劫持自启动程序

原理:

通过篡改、替换或代理原dll文件来达到劫持。

方法:

1.DLL替换:用恶意DLL替换合法的DLL。 2.DLL搜索顺序劫持:在应用程序指定的不带路径的DLL中。根据搜索顺序,将恶意DLL放在实际DLL之前的搜索位置。大部分时候都是目标应用程序的工作目录。(微软文档:https://docs.microsoft.com/zh-cn/windows/win32/dlls/dynamic-link-library-search-order) 3.Phantom DLL劫持:丢弃一个恶意的DLL来代替合法应用程序尝试加载的丢失/不存在的DLL。 4.DLL重定向:通过编辑,改变DLL被搜索的位置,例如%PATH%环境变量,或.exe.manifest/.exe.local文件。 5.WinSxS DLL替换:用恶意DLL替换WinSxS文件夹中合法的DLL。 6.相对路径DLL劫持:将合法的应用程序复制到用户可写文件夹中,并添加恶意DLL。

实际使用:

寻找开机自启的exe文件,并使用Process Explorer寻找是否有not found的dll文件,有的话直接放在对应位置(顺便提交拿一个CVE),没有就替换正常要加载的dll。建议做一个dll转发来保证程序正常运行。 厚颜无耻的放一个自己的文章:

可以考虑搭配下面这个文章实现user权限的劫持

附表

此处列出“c:\windows\system32”中易受DLL Hijacking的所有可执行文件。每个可执行文件的旁边是一个或多个可以被劫持的DLL,以及被调用的DLL的函数,可以方便的进行利用。

来源:

