dbghelp.dll

  • File Path: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\dbghelp.dll
  • Description: Windows Image Helper

Hashes

Type Hash
MD5 A970B7FCC13C18A1998CF65A5B8CB699
SHA1 E4E2C71ED0CAAC10E4A1555B54C91D03BFDA01B7
SHA256 9A02133854FF9F06C3B23A70F8C2A4814B2ED4EEF613244B485E3737259DDF9E
SHA384 BDEE521E79D82339DA7B6E2728AD2AA4BDE7EE640981130FF470818999980BE63ED0F1D8FBB2F00DEF4B96C33ABA50CE
SHA512 4DFEFD27487F706A5F59181735CDF2F8E80A6B354D756BF198BDC0D0FFB1060D4576BA8BFBCC8F7F5973F106D60E07D31BFB94B3034138BDED9F1CBB8C224A46
SSDEEP 24576:92I0ZwKNsVquEs4na7aDb4FzoRlUFs/9w7l38jxb9X7IqLC4X3:92Itw/s4na75c6Fa9IlE5EqF
IMP 5C256C275E3EB107999F286EFC9FC131
PESHA1 5073505635C7AFC4A68A0C52CA23F02944297861
PE256 094AEEFE24D4CCA35E15B658517153AB6FC4B4CC95F292D46E266223F42B5DD8

DLL Exports:

