samsrv.dll

  • File Path: C:\Windows\system32\samsrv.dll
  • Description: SAM Server DLL

Hashes

Type Hash
MD5 14F52E3233F916D8B38909AA0964DE67
SHA1 6D7637388CCE9506F492553215BB8A13894AE740
SHA256 D22E2D443ECF619BAE0AD31B0A3B7366D17D47EF2AE16A2E58480B9907ABFD2B
SHA384 3AC694AC1BA4FAA8C39F5DAD984AD3602F8787966D41B7B52D857173AFD154FDF4C6919DC5220B4DF802A64645E77346
SHA512 755791B8F7484ECAE128533F8CF6172F2B17018946403B6BB51671C29DBAD04F07D58233378F4EE70D6D83393369E011FD37DD9892EBBCFDF6FDAFC746B1468C
SSDEEP 24576:Kr/eZvMOWXv7aBhbmtG5IzFXQzl0pd7i:a/yvMOWXeDbPRzl0pd7i
IMP A01096B38FDDA4701E06C7CE575B694B
PESHA1 B111182CE8AD831E36247DCB5D16C88E71245E39
PE256 6C84C6A420AC147501D6656E719E8790A9ADD57C731EA3AD0A2555938AAB7D93

DLL Exports:

Function Name Ordinal Type
SampGetUserAccountSettings 219 Exported Function
SampGetWillNeverTime 220 Exported Function
SampGetUserAccountControlComputed 218 Exported Function
SampGetUlongArrayAttribute 216 Exported Function
SampGetUnicodeStringAttribute 217 Exported Function
SampIncrementNetlogonChangeLogSerialNumber 224 Exported Function
SampInvalidateDomainCache 225 Exported Function
SampIncrementActiveThreads 223 Exported Function
SampImpersonateClient 221 Exported Function
SampIncreaseBadPwdCountLoopback 222 Exported Function
SampGetReverseMembershipTransitive 209 Exported Function
SampGetSamSubsystemName 210 Exported Function
SampGetPasswordMustChangeWithUF_UAC 208 Exported Function
SampGetObjectSD 206 Exported Function
SampGetObjectTypeNameFromIndex 207 Exported Function
SampGetSidAttribute 214 Exported Function
SampGetSuccessAccountAuditingEnabled 215 Exported Function
SampGetSidArrayAttribute 213 Exported Function
SampGetSerialNumberDomain2 211 Exported Function
SampGetServerObjectName 212 Exported Function
SampIsAccountBuiltIn 226 Exported Function
SampPasswordChangeNotifyWorker 240 Exported Function
SampPositionOfHighestBit 241 Exported Function
SampPasswordChangeNotify 239 Exported Function
SampNotifyAuditChange 237 Exported Function
SampNotifyReplicatedInChange 238 Exported Function
SampReadExtendedAttributes 245 Exported Function
SampRecordSystemSchemaVerisonInRegistry 246 Exported Function
SampQueryUserSupplementalCredentialsRegistry 244 Exported Function
SampQueryCapabilities 242 Exported Function
SampQueryInformationUserInternal 243 Exported Function
SampIsServiceRunning 230 Exported Function
SampIsSetupInProgress 231 Exported Function
SampIsDomainHosted 229 Exported Function
SampIsAuditingEnabled 227 Exported Function
SampIsBuiltinDomain 228 Exported Function
SampNeedUserAccountSettingsDuringQuery 235 Exported Function
SampNetLogonNotificationRequired 236 Exported Function
SampMarkPerAttributeInvalidFromWhichFields 234 Exported Function
SampLogPrint 232 Exported Function
SampLookupContext 233 Exported Function
SampGetAccountDomainInfo 178 Exported Function
SampGetBehaviorVersion 179 Exported Function
SampGetAccessAttribute 177 Exported Function
SampFreeUserInfo 175 Exported Function
SampGenerateRandomPassword 176 Exported Function
SampGetDisableRSOOnPDCForward 182 Exported Function
SampGetDisableSingleObjectRepl 184 Exported Function
SampGetDisableResetBadPwdCountForward 183 Exported Function
SampGetCurrentOwnerAndPrimaryGroup 180 Exported Function
SampGetDisableOutboundRSO 181 Exported Function
SampExtendDefinedDomains 168 Exported Function
SampFlagsToAccountControl 169 Exported Function
SampExamineSid 167 Exported Function
