ipnathlp.dll

Description: Microsoft NAT Helper Components

Version: 10.0.19041.6033

Architecture: 64-bit

Operating System: Windows NT

SHA256: 1466a5849401b24189416c4a763cf47b

File Size: 633.0 KB

Uploaded At: Dec. 1, 2025, 7:29 a.m.

Views: 8

Security Warning

This file has been flagged as potentially dangerous.

Reason: Detected potentially dangerous functions used for process injection: OpenProcess

Exported Functions

NhAcceptStreamSocket (Ordinal: 1, Address: 0x5d30)
NhAcquireFixedLengthBuffer (Ordinal: 2, Address: 0x15a0)
NhAcquireVariableLengthBuffer (Ordinal: 3, Address: 0x1600)
NhCreateDatagramSocket (Ordinal: 4, Address: 0x64e0)
NhCreateStreamSocket (Ordinal: 5, Address: 0x6bd0)
NhDeleteSocket (Ordinal: 6, Address: 0x6f40)
NhInitializeBufferManagement (Ordinal: 7, Address: 0x1870)
NhInitializeTraceManagement (Ordinal: 8, Address: 0x4d60)
NhReadDatagramSocket (Ordinal: 9, Address: 0x73b0)
NhReadStreamSocket (Ordinal: 10, Address: 0x7700)
NhReleaseBuffer (Ordinal: 11, Address: 0x1920)
NhWriteDatagramSocket (Ordinal: 12, Address: 0x7a30)
NhWriteStreamSocket (Ordinal: 13, Address: 0x7ca0)
RegisterProtocol (Ordinal: 14, Address: 0x4740)
SvchostPushServiceGlobals (Ordinal: 15, Address: 0x440d0)
NatAcquirePortReservation (Ordinal: 16, Address: 0x8f30)
NatCancelDynamicRedirect (Ordinal: 17, Address: 0x9630)
NatCancelRedirect (Ordinal: 18, Address: 0x96c0)
NatCreateDynamicFullRedirect (Ordinal: 19, Address: 0x9810)
NatCreateDynamicRedirect (Ordinal: 20, Address: 0x9a60)
NatCreateDynamicRedirectEx (Ordinal: 21, Address: 0x9ad0)
NatCreateRedirect (Ordinal: 22, Address: 0x9b50)
NatCreateRedirectEx (Ordinal: 23, Address: 0x9bf0)
NatInitializePortReservation (Ordinal: 24, Address: 0x9060)
NatInitializeTranslator (Ordinal: 25, Address: 0x9e40)
NatLookupAndQueryInformationSessionMapping (Ordinal: 26, Address: 0xa010)
NatQueryInformationRedirect (Ordinal: 27, Address: 0xa8e0)
NatQueryInformationRedirectHandle (Ordinal: 28, Address: 0xab90)
NatReleasePortReservation (Ordinal: 29, Address: 0x94b0)
NatShutdownPortReservation (Ordinal: 30, Address: 0x95b0)
NatShutdownTranslator (Ordinal: 31, Address: 0xac00)
ServiceMain (Ordinal: 32, Address: 0x44420)

Imported DLLs & Functions

api-ms-win-core-apiquery-l1-1-0.dll

ApiSetQueryApiSetPresence (Address: 0x180086f60)

api-ms-win-core-debug-l1-1-0.dll

DebugBreak (Address: 0x180086f80)
IsDebuggerPresent (Address: 0x180086f78)
OutputDebugStringW (Address: 0x180086f70)

api-ms-win-core-delayload-l1-1-0.dll

DelayLoadFailureHook (Address: 0x180086f90)

api-ms-win-core-delayload-l1-1-1.dll

ResolveDelayLoadedAPI (Address: 0x180086fa0)

api-ms-win-core-errorhandling-l1-1-0.dll

GetLastError (Address: 0x180086fc8)
SetLastError (Address: 0x180086fb0)
SetUnhandledExceptionFilter (Address: 0x180086fc0)
UnhandledExceptionFilter (Address: 0x180086fb8)