Auto-elevated

Executable

DLL

Procedure

✔️

bthudtask.exe

DEVOBJ.dll

DllMain

✔️

computerdefaults.exe

CRYPTBASE.DLL

DllMain

✔️

computerdefaults.exe

edputil.dll

DllMain

✔️

computerdefaults.exe

edputil.dll

EdpGetIsManaged

✔️

computerdefaults.exe

MLANG.dll

ConvertINetUnicodeToMultiByte

✔️

computerdefaults.exe

MLANG.dll

DllMain

✔️

computerdefaults.exe

PROPSYS.dll

DllMain

✔️

computerdefaults.exe

PROPSYS.dll

PSCreateMemoryPropertyStore

✔️

computerdefaults.exe

PROPSYS.dll

PSPropertyBag_WriteDWORD

✔️

computerdefaults.exe

Secur32.dll

DllMain

✔️

computerdefaults.exe

SSPICLI.DLL

DllMain

✔️

computerdefaults.exe

SSPICLI.DLL

GetUserNameExW

✔️

computerdefaults.exe

WININET.dll

DllMain

✔️

computerdefaults.exe

WININET.dll

GetUrlCacheEntryBinaryBlob

✔️

dccw.exe

ColorAdapterClient.dll

DllMain

✔️

dccw.exe

dxva2.dll

DllMain

✔️

dccw.exe

mscms.dll

DccwReleaseDisplayProfileAssociationList

✔️

dccw.exe

mscms.dll

DllMain

✔️

dccw.exe

mscms.dll

WcsGetCalibrationManagementState

✔️

dccw.exe

mscms.dll

WcsSetCalibrationManagementState

✔️

dccw.exe

USERENV.dll

DllMain

✔️

easinvoker.exe

AUTHZ.dll

DllMain

✔️

easinvoker.exe

netutils.dll

DllMain

✔️

easinvoker.exe

samcli.dll

DllMain

✔️

easinvoker.exe

SAMLIB.dll

DllMain

✔️

easpolicymanagerbrokerhost.exe

InprocLogger.dll

DllMain

✔️

easpolicymanagerbrokerhost.exe

InprocLogger.dll

FlushInProcTraceSession

✔️

easpolicymanagerbrokerhost.exe

InprocLogger.dll

InitializeInProcLogger

✔️

easpolicymanagerbrokerhost.exe

InprocLogger.dll

InitializeInProcTraceFlushTrigger

✔️

easpolicymanagerbrokerhost.exe

InprocLogger.dll

InitializeInProcTraceSession

✔️

easpolicymanagerbrokerhost.exe

InprocLogger.dll

ShutdownInProcLogger

✔️

easpolicymanagerbrokerhost.exe

InprocLogger.dll

ShutdownInProcTraceSession

✔️

easpolicymanagerbrokerhost.exe

InprocLogger.dll

StopInProcTraceSession

✔️

easpolicymanagerbrokerhost.exe

policymanager.dll

DllMain

✔️

fodhelper.exe

CRYPTBASE.DLL

DllMain

✔️

fodhelper.exe

edputil.dll

DllMain

✔️

fodhelper.exe

edputil.dll

EdpGetIsManaged

✔️

fodhelper.exe

MLANG.dll

ConvertINetUnicodeToMultiByte

✔️

fodhelper.exe

MLANG.dll

DllMain

✔️

fodhelper.exe

PROPSYS.dll

DllMain

✔️

fodhelper.exe

PROPSYS.dll

PSCreateMemoryPropertyStore

✔️

fodhelper.exe

PROPSYS.dll

PSPropertyBag_WriteDWORD

✔️

fodhelper.exe

Secur32.dll

DllMain

✔️

fodhelper.exe

SSPICLI.DLL

DllMain

✔️

fodhelper.exe

SSPICLI.DLL

GetUserNameExW

✔️

fodhelper.exe

WININET.dll

DllMain

✔️

fodhelper.exe

WININET.dll

GetUrlCacheEntryBinaryBlob

✔️

fsavailux.exe

DEVOBJ.dll

DllMain

✔️

fxsunatd.exe

FXSAPI.dll

DllMain

✔️

fxsunatd.exe

FXSAPI.dll

FaxConnectFaxServerW

✔️

fxsunatd.exe

IPHLPAPI.DLL

DllMain

✔️

fxsunatd.exe

PROPSYS.dll

DllMain

✔️

immersivetpmvscmgrsvr.exe

DEVOBJ.dll

DllMain

✔️

iscsicli.exe

DEVOBJ.dll

DllMain

✔️

iscsicli.exe

ISCSIDSC.dll

DllMain

✔️

iscsicli.exe

ISCSIDSC.dll

GetIScsiVersionInformation

✔️

iscsicli.exe

ISCSIUM.dll

DiscpAllocMemory

✔️

iscsicli.exe

ISCSIUM.dll

DiscpRegisterHeap

✔️

iscsicli.exe

ISCSIUM.dll

DllMain

✔️

iscsicli.exe

WMICLNT.dll

DllMain

✔️

mdsched.exe

bcd.dll

DllMain

✔️

mschedexe.exe

MaintenanceUI.dll

DllMain

✔️

msconfig.exe

ATL.DLL

AtlModuleInit

✔️

msconfig.exe

ATL.DLL

AtlModuleRegisterClassObjects

✔️

msconfig.exe

ATL.DLL

DllMain

✔️

msconfig.exe

bcd.dll

DllMain

✔️

msdt.exe

ATL.DLL

DllMain

✔️

msdt.exe

Cabinet.dll

DllMain

✔️

msdt.exe

SSPICLI.DLL

DllMain

✔️

msdt.exe

UxTheme.dll

DllMain

✔️

msdt.exe

wer.dll

DllMain

✔️

msdt.exe

WINHTTP.dll

DllMain

✔️

multidigimon.exe

NInput.dll

DllMain

✔️

netplwiz.exe

CRYPTBASE.dll

DllMain

✔️

netplwiz.exe

DSROLE.dll

DllMain

✔️

netplwiz.exe

DSROLE.dll

DsRoleGetPrimaryDomainInformation

✔️

netplwiz.exe

NETPLWIZ.dll

DllMain

✔️

netplwiz.exe

NETPLWIZ.dll

UsersRunDllW

✔️

netplwiz.exe

netutils.dll

DllMain

✔️

netplwiz.exe

netutils.dll

NetApiBufferFree

✔️

netplwiz.exe

PROPSYS.dll

DllMain

✔️

netplwiz.exe

samcli.dll

DllMain

✔️

netplwiz.exe

samcli.dll

NetUserGetInfo

✔️

netplwiz.exe

SAMLIB.dll

DllMain

✔️

netplwiz.exe

SAMLIB.dll

SamConnect

✔️

netplwiz.exe

SAMLIB.dll

SamEnumerateDomainsInSamServer

✔️

netplwiz.exe

SAMLIB.dll

SamFreeMemory

✔️

optionalfeatures.exe

DUI70.dll

DllMain

✔️

optionalfeatures.exe

DUI70.dll

InitProcessPriv

✔️

optionalfeatures.exe

DUI70.dll

RegisterBaseControls

✔️

optionalfeatures.exe

DUI70.dll

RegisterCommonControls

✔️

optionalfeatures.exe

DUI70.dll

