desksrv.dll

Description: Microsoft User Experience Desktop Server

Authors: © Microsoft Corporation. All rights reserved.

Version: 6.0.4074.0

Architecture: 32-bit

Operating System: Windows NT

SHA256: 6e6119a4a32e01d1622d43522ea21121

File Size: 567.0 KB

Uploaded At: May 5, 2026, 3:46 p.m.

Views: 31

Security Warning

This file has been flagged as potentially dangerous.

Reason: Detected potentially dangerous functions used for process injection: OpenProcess, CreateRemoteThread, WriteProcessMemory

Exported Functions

  • ServiceMain (Ordinal: 1, Address: 0x7f53)

Imported DLLs & Functions

ADVAPI32.dll
  • AccessCheck (Address: 0x6f73106c)
  • AddAccessAllowedAce (Address: 0x6f731094)
  • AddAccessAllowedAceEx (Address: 0x6f7310ac)
  • AllocateAndInitializeSid (Address: 0x6f731068)
  • CloseServiceHandle (Address: 0x6f731008)
  • CopySid (Address: 0x6f731028)
  • CreateProcessAsUserW (Address: 0x6f731018)
  • DeleteService (Address: 0x6f73100c)
  • DuplicateToken (Address: 0x6f731070)
  • DuplicateTokenEx (Address: 0x6f7310b8)
  • EqualSid (Address: 0x6f73109c)
  • FreeSid (Address: 0x6f731064)
  • GetAce (Address: 0x6f7310b0)
  • GetKernelObjectSecurity (Address: 0x6f7310a4)
  • GetLengthSid (Address: 0x6f73102c)
  • GetSecurityDescriptorDacl (Address: 0x6f731030)
  • GetSecurityDescriptorGroup (Address: 0x6f73108c)
  • GetSecurityDescriptorOwner (Address: 0x6f731090)
  • GetSidLengthRequired (Address: 0x6f73107c)
  • GetSidSubAuthority (Address: 0x6f731074)
  • GetTokenInformation (Address: 0x6f731020)
  • ImpersonateLoggedOnUser (Address: 0x6f7310bc)
  • InitializeAcl (Address: 0x6f731098)
  • InitializeSecurityDescriptor (Address: 0x6f73103c)
  • InitializeSid (Address: 0x6f731078)
  • IsValidSecurityDescriptor (Address: 0x6f7310a0)
  • MakeSelfRelativeSD (Address: 0x6f731080)
  • OpenProcessToken (Address: 0x6f73101c)
  • OpenSCManagerW (Address: 0x6f731014)
  • OpenServiceW (Address: 0x6f731010)
  • OpenThreadToken (Address: 0x6f731024)
  • RegCloseKey (Address: 0x6f731040)
  • RegCreateKeyExW (Address: 0x6f731060)
  • RegDeleteKeyW (Address: 0x6f731054)
  • RegDeleteValueW (Address: 0x6f73105c)
  • RegisterServiceCtrlHandlerExW (Address: 0x6f731000)
  • RegOpenKeyA (Address: 0x6f731048)
  • RegOpenKeyExW (Address: 0x6f731050)
  • RegQueryValueExA (Address: 0x6f731044)
  • RegQueryValueExW (Address: 0x6f73104c)
  • RegSetValueExW (Address: 0x6f731058)
  • RevertToSelf (Address: 0x6f731034)
  • SetKernelObjectSecurity (Address: 0x6f7310a8)
  • SetSecurityDescriptorDacl (Address: 0x6f731038)
  • SetSecurityDescriptorGroup (Address: 0x6f731084)
  • SetSecurityDescriptorOwner (Address: 0x6f731088)
  • SetServiceStatus (Address: 0x6f731004)
  • SetThreadToken (Address: 0x6f7310b4)
d3d9.dll
  • Direct3DCreate9 (Address: 0x6f7313fc)
GDI32.dll
  • CreateCompatibleDC (Address: 0x6f7310e0)
  • CreateDIBSection (Address: 0x6f7310dc)
  • CreateFontIndirectW (Address: 0x6f7310c4)
