w3logsvc.dll
Description: IIS Logging Service
Authors: © Microsoft Corporation. All rights reserved.
Version: 10.0.19041.3636
Architecture: 32-bit
Operating System: Windows NT
SHA256: 456bad9d8dbfa1fda757d19f3945b82f
File Size: 74.0 KB
Uploaded At: Dec. 1, 2025, 8:33 a.m.
Views: 11
Security Warning
This file has been flagged as potentially dangerous.
Reason: Detected potentially dangerous functions used for process injection: OpenProcess
Exported Functions
- ServiceMain (Ordinal: 1, Address: 0x3880)
Imported DLLs & Functions
api-ms-win-core-com-l1-1-0.dll
- CoCreateInstance (Address: 0x10011020)
- CoInitializeEx (Address: 0x10011024)
- CoUninitialize (Address: 0x10011028)
api-ms-win-core-datetime-l1-1-0.dll
- GetDateFormatW (Address: 0x10011030)
api-ms-win-core-datetime-l1-1-1.dll
- GetTimeFormatEx (Address: 0x10011038)
api-ms-win-core-debug-l1-1-0.dll
- OutputDebugStringA (Address: 0x10011040)
api-ms-win-core-errorhandling-l1-1-0.dll
- GetLastError (Address: 0x1001104c)
- SetUnhandledExceptionFilter (Address: 0x10011048)
- UnhandledExceptionFilter (Address: 0x10011050)
api-ms-win-core-file-l1-1-0.dll
- CreateDirectoryW (Address: 0x10011068)
- CreateFileW (Address: 0x10011060)
- GetFileAttributesExW (Address: 0x1001105c)
- GetFileAttributesW (Address: 0x10011070)
- GetFileSizeEx (Address: 0x1001106c)
- GetFileTime (Address: 0x10011064)
- WriteFile (Address: 0x10011058)
api-ms-win-core-handle-l1-1-0.dll
- CloseHandle (Address: 0x1001107c)
- DuplicateHandle (Address: 0x10011078)
api-ms-win-core-heap-l1-1-0.dll
- GetProcessHeap (Address: 0x1001108c)
- HeapAlloc (Address: 0x10011088)
- HeapFree (Address: 0x10011084)
api-ms-win-core-heap-l2-1-0.dll
- LocalAlloc (Address: 0x10011098)
- LocalFree (Address: 0x10011094)
api-ms-win-core-libraryloader-l1-2-0.dll
- DisableThreadLibraryCalls (Address: 0x100110a0)
api-ms-win-core-path-l1-1-0.dll
- PathAllocCombine (Address: 0x100110a8)
api-ms-win-core-processthreads-l1-1-0.dll
- CreateThread (Address: 0x100110b4)
- GetCurrentProcess (Address: 0x100110c0)
- GetCurrentProcessId (Address: 0x100110b8)
- GetCurrentThreadId (Address: 0x100110b0)
- GetExitCodeThread (Address: 0x100110bc)
- SetThreadPriority (Address: 0x100110c8)
- TerminateProcess (Address: 0x100110c4)
api-ms-win-core-processthreads-l1-1-1.dll
- OpenProcess (Address: 0x100110d0)
api-ms-win-core-profile-l1-1-0.dll
- QueryPerformanceCounter (Address: 0x100110d8)
api-ms-win-core-synch-l1-1-0.dll
- AcquireSRWLockExclusive (Address: 0x100110e8)
- AcquireSRWLockShared (Address: 0x100110fc)
- CreateEventW (Address: 0x1001110c)
- DeleteCriticalSection (Address: 0x100110f4)