RegisterExtendedControls

✔️

optionalfeatures.exe

DUI70.dll

RegisterStandardControls

✔️

optionalfeatures.exe

msi.dll

DllMain

✔️

optionalfeatures.exe

OLEACC.dll

CreateStdAccessibleObject

✔️

optionalfeatures.exe

OLEACC.dll

DllMain

✔️

optionalfeatures.exe

OLEACC.dll

GetRoleTextW

✔️

optionalfeatures.exe

osbaseln.dll

CloseOsBaseline

✔️

optionalfeatures.exe

osbaseln.dll

DllMain

✔️

optionalfeatures.exe

osbaseln.dll

OpenOsBaseline

✔️

optionalfeatures.exe

PROPSYS.dll

DllMain

✔️

perfmon.exe

ATL.DLL

DllMain

✔️

perfmon.exe

credui.dll

DllMain

✔️

perfmon.exe

SspiCli.dll

DllMain

✔️

printui.exe

IPHLPAPI.DLL

DllMain

✔️

printui.exe

printui.dll

DllMain

✔️

printui.exe

printui.dll

PrintUIEntryW

✔️

printui.exe

PROPSYS.dll

DllMain

✔️

printui.exe

puiapi.dll

DllMain

✔️

recdisc.exe

bcd.dll

DllMain

✔️

recdisc.exe

Cabinet.dll

DllMain

✔️

recdisc.exe

ReAgent.dll

DllMain

✔️

rstrui.exe

bcd.dll

DllMain

✔️

rstrui.exe

ktmw32.dll

DllMain

✔️

rstrui.exe

SPP.dll

DllMain

✔️

rstrui.exe

SPP.dll

SxTracerGetThreadContextRetail

✔️

rstrui.exe

SRCORE.dll

DllMain

✔️

rstrui.exe

SRCORE.dll

SrFreeRestoreStatus

✔️

rstrui.exe

VSSAPI.DLL

DllMain

✔️

rstrui.exe

VssTrace.DLL

DllMain

✔️

rstrui.exe

wer.dll

DllMain

✔️

sdclt.exe

bcd.dll

DllMain

✔️

sdclt.exe

Cabinet.dll

DllMain

✔️

sdclt.exe

CLDAPI.dll

CfGetPlaceholderStateFromAttributeTag

✔️

sdclt.exe

CLDAPI.dll

DllMain

✔️

sdclt.exe

CRYPTBASE.DLL

DllMain

✔️

sdclt.exe

edputil.dll

DllMain

✔️

sdclt.exe

edputil.dll

EdpGetIsManaged

✔️

sdclt.exe

FLTLIB.DLL

DllMain

✔️

sdclt.exe

PROPSYS.dll

DllMain

✔️

sdclt.exe

PROPSYS.dll

PSCreateMemoryPropertyStore

✔️

sdclt.exe

PROPSYS.dll

PSPropertyBag_WriteDWORD

✔️

sdclt.exe

ReAgent.dll

DllMain

✔️

sdclt.exe

SPP.dll

DllMain

✔️

sdclt.exe

SPP.dll

SxTracerGetThreadContextRetail

✔️

sdclt.exe

SspiCli.dll

DllMain

✔️

sdclt.exe

SspiCli.dll

GetUserNameExW

✔️

sdclt.exe

UxTheme.dll

DllMain

✔️

sdclt.exe

VSSAPI.DLL

DllMain

✔️

sdclt.exe

VssTrace.DLL

DllMain

✔️

sdclt.exe

wer.dll

DllMain

✔️

sdclt.exe

WTSAPI32.dll

DllMain

✔️

systempropertiesadvanced.exe

bcd.dll

DllMain

✔️

systempropertiesadvanced.exe

credui.dll

DllMain

✔️

systempropertiesadvanced.exe

DNSAPI.dll

DllMain

✔️

systempropertiesadvanced.exe

DSROLE.DLL

DllMain

✔️

systempropertiesadvanced.exe

DSROLE.DLL

DsRoleGetPrimaryDomainInformation

✔️

systempropertiesadvanced.exe

LOGONCLI.DLL

DllMain

✔️

systempropertiesadvanced.exe

netid.dll

CreateNetIDPropertyPage

✔️

systempropertiesadvanced.exe

netid.dll

DllMain

✔️

systempropertiesadvanced.exe

NETUTILS.DLL

DllMain

✔️

systempropertiesadvanced.exe

SRVCLI.DLL

DllMain

✔️

systempropertiesadvanced.exe

WINBRAND.dll

DllMain

✔️

systempropertiesadvanced.exe

WINSTA.dll

DllMain

✔️

systempropertiesadvanced.exe

WKSCLI.DLL

DllMain

✔️

systempropertiescomputername.exe

bcd.dll

DllMain

✔️

systempropertiescomputername.exe

WINSTA.dll

DllMain

✔️

systempropertiesdataexecutionprevention.exe

bcd.dll

DllMain

✔️

systempropertiesdataexecutionprevention.exe

WINSTA.dll

DllMain

✔️

systempropertieshardware.exe

bcd.dll

DllMain

✔️

systempropertieshardware.exe

WINSTA.dll

DllMain

✔️

systempropertiesprotection.exe

bcd.dll

DllMain

✔️

systempropertiesprotection.exe

WINSTA.dll

DllMain

✔️

systempropertiesremote.exe

bcd.dll

DllMain

✔️

systempropertiesremote.exe

WINSTA.dll

DllMain

✔️

systemreset.exe

bcd.dll

BcdCloseObject

✔️

systemreset.exe

bcd.dll

BcdCloseStore

✔️

systemreset.exe

bcd.dll

BcdFlushStore

✔️

systemreset.exe

bcd.dll

BcdGetElementData

✔️

systemreset.exe

bcd.dll

BcdOpenObject

✔️

systemreset.exe

bcd.dll

BcdOpenStore

✔️

systemreset.exe

bcd.dll

DllMain

✔️

systemreset.exe

Cabinet.dll

DllMain

✔️

systemreset.exe

d3d10warp.dll

DllMain

✔️

systemreset.exe

d3d10warp.dll

OpenAdapter10_2

✔️

systemreset.exe

d3d11.dll

D3D11CreateDevice

✔️

systemreset.exe

d3d11.dll

DllMain

✔️

systemreset.exe

dbgcore.DLL

DllMain

✔️

systemreset.exe

DismApi.DLL

DllMain

✔️

systemreset.exe

dxgi.dll

CreateDXGIFactory1

✔️

systemreset.exe

dxgi.dll

DllMain

✔️

systemreset.exe

FVEAPI.dll

DllMain

✔️

systemreset.exe

FVEAPI.dll

FveGetStatus

✔️

systemreset.exe

FVEAPI.dll

FveOpenVolumeW

✔️

systemreset.exe

ReAgent.dll

DllMain

✔️

systemreset.exe

ReAgent.dll

WinReGetConfig

✔️

systemreset.exe

ResetEngine.dll

DllMain

✔️

systemreset.exe

ResetEngine.dll

ResetCreateSession

✔️

systemreset.exe

ResetEngine.dll

