duser.dll

  • File Path: C:\Windows\system32\duser.dll
  • Description: Windows DirectUser Engine

Hashes

Type Hash
MD5 1F51AEE42369FAEE944681E55AFE065A
SHA1 2ABAE1498B4B379E9E36D5737B49BCC54319A519
SHA256 0A8F8EEA79D47159053D23FC154ECBB12CDE8D1EBE09908F5791073D7F3539B4
SHA384 5FBE9BF7CD573DAEBFCC23B93192667C2D7F3FC2C1C39F342010C235DB99C5C6164800F226F5754F63FDE51D20913495
SHA512 BACC9B214E0D0ED6B2B5FC532080F12D6981F4952CE76B1AE8C028D7A2F4905429182E84A51669D061FDEFC42B991FB2CCA169DAA2E7228D8CC3BD32374316BF
SSDEEP 6144:w7iRj5sXQsfcUhGkOQUV3wwXIl0AEy+DUXoDut6WFl1dXn4KVfS9ESl6GRTdoIwC:SEU69V3wwXqSwX/TFl1dX4geR7Yc
IMP A58EEA7A520B65403D6A57F563000A63
PESHA1 DED611B4852DC440FD8498BAD74A800C1CDE17B6
PE256 7A3A702CAF04CE8534CD06E05D6A49AB76244F2AF444C57D8817755A635A984F

DLL Exports:

