NPSMDesktopProvider.dll

Description: <d> NPSM Desktop Local Provider DLL

Version: 10.0.19041.5848

Architecture: 64-bit

Operating System: Windows NT

SHA256: 09826ac5356464056b654e2a673d1b14

File Size: 209.0 KB

Uploaded At: Dec. 1, 2025, 7:35 a.m.

Views: 6

Security Warning

This file has been flagged as potentially dangerous.

Reason: Detected potentially dangerous functions used for process injection: OpenProcess

Exported Functions

DllCanUnloadNow (Ordinal: 1, Address: 0x2ad0)
DllGetClassObject (Ordinal: 2, Address: 0x29d0)

Imported DLLs & Functions

api-ms-win-core-com-l1-1-0.dll

CoCancelCall (Address: 0x180029630)
CoCreateFreeThreadedMarshaler (Address: 0x180029670)
CoCreateInstance (Address: 0x180029608)
CoDisableCallCancellation (Address: 0x180029638)
CoEnableCallCancellation (Address: 0x180029640)
CoGetApartmentType (Address: 0x180029628)
CoGetMalloc (Address: 0x180029650)
CoImpersonateClient (Address: 0x180029620)
CoInitializeEx (Address: 0x180029668)
CoRevertToSelf (Address: 0x180029618)
CoTaskMemAlloc (Address: 0x180029610)
CoTaskMemFree (Address: 0x180029658)
CoTaskMemRealloc (Address: 0x180029648)
CoUninitialize (Address: 0x180029660)

api-ms-win-core-com-l1-1-1.dll

RoGetAgileReference (Address: 0x180029680)

api-ms-win-core-debug-l1-1-0.dll

DebugBreak (Address: 0x180029690)
IsDebuggerPresent (Address: 0x180029698)
OutputDebugStringW (Address: 0x1800296a0)

api-ms-win-core-errorhandling-l1-1-0.dll

GetLastError (Address: 0x1800296d0)
RaiseException (Address: 0x1800296b8)
SetLastError (Address: 0x1800296c0)
SetUnhandledExceptionFilter (Address: 0x1800296c8)
UnhandledExceptionFilter (Address: 0x1800296b0)

api-ms-win-core-handle-l1-1-0.dll

CloseHandle (Address: 0x1800296e0)
DuplicateHandle (Address: 0x1800296e8)

api-ms-win-core-heap-l1-1-0.dll

GetProcessHeap (Address: 0x1800296f8)
HeapAlloc (Address: 0x180029708)
HeapFree (Address: 0x180029700)

api-ms-win-core-libraryloader-l1-2-0.dll

DisableThreadLibraryCalls (Address: 0x180029718)
GetModuleFileNameA (Address: 0x180029738)
GetModuleHandleExW (Address: 0x180029730)
GetModuleHandleW (Address: 0x180029728)
GetProcAddress (Address: 0x180029740)
LoadStringW (Address: 0x180029720)

api-ms-win-core-localization-l1-2-0.dll

FormatMessageW (Address: 0x180029750)
GetLocaleInfoW (Address: 0x180029758)

api-ms-win-core-localization-obsolete-l1-2-0.dll

GetUserDefaultUILanguage (Address: 0x180029768)

api-ms-win-core-processthreads-l1-1-0.dll

GetCurrentProcess (Address: 0x180029780)
GetCurrentProcessId (Address: 0x180029788)
GetCurrentThreadId (Address: 0x180029790)
OpenProcessToken (Address: 0x180029798)
TerminateProcess (Address: 0x180029778)

api-ms-win-core-processthreads-l1-1-1.dll

OpenProcess (Address: 0x1800297a8)

api-ms-win-core-profile-l1-1-0.dll

QueryPerformanceCounter (Address: 0x1800297b8)

api-ms-win-core-psapi-l1-1-0.dll

QueryFullProcessImageNameW (Address: 0x1800297c8)

api-ms-win-core-rtlsupport-l1-1-0.dll

RtlCaptureContext (Address: 0x1800297e8)
RtlLookupFunctionEntry (Address: 0x1800297d8)
RtlVirtualUnwind (Address: 0x1800297e0)

api-ms-win-core-string-l1-1-0.dll

CompareStringOrdinal (Address: 0x1800297f8)