  • CreateRectRgnIndirect (Address: 0x6f7310cc)
  • DeleteDC (Address: 0x6f7310e4)
  • DeleteObject (Address: 0x6f7310f8)
  • ExtTextOutW (Address: 0x6f7310f0)
  • GdiEntry13 (Address: 0x6f7310c8)
  • GetDeviceCaps (Address: 0x6f7310d0)
  • SelectObject (Address: 0x6f7310d4)
  • SetBkColor (Address: 0x6f7310f4)
  • SetBkMode (Address: 0x6f7310e8)
  • SetMapMode (Address: 0x6f7310d8)
  • SetTextColor (Address: 0x6f7310ec)
KERNEL32.dll
  • AddAtomW (Address: 0x6f73119c)
  • CloseHandle (Address: 0x6f7311f4)
  • CompareStringW (Address: 0x6f731258)
  • CreateEventW (Address: 0x6f73115c)
  • CreateFileMappingW (Address: 0x6f731124)
  • CreateMutexW (Address: 0x6f7311ec)
  • CreateRemoteThread (Address: 0x6f731194)
  • CreateSemaphoreW (Address: 0x6f7311c4)
  • CreateThread (Address: 0x6f731118)
  • CreateTimerQueueTimer (Address: 0x6f731160)
  • DeleteAtom (Address: 0x6f7311a0)
  • DeleteCriticalSection (Address: 0x6f731220)
  • DeleteTimerQueueTimer (Address: 0x6f7311e4)
  • DisableThreadLibraryCalls (Address: 0x6f7311f8)
  • DuplicateHandle (Address: 0x6f731178)
  • EnterCriticalSection (Address: 0x6f731250)
  • ExpandEnvironmentStringsW (Address: 0x6f7311e0)
  • FindAtomW (Address: 0x6f731198)
  • FindResourceW (Address: 0x6f73122c)
  • FreeLibrary (Address: 0x6f731138)
  • FreeResource (Address: 0x6f731164)
  • GetAtomNameW (Address: 0x6f731254)
  • GetCurrentProcess (Address: 0x6f731174)
  • GetCurrentProcessId (Address: 0x6f731154)
  • GetCurrentThread (Address: 0x6f73110c)
  • GetCurrentThreadId (Address: 0x6f73113c)
  • GetFileAttributesW (Address: 0x6f7311e8)
  • GetLastError (Address: 0x6f7311f0)
  • GetModuleHandleW (Address: 0x6f73118c)
  • GetProcAddress (Address: 0x6f731190)
  • GetSystemDirectoryW (Address: 0x6f731244)
  • GetSystemInfo (Address: 0x6f731188)
  • GetSystemTimeAsFileTime (Address: 0x6f73121c)
  • GetTickCount (Address: 0x6f731108)
  • HeapAlloc (Address: 0x6f73120c)
  • HeapCreate (Address: 0x6f731214)
  • HeapDestroy (Address: 0x6f731210)
  • HeapFree (Address: 0x6f731204)
  • HeapReAlloc (Address: 0x6f731208)
  • InitializeCriticalSection (Address: 0x6f731224)
  • InterlockedCompareExchange (Address: 0x6f731228)
  • InterlockedDecrement (Address: 0x6f731104)
  • InterlockedExchange (Address: 0x6f731120)
  • InterlockedIncrement (Address: 0x6f731100)
  • IsDebuggerPresent (Address: 0x6f7311cc)
  • IsProcessorFeaturePresent (Address: 0x6f7311d4)
  • LeaveCriticalSection (Address: 0x6f73124c)
  • LoadLibraryW (Address: 0x6f731134)
  • LoadResource (Address: 0x6f731234)
  • LockResource (Address: 0x6f731238)
  • lstrcmpW (Address: 0x6f73117c)
  • lstrlenW (Address: 0x6f731130)
  • MapViewOfFile (Address: 0x6f731110)
  • MulDiv (Address: 0x6f731248)
  • OpenEventW (Address: 0x6f731148)
  • OpenProcess (Address: 0x6f731184)
  • OpenThread (Address: 0x6f73116c)
  • ProcessIdToSessionId (Address: 0x6f731158)
  • QueryPerformanceCounter (Address: 0x6f73123c)