SampDuplicateUserInfo 165 Exported Function
SampEncryptCredentialData 166 Exported Function
SampFreeOemUserInfo 173 Exported Function
SampFreeUnicodeString 174 Exported Function
SampFreeOemGroupInfo 172 Exported Function
SampFreeGroupInfo 170 Exported Function
SampFreeMachineInfo 171 Exported Function
SampGetDnsDomainNameFromIndex 185 Exported Function
SampGetIgnoreGCFailures 199 Exported Function
SampGetLogLevel 200 Exported Function
SampGetHasNeverTime 198 Exported Function
SampGetExternalNameFromIndex 196 Exported Function
SampGetFixedAttributes 197 Exported Function
SampGetNoGcLogonEnforceNTLMCheck 205 Exported Function
SampGetNT4UpgradeInProgress 201 Exported Function
SampGetNoGcLogonEnforceKerberosIpCheck 204 Exported Function
SampGetNewAccountSecurityNt4 202 Exported Function
SampGetNextUnmodifiedRidFromIndex 203 Exported Function
SampGetDomainServerRoleFromIndex 189 Exported Function
SampGetDomainSidFromAccountContext 190 Exported Function
SampGetDomainObjectFromIndex 188 Exported Function
SampGetDomainContextFromIndex 186 Exported Function
SampGetDomainObjectFromAccountContext 187 Exported Function
SampGetDownLevelDomainControllersPresent 194 Exported Function
SampGetExtendedAttribute 195 Exported Function
SampGetDomainUpgradeTasks 193 Exported Function
SampGetDomainSidFromIndex 191 Exported Function
SampGetDomainSidListForSam 192 Exported Function
SamrDeleteAlias 301 Exported Function
SamrDeleteGroup 302 Exported Function
SamrCreateUserInDomain 300 Exported Function
SamrCloseHandle 298 Exported Function
SamrCreateUser2InDomain 299 Exported Function
SamrGetAliasMembership 306 Exported Function
SamrGetGroupsForUser 307 Exported Function
SamrEnumerateUsersInDomain2 305 Exported Function
SamrDeleteUser 303 Exported Function
SamrEnumerateUsersInDomain 304 Exported Function
SampValidateDomainControllerCreation 291 Exported Function
SampValidatePwdSettingAttempt 292 Exported Function
SampValidateDomainCacheCallback 290 Exported Function
SampUpgradeUserParmsActual 288 Exported Function
SampUsingDsData 289 Exported Function
SamrAddMemberToAlias 296 Exported Function
SamrAddMemberToGroup 297 Exported Function
SampWriteGroupType 295 Exported Function
SampValidateRegAttributes 293 Exported Function
SampWriteEventLog 294 Exported Function
SamrGetMembersInAlias 308 Exported Function
SamrRemoveMemberFromGroup 322 Exported Function
SamrRidToSid 323 Exported Function
SamrRemoveMemberFromAlias 321 Exported Function
SamrQueryInformationUser2 319 Exported Function
SamrQuerySecurityObject 320 Exported Function
SamrSetSecurityObject 327 Exported Function
SamrValidatePassword 328 Exported Function
SamrSetInformationUser 326 Exported Function
SamrSetInformationAlias 324 Exported Function
SamrSetInformationGroup 325 Exported Function
SamrOpenAlias 312 Exported Function
SamrOpenDomain 313 Exported Function
SamrLookupNamesInDomain2 311 Exported Function
SamrLookupIdsInDomain 309 Exported Function
SamrLookupNamesInDomain 310 Exported Function
SamrQueryInformationDomain 317 Exported Function
SamrQueryInformationUser 318 Exported Function
SamrQueryDisplayInformation 316 Exported Function
SamrOpenGroup 314 Exported Function
SamrOpenUser 315 Exported Function
SampRetrieveUserPasswords 260 Exported Function
SampRetrieveUserV1aFixed 261 Exported Function
SampRetrieveMultipleCredentials 259 Exported Function
SampReplaceUserV1aFixed 257 Exported Function
SampRetrieveGroupV1Fixed 258 Exported Function