Function Name Ordinal Type
SymGetSourceFile 1256 Exported Function
SymGetSourceFileChecksum 1257 Exported Function
SymGetSearchPath 1254 Exported Function
SymGetSearchPathW 1255 Exported Function
SymGetSourceFileFromTokenW 1260 Exported Function
SymGetSourceFileToken 1261 Exported Function
SymGetSourceFileChecksumW 1258 Exported Function
SymGetSourceFileFromToken 1259 Exported Function
SymGetModuleInfoW64 1249 Exported Function
SymGetOmapBlockBase 1123 Exported Function
SymGetModuleInfo64 1247 Exported Function
SymGetModuleInfoW 1248 Exported Function
SymGetScope 1252 Exported Function
SymGetScopeW 1253 Exported Function
SymGetOmaps 1250 Exported Function
SymGetOptions 1251 Exported Function
SymGetSymNext 1270 Exported Function
SymGetSymNext64 1271 Exported Function
SymGetSymFromName 1268 Exported Function
SymGetSymFromName64 1269 Exported Function
SymGetTypeFromName 1276 Exported Function
SymGetTypeFromNameW 1277 Exported Function
SymGetSymPrev 1272 Exported Function
SymGetSymPrev64 1273 Exported Function
SymGetSourceVarFromToken 1264 Exported Function
SymGetSourceVarFromTokenW 1265 Exported Function
SymGetSourceFileTokenW 1262 Exported Function
SymGetSourceFileW 1263 Exported Function
SymGetSymFromAddr 1266 Exported Function
SymGetSymFromAddr64 1267 Exported Function
SymGetSymbolFile 1274 Exported Function
SymGetSymbolFileW 1275 Exported Function
SymGetHomeDirectoryW 1229 Exported Function
SymGetLineFromAddr 1230 Exported Function
SymGetFileLineOffsets64 1227 Exported Function
SymGetHomeDirectory 1228 Exported Function
SymGetLineFromAddrW64 1232 Exported Function
SymGetLineFromInlineContext 1233 Exported Function
SymGetLineFromAddr64 1231 Exported Function
SymGetLineFromAddrEx 1114 Exported Function
SymFromTokenW 1222 Exported Function
SymFunctionTableAccess 1223 Exported Function
SymFromNameW 1220 Exported Function
SymFromToken 1221 Exported Function
SymGetDiaSession 1113 Exported Function
SymGetExtendedOption 1226 Exported Function
SymFunctionTableAccess64 1224 Exported Function
SymFunctionTableAccess64AccessRoutines 1225 Exported Function
SymGetLinePrev64 1242 Exported Function
SymGetLinePrevEx 1122 Exported Function
SymGetLineNextW64 1240 Exported Function
SymGetLinePrev 1241 Exported Function
SymGetModuleBase64 1245 Exported Function
SymGetModuleInfo 1246 Exported Function
SymGetLinePrevW64 1243 Exported Function
SymGetModuleBase 1244 Exported Function
SymGetLineFromName64 1236 Exported Function
SymGetLineFromNameEx 1120 Exported Function
SymGetLineFromInlineContextW 1234 Exported Function
SymGetLineFromName 1235 Exported Function
SymGetLineNext64 1239 Exported Function
SymGetLineNextEx 1121 Exported Function
SymGetLineFromNameW64 1237 Exported Function
SymGetLineNext 1238 Exported Function
SymSrvGetFileIndexes 1322 Exported Function
SymSrvGetFileIndexesW 1323 Exported Function
SymSrvDeltaName 1316 Exported Function
SymSrvDeltaNameW 1317 Exported Function
SymSrvGetFileIndexString 1320 Exported Function
SymSrvGetFileIndexStringW 1321 Exported Function
SymSrvGetFileIndexInfo 1318 Exported Function
SymSrvGetFileIndexInfoW 1319 Exported Function
SymSetScopeFromAddr 1311 Exported Function
SymSetScopeFromIndex 1312 Exported Function
SymSetOptions 1309 Exported Function
SymSetParentWindow 1310 Exported Function
SymSetSearchPathW 1315 Exported Function
symsrv 1356 Exported Function
SymSetScopeFromInlineContext 1313 Exported Function
SymSetSearchPath 1314 Exported Function
SymUnloadModule 1334 Exported Function
SymUnloadModule64 1335 Exported Function
SymUnDName 1332 Exported Function
SymUnDName64 1333 Exported Function
vc7fpo 1357 Exported Function
WinDbgExtensionDllInit 1338 Exported Function
UnDecorateSymbolName 1336 Exported Function
UnDecorateSymbolNameW 1337 Exported Function
SymSrvIsStore 1326 Exported Function
SymSrvIsStoreW 1327 Exported Function
SymSrvGetSupplement 1324 Exported Function
SymSrvGetSupplementW 1325 Exported Function
SymSrvStoreSupplement 1330 Exported Function
SymSrvStoreSupplementW 1331 Exported Function
SymSrvStoreFile 1328 Exported Function
SymSrvStoreFileW 1329 Exported Function
SymMatchFileNameW 1288 Exported Function
SymMatchString 1289 Exported Function
SymLoadModuleExW 1286 Exported Function
SymMatchFileName 1287 Exported Function
SymNext 1292 Exported Function
SymNextW 1293 Exported Function
SymMatchStringA 1290 Exported Function
SymMatchStringW 1291 Exported Function
SymGetUnwindInfo 1280 Exported Function
SymInitialize 1281 Exported Function
SymGetTypeInfo 1278 Exported Function
SymGetTypeInfoEx 1279 Exported Function
SymLoadModule64 1284 Exported Function
SymLoadModuleEx 1285 Exported Function
SymInitializeW 1282 Exported Function
SymLoadModule 1283 Exported Function
SymSearchW 1304 Exported Function
SymSetContext 1305 Exported Function
SymRegisterFunctionEntryCallback64 1302 Exported Function
SymSearch 1303 Exported Function
SymSetHomeDirectory 1307 Exported Function
SymSetHomeDirectoryW 1308 Exported Function
SymSetDiaSession 1124 Exported Function
SymSetExtendedOption 1306 Exported Function
SymQueryInlineTrace 1296 Exported Function
SymRefreshModuleList 1297 Exported Function
SymPrev 1294 Exported Function
SymPrevW 1295 Exported Function
SymRegisterCallbackW64 1300 Exported Function