- EnterCriticalSection (Address: 0x10011104)
- InitializeCriticalSectionAndSpinCount (Address: 0x100110f0)
- InitializeSRWLock (Address: 0x100110e0)
- LeaveCriticalSection (Address: 0x10011108)
- ReleaseSRWLockExclusive (Address: 0x100110ec)
- ReleaseSRWLockShared (Address: 0x10011100)
- SetEvent (Address: 0x100110f8)
- WaitForSingleObject (Address: 0x100110e4)
api-ms-win-core-synch-l1-2-0.dll
- Sleep (Address: 0x10011114)
api-ms-win-core-sysinfo-l1-1-0.dll
- GetComputerNameExW (Address: 0x10011130)
- GetLocalTime (Address: 0x10011120)
- GetSystemTime (Address: 0x10011124)
- GetSystemTimeAsFileTime (Address: 0x1001112c)
- GetTickCount (Address: 0x10011128)
- GetTickCount64 (Address: 0x1001111c)
api-ms-win-core-threadpool-l1-2-0.dll
- CloseThreadpool (Address: 0x10011140)
- CloseThreadpoolCleanupGroup (Address: 0x1001113c)
- CloseThreadpoolCleanupGroupMembers (Address: 0x10011138)
- CloseThreadpoolTimer (Address: 0x10011168)
- CloseThreadpoolWait (Address: 0x1001115c)
- CreateThreadpool (Address: 0x10011154)
- CreateThreadpoolCleanupGroup (Address: 0x1001114c)
- CreateThreadpoolTimer (Address: 0x1001116c)
- CreateThreadpoolWait (Address: 0x10011150)
- SetThreadpoolThreadMaximum (Address: 0x10011144)
- SetThreadpoolThreadMinimum (Address: 0x10011148)
- SetThreadpoolTimer (Address: 0x10011170)
- SetThreadpoolWait (Address: 0x10011164)
- TrySubmitThreadpoolCallback (Address: 0x10011158)
- WaitForThreadpoolTimerCallbacks (Address: 0x10011174)
- WaitForThreadpoolWaitCallbacks (Address: 0x10011160)
api-ms-win-core-timezone-l1-1-0.dll
- FileTimeToSystemTime (Address: 0x10011180)
- SystemTimeToTzSpecificLocalTime (Address: 0x1001117c)
api-ms-win-eventing-consumer-l1-1-0.dll
- CloseTrace (Address: 0x10011190)
- OpenTraceW (Address: 0x10011188)
- ProcessTrace (Address: 0x1001118c)
api-ms-win-eventing-controller-l1-1-0.dll
- ControlTraceW (Address: 0x1001119c)
- EnableTraceEx2 (Address: 0x10011198)
- StartTraceW (Address: 0x100111a0)
- StopTraceW (Address: 0x100111a4)
api-ms-win-eventing-legacy-l1-1-0.dll
- QueryTraceW (Address: 0x100111ac)
api-ms-win-eventing-provider-l1-1-0.dll
- EventRegister (Address: 0x100111b8)
- EventUnregister (Address: 0x100111b4)
- EventWriteTransfer (Address: 0x100111bc)
api-ms-win-security-base-l1-1-0.dll
- AllocateAndInitializeSid (Address: 0x100111cc)
- FreeSid (Address: 0x100111c4)
- InitializeSecurityDescriptor (Address: 0x100111d0)
- SetSecurityDescriptorDacl (Address: 0x100111d4)
- SetSecurityDescriptorOwner (Address: 0x100111c8)
api-ms-win-security-lsapolicy-l1-1-0.dll
- LsaClose (Address: 0x100111e8)
- LsaFreeMemory (Address: 0x100111e0)