  • QueryPerformanceFrequency (Address: 0x6f731240)
  • QueueUserAPC (Address: 0x6f731168)
  • QueueUserWorkItem (Address: 0x6f7311a8)
  • RaiseException (Address: 0x6f7311d0)
  • RegisterWaitForSingleObject (Address: 0x6f7311b0)
  • ResetEvent (Address: 0x6f731200)
  • ResumeThread (Address: 0x6f7311dc)
  • SetEvent (Address: 0x6f7311fc)
  • SetThreadPriority (Address: 0x6f7311d8)
  • SetUnhandledExceptionFilter (Address: 0x6f7311a4)
  • SizeofResource (Address: 0x6f731230)
  • SleepEx (Address: 0x6f73111c)
  • TerminateJobObject (Address: 0x6f731180)
  • TerminateProcess (Address: 0x6f731170)
  • TerminateThread (Address: 0x6f7311ac)
  • TlsAlloc (Address: 0x6f73114c)
  • TlsFree (Address: 0x6f731140)
  • TlsGetValue (Address: 0x6f731150)
  • TlsSetValue (Address: 0x6f731144)
  • UnhandledExceptionFilter (Address: 0x6f731218)
  • UnmapViewOfFile (Address: 0x6f731114)
  • UnregisterWait (Address: 0x6f7311b4)
  • UnregisterWaitEx (Address: 0x6f7311b8)
  • VirtualAlloc (Address: 0x6f7311c8)
  • WaitForMultipleObjects (Address: 0x6f73112c)
  • WaitForSingleObject (Address: 0x6f731128)
  • WideCharToMultiByte (Address: 0x6f7311bc)
  • WriteProcessMemory (Address: 0x6f7311c0)
milcore.dll
  • MilBatch_Abort (Address: 0x6f7314a8)
  • MilBatch_Commit (Address: 0x6f7314ac)
  • MilBitmap_AddDirtyRect (Address: 0x6f731468)
  • MilBitmap_GetDXSharedSurface (Address: 0x6f73150c)
  • MilCompositionContext_SetRootNode (Address: 0x6f73147c)
  • MilCompositionDevice_Create (Address: 0x6f73148c)
  • MilCompositionDevice_CreateBatch (Address: 0x6f7314b0)
  • MilCompositionDevice_Destroy (Address: 0x6f731518)
  • MilCompositionDevice_FlushChangeQueue (Address: 0x6f731460)
  • MilCompositionDevice_ProcessNotifications (Address: 0x6f73145c)
  • MilCompositionDevice_SignalInput (Address: 0x6f731464)
  • MilCompositionNode_SetRenderData (Address: 0x6f73144c)
  • MilRenderData_DrawRenderData (Address: 0x6f73143c)
  • MilRenderData_DrawScene3D (Address: 0x6f731438)
  • MilRenderData_Pop (Address: 0x6f731444)
  • MilRenderData_PushOpacity (Address: 0x6f731440)
  • MilResource_AddRef (Address: 0x6f73151c)
  • MilResource_AmbientLight_Create (Address: 0x6f7314f8)
  • MilResource_AmbientLight_Update (Address: 0x6f7314f4)
  • MilResource_AnimatedDouble_Create (Address: 0x6f7314e4)
  • MilResource_AnimatedPoint3D_Create (Address: 0x6f7314d8)
  • MilResource_AnimatedQuaternion3D_Create (Address: 0x6f73146c)
  • MilResource_Bitmap_CreateFromSection (Address: 0x6f731514)
  • MilResource_Bitmap_CreatePlaceholder (Address: 0x6f731510)
  • MilResource_CompositionContext_Create (Address: 0x6f731484)
  • MilResource_CompositionNode_Create (Address: 0x6f731448)
  • MilResource_DiffuseShader_Create (Address: 0x6f7314cc)
  • MilResource_DiffuseShader_Update (Address: 0x6f7314c0)
  • MilResource_DoubleAnimation_Create (Address: 0x6f7314dc)
  • MilResource_DoubleAnimationCollection_Create (Address: 0x6f7314e0)
  • MilResource_GlassShader_Create (Address: 0x6f7314c8)
