UserDataService.dll

  • File Path: C:\Windows\system32\UserDataService.dll
  • Description: The endpoint for 3rd party APIs to read/write user data

Hashes

Type Hash
MD5 12DB5302310C244632A997D52DFAB2C6
SHA1 8B65880160406C28969A5D4C31757B8151AEA28E
SHA256 D035B96CB61CE2BDA341D872CD4BB6093BBB260BEFABCDEE486048D0CCD0141A
SHA384 D8DCD7C1F2A95E068ED495630DECD6C88D3E305ED38CCBB0D790E3D6FB5EA2940EBE8F60580C37A133AA9DD3B4EB0E8D
SHA512 9DE175DFE2F14D43EDC51786AF06A7CEC9B04FE307D7BD8D3EA2FA4F4D96B8B2AA23E1EE03C01F0DDF3D9FCDA8C858D3E1C1BE47112CEC7AFB8AD7B329A6F7A8
SSDEEP 24576:kBBZ3gbi3z4O66rk5piamc83yEbpnGhhHgXpqQMXrFrlIzDDZZZZykaBBXXXXUJY:k32Wj4O6uk5pFi1GHHTQ+UDDZZZZykar
IMP AC52298ABAC7C2DA091DA9E1D1AD5075
PESHA1 035292B48952F8409769EE13E5DD9EE12052C58B
PE256 2C9D6798780FE649A60D6E7ECB2593C380457E3D98E1CA99EB2687A7CF58FFF5

DLL Exports:

Function Name Ordinal Type
SvchostPushServiceGlobals 4 Exported Function
TeardownInprocConnectionHandle 5 Exported Function
ServiceMain 3 Exported Function
CleanupUDSGlobals 1 Exported Function
CreateInprocConnectionHandle 2 Exported Function

Signature

  • Status: Signature verified.
  • Serial: 3300000266BD1580EFA75CD6D3000000000266
  • Thumbprint: A4341B9FD50FB9964283220A36A1EF6F6FAA7840
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: USERDATASERVICE.dll.mui
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.19041.1 (WinBuild.160101.0800)
  • Product Version: 10.0.19041.1
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 64-bit

File Scan

  • VirusTotal Detections: 0/70
  • VirusTotal Link: https://www.virustotal.com/gui/file/d035b96cb61ce2bda341d872cd4bb6093bbb260befabcdee486048d0ccd0141a/detection/

File Similarity (ssdeep match)

File Score
C:\Windows\system32\ContactApis.dll 38

MIT License. Copyright (c) 2020-2021 Strontic.