ResetReleaseSession

✔️

systemreset.exe

ResetEngine.dll

ResetTraceClientInfo

✔️

systemreset.exe

ResetEngine.dll

ResetValidateScenario

✔️

systemreset.exe

tbs.dll

DllMain

✔️

systemreset.exe

VSSAPI.DLL

DllMain

✔️

systemreset.exe

VssTrace.DLL

DllMain

✔️

systemreset.exe

WDSCORE.dll

ConstructPartialMsgVW

✔️

systemreset.exe

WDSCORE.dll

CurrentIP

✔️

systemreset.exe

WDSCORE.dll

DllMain

✔️

systemreset.exe

WDSCORE.dll

WdsInitialize

✔️

systemreset.exe

WDSCORE.dll

WdsSetupLogMessageW

✔️

systemreset.exe

WIMGAPI.DLL

DllMain

✔️

systemreset.exe

WIMGAPI.DLL

WIMCreateFile

✔️

systemreset.exe

WINHTTP.dll

DllMain

✔️

systemreset.exe

WOFUTIL.dll

DllMain

✔️

systemreset.exe

XmlLite.dll

DllMain

✔️

systemsettingsadminflows.exe

AppXDeploymentClient.dll

DllMain

✔️

systemsettingsadminflows.exe

Bcp47Langs.dll

DllMain

✔️

systemsettingsadminflows.exe

DEVRTL.dll

DllMain

✔️

systemsettingsadminflows.exe

DismApi.DLL

DllMain

✔️

systemsettingsadminflows.exe

DNSAPI.dll

DllMain

✔️

systemsettingsadminflows.exe

FirewallAPI.dll

DllMain

✔️

systemsettingsadminflows.exe

fwbase.dll

DllMain

✔️

systemsettingsadminflows.exe

fwbase.dll

FwCriticalSectionCreate

✔️

systemsettingsadminflows.exe

fwbase.dll

FwCriticalSectionDestroy

✔️

systemsettingsadminflows.exe

logoncli.dll

DllMain

✔️

systemsettingsadminflows.exe

netutils.dll

DllMain

✔️

systemsettingsadminflows.exe

newdev.dll

DllMain

✔️

systemsettingsadminflows.exe

PROPSYS.dll

DllMain

✔️

systemsettingsadminflows.exe

samcli.dll

DllMain

✔️

systemsettingsadminflows.exe

SspiCli.dll

DllMain

✔️

systemsettingsadminflows.exe

StateRepository.Core.dll

DllMain

✔️

systemsettingsadminflows.exe

SystemSettingsThresholdAdminFlowUI.dll

DllMain

✔️

systemsettingsadminflows.exe

timesync.dll

DllMain

✔️

systemsettingsadminflows.exe

USERENV.dll

DllMain

✔️

systemsettingsadminflows.exe

WINBRAND.dll

DllMain

✔️

systemsettingsadminflows.exe

wkscli.dll

DllMain

✔️

systemsettingsadminflows.exe

Wldp.dll

DllMain

✔️

systemsettingsadminflows.exe

WTSAPI32.dll

DllMain

✔️

taskmgr.exe

credui.dll

DllMain

✔️

taskmgr.exe

d3d11.dll

DllMain

✔️

taskmgr.exe

d3d12.dll

DllMain

✔️

taskmgr.exe

dxgi.dll

DllMain

✔️

taskmgr.exe

pdh.dll

DllMain

✔️

taskmgr.exe

UxTheme.dll

DllMain

✔️

tcmsetup.exe

TAPI32.dll

DllMain

✔️

winsat.exe

d3d10_1.dll

DllMain

✔️

winsat.exe

d3d10_1core.dll

DllMain

✔️

winsat.exe

d3d10.dll

DllMain

✔️

winsat.exe

d3d10core.dll

DllMain

✔️

winsat.exe

d3d11.dll

DllMain

✔️

winsat.exe

dxgi.dll

DllMain

✔️

winsat.exe

winmm.dll

DllMain

✔️

wsreset.exe

licensemanagerapi.dll

DllMain

✔️

wsreset.exe

licensemanagerapi.dll

Reset

✔️

wsreset.exe

wevtapi.dll

DllMain

✔️

wusa.exe

dpx.dll

DllMain

✔️

wusa.exe

WTSAPI32.dll

DllMain

agentservice.exe

ACTIVEDS.dll

DllMain

agentservice.exe

adsldpc.dll

DllMain

agentservice.exe

FLTLIB.DLL

DllMain

applytrustoffline.exe

mintdh.dll

DllMain

applytrustoffline.exe

mintdh.dll

TdhpSetWbemExtensionBlock

applytrustoffline.exe

StateRepository.Core.dll

DllMain

arp.exe

IPHLPAPI.DLL

DllMain

arp.exe

snmpapi.dll

DllMain

at.exe

cryptdll.dll

DllMain

at.exe

netutils.dll

DllMain

at.exe

NtlmShared.dll

DllMain

at.exe

schedcli.dll

DllMain

at.exe

schedcli.dll

NetScheduleJobEnum

at.exe

sspicli.dll

DllMain

at.exe

sspicli.dll

InitSecurityInterfaceW

auditpol.exe

auditpolcore.dll

AdtEnableSinglePrivilege

auditpol.exe

auditpolcore.dll

AuditPolicyData_DeleteAuditDataInstance

auditpol.exe

auditpolcore.dll

DllMain

auditpol.exe

auditpolcore.dll

LoadFormatStringAndPrintToConsole

baaupdate.exe

FVEAPI.dll

DllMain

bdechangepin.exe

FVEAPI.dll

DllMain

bdechangepin.exe

FVEAPI.dll

FveGetAuthMethodInformation

bdechangepin.exe

FVEAPI.dll

FveGetStatus

bdechangepin.exe

FVEAPI.dll

FveOpenVolumeW

bdeuisrv.exe

USERENV.dll

DllMain

bdeuisrv.exe

WTSAPI32.dll

DllMain

bioiso.exe

iumbase.DLL

DllMain

bootim.exe

bcd.dll

BcdGetElementData

bootim.exe

bcd.dll

BcdOpenObject

bootim.exe

bcd.dll

BcdOpenSystemStore

bootim.exe

bcd.dll

BcdQueryObject

bootim.exe

bcd.dll

DllMain

bootim.exe

BootMenuUX.DLL

CreateBareMetalRecoveryButton

bootim.exe

BootMenuUX.DLL

CreateBootableOSButtonCollection

bootim.exe

BootMenuUX.DLL

CreateCloudRecoveryButton

bootim.exe

BootMenuUX.DLL

CreateDefaultOSButton

bootim.exe

BootMenuUX.DLL

CreateDeviceListButton

bootim.exe

BootMenuUX.DLL

CreateDirectFactoryResetButton

bootim.exe

BootMenuUX.DLL

CreateOSListButton

bootim.exe

BootMenuUX.DLL