SampSetAdminPassword 265 Exported Function
SampSetAttributeAccess 266 Exported Function
SampSetAccessAttribute 264 Exported Function
SampRevertToSelf 262 Exported Function
SampRtlWellKnownPrivilegeCheck 263 Exported Function
SampReleaseSamLockExclusive 250 Exported Function
SampReleaseWriteLock 251 Exported Function
SampReleaseReadLock 249 Exported Function
SampReferenceContext 247 Exported Function
SampRegObjToDsObj 248 Exported Function
SampRenameKrbtgtAccount 255 Exported Function
SampReplaceUserLogonHours 256 Exported Function
SampRemoveUserFromGroup 254 Exported Function
SampRemoveAccountFromGroupMembers 252 Exported Function
SampRemoveSameDomainMemberFromGlobalOrUniversalGroup 253 Exported Function
SampSetComputerObjectDsName 267 Exported Function
SampStoreObjectAttributes 281 Exported Function
SampStringFromGuid 282 Exported Function
SampSplitSid 280 Exported Function
SampSetUnicodeStringAttribute 278 Exported Function
SampSetUserAccountControl 279 Exported Function
SampUpdateMixedModeAndFindDomain 286 Exported Function
SampUpdatePerformanceCounters 287 Exported Function
SampUpdateComputedUserAccountControlBits 285 Exported Function
SampTraceEvent 283 Exported Function
SampUpdateAccountDisabledFlag 284 Exported Function
SampSetGlobalDsSids 271 Exported Function
SampSetPassword 272 Exported Function
SampSetFixedAttributes 270 Exported Function
SampSetDSRMPasswordWorker 268 Exported Function
SampSetExtendedAttributeAccess 269 Exported Function
SampSetTransactionDomain 276 Exported Function
SampSetTransactionWithinDomain 277 Exported Function
SampSetSerialNumberDomain2 275 Exported Function
SampSetPasswordInfoOnPdcByHandle 273 Exported Function
SampSetPasswordInfoOnPdcByIndex 274 Exported Function
SamIIsExtendedSidMode 55 Exported Function
SamIIsRebootAfterPromotion 56 Exported Function
SamIIsDownlevelDcUpgrade 54 Exported Function
SamIImpersonateNullSession 52 Exported Function
SamIInitialize 53 Exported Function
SamILookupNamesInDomain 60 Exported Function
SamILookupSidsByName 61 Exported Function
SamILookupNamesBySid 59 Exported Function
SamIIsSetupInProgress 57 Exported Function
SamILoadDownlevelDatabase 58 Exported Function
SamIGetResourceGroupMembershipsTransitive 45 Exported Function
SamIGetResourceGroupMembershipsTransitive2 46 Exported Function
SamIGetDefaultAdministratorName 44 Exported Function
SamIGetAliasMembership 42 Exported Function
SamIGetConfigurationOidList 43 Exported Function
SamIGetUserLogonInformationEx 50 Exported Function
SamIHandleObjectUpdate 51 Exported Function
SamIGetUserLogonInformation3 49 Exported Function
SamIGetUserLogonInformation 47 Exported Function
SamIGetUserLogonInformation2 48 Exported Function
SamILoopbackConnect 62 Exported Function
SamIQueryServerRole2 76 Exported Function
SamIRandomizeStoredPassword 77 Exported Function
SamIQueryServerRole 75 Exported Function
SamIQueryCapabilities 73 Exported Function
SamIQueryRealmList 74 Exported Function
SamIReplicateAccountData 81 Exported Function
SamIResetBadPwdCountOnPdc 82 Exported Function
SamIReplaceDownlevelDatabase 80 Exported Function
SamIRandomizeStoredPasswordWithoutExpirationCheck 78 Exported Function
SamIRemoveDSNameFromAlias 79 Exported Function
SamINotifyRoleChange 67 Exported Function
SamINT4UpgradeInProgress 65 Exported Function
SamINetLogonPing 66 Exported Function
SamIMixedDomain 63 Exported Function
SamIMixedDomain2 64 Exported Function
SamIPurgeSecrets 71 Exported Function