api-ms-win-core-synch-l1-1-0.dll

AcquireSRWLockExclusive (Address: 0x180029818)
AcquireSRWLockShared (Address: 0x180029848)
CreateMutexExW (Address: 0x180029838)
CreateSemaphoreExW (Address: 0x180029858)
DeleteCriticalSection (Address: 0x180029810)
EnterCriticalSection (Address: 0x180029878)
InitializeCriticalSectionEx (Address: 0x180029870)
InitializeSRWLock (Address: 0x180029880)
LeaveCriticalSection (Address: 0x180029868)
OpenSemaphoreW (Address: 0x180029820)
ReleaseMutex (Address: 0x180029828)
ReleaseSemaphore (Address: 0x180029840)
ReleaseSRWLockExclusive (Address: 0x180029808)
ReleaseSRWLockShared (Address: 0x180029860)
WaitForSingleObject (Address: 0x180029850)
WaitForSingleObjectEx (Address: 0x180029830)

api-ms-win-core-synch-l1-2-0.dll

InitOnceBeginInitialize (Address: 0x180029890)
InitOnceComplete (Address: 0x180029898)
InitOnceExecuteOnce (Address: 0x1800298a8)
Sleep (Address: 0x1800298a0)

api-ms-win-core-sysinfo-l1-1-0.dll

GetSystemTimeAsFileTime (Address: 0x1800298b8)
GetTickCount (Address: 0x1800298c0)

api-ms-win-core-threadpool-l1-2-0.dll

CloseThreadpoolTimer (Address: 0x1800298e8)
CloseThreadpoolWait (Address: 0x1800298d0)
CreateThreadpoolTimer (Address: 0x1800298d8)
CreateThreadpoolWait (Address: 0x1800298e0)
IsThreadpoolTimerSet (Address: 0x180029910)
SetThreadpoolTimer (Address: 0x1800298f8)
SetThreadpoolWait (Address: 0x180029900)
WaitForThreadpoolTimerCallbacks (Address: 0x180029908)
WaitForThreadpoolWaitCallbacks (Address: 0x1800298f0)

api-ms-win-core-threadpool-legacy-l1-1-0.dll

CreateTimerQueueTimer (Address: 0x180029920)
DeleteTimerQueueTimer (Address: 0x180029928)

api-ms-win-core-util-l1-1-0.dll

DecodePointer (Address: 0x180029938)
EncodePointer (Address: 0x180029940)

api-ms-win-core-winrt-error-l1-1-0.dll

RoOriginateError (Address: 0x180029950)
RoTransformError (Address: 0x180029960)
SetRestrictedErrorInfo (Address: 0x180029958)

api-ms-win-core-winrt-error-l1-1-1.dll

IsErrorPropagationEnabled (Address: 0x180029980)
RoGetMatchingRestrictedErrorInfo (Address: 0x180029970)
RoReportFailedDelegate (Address: 0x180029978)

api-ms-win-core-winrt-string-l1-1-0.dll

WindowsCreateString (Address: 0x1800299a0)
WindowsCreateStringReference (Address: 0x180029998)
WindowsDeleteString (Address: 0x180029990)
WindowsDuplicateString (Address: 0x1800299b0)
WindowsGetStringRawBuffer (Address: 0x1800299a8)

api-ms-win-eventing-classicprovider-l1-1-0.dll

TraceMessage (Address: 0x1800299c0)

api-ms-win-eventing-provider-l1-1-0.dll

EventActivityIdControl (Address: 0x1800299f0)
EventRegister (Address: 0x1800299e0)
EventSetInformation (Address: 0x1800299d0)
EventUnregister (Address: 0x1800299e8)
EventWriteTransfer (Address: 0x1800299d8)

api-ms-win-security-base-l1-1-0.dll

DuplicateTokenEx (Address: 0x180029a00)
GetTokenInformation (Address: 0x180029a08)

api-ms-win-security-capability-l1-1-0.dll

CapabilityCheck (Address: 0x180029a18)

api-ms-win-service-management-l1-1-0.dll

CloseServiceHandle (Address: 0x180029a28)
OpenSCManagerW (Address: 0x180029a30)
OpenServiceW (Address: 0x180029a38)

api-ms-win-service-private-l1-1-0.dll

SubscribeServiceChangeNotifications (Address: 0x180029a48)
UnsubscribeServiceChangeNotifications (Address: 0x180029a50)

api-ms-win-service-winsvc-l1-1-0.dll

QueryServiceStatus (Address: 0x180029a60)

api-ms-win-shcore-comhelpers-l1-1-0.dll

IUnknown_QueryService (Address: 0x180029a70)

api-ms-win-shcore-taskpool-l1-1-0.dll

SHTaskPoolGetUniqueContext (Address: 0x180029a80)
SHTaskPoolQueueTask (Address: 0x180029a88)

api-ms-win-shcore-thread-l1-1-0.dll

SHCreateThread (Address: 0x180029a98)