CreateRecoveryToolsListButton

bootim.exe

BootMenuUX.DLL

CreateSelectOSPage

bootim.exe

BootMenuUX.DLL

CreateShutdownButton

bootim.exe

BootMenuUX.DLL

DllMain

bootim.exe

Cabinet.dll

DllMain

bootim.exe

dbghelp.dll

DllMain

bootim.exe

DismApi.DLL

DllMain

bootim.exe

FLTLIB.DLL

DllMain

bootim.exe

OLEACC.dll

DllMain

bootim.exe

OLEACC.dll

GetRoleTextW

bootim.exe

PROPSYS.dll

DllMain

bootim.exe

PROPSYS.dll

PSCreateMemoryPropertyStore

bootim.exe

ReAgent.dll

DllMain

bootim.exe

ReAgent.dll

WinReGetConfig

bootim.exe

ResetEng.dll

DllMain

bootim.exe

tbs.dll

DllMain

bootim.exe

VirtDisk.dll

DllMain

bootim.exe

VSSAPI.DLL

DllMain

bootim.exe

VssTrace.DLL

DllMain

bootim.exe

WDSCORE.dll

ConstructPartialMsgVW

bootim.exe

WDSCORE.dll

CurrentIP

bootim.exe

WDSCORE.dll

DllMain

bootim.exe

WDSCORE.dll

WdsSetupLogMessageW

calc.exe

CRYPTBASE.DLL

DllMain

calc.exe

edputil.dll

DllMain

calc.exe

edputil.dll

EdpGetIsManaged

calc.exe

MLANG.dll

ConvertINetUnicodeToMultiByte

calc.exe

MLANG.dll

DllMain

calc.exe

PROPSYS.dll

DllMain

calc.exe

PROPSYS.dll

PSCreateMemoryPropertyStore

calc.exe

PROPSYS.dll

PSPropertyBag_WriteDWORD

calc.exe

Secur32.dll

DllMain

calc.exe

SSPICLI.DLL

DllMain

calc.exe

SSPICLI.DLL

GetUserNameExW

calc.exe

WININET.dll

DllMain

calc.exe

WININET.dll

GetUrlCacheEntryBinaryBlob

certreq.exe

cscapi.dll

CscNetApiGetInterface

certreq.exe

cscapi.dll

DllMain

certreq.exe

DUI70.dll

DllMain

certreq.exe

DUI70.dll

FlushThemeHandles

certreq.exe

DUI70.dll

InitProcessPriv

certreq.exe

DUI70.dll

InitThread

certreq.exe

dwmapi.dll

DllMain

certreq.exe

dwmapi.dll

DwmSetWindowAttribute

certreq.exe

LINKINFO.dll

DllMain

certreq.exe

LINKINFO.dll

IsValidLinkInfo

certreq.exe

SSPICLI.DLL

DllMain

certreq.exe

WindowsCodecs.dll

DllMain

certreq.exe

WindowsCodecs.dll

WICCreateImagingFactory_Proxy

certreq.exe

WININET.dll

DllMain

certreq.exe

XmlLite.dll

CreateXmlReader

certreq.exe

XmlLite.dll

CreateXmlReaderInputWithEncodingName

certreq.exe

XmlLite.dll

DllMain

certutil.exe

Cabinet.dll

DllMain

certutil.exe

CRYPTUI.dll

DllMain

certutil.exe

DSROLE.DLL

DllMain

certutil.exe

LOGONCLI.DLL

DllMain

certutil.exe

NETUTILS.DLL

DllMain

certutil.exe

NTDSAPI.dll

DllMain

certutil.exe

SAMCLI.DLL

DllMain

certutil.exe

SSPICLI.DLL

DllMain

change.exe

logoncli.dll

DllMain

change.exe

netutils.dll

DllMain

change.exe

samcli.dll

DllMain

change.exe

srvcli.dll

DllMain

change.exe

utildll.dll

DllMain

change.exe

WINSTA.dll

DllMain

charmap.exe

GetUName.dll

DllMain

charmap.exe

MSFTEDIT.DLL

DllMain

checknetisolation.exe

DNSAPI.dll

DllMain

checknetisolation.exe

FirewallAPI.dll

DllMain

checknetisolation.exe

fwbase.dll

DllMain

checknetisolation.exe

fwbase.dll

FwAlloc

checknetisolation.exe

fwbase.dll

FwCriticalSectionCreate

checknetisolation.exe

fwbase.dll

FwCriticalSectionDestroy

checknetisolation.exe

fwbase.dll

FwFree

checknetisolation.exe

fwpuclnt.dll

DllMain

chglogon.exe

logoncli.dll

DllMain

chglogon.exe

netutils.dll

DllMain

chglogon.exe

REGAPI.dll

DllMain

chglogon.exe

samcli.dll

DllMain

chglogon.exe

srvcli.dll

DllMain

chglogon.exe

utildll.dll

DllMain

chglogon.exe

WINSTA.dll

DllMain

chgport.exe

logoncli.dll

DllMain

chgport.exe

netutils.dll

DllMain

chgport.exe

samcli.dll

DllMain

chgport.exe

srvcli.dll

DllMain

chgport.exe

utildll.dll

DllMain

chgport.exe

WINSTA.dll

DllMain

chkdsk.exe

DEVOBJ.dll

DllMain

chkntfs.exe

DEVOBJ.dll

DllMain

cipher.exe

DSROLE.dll

DllMain

cipher.exe

EFSUTIL.dll

DllMain

cipher.exe

FeClient.dll

DllMain

cipher.exe

iertutil.dll

DllMain

cipher.exe

NTDSAPI.dll

DllMain

cipher.exe

VAULTCLI.dll

DllMain

clipup.exe

CRYPTXML.dll

DllMain

clipup.exe

webservices.dll

DllMain

cmdl32.exe

Cabinet.dll

DllMain

cmdl32.exe

cmpbk32.dll

DllMain

cmdl32.exe

RASAPI32.dll

DllMain

cmdl32.exe

rasman.dll

DllMain

cmdl32.exe

WINHTTP.dll

DllMain

colorcpl.exe

ColorAdapterClient.dll

DllMain

colorcpl.exe

colorui.dll

DllMain

colorcpl.exe

colorui.dll

LaunchColorCpl

colorcpl.exe

IPHLPAPI.DLL

DllMain

colorcpl.exe

mscms.dll

ColorCplInitialize

colorcpl.exe

mscms.dll

ColorCplUninitialize

colorcpl.exe

mscms.dll

DllMain

colorcpl.exe

PROPSYS.dll

DllMain

colorcpl.exe

USERENV.dll

DllMain

compmgmtlauncher.exe

apphelp.dll

ApphelpCheckShellObject

compmgmtlauncher.exe

apphelp.dll

DllMain

compmgmtlauncher.exe

CLDAPI.dll

CfGetPlaceholderStateFromAttributeTag

compmgmtlauncher.exe

CLDAPI.dll

DllMain