SamIQueryAccountSecretsCachability 72 Exported Function
SamIPromoteUndo 70 Exported Function
SamIOpenUserByAlternateId 68 Exported Function
SamIPromote 69 Exported Function
SamIConvertSecurityAttributesToClaimsBlob 14 Exported Function
SamICopyCurrentDomainAccountSettings 15 Exported Function
SamIConnect 13 Exported Function
SamIChangePasswordForeignUser 11 Exported Function
SamIClaimIsValid 12 Exported Function
SamIDecodeClaimsBlobToAuthz 19 Exported Function
SamIDemote 20 Exported Function
SamIDecodeClaimsBlobIntoClaimsSet 18 Exported Function
SamICreateKrbTgt 16 Exported Function
SamIDecodeClaimsBlob 17 Exported Function
RtlLookupElementGenericTable2 4 Exported Function
SAM_MIDL_user_allocate 5 Exported Function
RtlInsertElementGenericTable2 3 Exported Function
RtlDeleteElementGenericTable2 1 Exported Function
RtlInitializeGenericTable2 2 Exported Function
SamIAccountRestrictions 9 Exported Function
SamIAddDSNameToAlias 10 Exported Function
SamDsExtFree 8 Exported Function
SAM_MIDL_user_free 6 Exported Function
SamDsExtAlloc 7 Exported Function
SamIDemoteUndo 21 Exported Function
SamIFreeLookupSidsInfo 27 Exported Function
SamIFreeOidList 28 Exported Function
SamIFreeLookupNamesInfo 26 Exported Function
SamIFreeClaimsBlob 24 Exported Function
SamIFreeDecodedClaimsSet 25 Exported Function
SamIFreeSidArray 32 Exported Function
SamIFreeVoid 33 Exported Function
SamIFreeSidAndAttributesList 31 Exported Function
SamIFreeRealmList 29 Exported Function
SamIFreeSecurityAttributesInfo 30 Exported Function
SamIFree_SAMPR_ENUMERATION_BUFFER 36 Exported Function
SamIFree_SAMPR_GET_GROUPS_BUFFER 37 Exported Function
SamIFree_SAMPR_DOMAIN_INFO_BUFFER 35 Exported Function
SamIDoFSMORoleChange 22 Exported Function
SamIFree_SAMPR_DISPLAY_INFO_BUFFER 34 Exported Function
SamIFree_UserInternal6Information 41 Exported Function
SamIFreeAuthzSecurityAttributesInfo 23 Exported Function
SamIFree_SAMPR_USER_INFO_BUFFER 40 Exported Function
SamIFree_SAMPR_RETURNED_USTRING_ARRAY 38 Exported Function
SamIFree_SAMPR_ULONG_ARRAY 39 Exported Function
SampCreateContextEx 137 Exported Function
SampCreateDefaultUPN 138 Exported Function
SampCreateAliasInDomain 136 Exported Function
SampCopyUserSupplementalCredentialsForDCPromo 134 Exported Function
SampCreateAccountContext2 135 Exported Function
SampCurrentThreadOwnsLock 142 Exported Function
SampDecrementActiveThreads 144 Exported Function
SampCreateUserInDomain 141 Exported Function
SampCreateFullSid 139 Exported Function
SampCreateGroupInDomain 140 Exported Function
SampCheckGroupTypeBits 127 Exported Function
SampCheckSidType 128 Exported Function
SampCheckForAccountLockout 126 Exported Function
SampChangeGroupAccountName 124 Exported Function
SampChangeUserAccountName 125 Exported Function
SampConnect 132 Exported Function
SampConvertUiListToApiList 133 Exported Function
SampComputePasswordExpired 131 Exported Function
SampCommitBufferedWrites 129 Exported Function
SampCompareDisplayStrings 130 Exported Function
SampDecryptCredentialData 145 Exported Function
SampDsSetPasswordUser 158 Exported Function
SampDsUpdateContextAttributes 159 Exported Function
SampDsSetDomainPolicy 157 Exported Function
SampDsMakeAttrBlock 155 Exported Function
SampDsSetBuiltinDomainPolicy 156 Exported Function
SampDuplicateOemUserInfo 163 Exported Function
SampDuplicateUnicodeString 164 Exported Function
SampDuplicateOemGroupInfo 162 Exported Function