  • MilResource_GlassShader_Update (Address: 0x6f7314c4)
  • MilResource_HWndRenderTarget_Create (Address: 0x6f731488)
  • MilResource_HWndRenderTarget_SetCompositionContext (Address: 0x6f731480)
  • MilResource_ImageBrush_Create (Address: 0x6f731508)
  • MilResource_ImageBrush_Update (Address: 0x6f731504)
  • MilResource_Marshal (Address: 0x6f7314a4)
  • MilResource_MatrixCamera_Create (Address: 0x6f731500)
  • MilResource_MatrixCamera_Update (Address: 0x6f7314fc)
  • MilResource_MatrixTransform3D_Create (Address: 0x6f73149c)
  • MilResource_MatrixTransform3D_Update (Address: 0x6f731458)
  • MilResource_Mesh3D_CopyFromD3DXMesh (Address: 0x6f7314bc)
  • MilResource_Mesh3D_Create (Address: 0x6f731410)
  • MilResource_MeshPrimitive3D_Create (Address: 0x6f731414)
  • MilResource_MeshPrimitive3D_Update (Address: 0x6f731418)
  • MilResource_Model3DCollection_AppendModel (Address: 0x6f73142c)
  • MilResource_Model3DCollection_ClearModelCollection (Address: 0x6f731428)
  • MilResource_Model3DCollection_Create (Address: 0x6f731420)
  • MilResource_Model3DCollection_Update (Address: 0x6f731424)
  • MilResource_Point3DAnimation_Create (Address: 0x6f7314d0)
  • MilResource_Point3DAnimationCollection_Create (Address: 0x6f7314d4)
  • MilResource_Quaternion3DAnimation_Create (Address: 0x6f731474)
  • MilResource_Quaternion3DAnimationCollection_Create (Address: 0x6f731470)
  • MilResource_Release (Address: 0x6f73141c)
  • MilResource_RenderData_Create (Address: 0x6f731434)
  • MilResource_RotateTransform3D_Create (Address: 0x6f7314a0)
  • MilResource_RotateTransform3D_Update (Address: 0x6f731408)
  • MilResource_Scene3D_Create (Address: 0x6f731430)
  • MilResource_Scene3D_Update (Address: 0x6f731478)
  • MilResource_Timeline_Create (Address: 0x6f7314ec)
  • MilResource_Transform3DCollection_AppendTransform (Address: 0x6f73140c)
  • MilResource_Transform3DCollection_Create (Address: 0x6f7314b8)
  • MilResource_TranslateTransform3D_Create (Address: 0x6f7314b4)
  • MilResource_TranslateTransform3D_Update (Address: 0x6f731404)
  • MilResourceTable_Create (Address: 0x6f731494)
  • MilResourceTable_Destroy (Address: 0x6f731454)
  • MilResourceTable_SetAutoLock (Address: 0x6f731490)
  • MilTimeline_AddInterval (Address: 0x6f7314e8)
  • MilTimeline_Enable (Address: 0x6f7314f0)
  • MilTransport_InitializeTransport (Address: 0x6f731498)
  • MilTransport_ShutDownTransport (Address: 0x6f731450)
msvcrt.dll
  • __CxxFrameHandler (Address: 0x6f731530)
  • _CIacos (Address: 0x6f731544)
  • _CIatan2 (Address: 0x6f731540)
  • _CIsin (Address: 0x6f731524)
  • _CIsqrt (Address: 0x6f731528)
  • _except_handler3 (Address: 0x6f73154c)
  • _finite (Address: 0x6f73152c)
  • _purecall (Address: 0x6f731538)
  • _vsnprintf (Address: 0x6f731550)
  • _vsnwprintf (Address: 0x6f73153c)
  • memmove (Address: 0x6f731534)
  • wcsstr (Address: 0x6f731548)
ntdll.dll
  • DbgBreakPoint (Address: 0x6f731594)
  • DbgPrintEx (Address: 0x6f731564)