compmgmtlauncher.exe

CRYPTBASE.dll

DllMain

compmgmtlauncher.exe

CRYPTBASE.dll

SystemFunction036

compmgmtlauncher.exe

edputil.dll

DllMain

compmgmtlauncher.exe

edputil.dll

EdpGetIsManaged

compmgmtlauncher.exe

FLTLIB.DLL

DllMain

compmgmtlauncher.exe

PROPSYS.dll

DllMain

compmgmtlauncher.exe

PROPSYS.dll

PSCreateMemoryPropertyStore

compmgmtlauncher.exe

PROPSYS.dll

PSPropertyBag_WriteDWORD

ctfmon.exe

MsCtfMonitor.DLL

DllMain

ctfmon.exe

MsCtfMonitor.DLL

DoMsCtfMonitor

ctfmon.exe

MSUTB.dll

DllMain

ctfmon.exe

WINSTA.dll

DllMain

cttune.exe

DWrite.dll

DllMain

cttune.exe

DWrite.dll

DWriteCreateFactory

cttune.exe

OLEACC.dll

DllMain

cttune.exe

UxTheme.dll

DllMain

dataexchangehost.exe

d2d1.dll

DllMain

dataexchangehost.exe

d3d11.dll

DllMain

dataexchangehost.exe

DWrite.dll

DllMain

dataexchangehost.exe

dxgi.dll

DllMain

datausagelivetiletask.exe

dusmapi.dll

DllMain

datausagelivetiletask.exe

IPHLPAPI.DLL

DllMain

ddodiag.exe

XmlLite.dll

CreateXmlReader

ddodiag.exe

XmlLite.dll

DllMain

deploymentcsphelper.exe

dbgcore.DLL

DllMain

deploymentcsphelper.exe

DismApi.DLL

DllMain

deploymentcsphelper.exe

WDSCORE.dll

ConstructPartialMsgVW

deploymentcsphelper.exe

WDSCORE.dll

CurrentIP

deploymentcsphelper.exe

WDSCORE.dll

DllMain

deploymentcsphelper.exe

WDSCORE.dll

WdsInitialize

deploymentcsphelper.exe

WDSCORE.dll

WdsSetupLogMessageW

deploymentcsphelper.exe

WDSCORE.dll

WdsTerminate

devicecensus.exe

dcntel.dll

DllMain

devicecensus.exe

dcntel.dll

GetCensusRegistryLocation

devicecensus.exe

dcntel.dll

RunSystemContextCensus

devicecensus.exe

dcntel.dll

SetCustomTrigger

devicecensus.exe

dcntel.dll

SetCustomTriggerEx

devicecensus.exe

IPHLPAPI.DLL

DllMain

devicecensus.exe

IPHLPAPI.DLL

GetAdaptersInfo

devicecensus.exe

logoncli.dll

DllMain

devicecensus.exe

logoncli.dll

DsGetDcNameW

devicecensus.exe

netutils.dll

DllMain

devicecensus.exe

netutils.dll

NetApiBufferAllocate

devicecensus.exe

WINHTTP.dll

DllMain

devicecredentialdeployment.exe

DeviceCredential.dll

DllMain

deviceenroller.exe

DEVOBJ.dll

DllMain

deviceenroller.exe

DMCmnUtils.dll

CopyString

deviceenroller.exe

DMCmnUtils.dll

DllMain

deviceenroller.exe

dmEnrollEngine.DLL

DllMain

deviceenroller.exe

dmenterprisediagnostics.dll

DllMain

deviceenroller.exe

iri.dll

DllMain

deviceenroller.exe

netutils.dll

DllMain

deviceenroller.exe

omadmapi.dll

DllMain

deviceenroller.exe

omadmapi.dll

FreeCommandLineOptions

deviceenroller.exe

omadmapi.dll

ProcessCommandLine

deviceenroller.exe

samcli.dll

DllMain

deviceenroller.exe

USERENV.dll

DllMain

deviceenroller.exe

XmlLite.dll

DllMain

devicepairingwizard.exe

dwmapi.dll

DllMain

devicepairingwizard.exe

dwmapi.dll

DwmExtendFrameIntoClientArea

devicepairingwizard.exe

OLEACC.dll

DllMain

devicepairingwizard.exe

OLEACC.dll

GetRoleTextW

dfrgui.exe

SXSHARED.dll

DllMain

dfrgui.exe

SXSHARED.dll

SxTracerGetThreadContextRetail

dialer.exe

rtutils.dll

DllMain

dialer.exe

rtutils.dll

TraceRegisterExW

dialer.exe

rtutils.dll

TraceVprintfExA

dialer.exe

SspiCli.dll

DllMain

dialer.exe

SspiCli.dll

GetUserNameExW

dialer.exe

TAPI32.dll

DllMain

dialer.exe

TAPI32.dll

lineInitializeExW

disksnapshot.exe

CRYPTBASE.dll

DllMain

disksnapshot.exe

CRYPTBASE.dll

SystemFunction036

dispdiag.exe

DEVOBJ.dll

DevObjCreateDeviceInfoList

dispdiag.exe

DEVOBJ.dll

DevObjDestroyDeviceInfoList

dispdiag.exe

DEVOBJ.dll

DevObjGetClassDevs

dispdiag.exe

DEVOBJ.dll

DllMain

dispdiag.exe

DXVA2.dll

DllMain

dispdiag.exe

DXVA2.dll

GetNumberOfPhysicalMonitorsFromHMONITOR

dispdiag.exe

WMICLNT.dll

DllMain

dispdiag.exe

WMICLNT.dll

WmiDevInstToInstanceNameW

dispdiag.exe

WMICLNT.dll

WmiOpenBlock

displayswitch.exe

dwmapi.dll

DllMain

displayswitch.exe

policymanager.dll

DllMain

displayswitch.exe

policymanager.dll

PolicyManager_GetPolicyInt

displayswitch.exe

UxTheme.dll

DllMain

displayswitch.exe

WINSTA.dll

DllMain

djoin.exe

dbgcore.DLL

DllMain

djoin.exe

JOINUTIL.DLL

DllMain

djoin.exe

logoncli.dll

DllMain

djoin.exe

netutils.dll

DllMain

djoin.exe

netutils.dll

NetApiBufferFree

djoin.exe

wdscore.dll

ConstructPartialMsgVW

djoin.exe

wdscore.dll

CurrentIP

djoin.exe

wdscore.dll

DllMain

djoin.exe

wdscore.dll

WdsSetupLogDestroy

djoin.exe

wdscore.dll

WdsSetupLogInit

djoin.exe

wdscore.dll

WdsSetupLogMessageW

djoin.exe

wkscli.dll

DllMain

dmcertinst.exe

certenroll.dll

DllMain

dmcertinst.exe

DMCmnUtils.dll

DllMain

dmcertinst.exe

DSPARSE.dll

DllMain

dmcertinst.exe