api-ms-win-core-file-l1-1-0.dll

CreateFileA (Address: 0x180086fe0)
ReadFile (Address: 0x180086fe8)
WriteFile (Address: 0x180086fd8)

api-ms-win-core-handle-l1-1-0.dll

CloseHandle (Address: 0x180087000)
DuplicateHandle (Address: 0x180086ff8)

api-ms-win-core-heap-l1-1-0.dll

GetProcessHeap (Address: 0x180087010)
HeapAlloc (Address: 0x180087030)
HeapDestroy (Address: 0x180087020)
HeapFree (Address: 0x180087018)
HeapSize (Address: 0x180087028)

api-ms-win-core-heap-l2-1-0.dll

GlobalFree (Address: 0x180087048)
LocalAlloc (Address: 0x180087040)
LocalFree (Address: 0x180087050)

api-ms-win-core-io-l1-1-0.dll

DeviceIoControl (Address: 0x180087060)

api-ms-win-core-kernel32-legacy-l1-1-0.dll

BindIoCompletionCallback (Address: 0x180087078)
GetComputerNameW (Address: 0x180087080)
RegisterWaitForSingleObject (Address: 0x180087088)
UnregisterWait (Address: 0x180087070)

api-ms-win-core-libraryloader-l1-2-0.dll

DisableThreadLibraryCalls (Address: 0x1800870e0)
FreeLibrary (Address: 0x1800870c0)
FreeResource (Address: 0x1800870a0)
GetModuleFileNameA (Address: 0x1800870b8)
GetModuleFileNameW (Address: 0x1800870d8)
GetModuleHandleExW (Address: 0x1800870c8)
GetModuleHandleW (Address: 0x1800870d0)
GetProcAddress (Address: 0x1800870b0)
LoadResource (Address: 0x1800870f0)
LoadStringW (Address: 0x1800870e8)
LockResource (Address: 0x180087098)
SizeofResource (Address: 0x1800870a8)

api-ms-win-core-libraryloader-l1-2-1.dll

FindResourceW (Address: 0x180087100)
LoadLibraryA (Address: 0x180087110)
LoadLibraryW (Address: 0x180087108)

api-ms-win-core-localization-l1-2-0.dll

FormatMessageW (Address: 0x180087120)

api-ms-win-core-processenvironment-l1-1-0.dll

ExpandEnvironmentStringsA (Address: 0x180087130)

api-ms-win-core-processthreads-l1-1-0.dll

GetCurrentProcess (Address: 0x180087160)
GetCurrentProcessId (Address: 0x180087180)
GetCurrentThread (Address: 0x180087170)
GetCurrentThreadId (Address: 0x180087150)
OpenProcessToken (Address: 0x180087158)
OpenThreadToken (Address: 0x180087178)
SetThreadPriority (Address: 0x180087168)
SetThreadToken (Address: 0x180087148)
TerminateProcess (Address: 0x180087140)

api-ms-win-core-processthreads-l1-1-1.dll

GetProcessMitigationPolicy (Address: 0x180087190)
OpenProcess (Address: 0x180087198)

api-ms-win-core-profile-l1-1-0.dll

QueryPerformanceCounter (Address: 0x1800871a8)

api-ms-win-core-registry-l1-1-0.dll

RegCloseKey (Address: 0x1800871c8)
RegCreateKeyExW (Address: 0x1800871b8)
RegDeleteValueW (Address: 0x1800871d0)
RegOpenKeyExW (Address: 0x1800871e0)
RegQueryValueExW (Address: 0x1800871d8)
RegSetValueExW (Address: 0x1800871c0)

api-ms-win-core-rtlsupport-l1-1-0.dll

RtlCaptureContext (Address: 0x1800871f0)
RtlCompareMemory (Address: 0x180087208)
RtlLookupFunctionEntry (Address: 0x1800871f8)
RtlVirtualUnwind (Address: 0x180087200)

