| Windows 10 DLL File Information - wecsvc.dll |
The following DLL report was generated by automatic DLL script that scanned and loaded all DLL files in the system32 directory of Windows 10, extracted the information from them, and then saved it into HTML reports. If you want to view a report of another DLL, go to the main page of this Web site.
General Information
| File Description: | Event Collector Service |
| File Version: | 10.0.10130.0 (fbl_impressive.150522-2224) |
| Company: | Microsoft Corporation |
| Product Name: | Microsoft® Windows® Operating System |
| DLL popularity | Very Low - There is no any other DLL in system32 directory that is statically linked to this file. |
| File Size: | 151 KB |
| Total Number of Exported Functions: | 4 |
| Total Number of Exported Functions With Names: | 4 |
Section Headers
| Name | Virtual Address | Raw Data Size | % of File | Characteristics | Section Contains... |
|---|---|---|---|---|---|
| .text | 0x00001000 | 133,120 Bytes | 86.1% | Read, Execute | Code |
| .data | 0x00022000 | 512 Bytes | 0.3% | Write, Read | Initialized Data |
| .idata | 0x00023000 | 5,632 Bytes | 3.6% | Read | Initialized Data |
| .rsrc | 0x00025000 | 6,656 Bytes | 4.3% | Read | Initialized Data |
| .reloc | 0x00027000 | 7,680 Bytes | 5.0% | Read, Discardable | Initialized Data |
Static Linking
wecsvc.dll is statically linked to the following files:msvcrt.dll
api-ms-win-eventing-classicprovider-l1-1-0.dll
api-ms-win-core-debug-l1-1-1.dll
RPCRT4.dll
api-ms-win-security-base-l1-2-0.dll
api-ms-win-core-errorhandling-l1-1-1.dll
api-ms-win-core-synch-l1-2-0.dll
api-ms-win-core-handle-l1-1-0.dll
api-ms-win-service-core-l1-1-1.dll
api-ms-win-core-heap-l1-2-0.dll
api-ms-win-core-registry-l1-1-0.dll
api-ms-win-core-sysinfo-l1-2-1.dll
api-ms-win-core-localization-l1-2-1.dll
api-ms-win-core-timezone-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-2.dll
api-ms-win-core-heap-l2-1-0.dll
api-ms-win-security-sddl-l1-1-0.dll
api-ms-win-core-profile-l1-1-0.dll
api-ms-win-core-threadpool-legacy-l1-1-0.dll
api-ms-win-core-kernel32-legacy-l1-1-1.dll
WsmSvc.DLL
ntdll.dll
ADVAPI32.dll
wevtapi.dll
api-ms-win-core-localization-l1-2-2.dll
api-ms-win-core-file-l1-2-1.dll
This means that when wecsvc.dll is loaded, the above files are automatically loaded too. If one of these files is corrupted or missing, wecsvc.dll won't be loaded.
General Resources Information
| Resource Type | Number of Items | Total Size | % of File |
|---|---|---|---|
| Icons | 0 | 0 Bytes | 0.0% |
| Animated Icons | 0 | 0 Bytes | 0.0% |
| Cursors | 0 | 0 Bytes | 0.0% |
| Animated Cursors | 0 | 0 Bytes | 0.0% |
| Bitmaps | 0 | 0 Bytes | 0.0% |
| AVI Files | 0 | 0 Bytes | 0.0% |
| Dialog-Boxes | 0 | 0 Bytes | 0.0% |
| HTML Related Files | 0 | 0 Bytes | 0.0% |
| Menus | 0 | 0 Bytes | 0.0% |
| Strings | 2 | 816 Bytes | 0.5% |
| Type Libraries | 0 | 0 Bytes | 0.0% |
| Manifest | 0 | 0 Bytes | 0.0% |
| All Others | 4 | 9,718 Bytes | 6.3% |
| Total | 6 | 10,534 Bytes | 6.8% |
Icons in this file
No icons found in this file
Cursors in this file
No cursors found in this file
Dialog-boxes list (up to 1000 dialogs)
No dialog resources in this file.