COMCTL32.dll

ImageList_AddMasked (Address: 0x1800294b8)
ImageList_Create (Address: 0x1800294c0)
ImageList_Destroy (Address: 0x1800294c8)
ImageList_LoadImageW (Address: 0x1800294d0)

GDI32.dll

CreateCompatibleBitmap (Address: 0x1800294f0)
CreateCompatibleDC (Address: 0x1800294e0)
CreateDIBSection (Address: 0x1800294f8)
DeleteDC (Address: 0x180029518)
DeleteObject (Address: 0x180029510)
GetDeviceCaps (Address: 0x180029520)
GetObjectW (Address: 0x1800294e8)
SelectObject (Address: 0x180029500)
StretchBlt (Address: 0x180029508)

KERNEL32.dll

CreateEventW (Address: 0x180029540)
InitializeCriticalSection (Address: 0x180029530)
SetEvent (Address: 0x180029538)

MMDevAPI.DLL

(Address: 0x180029558)
(Address: 0x180029550)

msvcrt.dll

__C_specific_handler (Address: 0x180029ac0)
__CxxFrameHandler3 (Address: 0x180029ab8)
__dllonexit (Address: 0x180029af8)
_amsg_exit (Address: 0x180029ad8)
_callnewh (Address: 0x180029b40)
_CxxThrowException (Address: 0x180029b68)
_initterm (Address: 0x180029ac8)
_lock (Address: 0x180029ab0)
_onexit (Address: 0x180029b60)
_purecall (Address: 0x180029b80)
_unlock (Address: 0x180029aa8)
_vsnprintf_s (Address: 0x180029b38)
_vsnwprintf (Address: 0x180029b00)
_wsplitpath_s (Address: 0x180029b08)
_XcptFilter (Address: 0x180029ae0)
??0exception@@QEAA@AEBV0@@Z (Address: 0x180029b30)
??0exception@@QEAA@XZ (Address: 0x180029b28)
??1exception@@UEAA@XZ (Address: 0x180029b20)
??1type_info@@UEAA@XZ (Address: 0x180029b50)
?terminate@@YAXXZ (Address: 0x180029b48)
free (Address: 0x180029ae8)
malloc (Address: 0x180029b88)
memcmp (Address: 0x180029b70)
memcpy (Address: 0x180029b78)
memcpy_s (Address: 0x180029af0)
memmove (Address: 0x180029ad0)
memmove_s (Address: 0x180029b58)
memset (Address: 0x180029b90)
realloc (Address: 0x180029b10)
wcschr (Address: 0x180029b18)

ntdll.dll

NtQueryInformationToken (Address: 0x180029ba0)
NtQueryWnfStateData (Address: 0x180029bd8)
RtlAllocateHeap (Address: 0x180029bb0)
RtlCompareUnicodeString (Address: 0x180029bc0)
RtlFreeHeap (Address: 0x180029bb8)
RtlInitUnicodeString (Address: 0x180029ba8)
RtlNtStatusToDosErrorNoTeb (Address: 0x180029be8)
RtlQueryTokenHostIdAsUlong64 (Address: 0x180029bc8)
RtlSubscribeWnfStateChangeNotification (Address: 0x180029bd0)
RtlUnsubscribeWnfNotificationWaitForCompletion (Address: 0x180029be0)

RPCRT4.dll

NdrClientCall3 (Address: 0x180029580)
RpcBindingFree (Address: 0x180029578)
RpcBindingFromStringBindingW (Address: 0x180029568)
RpcStringBindingComposeW (Address: 0x180029588)
RpcStringFreeW (Address: 0x180029570)

SHCORE.dll

GetFeatureEnabledState (Address: 0x1800295b0)
RecordFeatureUsage (Address: 0x1800295a8)
SubscribeFeatureStateChangeNotification (Address: 0x1800295a0)
UnsubscribeFeatureStateChangeNotification (Address: 0x180029598)

USER32.dll

(Address: 0x1800295f8)
DestroyWindow (Address: 0x1800295d8)
GetDC (Address: 0x1800295c8)
GetSystemMetrics (Address: 0x1800295e0)
GetWindowThreadProcessId (Address: 0x1800295d0)
IsWindow (Address: 0x1800295c0)
LoadImageW (Address: 0x1800295f0)
ReleaseDC (Address: 0x1800295e8)