api-ms-win-core-string-l1-1-0.dll

MultiByteToWideChar (Address: 0x180087220)
WideCharToMultiByte (Address: 0x180087218)

api-ms-win-core-string-obsolete-l1-1-0.dll

lstrcmpiA (Address: 0x180087238)
lstrcmpiW (Address: 0x180087230)
lstrcmpW (Address: 0x180087248)
lstrlenA (Address: 0x180087240)
lstrlenW (Address: 0x180087250)

api-ms-win-core-synch-l1-1-0.dll

AcquireSRWLockExclusive (Address: 0x1800872e8)
AcquireSRWLockShared (Address: 0x180087268)
CreateEventA (Address: 0x180087290)
CreateEventW (Address: 0x1800872d0)
CreateMutexExW (Address: 0x1800872f0)
CreateSemaphoreExW (Address: 0x180087298)
DeleteCriticalSection (Address: 0x1800872a8)
EnterCriticalSection (Address: 0x1800872e0)
InitializeCriticalSection (Address: 0x1800872f8)
InitializeCriticalSectionAndSpinCount (Address: 0x1800872b8)
InitializeCriticalSectionEx (Address: 0x1800872c0)
LeaveCriticalSection (Address: 0x1800872d8)
OpenSemaphoreW (Address: 0x1800872c8)
ReleaseMutex (Address: 0x180087288)
ReleaseSemaphore (Address: 0x180087280)
ReleaseSRWLockExclusive (Address: 0x180087278)
ReleaseSRWLockShared (Address: 0x180087260)
ResetEvent (Address: 0x180087270)
SetEvent (Address: 0x180087300)
WaitForSingleObject (Address: 0x1800872b0)
WaitForSingleObjectEx (Address: 0x1800872a0)

api-ms-win-core-synch-l1-2-0.dll

Sleep (Address: 0x180087310)

api-ms-win-core-synch-l1-2-1.dll

WaitForMultipleObjects (Address: 0x180087320)

api-ms-win-core-sysinfo-l1-1-0.dll

GetComputerNameExW (Address: 0x180087340)
GetSystemDirectoryW (Address: 0x180087358)
GetSystemTimeAsFileTime (Address: 0x180087330)
GetTickCount (Address: 0x180087348)
GetTickCount64 (Address: 0x180087350)
GetVersionExW (Address: 0x180087338)

api-ms-win-core-threadpool-l1-2-0.dll

CloseThreadpoolTimer (Address: 0x180087390)
CloseThreadpoolWork (Address: 0x180087380)
CreateThreadpoolTimer (Address: 0x180087398)
CreateThreadpoolWork (Address: 0x180087378)
SetThreadpoolTimer (Address: 0x180087368)
SubmitThreadpoolWork (Address: 0x1800873a0)
WaitForThreadpoolTimerCallbacks (Address: 0x180087388)
WaitForThreadpoolWorkCallbacks (Address: 0x180087370)

api-ms-win-core-threadpool-legacy-l1-1-0.dll

CreateTimerQueue (Address: 0x1800873b0)
DeleteTimerQueueEx (Address: 0x1800873b8)
QueueUserWorkItem (Address: 0x1800873c8)
UnregisterWaitEx (Address: 0x1800873c0)

api-ms-win-core-timezone-l1-1-0.dll

FileTimeToSystemTime (Address: 0x1800873e0)
SystemTimeToFileTime (Address: 0x1800873d8)

api-ms-win-eventing-classicprovider-l1-1-0.dll

GetTraceEnableFlags (Address: 0x1800873f8)
GetTraceEnableLevel (Address: 0x1800873f0)
GetTraceLoggerHandle (Address: 0x180087410)
RegisterTraceGuidsW (Address: 0x180087400)
TraceMessage (Address: 0x180087408)
UnregisterTraceGuids (Address: 0x180087418)