SymRegisterFunctionEntryCallback 1301 Exported Function
SymRegisterCallback 1298 Exported Function
SymRegisterCallback64 1299 Exported Function
SymFromName 1219 Exported Function
optdbgdump 1350 Exported Function
optdbgdumpaddr 1351 Exported Function
MiniDumpWriteDump 1155 Exported Function
omap 1349 Exported Function
Ordinal1103 1103 Exported Function
Ordinal1104 1104 Exported Function
Ordinal1101 1101 Exported Function
Ordinal1102 1102 Exported Function
inlinedbg 1345 Exported Function
itoldyouso 1346 Exported Function
ImageRvaToSection 1149 Exported Function
ImageRvaToVa 1150 Exported Function
MakeSureDirectoryPathExists 1153 Exported Function
MiniDumpReadDumpStream 1154 Exported Function
lmi 1347 Exported Function
lminfo 1348 Exported Function
Ordinal1119 1119 Exported Function
RangeMapAddPeImageSections 1156 Exported Function
Ordinal1117 1117 Exported Function
Ordinal1118 1118 Exported Function
RangeMapRead 1159 Exported Function
RangeMapRemove 1160 Exported Function
RangeMapCreate 1157 Exported Function
RangeMapFree 1158 Exported Function
Ordinal1107 1107 Exported Function
Ordinal1108 1108 Exported Function
Ordinal1105 1105 Exported Function
Ordinal1106 1106 Exported Function
Ordinal1115 1115 Exported Function
Ordinal1116 1116 Exported Function
Ordinal1109 1109 Exported Function
Ordinal1110 1110 Exported Function
EnumerateLoadedModules64 1131 Exported Function
EnumerateLoadedModulesEx 1132 Exported Function
EnumDirTreeW 1129 Exported Function
EnumerateLoadedModules 1130 Exported Function
ExtensionApiVersion 1135 Exported Function
FindDebugInfoFile 1136 Exported Function
EnumerateLoadedModulesExW 1133 Exported Function
EnumerateLoadedModulesW64 1134 Exported Function
chksym 1340 Exported Function
dbghelp 1341 Exported Function
_EFN_DumpImage 1125 Exported Function
block 1339 Exported Function
dh 1342 Exported Function
EnumDirTree 1128 Exported Function
DbgHelpCreateUserDump 1126 Exported Function
DbgHelpCreateUserDumpW 1127 Exported Function
homedir 1344 Exported Function
ImageDirectoryEntryToData 1146 Exported Function
GetSymLoadError 1144 Exported Function
GetTimestampForLoadedLibrary 1145 Exported Function
ImagehlpApiVersionEx 1152 Exported Function
ImageNtHeader 1148 Exported Function
ImageDirectoryEntryToDataEx 1147 Exported Function
ImagehlpApiVersion 1151 Exported Function
FindExecutableImage 1139 Exported Function
FindExecutableImageEx 1140 Exported Function
FindDebugInfoFileEx 1137 Exported Function
FindDebugInfoFileExW 1138 Exported Function
FindFileInSearchPath 1143 Exported Function
fptr 1343 Exported Function
FindExecutableImageExW 1141 Exported Function
FindFileInPath 1142 Exported Function
SymEnumSymbolsEx 1191 Exported Function
SymEnumSymbolsExW 1192 Exported Function
SymEnumSym 1189 Exported Function
SymEnumSymbols 1190 Exported Function
SymEnumSymbolsW 1195 Exported Function
SymEnumTypes 1196 Exported Function
SymEnumSymbolsForAddr 1193 Exported Function
SymEnumSymbolsForAddrW 1194 Exported Function
SymEnumProcesses 1183 Exported Function
SymEnumSourceFiles 1185 Exported Function
SymEnumLines 1181 Exported Function
SymEnumLinesW 1182 Exported Function
SymEnumSourceLines 1187 Exported Function
SymEnumSourceLinesW 1188 Exported Function
SymEnumSourceFilesW 1186 Exported Function
SymEnumSourceFileTokens 1184 Exported Function
SymFromAddr 1213 Exported Function
SymFromAddrW 1214 Exported Function
SymFindFileInPathW 1212 Exported Function
SymFreeDiaString 1112 Exported Function
SymFromInlineContext 1217 Exported Function
SymFromInlineContextW 1218 Exported Function
SymFromIndex 1215 Exported Function
SymFromIndexW 1216 Exported Function
SymEnumTypesW 1199 Exported Function
SymFindDebugInfoFile 1207 Exported Function
SymEnumTypesByName 1197 Exported Function
SymEnumTypesByNameW 1198 Exported Function
SymFindExecutableImageW 1210 Exported Function
SymFindFileInPath 1211 Exported Function
SymFindDebugInfoFileW 1208 Exported Function
SymFindExecutableImage 1209 Exported Function
StackWalk 1168 Exported Function
StackWalk64 1169 Exported Function
stack_force_ebp 1353 Exported Function
stackdbg 1354 Exported Function
SymAddrIncludeInlineTrace 1176 Exported Function
SymAddSourceStream 1171 Exported Function
StackWalkEx 1170 Exported Function
sym 1355 Exported Function
ReportSymbolLoadSummary 1163 Exported Function
SearchTreeForFile 1164 Exported Function
RangeMapWrite 1161 Exported Function
RemoveInvalidModuleList 1162 Exported Function
SetSymLoadError 1167 Exported Function
srcfiles 1352 Exported Function
SearchTreeForFileW 1165 Exported Function
SetCheckUserInterruptShared 1166 Exported Function
SymEnumerateModules64 1201 Exported Function
SymEnumerateModulesW64 1202 Exported Function
SymDeleteSymbolW 1180 Exported Function
SymEnumerateModules 1200 Exported Function
SymEnumerateSymbolsW 1205 Exported Function
SymEnumerateSymbolsW64 1206 Exported Function
SymEnumerateSymbols 1203 Exported Function
SymEnumerateSymbols64 1204 Exported Function
SymAddSymbol 1174 Exported Function
SymAddSymbolW 1175 Exported Function
SymAddSourceStreamA 1172 Exported Function
SymAddSourceStreamW 1173 Exported Function
SymCompareInlineTrace 1178 Exported Function
SymDeleteSymbol 1179 Exported Function
SymAllocDiaString 1111 Exported Function
SymCleanup 1177 Exported Function