iri.dll

DllMain

dmcertinst.exe

omadmapi.dll

DllMain

dmcertinst.exe

omadmapi.dll

ProcessCommandLine

dmcfghost.exe

DMCmnUtils.dll

DllMain

dmcfghost.exe

DMPushProxy.dll

DllMain

dmcfghost.exe

DMPushProxy.dll

PushRouter_FreeGetMessageEventName

dmcfghost.exe

DMPushProxy.dll

PushRouter_Open

dmcfghost.exe

dmxmlhelputils.dll

DllMain

dmcfghost.exe

dsclient.dll

DllMain

dmcfghost.exe

iri.dll

DllMain

dmcfghost.exe

omadmapi.dll

DllMain

dmcfghost.exe

XmlLite.dll

DllMain

dmclient.exe

WINHTTP.dll

DllMain

dmclient.exe

XmlLite.dll

DllMain

dmnotificationbroker.exe

DMCmnUtils.dll

DllMain

dmomacpmo.exe

DEVOBJ.dll

DllMain

dmomacpmo.exe

DMCmnUtils.dll

DllMain

dmomacpmo.exe

dmEnrollEngine.DLL

DllMain

dmomacpmo.exe

DMProcessXMLFiltered.dll

DllMain

dmomacpmo.exe

dsclient.dll

DllMain

dmomacpmo.exe

iri.dll

DllMain

dmomacpmo.exe

omadmapi.dll

DllMain

dmomacpmo.exe

omadmapi.dll

ProcessCommandLine

dmomacpmo.exe

USERENV.dll

DllMain

dmomacpmo.exe

XmlLite.dll

DllMain

dnscacheugc.exe

dbgcore.DLL

DllMain

dnscacheugc.exe

IPHLPAPI.DLL

DllMain

dnscacheugc.exe

wdscore.dll

ConstructPartialMsgVW

dnscacheugc.exe

wdscore.dll

CurrentIP

dnscacheugc.exe

wdscore.dll

DllMain

dnscacheugc.exe

wdscore.dll

WdsSetupLogDestroy

dnscacheugc.exe

wdscore.dll

WdsSetupLogInit

dnscacheugc.exe

wdscore.dll

WdsSetupLogMessageW

dpapimig.exe

netutils.dll

DllMain

dpapimig.exe

netutils.dll

NetApiBufferFree

dpapimig.exe

samcli.dll

DllMain

dpapimig.exe

samcli.dll

NetUserModalsGet

dpapimig.exe

SAMLIB.dll

DllMain

dpapimig.exe

SAMLIB.dll

SamConnect

dpapimig.exe

SAMLIB.dll

SamEnumerateDomainsInSamServer

dpapimig.exe

SAMLIB.dll

SamFreeMemory

dpiscaling.exe

CLDAPI.dll

CfGetPlaceholderStateFromAttributeTag

dpiscaling.exe

CLDAPI.dll

DllMain

dpiscaling.exe

CRYPTBASE.DLL

DllMain

dpiscaling.exe

edputil.dll

DllMain

dpiscaling.exe

edputil.dll

EdpGetIsManaged

dpiscaling.exe

FLTLIB.DLL

DllMain

dpiscaling.exe

PROPSYS.dll

DllMain

dpiscaling.exe

PROPSYS.dll

PSCreateMemoryPropertyStore

dpiscaling.exe

PROPSYS.dll

PSPropertyBag_WriteDWORD

driverquery.exe

netutils.dll

DllMain

driverquery.exe

srvcli.dll

DllMain

driverquery.exe

SspiCli.dll

DllMain

drvinst.exe

DEVOBJ.dll

DllMain

drvinst.exe

DEVRTL.dll

DllMain

dsregcmd.exe

dsreg.dll

DllMain

dsregcmd.exe

logoncli.dll

DllMain

dsregcmd.exe

netutils.dll

DllMain

dsregcmd.exe

PROPSYS.dll

DllMain

dsregcmd.exe

SSPICLI.DLL

DllMain

dsregcmd.exe

USERENV.dll

DllMain

dsregcmd.exe

WINHTTP.dll

DllMain

dsregcmd.exe

WININET.dll

DllMain

dsregcmd.exe

wkscli.dll

DllMain

dstokenclean.exe

dsclient.dll

DllMain

dstokenclean.exe

dsclient.dll

DSRemoveExpiredTokens

dwm.exe

CoreMessaging.dll

DllMain

dwm.exe

d2d1.dll

DllMain

dwm.exe

d3d11.dll

DllMain

dwm.exe

D3DCOMPILER_47.dll

DllMain

dwm.exe

dwmcore.dll

DllMain

dwm.exe

dxgi.dll

DllMain

dwm.exe

dxgi.dll

DXGIDeclareAdapterRemovalSupport

dwwin.exe

wer.dll

DllMain

dxgiadaptercache.exe

d3d11.dll

DllMain

dxgiadaptercache.exe

d3d12.dll

DllMain

dxgiadaptercache.exe

dxgi.dll

DllMain

dxpserver.exe

dwmapi.dll

DllMain

dxpserver.exe

msi.dll

DllMain

dxpserver.exe

PROPSYS.dll

DllMain

dxpserver.exe

XmlLite.dll

DllMain

easeofaccessdialog.exe

OLEACC.dll

DllMain

edpcleanup.exe

DMCmnUtils.dll

DllMain

edpcleanup.exe

DNSAPI.dll

DllMain

edpcleanup.exe

FirewallAPI.dll

DllMain

edpcleanup.exe

fwbase.dll

DllMain

edpcleanup.exe

fwbase.dll

FwCriticalSectionCreate

edpcleanup.exe

fwbase.dll

FwCriticalSectionDestroy

edpcleanup.exe

netutils.dll

DllMain

edpcleanup.exe

policymanager.dll

DllMain

edpcleanup.exe

SspiCli.dll

DllMain

edpcleanup.exe

wkscli.dll

DllMain

eduprintprov.exe

deviceassociation.dll

DllMain

eduprintprov.exe

policymanager.dll

DllMain

eduprintprov.exe

policymanager.dll

PolicyManager_GetPolicy

eduprintprov.exe

SspiCli.dll

DllMain

eduprintprov.exe

SspiCli.dll

GetUserNameExW

efsui.exe

credui.dll

DllMain

efsui.exe

CRYPTBASE.DLL

DllMain

efsui.exe

CRYPTUI.dll

DllMain

efsui.exe

DSROLE.dll

DllMain

efsui.exe

EFSADU.dll

DllMain

efsui.exe

EFSUTIL.dll

DllMain

efsui.exe

FeClient.dll

DllMain

efsui.exe

logoncli.dll

DllMain

efsui.exe

netutils.dll

DllMain

efsui.exe

USERENV.dll

DllMain

efsui.exe

VAULTCLI.dll

DllMain

ehstorauthn.exe

UxTheme.dll

DllMain

esentutl.exe

ESENT.dll

DllMain

eventcreate.exe

netutils.dll

DllMain

eventcreate.exe

srvcli.dll

DllMain

eventcreate.exe

SspiCli.dll

DllMain

expand.exe

Cabinet.dll

DllMain

extrac32.exe