api-ms-win-eventing-provider-l1-1-0.dll

EventRegister (Address: 0x180087428)
EventSetInformation (Address: 0x180087430)
EventUnregister (Address: 0x180087438)
EventWriteTransfer (Address: 0x180087440)

api-ms-win-security-base-l1-1-0.dll

AddAccessAllowedAce (Address: 0x180087488)
CheckTokenMembership (Address: 0x180087480)
CreateWellKnownSid (Address: 0x180087468)
DuplicateToken (Address: 0x180087498)
GetLengthSid (Address: 0x180087470)
InitializeAcl (Address: 0x180087478)
InitializeSecurityDescriptor (Address: 0x180087460)
RevertToSelf (Address: 0x180087450)
SetKernelObjectSecurity (Address: 0x180087490)
SetSecurityDescriptorDacl (Address: 0x180087458)

api-ms-win-security-sddl-l1-1-0.dll

ConvertStringSecurityDescriptorToSecurityDescriptorW (Address: 0x1800874a8)

CRYPTSP.dll

CryptAcquireContextW (Address: 0x180086ce0)
CryptGenRandom (Address: 0x180086ce8)
CryptReleaseContext (Address: 0x180086cd8)

dhcpcsvc.DLL

DhcpEnableDhcp (Address: 0x1800874b8)

dhcpcsvc6.DLL

Dhcpv6CancelOperation (Address: 0x1800874d0)
Dhcpv6ReleasePrefixEx (Address: 0x1800874c8)
Dhcpv6RenewPrefixEx (Address: 0x1800874d8)
Dhcpv6RequestPrefixEx (Address: 0x1800874e0)

DNSAPI.dll

Dns_BuildPacket (Address: 0x180086d00)
Dns_FreeMsgBuf (Address: 0x180086cf8)
Dns_ParseMessage (Address: 0x180086d08)
DnsFree (Address: 0x180086d10)
DnsFreeConfigStructure (Address: 0x180086d28)
DnsGetPrimaryDomainName_A (Address: 0x180086d18)
DnsNameCompare_W (Address: 0x180086d20)
DnsQuery_W (Address: 0x180086d30)
DnsQueryConfigAllocEx (Address: 0x180086d38)

FirewallAPI.dll

FWAddFirewallRule (Address: 0x180086d58)
FWClosePolicyStore (Address: 0x180086d48)
FWDeleteFirewallRule (Address: 0x180086d50)
FWFreeFirewallRules (Address: 0x180086d78)
FWOpenPolicyStore (Address: 0x180086d70)
FWQueryFirewallRules (Address: 0x180086d68)
FWSetFirewallRule (Address: 0x180086d60)

IPHLPAPI.DLL

CancelIPChangeNotify (Address: 0x180086de8)
CancelMibChangeNotify2 (Address: 0x180086df0)
ConvertInterfaceGuidToLuid (Address: 0x180086e20)
ConvertInterfaceIndexToLuid (Address: 0x180086e18)
ConvertInterfaceLuidToGuid (Address: 0x180086e38)
ConvertInterfaceLuidToIndex (Address: 0x180086dd8)
ConvertInterfaceLuidToNameW (Address: 0x180086e30)
ConvertIpv4MaskToLength (Address: 0x180086d98)
CreateIpNetEntry2 (Address: 0x180086d88)
CreateUnicastIpAddressEntry (Address: 0x180086d90)
DeleteIpNetEntry (Address: 0x180086e28)
DeleteUnicastIpAddressEntry (Address: 0x180086dc0)
GetAdapterIndex (Address: 0x180086da8)
GetAdaptersAddresses (Address: 0x180086de0)
GetIfEntry (Address: 0x180086da0)
GetIfEntry2 (Address: 0x180086e10)
GetIfTable (Address: 0x180086db8)
GetIpAddrTable (Address: 0x180086df8)
GetIpNetTable (Address: 0x180086e40)
InitializeUnicastIpAddressEntry (Address: 0x180086dc8)
NotifyAddrChange (Address: 0x180086e08)
NotifyIpInterfaceChange (Address: 0x180086e00)
NotifyUnicastIpAddressChange (Address: 0x180086dd0)
SendARP (Address: 0x180086db0)