Function Name Ordinal Type
IsInsideContext 102 Exported Function
IsGadgetParentChainStyle 101 Exported Function
LookupGadgetTicket 104 Exported Function
IsStartDelete 103 Exported Function
InvalidateLayeredDescendants 100 Exported Function
InitGadgetComponent 97 Exported Function
GetStdPalette 96 Exported Function
InvalidateGadget 99 Exported Function
InitGadgets 98 Exported Function
ReleaseDetachedObjects 111 Exported Function
RegisterGadgetProperty 110 Exported Function
ReleaseMouseCapture 113 Exported Function
ReleaseLayeredRef 112 Exported Function
RegisterGadgetMessageString 109 Exported Function
PeekMessageExA 106 Exported Function
MapGadgetPoints 105 Exported Function
RegisterGadgetMessage 108 Exported Function
PeekMessageExW 107 Exported Function
GetStdColorPenI 95 Exported Function
GetGadgetSize 86 Exported Function
GetGadgetScale 85 Exported Function
GetGadgetTicket 88 Exported Function
GetGadgetStyle 87 Exported Function
GetGadgetRotation 84 Exported Function
GetGadgetRect 81 Exported Function
GetGadgetProperty 80 Exported Function
GetGadgetRootInfo 83 Exported Function
GetGadgetRgn 82 Exported Function
GetStdColorI 93 Exported Function
GetStdColorF 4 Exported Function
GetStdColorPenF 5 Exported Function
GetStdColorName 94 Exported Function
GetStdColorBrushI 92 Exported Function
GetMessageExA 90 Exported Function
GetGadgetVisual 89 Exported Function
GetStdColorBrushF 3 Exported Function
GetMessageExW 91 Exported Function
RemoveClippingImmunityFromVisual 114 Exported Function
SetRestoreCachedLayeredRefFlag 140 Exported Function
SetMinimumDCompVersion 139 Exported Function
SetWindowResizeFlag 142 Exported Function
SetTransitionVisualProperties 141 Exported Function
SetHardwareDeviceUsage 138 Exported Function
SetGadgetRotation 135 Exported Function
SetGadgetRootInfo 134 Exported Function
SetGadgetStyle 137 Exported Function
SetGadgetScale 136 Exported Function
UtilGetColor 148 Exported Function
UtilDrawOutlineRect 6 Exported Function
WaitMessageEx 150 Exported Function
UtilSetBackground 149 Exported Function
UtilDrawBlendRect 147 Exported Function
UnregisterGadgetMessageString 144 Exported Function
UnregisterGadgetMessage 143 Exported Function
UtilBuildFont 146 Exported Function
UnregisterGadgetProperty 145 Exported Function
SetGadgetRect 133 Exported Function
SetGadgetBufferInfo 121 Exported Function
SetAtlasingHints 120 Exported Function
SetGadgetFillF 123 Exported Function
SetGadgetCenterPoint 122 Exported Function
SetActionTimeslice 119 Exported Function
RemoveGadgetProperty 116 Exported Function
RemoveGadgetMessageHandler 115 Exported Function
ScheduleGadgetTransitions 118 Exported Function
ResetDUserDevice 117 Exported Function
SetGadgetOrder 130 Exported Function
SetGadgetMessageFilter 129 Exported Function
SetGadgetProperty 132 Exported Function
SetGadgetParent 131 Exported Function
SetGadgetLayerInfo 128 Exported Function
SetGadgetFlags 125 Exported Function
SetGadgetFillI 124 Exported Function
SetGadgetFocusEx 127 Exported Function
SetGadgetFocus 126 Exported Function
DUserBuildGadget 25 Exported Function
DrawGadgetTree 52 Exported Function
DUserCastDirect 27 Exported Function
DUserCastClass 26 Exported Function
DllMain 51 Exported Function
DetachGadgetVisuals 48 Exported Function
DestroyPendingDCVisuals 47 Exported Function
DisableContainerHwnd 50 Exported Function
DetachWndProc 49 Exported Function
DUserGetGutsData 32 Exported Function
DUserGetAlphaPRID 31 Exported Function
DUserGetRotatePRID 34 Exported Function
DUserGetRectPRID 33 Exported Function
DUserFlushMessages 30 Exported Function
DUserDeleteGadget 2 Exported Function
DUserCastHandle 1 Exported Function
DUserFlushDeferredMessages 29 Exported Function
DUserFindClass 28 Exported Function
DeleteHandle 46 Exported Function
BeginHideInputPaneAnimation 13 Exported Function
AutoTrace 12 Exported Function
BuildAnimation 15 Exported Function
BeginShowInputPaneAnimation 14 Exported Function
AttachWndProcW 11 Exported Function
AddLayeredRef 8 Exported Function
AddGadgetMessageHandler 7 Exported Function
AttachWndProcA 10 Exported Function
AdjustClipInsideRef 9 Exported Function
CreateAction 22 Exported Function
ClearTopmostVisual 21 Exported Function
CustomGadgetHitTestQuery 24 Exported Function
CreateGadget 23 Exported Function
ClearPushedOpacitiesFromGadgetTree 20 Exported Function
BuildInterpolation 17 Exported Function
BuildDropTarget 16 Exported Function
ChangeCurrentAnimationScenario 19 Exported Function
CacheDWriteRenderTarget 18 Exported Function
DUserGetScalePRID 35 Exported Function
GetDebug 69 Exported Function
GetCachedDWriteRenderTarget 67 Exported Function
GetFinalAnimatingPosition 70 Exported Function
GetDUserModule 68 Exported Function
GetActionTimeslice 66 Exported Function
FreeGdiDxInteropStagingBuffer 63 Exported Function
ForwardGadgetMessage 62 Exported Function
GadgetTransSettingChanged 65 Exported Function
GadgetTransCompositionChanged 64 Exported Function
GetGadgetFocus 77 Exported Function
GetGadgetFlags 76 Exported Function
GetGadgetMessageFilter 79 Exported Function
GetGadgetLayerInfo 78 Exported Function
GetGadgetCenterPoint 75 Exported Function
GetGadgetAnimation 72 Exported Function
GetGadget 71 Exported Function
GetGadgetBufferInfo 74 Exported Function
GetGadgetBitmap 73 Exported Function
FireGadgetMessages 61 Exported Function
DUserSendEvent 42 Exported Function
DUserRegisterSuper 41 Exported Function
DUserStopAnimation 44 Exported Function
DUserSendMethod 43 Exported Function
DUserRegisterStub 40 Exported Function
DUserPostEvent 37 Exported Function
DUserInstanceOf 36 Exported Function
DUserRegisterGuts 39 Exported Function
DUserPostMethod 38 Exported Function
FindGadgetMessages 58 Exported Function
FindGadgetFromPoint 57 Exported Function
FindStdColor 60 Exported Function
FindGadgetTargetingInfo 59 Exported Function
EnumGadgets 56 Exported Function
EndInputPaneAnimation 53 Exported Function
DUserStopPVLAnimation 45 Exported Function
EnsureGadgetTransInitialized 55 Exported Function
EnsureAnimationsEnabled 54 Exported Function

Signature

  • Status: Signature verified.
  • Serial: 3300000266BD1580EFA75CD6D3000000000266
  • Thumbprint: A4341B9FD50FB9964283220A36A1EF6F6FAA7840
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: DUser.DLL.MUI
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.19041.1 (WinBuild.160101.0800)
  • Product Version: 10.0.19041.1
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 64-bit

File Scan

  • VirusTotal Detections: 0/69
  • VirusTotal Link: https://www.virustotal.com/gui/file/0a8f8eea79d47159053d23fc154ecbb12cde8d1ebe09908f5791073d7f3539b4/detection/

Possible Misuse

The following table contains possible examples of duser.dll being misused. While duser.dll is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source Source File Example License
signature-base apt_sidewinder.yar $a1 = “DUSER.dll” fullword wide CC BY-NC 4.0

MIT License. Copyright (c) 2020-2021 Strontic.