Cabinet.dll

DllMain

fhmanagew.exe

fhsvcctl.dll

DllMain

filehistory.exe

CRYPTBASE.dll

DllMain

filehistory.exe

CRYPTBASE.dll

SystemFunction036

filehistory.exe

UxTheme.dll

DllMain

filehistory.exe

UxTheme.dll

EnableThemeDialogTexture

filehistory.exe

UxTheme.dll

OpenThemeData

fixmapi.exe

mapistub.dll

DllMain

fixmapi.exe

mapistub.dll

FixMAPI

fltmc.exe

FLTLIB.DLL

DllMain

fltmc.exe

FLTLIB.DLL

FilterFindFirst

fltmc.exe

FLTLIB.DLL

FilterFindNext

fondue.exe

msi.dll

DllMain

fondue.exe

osbaseln.dll

DllMain

fondue.exe

PROPSYS.dll

DllMain

fsiso.exe

iumbase.DLL

DllMain

fsquirt.exe

DEVOBJ.dll

DevObjCreateDeviceInfoList

fsquirt.exe

DEVOBJ.dll

DevObjDestroyDeviceInfoList

fsquirt.exe

DEVOBJ.dll

DevObjGetClassDevs

fsquirt.exe

DEVOBJ.dll

DllMain

fsquirt.exe

dwmapi.dll

DllMain

fsquirt.exe

dwmapi.dll

DwmExtendFrameIntoClientArea

fsquirt.exe

OLEACC.dll

DllMain

fsquirt.exe

OLEACC.dll

GetRoleTextW

ftp.exe

SspiCli.dll

DllMain

fvenotify.exe

FVEAPI.dll

DllMain

fvenotify.exe

FVEAPI.dll

FveFindFirstVolume

fvenotify.exe

FVEAPI.dll

FveFindNextVolume

fvenotify.exe

FVEAPI.dll

FveGetStatus

fvenotify.exe

FVEAPI.dll

FveGetVolumeNameW

fvenotify.exe

FVEAPI.dll

FveIsVolumeEncryptable

fvenotify.exe

FVEAPI.dll

FveOpenVolumeByHandle

fvenotify.exe

FVEAPI.dll

FveOpenVolumeW

fveprompt.exe

FVEAPI.dll

DllMain

fxscover.exe

IPHLPAPI.DLL

DllMain

fxscover.exe

IPHLPAPI.DLL

GetAdaptersAddresses

fxssvc.exe

credui.dll

DllMain

fxssvc.exe

FXSTIFF.dll

DllMain

fxssvc.exe

IPHLPAPI.DLL

DllMain

fxssvc.exe

PROPSYS.dll

DllMain

fxssvc.exe

TAPI32.dll

DllMain

gamepanel.exe

d2d1.dll

DllMain

gamepanel.exe

d3d11.dll

DllMain

gamepanel.exe

dcomp.dll

DllMain

gamepanel.exe

dwmapi.dll

DllMain

gamepanel.exe

dwmapi.dll

DwmSetWindowAttribute

gamepanel.exe

DWrite.dll

DllMain

gamepanel.exe

DWrite.dll

DWriteCreateFactory

gamepanel.exe

dxgi.dll

CreateDXGIFactory2

gamepanel.exe

dxgi.dll

DllMain

gamepanel.exe

msdrm.dll

DllMain

gamepanel.exe

UIAutomationCore.DLL

DllMain

gamepanel.exe

UxTheme.dll

DllMain

gamepanel.exe

UxTheme.dll

EnableThemeDialogTexture

gamepanel.exe

UxTheme.dll

OpenThemeData

genvalobj.exe

bcd.dll

DllMain

getmac.exe

netutils.dll

DllMain

getmac.exe

srvcli.dll

DllMain

getmac.exe

SspiCli.dll

DllMain

getmac.exe

wkscli.dll

DllMain

gpresult.exe

logoncli.dll

DllMain

gpresult.exe

netutils.dll

DllMain

gpresult.exe

NTDSAPI.dll

DllMain

gpresult.exe

Secur32.dll

DllMain

gpresult.exe

srvcli.dll

DllMain

gpresult.exe

SspiCli.dll

DllMain

gpupdate.exe

USERENV.dll

DllMain

gpupdate.exe

wevtapi.dll

DllMain

hvax64.exe

KDSTUB.dll

DllMain

hvix64.exe

KDSTUB.dll

DllMain

hvsievaluator.exe

DismApi.DLL

DllMain

hvsievaluator.exe

DMCmnUtils.dll

DllMain

hvsievaluator.exe

iri.dll

DllMain

hvsievaluator.exe

omadmapi.dll

DllMain

hvsievaluator.exe

policymanager.dll

DllMain

hvsievaluator.exe

policymanager.dll

PolicyManager_GetPolicyInt

ie4uinit.exe

CRYPTBASE.DLL

DllMain

ie4uinit.exe

IEADVPACK.dll

DllMain

ie4uinit.exe

iedkcs32.dll

DllMain

ie4uinit.exe

MLANG.dll

DllMain

ie4uinit.exe

netutils.dll

DllMain

ie4uinit.exe

WININET.dll

DllMain

ie4uinit.exe

wkscli.dll

DllMain

ieunatt.exe

dbgcore.DLL

DllMain

klist.exe

secur32.dll

DllMain

ksetup.exe

logoncli.dll

DllMain

ksetup.exe

netutils.dll

DllMain

ksetup.exe

srvcli.dll

DllMain

ksetup.exe

SspiCli.dll

DllMain

label.exe

DEVOBJ.dll

DllMain

licensingdiag.exe

Cabinet.dll

DllMain

licensingdiag.exe

Cabinet.dll

FCICreate

licensingdiag.exe

CLIPC.dll

ClipGatherDiagnostics

licensingdiag.exe

CLIPC.dll

ClipGenerateDeviceLicenseRequest

licensingdiag.exe

CLIPC.dll

ClipGetLicenseAndPolicyForPfn

licensingdiag.exe

CLIPC.dll

ClipOpen

licensingdiag.exe

CLIPC.dll

DllMain

lockscreencontentserver.exe

dwmapi.dll

DllMain

lpksetup.exe

CRYPTBASE.dll

DllMain

lpksetup.exe

CRYPTBASE.dll

SystemFunction036

lpksetup.exe

dpx.dll

DllMain

lpremove.exe

AppXAllUserStore.dll

DllMain

lpremove.exe

AppXAllUserStore.dll

IsNonInboxAllUserPackage

lpremove.exe

AppXDeploymentClient.dll

DllMain

lpremove.exe

Bcp47Langs.dll

Bcp47GetMuiForm

lpremove.exe

Bcp47Langs.dll

DllMain

lpremove.exe

Bcp47Langs.dll

GetUserLanguagesForUser

lpremove.exe

DNSAPI.dll

DllMain

lpremove.exe

FirewallAPI.dll

DllMain

lpremove.exe

fwbase.dll

DllMain

lpremove.exe

fwbase.dll

FwCriticalSectionCreate

lpremove.exe

fwbase.dll

FwCriticalSectionDestroy

lpremove.exe

StateRepository.Core.dll

DllMain

magnify.exe

d3d9.dll

DllMain