msvcrt.dll

__C_specific_handler (Address: 0x180087518)
__dllonexit (Address: 0x180087668)
_amsg_exit (Address: 0x180087648)
_callnewh (Address: 0x180087628)
_CxxThrowException (Address: 0x180087630)
_fdopen (Address: 0x180087570)
_initterm (Address: 0x180087650)
_itow (Address: 0x180087510)
_lock (Address: 0x180087678)
_onexit (Address: 0x180087660)
_open_osfhandle (Address: 0x180087568)
_purecall (Address: 0x180087520)
_strnicmp (Address: 0x180087590)
_unlock (Address: 0x180087670)
_vsnprintf (Address: 0x1800875e8)
_vsnwprintf (Address: 0x180087530)
_wcsdup (Address: 0x1800875e0)
_wcsicmp (Address: 0x180087550)
_XcptFilter (Address: 0x180087638)
??0exception@@QEAA@AEBQEBDH@Z (Address: 0x180087608)
??0exception@@QEAA@AEBV0@@Z (Address: 0x180087610)
??1exception@@UEAA@XZ (Address: 0x180087618)
??1type_info@@UEAA@XZ (Address: 0x180087658)
?what@exception@@UEBAPEBDXZ (Address: 0x180087620)
atoi (Address: 0x180087598)
difftime (Address: 0x1800875d0)
fclose (Address: 0x180087560)
feof (Address: 0x180087580)
fgets (Address: 0x180087578)
fprintf (Address: 0x1800875b0)
fputc (Address: 0x1800875a0)
fputs (Address: 0x1800875a8)
free (Address: 0x1800875c0)
malloc (Address: 0x1800875c8)
mbstowcs (Address: 0x180087558)
memcmp (Address: 0x180087500)
memcpy (Address: 0x1800874f8)
memcpy_s (Address: 0x180087528)
memmove (Address: 0x1800874f0)
memmove_s (Address: 0x180087538)
memset (Address: 0x180087508)
qsort (Address: 0x1800875f0)
realloc (Address: 0x180087600)
sprintf_s (Address: 0x180087548)
strpbrk (Address: 0x180087588)
strtok_s (Address: 0x1800875d8)
time (Address: 0x1800875b8)
wcscmp (Address: 0x180087640)
wcsncmp (Address: 0x1800875f8)
wcstombs (Address: 0x180087540)

MSWSOCK.dll

AcceptEx (Address: 0x180086e50)

NSI.dll

NsiAllocateAndGetTable (Address: 0x180086e88)
NsiCancelChangeNotification (Address: 0x180086e90)
NsiFreeTable (Address: 0x180086e60)
NsiGetAllParameters (Address: 0x180086e78)
NsiGetParameterEx (Address: 0x180086e70)
NsiRequestChangeNotification (Address: 0x180086e98)
NsiSetAllParameters (Address: 0x180086e80)
NsiSetAllParametersEx (Address: 0x180086e68)