- LsaLookupNames2 (Address: 0x100111dc)
- LsaOpenPolicy (Address: 0x100111e4)
api-ms-win-security-provider-l1-1-0.dll
- GetNamedSecurityInfoW (Address: 0x100111f0)
- SetEntriesInAclW (Address: 0x100111f4)
api-ms-win-service-core-l1-1-0.dll
- SetServiceStatus (Address: 0x100111fc)
api-ms-win-service-winsvc-l1-1-0.dll
- RegisterServiceCtrlHandlerW (Address: 0x10011204)
iisutil.dll
- ??0ALLOC_CACHE_HANDLER@@QAE@PBDPBUALLOC_CACHE_CONFIGURATION@@H@Z (Address: 0x10011220)
- ??0EVENT_LOG@@QAE@PBG@Z (Address: 0x10011258)
- ??0MULTISZ@@QAE@PBG@Z (Address: 0x10011248)
- ??0MULTISZ@@QAE@XZ (Address: 0x100112b8)
- ??0STRA@@QAE@PADK@Z (Address: 0x10011270)
- ??0STRA@@QAE@XZ (Address: 0x10011290)
- ??0STRU@@QAE@PAGK@Z (Address: 0x1001129c)
- ??0STRU@@QAE@XZ (Address: 0x10011288)
- ??1ALLOC_CACHE_HANDLER@@QAE@XZ (Address: 0x10011210)
- ??1BUFFER@@QAE@XZ (Address: 0x1001123c)
- ??1MULTISZ@@QAE@XZ (Address: 0x100112ac)
- ??1STRA@@QAE@XZ (Address: 0x10011294)
- ??1STRU@@QAE@XZ (Address: 0x1001128c)
- ?Alloc@ALLOC_CACHE_HANDLER@@QAEPAXXZ (Address: 0x1001126c)
- ?Append@MULTISZ@@QAEHAAVSTRU@@@Z (Address: 0x10011304)
- ?Append@MULTISZ@@QAEHPBG@Z (Address: 0x10011230)
- ?Append@STRA@@QAEJABV1@@Z (Address: 0x100112d8)
- ?Append@STRA@@QAEJPBD@Z (Address: 0x100112f4)
- ?Append@STRA@@QAEJPBDK@Z (Address: 0x100112f0)
- ?Append@STRU@@QAEJABV1@@Z (Address: 0x100112c8)
- ?Append@STRU@@QAEJG@Z (Address: 0x100112c4)
- ?Append@STRU@@QAEJPBG@Z (Address: 0x100112c0)
- ?Append@STRU@@QAEJPBGK@Z (Address: 0x100112dc)
- ?AppendA@STRU@@QAEJPBDK@Z (Address: 0x100112f8)
- ?AppendWSimple@STRA@@QAEJPBGK@Z (Address: 0x100112d0)
- ?CleanupLookaside@ALLOC_CACHE_HANDLER@@QAEXH@Z (Address: 0x10011214)
- ?Copy@MULTISZ@@QAEHABV1@@Z (Address: 0x100112b0)
- ?Copy@STRA@@QAEJABV1@@Z (Address: 0x100112d4)
- ?Copy@STRA@@QAEJPBD@Z (Address: 0x100112a4)
- ?Copy@STRA@@QAEJPBDK@Z (Address: 0x10011244)
- ?Copy@STRU@@QAEJABV1@@Z (Address: 0x100112b4)
- ?Copy@STRU@@QAEJPBG@Z (Address: 0x100112a8)
- ?Copy@STRU@@QAEJPBGK@Z (Address: 0x100112ec)
- ?CopyA@STRU@@QAEJPBD@Z (Address: 0x10011234)
- ?CopyA@STRU@@QAEJPBDK@Z (Address: 0x10011238)
- ?CopyWToUTF8Unescaped@STRA@@QAEJABVSTRU@@@Z (Address: 0x100112e4)
- ?CopyWToUTF8Unescaped@STRA@@QAEJPBGK@Z (Address: 0x100112cc)
- ?CreateIpmMessagePipe@IPM2_MESSAGE_PIPE@@SGJPAVIPM2_MESSAGE_ACCEPTOR@@PBGHPAU_SECURITY_ATTRIBUTES@@PAPAV1@@Z (Address: 0x10011228)
- ?DestroyIpmMessagePipe@IPM2_MESSAGE_PIPE@@QAGXXZ (Address: 0x1001122c)
- ?Equals@MULTISZ@@QAEHPAV1@@Z (Address: 0x10011298)
- ?EqualsNoCase@STRU@@QBE_NABV1@@Z (Address: 0x1001124c)
- ?EqualsNoCase@STRU@@QBE_NPBG@Z (Address: 0x100112e0)