String resources in this dll (up to 1000 strings)
| String ID | String Text |
|---|---|
| 200 | Windows Event Collector |
| 201 | This service manages persistent subscriptions to events from remote sources that support WS-Management protocol. This includes Windows Vista event logs, hardware and IPMI-enabled event sources. The service stores forwarded events in a local Event Log. If this service is stopped or disabled event subscriptions cannot be created and forwarded events cannot be accepted. |
COM Classes/Interfaces
There is no type library in this file with COM classes/interfaces information
Exported Functions List
The following functions are exported by this dll:| DllRegisterServer | DllUnregisterServer | ServiceMain | SvchostPushServiceGlobals |
Imported Functions List
The following functions are imported by this dll:- msvcrt.dll:
_CxxThrowException _XcptFilter __CxxFrameHandler __dllonexit _amsg_exit _except_handler4_common _initterm _lock _onexit _purecall _ultow _unlock _vsnwprintf _wcsicmp _wcsnicmp abort free malloc memcpy memcpy_s memmove_s memset public: __thiscall exception::exception(char const * const &) public: __thiscall exception::exception(class exception const &) public: __thiscall exception::exception(void) public: virtual __thiscall exception::~exception(void) public: virtual __thiscall type_info::~type_info(void) public: virtual char const * __thiscall exception::what(void)const swprintf_s swscanf_s - api-ms-win-eventing-classicprovider-l1-1-0.dll:
ntdll!EtwGetTraceEnableFlags ntdll!EtwGetTraceEnableLevel ntdll!EtwGetTraceLoggerHandle ntdll!EtwRegisterTraceGuidsW ntdll!EtwTraceMessage ntdll!EtwUnregisterTraceGuids - api-ms-win-core-debug-l1-1-1.dll:
KernelBase!DebugBreak KernelBase!OutputDebugStringA - RPCRT4.dll:
NdrServerCall2 RpcBindingToStringBindingW RpcImpersonateClient RpcRevertToSelf RpcServerRegisterAuthInfoW RpcServerRegisterIfEx RpcServerUnregisterIfEx RpcServerUseProtseqEpW RpcStringBindingParseW RpcStringFreeW UuidCreate UuidToStringW - api-ms-win-security-base-l1-2-0.dll:
KernelBase!AllocateAndInitializeSid KernelBase!CheckTokenMembership KernelBase!FreeSid - api-ms-win-core-errorhandling-l1-1-1.dll:
KernelBase!GetLastError KernelBase!SetUnhandledExceptionFilter KernelBase!UnhandledExceptionFilter - api-ms-win-core-synch-l1-2-0.dll:
KernelBase!CreateEventW KernelBase!InitializeCriticalSectionAndSpinCount KernelBase!ResetEvent KernelBase!SetEvent KernelBase!Sleep KernelBase!WaitForSingleObject ntdll!RtlDeleteCriticalSection ntdll!RtlEnterCriticalSection ntdll!RtlLeaveCriticalSection - api-ms-win-core-handle-l1-1-0.dll:
KernelBase!CloseHandle - api-ms-win-service-core-l1-1-1.dll:
sechost!RegisterServiceCtrlHandlerExW sechost!SetServiceStatus - api-ms-win-core-heap-l1-2-0.dll:
KernelBase!GetProcessHeap ntdll!RtlAllocateHeap ntdll!RtlFreeHeap - api-ms-win-core-registry-l1-1-0.dll:
KernelBase!RegCloseKey KernelBase!RegCreateKeyExW KernelBase!RegDeleteValueW KernelBase!RegOpenKeyExW KernelBase!RegSetValueExW - api-ms-win-core-sysinfo-l1-2-1.dll:
KernelBase!GetComputerNameExW KernelBase!GetSystemTime KernelBase!GetSystemTimeAsFileTime KernelBase!GetTickCount - api-ms-win-core-localization-l1-2-1.dll:
KernelBase!GetThreadLocale KernelBase!LocaleNameToLCID - api-ms-win-core-timezone-l1-1-0.dll:
KernelBase!FileTimeToSystemTime KernelBase!SystemTimeToFileTime - api-ms-win-core-processthreads-l1-1-2.dll:
KernelBase!OpenThreadToken KernelBase!SetThreadToken kernel32!GetCurrentProcess kernel32!GetCurrentProcessId kernel32!GetCurrentThread kernel32!GetCurrentThreadId kernel32!TerminateProcess - api-ms-win-core-heap-l2-1-0.dll:
KernelBase!LocalFree - api-ms-win-security-sddl-l1-1-0.dll:
sechost!ConvertStringSecurityDescriptorToSecurityDescriptorW - api-ms-win-core-profile-l1-1-0.dll:
ntdll!RtlQueryPerformanceCounter - api-ms-win-core-threadpool-legacy-l1-1-0.dll:
KernelBase!CreateTimerQueueTimer KernelBase!DeleteTimerQueueTimer KernelBase!UnregisterWaitEx - api-ms-win-core-kernel32-legacy-l1-1-1.dll:
kernel32!GetComputerNameW kernel32!RegisterWaitForSingleObject - WsmSvc.DLL:
WSManAckEvents WSManCloseEnumeratorHandle WSManCloseObjectHandle WSManCloseSessionHandle WSManCloseSubscriptionHandle WSManCreatePullSubscription WSManCreatePushSubscription WSManCreateSessionInternal WSManDecodeObject WSManEncodeObject WSManEnumeratorNextObject WSManPullEvents WSManSetSessionOption - ntdll.dll:
EtwEventWriteFull - ADVAPI32.dll:
CredDeleteW CredEnumerateW CredFree CredReadW CredWriteW RegDeleteKeyExW RegDeleteKeyW RegEnumKeyExW RegQueryInfoKeyW RegQueryValueExW RevertToSelf ntdll!EtwEventRegister ntdll!EtwEventUnregister ntdll!EtwEventWrite - wevtapi.dll:
EvtClose EvtGetChannelConfigProperty EvtGetObjectArrayProperty EvtGetObjectArraySize EvtGetPublisherMetadataProperty EvtOpenChannelConfig EvtOpenPublisherMetadata - api-ms-win-core-localization-l1-2-2.dll:
KernelBase!LCIDToLocaleName - api-ms-win-core-file-l1-2-1.dll:
KernelBase!CompareFileTime