ntdll.dll

NtClose (Address: 0x1800877e8)
NtCreateEvent (Address: 0x1800876d0)
NtCreateFile (Address: 0x180087798)
NtDeviceIoControlFile (Address: 0x180087790)
NtLoadDriver (Address: 0x180087768)
NtNotifyChangeKey (Address: 0x1800876d8)
NtOpenFile (Address: 0x180087760)
NtOpenKey (Address: 0x180087688)
NtQueryValueKey (Address: 0x1800877f0)
NtSetEvent (Address: 0x1800876b0)
NtUnloadDriver (Address: 0x180087748)
RtlAdjustPrivilege (Address: 0x180087758)
RtlAllocateHeap (Address: 0x1800877c8)
RtlAnsiStringToUnicodeString (Address: 0x1800877c0)
RtlClearAllBits (Address: 0x180087780)
RtlClearBits (Address: 0x180087778)
RtlCreateTimer (Address: 0x1800877b8)
RtlCreateTimerQueue (Address: 0x180087808)
RtlDeleteElementGenericTable (Address: 0x1800876f8)
RtlDeleteTimer (Address: 0x1800877f8)
RtlDeleteTimerQueueEx (Address: 0x1800877b0)
RtlDeregisterWait (Address: 0x180087718)
RtlDeregisterWaitEx (Address: 0x180087690)
RtlEnumerateGenericTable (Address: 0x1800876e0)
RtlFindClearBitsAndSet (Address: 0x1800877a0)
RtlFindSetBits (Address: 0x180087770)
RtlFreeAnsiString (Address: 0x180087698)
RtlFreeHeap (Address: 0x1800877d8)
RtlFreeUnicodeString (Address: 0x1800876c0)
RtlGetElementGenericTable (Address: 0x180087700)
RtlGetPersistedStateLocation (Address: 0x1800877d0)
RtlImpersonateSelf (Address: 0x180087750)
RtlInitAnsiString (Address: 0x1800876a8)
RtlInitializeBitMap (Address: 0x180087788)
RtlInitializeGenericTable (Address: 0x180087710)
RtlInitString (Address: 0x1800877e0)
RtlInitUnicodeString (Address: 0x180087810)
RtlInsertElementGenericTable (Address: 0x1800876f0)
RtlLookupElementGenericTable (Address: 0x1800876e8)
RtlNtStatusToDosError (Address: 0x180087800)
RtlNumberGenericTableElements (Address: 0x180087708)
RtlPublishWnfStateData (Address: 0x180087720)
RtlQueueWorkItem (Address: 0x180087730)
RtlRandom (Address: 0x180087728)
RtlRegisterWait (Address: 0x1800876c8)
RtlStringFromGUID (Address: 0x1800876b8)
RtlSubscribeWnfStateChangeNotification (Address: 0x180087740)
RtlUnicodeStringToAnsiString (Address: 0x1800876a0)
RtlUnsubscribeWnfNotificationWaitForCompletion (Address: 0x180087738)
RtlUpdateTimer (Address: 0x1800877a8)

RPCRT4.dll

NdrServerCall2 (Address: 0x180086f00)
NdrServerCallAll (Address: 0x180086f10)
RpcBindingVectorFree (Address: 0x180086ef0)
RpcEpRegisterW (Address: 0x180086ee8)
RpcEpUnregister (Address: 0x180086ee0)
RpcImpersonateClient (Address: 0x180086ed8)
RpcRevertToSelfEx (Address: 0x180086eb8)
RpcServerInqBindings (Address: 0x180086ef8)
RpcServerRegisterIf3 (Address: 0x180086eb0)
RpcServerUnregisterIf (Address: 0x180086ed0)
RpcServerUseProtseqW (Address: 0x180086ec8)
RpcStringFreeW (Address: 0x180086ec0)
UuidCreate (Address: 0x180086f08)
UuidToStringW (Address: 0x180086ea8)

rtutils.dll

TraceDeregisterW (Address: 0x180087828)
TraceRegisterExW (Address: 0x180087820)

WINHTTP.dll

WinHttpDetectAutoProxyConfigUrl (Address: 0x180086f20)

WINNSI.DLL

NsiConnectToServer (Address: 0x180086f30)
NsiDisconnectFromServer (Address: 0x180086f48)
NsiRpcDeregisterChangeNotification (Address: 0x180086f50)
NsiRpcRegisterChangeNotification (Address: 0x180086f40)
NsiRpcSetAllParameters (Address: 0x180086f38)