SampDuplicateGroupInfo 160 Exported Function
SampDuplicateMachineInfo 161 Exported Function
SampDeltaChangeNotify 149 Exported Function
SampDeReferenceContext 143 Exported Function
SampDeleteKeyForPostBootPromote 148 Exported Function
SampDeleteContext 146 Exported Function
SampDeleteDsDirsToDeleteKey 147 Exported Function
SampDsInitializeSingleDomain 153 Exported Function
SampDsIsRunning 154 Exported Function
SampDsGetPrimaryDomainStart 152 Exported Function
SampDsChangePasswordUser 150 Exported Function
SampDsConvertReadAttrBlock 151 Exported Function
SamIUnLoadDownlevelDatabase 96 Exported Function
SamIUpdateLogonStatistics 98 Exported Function
SamIUninitialize 97 Exported Function
SamIStorePrimaryCredentials 93 Exported Function
SamITransformClaims 94 Exported Function
SampAccountControlToFlags 101 Exported Function
SampAcquireReadLock 102 Exported Function
SamIValidateNewAccountName 100 Exported Function
SamIUPNFromUserHandle 95 Exported Function
SamIValidateAccountName 99 Exported Function
SamIRevertNullSession 86 Exported Function
SamIScorePassword 87 Exported Function
SamIRetrievePrimaryCredentials 85 Exported Function
SamIRetrieveMultiplePrimaryCredentials 83 Exported Function
SamIRetrieveNGCKeyCredential 84 Exported Function
SamISetPasswordForeignUser3 91 Exported Function
SamISetPasswordInfoOnDc 92 Exported Function
SamISetPasswordForeignUser2 90 Exported Function
SamISetAuditingInformation 88 Exported Function
SamISetMachinePassword 89 Exported Function
SampAcquireSamLockExclusive 103 Exported Function
SampAuditAnyEvent 117 Exported Function
SampAuditGroupTypeChange 118 Exported Function
SampAuditAccountNameChange 116 Exported Function
SampAssignPrimaryGroup 114 Exported Function
SampAuditAccountEnableDisableChange 115 Exported Function
SampCalculateLmAndNtOwfPasswords 122 Exported Function
SampChangeAliasAccountName 123 Exported Function
SampBuildSamProtection 121 Exported Function
SampAuditSidHistory 119 Exported Function
SampBuildDsNameFromSid 120 Exported Function
SampAddDeltaTime 107 Exported Function
SampAddNonLocalDomainRelativeMemberships 108 Exported Function
SampAddAccountToGroupMembers 105 Exported Function
SampAcquireWriteLock 104 Exported Function
SampAddAccountsAndApplyMemberships 106 Exported Function
SampAllocateNextCurrentRidFromIndex 112 Exported Function
SampApplyDomainUpdatesForAllDomains 113 Exported Function
SampAlInvalidateAliasInformation 111 Exported Function
SampAddSameDomainMemberToGlobalOrUniversalGroup 109 Exported Function
SampAddUserToGroup 110 Exported Function

Signature

  • Status: Signature verified.
  • Serial: 3300000266BD1580EFA75CD6D3000000000266
  • Thumbprint: A4341B9FD50FB9964283220A36A1EF6F6FAA7840
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: samsrv.dll.mui
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.19041.1 (WinBuild.160101.0800)
  • Product Version: 10.0.19041.1
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 64-bit

File Scan

  • VirusTotal Detections: 0/70
  • VirusTotal Link: https://www.virustotal.com/gui/file/d22e2d443ecf619bae0ad31b0a3b7366d17d47ef2ae16a2e58480b9907abfd2b/detection/

Possible Misuse

The following table contains possible examples of samsrv.dll being misused. While samsrv.dll is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source Source File Example License
signature-base apt_skeletonkey.yar $dll2 = “samsrv.dll” CC BY-NC 4.0

MIT License. Copyright (c) 2020-2021 Strontic.