)
wcsncmp (Address: 0x1006e648)
wcsncpy_s (Address: 0x1006e628)
wcsrchr (Address: 0x1006e674)
wcsstr (Address: 0x1006e624)
wcstoul (Address: 0x1006e63c)

nativerd.dll

CreateNativeConfigurationSystem (Address: 0x1006e68c)
GetDefaultNativeConfigurationSystem (Address: 0x1006e690)
InitializeNativeConfiguration (Address: 0x1006e688)
TerminateNativeConfiguration (Address: 0x1006e684)

ntdll.dll

NtQuerySystemInformation (Address: 0x1006e6c4)
RtlDeregisterWaitEx (Address: 0x1006e6bc)
RtlExpandEnvironmentStrings_U (Address: 0x1006e6b4)
RtlInitializeSid (Address: 0x1006e698)
RtlInitUnicodeString (Address: 0x1006e6b0)
RtlInitUnicodeStringEx (Address: 0x1006e6b8)
RtlIpv4StringToAddressW (Address: 0x1006e6a0)
RtlLengthRequiredSid (Address: 0x1006e69c)
RtlNtStatusToDosError (Address: 0x1006e6ac)
RtlRegisterWait (Address: 0x1006e6c0)
RtlSubAuthoritySid (Address: 0x1006e6c8)
WinSqmSetDWORD (Address: 0x1006e6a8)
WinSqmSetDWORD64 (Address: 0x1006e6a4)

OLEAUT32.dll

GetErrorInfo (Address: 0x1006e018)
SysAllocString (Address: 0x1006e014)
SysFreeString (Address: 0x1006e010)
VariantClear (Address: 0x1006e00c)
VariantInit (Address: 0x1006e008)

SspiCli.dll

LogonUserExExW (Address: 0x1006e024)
LsaFreeReturnBuffer (Address: 0x1006e020)

W3TP.dll

ThreadPoolInitialize (Address: 0x1006e02c)
ThreadPoolSetInfo (Address: 0x1006e034)
ThreadPoolTerminate (Address: 0x1006e030)

WS2_32.dll

GetNameInfoW (Address: 0x1006e048)
WSACleanup (Address: 0x1006e040)
WSAGetLastError (Address: 0x1006e044)
WSAStartup (Address: 0x1006e03c)

XmlLite.dll

CreateXmlReader (Address: 0x1006e050)
CreateXmlWriter (Address: 0x1006e054)