Signature

  • Status: Signature verified.
  • Serial: 33000002CF6D2CC57CAA65A6D80000000002CF
  • Thumbprint: 1A221B3B4FEF088B17BA6704FD088DF192D9E0EF
  • Issuer: CN=Microsoft Code Signing PCA 2010, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: DBGHELP.DLL
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.19041.1 (WinBuild.160101.0800)
  • Product Version: 10.0.19041.1
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 64-bit

File Scan

  • VirusTotal Detections: 0/75
  • VirusTotal Link: https://www.virustotal.com/gui/file/9a02133854ff9f06c3b23a70f8c2a4814b2ed4eef613244b485e3737259ddf9e/detection

File Similarity (ssdeep match)

File Score
C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\srcsrv\dbghelp.dll 99

Possible Misuse

The following table contains possible examples of dbghelp.dll being misused. While dbghelp.dll is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source Source File Example License
sigma image_load_suspicious_dbghelp_dbgcore_load.yml description: Detects the load of dbghelp/dbgcore DLL (used to make memory dumps) by suspicious processes. Tools like ProcessHacker and some attacker tradecract use MiniDumpWriteDump API found in dbghelp.dll or dbgcore.dll. As an example, SilentTrynity C2 Framework has a module that leverages this API to dump the contents of Lsass.exe and transfer it over the network back to the attacker's machine. DRL 1.0
sigma image_load_suspicious_dbghelp_dbgcore_load.yml - '\dbghelp.dll' DRL 1.0
sigma proc_access_win_lsass_memdump.yml description: Detects process LSASS memory dump using Mimikatz, NanoDump, Invoke-Mimikatz, Procdump or Taskmgr based on the CallTrace pointing to ntdll.dll, dbghelp.dll or dbgcore.dll for win10, server2016 and up. DRL 1.0
sigma proc_access_win_lsass_memdump.yml - 'dbghelp.dll' DRL 1.0
signature-base apt_donotteam_ytyframework.yar $s9 = “dbghelp.dll” wide fullword CC BY-NC 4.0

MIT License. Copyright (c) 2020-2021 Strontic.