- ?ExpandEnvironmentVariables@STRU@@SGJPBGPAV1@@Z (Address: 0x100112bc)
- ?Free@ALLOC_CACHE_HANDLER@@QAEHPAX@Z (Address: 0x10011218)
- ?LogEvent@EVENT_LOG@@QAEXKGQAPBGK@Z (Address: 0x10011300)
- ?QueryOutstandingAllocationCount@ALLOC_CACHE_HANDLER@@QBEKXZ (Address: 0x1001121c)
- ?Resize@BUFFER@@QAE_NK@Z (Address: 0x10011250)
- ?Resize@STRA@@QAEJK@Z (Address: 0x100112a0)
- ?Resize@STRU@@QAEJK@Z (Address: 0x100112fc)
- ?SetLen@STRU@@QAE_NK@Z (Address: 0x100112e8)
- ?WriteMessage@IPM2_MESSAGE_PIPE@@QAEJW4IPM2_OPCODE@@HKKPAXK1@Z (Address: 0x10011224)
- DestroyRefTraceLog (Address: 0x1001120c)
- IISInitializeCriticalSection (Address: 0x10011240)
- InitializeIISUtil (Address: 0x10011264)
- IsStringEqualOrdinalIgnoreCase (Address: 0x10011254)
- PuCreateDebugPrintsObject (Address: 0x10011274)
- PuDbgPrint (Address: 0x1001127c)
- PuDbgPrintError (Address: 0x10011280)
- PuDeleteDebugPrintsObject (Address: 0x10011284)
- PuLoadDebugFlagsFromRegStr (Address: 0x10011278)
- ReadDwordParameterValueFromAnyService (Address: 0x1001125c)
- TerminateIISUtil (Address: 0x10011260)
- WriteRefTraceLog (Address: 0x10011268)
msvcrt.dll
- __CxxFrameHandler3 (Address: 0x1001132c)
- _amsg_exit (Address: 0x10011330)
- _callnewh (Address: 0x10011344)
- _except_handler4_common (Address: 0x1001130c)
- _initterm (Address: 0x10011374)
- _itow_s (Address: 0x10011318)
- _purecall (Address: 0x1001134c)
- _strnicmp (Address: 0x10011358)
- _ui64tow_s (Address: 0x10011328)
- _ultow (Address: 0x10011340)
- _ultow_s (Address: 0x10011364)
- _vsnwprintf_s (Address: 0x1001136c)
- _wcsicmp (Address: 0x10011310)
- _wcsupr_s (Address: 0x10011334)
- _XcptFilter (Address: 0x10011338)
- ?terminate@@YAXXZ (Address: 0x10011370)
- free (Address: 0x10011350)
- malloc (Address: 0x10011348)
- memchr (Address: 0x10011324)
- memcpy (Address: 0x10011320)
- memcpy_s (Address: 0x10011354)
- memset (Address: 0x10011378)
- strncpy_s (Address: 0x10011360)
- strtoul (Address: 0x1001135c)
- swprintf_s (Address: 0x10011368)
- wcscpy_s (Address: 0x1001133c)
- wcsnlen (Address: 0x1001131c)
- wcsstr (Address: 0x10011314)
ntdll.dll
- RtlCreateTimer (Address: 0x10011380)
- RtlCreateTimerQueue (Address: 0x10011384)
- RtlDeleteTimer (Address: 0x10011390)
- RtlDeleteTimerQueueEx (Address: 0x10011394)
- RtlIpv4AddressToStringExW (Address: 0x1001138c)
- RtlIpv6AddressToStringExW (Address: 0x10011388)
OLEAUT32.dll
- SysAllocString (Address: 0x10011004)
- SysFreeString (Address: 0x10011008)
- VariantChangeType (Address: 0x1001100c)
- VariantClear (Address: 0x10011000)
- VariantInit (Address: 0x10011010)
WS2_32.dll
- ntohs (Address: 0x10011018)