Forensic Riddle #12 – Answer

Posted on by

There are many answers to this one.

For starters, consider triplet A, W, UTF8 instead of usual A,W in:

  • DnsQueryExA
  • DnsQueryExUTF8
  • DnsQueryExW

or

  • DnsQuery_A
  • DnsQuery_UTF8
  • DnsQuery_W

Other examples include:

  • RunDll32ShimW for Unciode, but not ANSI version RunDll32ShimA
  • GetHashFromFile for ANSI and GetHashFromFileW for Unicode
  • triplet ShellExec_RunDLL and ShellExec_RunDLLA for ANSI and ShellExec_RunDLLW for Unicode

and many more…