  • NtAcceptConnectPort (Address: 0x6f731584)
  • NtCompleteConnectPort (Address: 0x6f731588)
  • NtConnectPort (Address: 0x6f731590)
  • NtCreatePort (Address: 0x6f731578)
  • NtMapViewOfSection (Address: 0x6f731574)
  • NtQueryInformationProcess (Address: 0x6f73159c)
  • NtQueryObject (Address: 0x6f7315a0)
  • NtQuerySection (Address: 0x6f731568)
  • NtQuerySystemInformation (Address: 0x6f73155c)
  • NtReplyPort (Address: 0x6f73156c)
  • NtReplyWaitReceivePort (Address: 0x6f731580)
  • NtRequestWaitReplyPort (Address: 0x6f73157c)
  • NtResumeProcess (Address: 0x6f7315a4)
  • NtSuspendProcess (Address: 0x6f731598)
  • NtUnmapViewOfSection (Address: 0x6f731570)
  • RtlInitUnicodeString (Address: 0x6f73158c)
  • RtlNtStatusToDosError (Address: 0x6f731558)
  • RtlUnhandledExceptionFilter (Address: 0x6f731560)
USER32.dll
  • BeginDeferWindowPos (Address: 0x6f7312a0)
  • BeginPaint (Address: 0x6f7312d0)
  • CloseDesktop (Address: 0x6f731338)
  • CopyRect (Address: 0x6f7312c8)
  • CreateWindowExW (Address: 0x6f731330)
  • DeferWindowPos (Address: 0x6f7312a8)
  • DefWindowProcW (Address: 0x6f731318)
  • DestroyWindow (Address: 0x6f73130c)
  • DispatchMessageW (Address: 0x6f731324)
  • DrawTextExW (Address: 0x6f73138c)
  • DwmGetSurfaceData (Address: 0x6f731280)
  • DwmRegisterPort (Address: 0x6f7312ec)
  • DwmShutdown (Address: 0x6f73137c)
  • DwmStartup (Address: 0x6f731384)
  • DwmUnregisterPort (Address: 0x6f7312f4)
  • EnableWindow (Address: 0x6f7312dc)
  • EndDeferWindowPos (Address: 0x6f7312ac)
  • EndPaint (Address: 0x6f7312d8)
  • EnumDesktopsW (Address: 0x6f73136c)
  • EnumDesktopWindows (Address: 0x6f731364)
  • GetAsyncKeyState (Address: 0x6f731294)
  • GetClassNameW (Address: 0x6f73127c)
  • GetDC (Address: 0x6f731260)
  • GetForegroundWindow (Address: 0x6f7312b4)
  • GetKeyState (Address: 0x6f731290)
  • GetMessageW (Address: 0x6f73132c)
  • GetProcessWindowStation (Address: 0x6f731370)
  • GetShellWindow (Address: 0x6f731380)
  • GetSystemMetrics (Address: 0x6f731374)
  • GetThreadDesktop (Address: 0x6f731344)
  • GetUserObjectInformationW (Address: 0x6f731278)
  • GetWindowInfo (Address: 0x6f7312b8)
  • GetWindowLongW (Address: 0x6f73131c)
  • GetWindowPlacement (Address: 0x6f731288)
  • GetWindowRect (Address: 0x6f7312a4)
  • GetWindowThreadProcessId (Address: 0x6f731360)
  • InflateRect (Address: 0x6f731274)
  • InternalGetWindowText (Address: 0x6f73126c)
  • IntersectRect (Address: 0x6f7312c4)
  • InvalidateRect (Address: 0x6f7312bc)
  • IsRectEmpty (Address: 0x6f7312cc)
  • IsWindow (Address: 0x6f731348)
  • KillTimer (Address: 0x6f7312b0)
  • MsgWaitForMultipleObjectsEx (Address: 0x6f7312e0)
  • OffsetRect (Address: 0x6f7312e4)
  • OpenDesktopW (Address: 0x6f731368)
  • OpenInputDesktop (Address: 0x6f73133c)
  • PaintDesktop (Address: 0x6f7312d4)
  • PeekMessageW (Address: 0x6f731350)
  • PostMessageW (Address: 0x6f7312fc)
  • PostQuitMessage (Address: 0x6f731304)
  • PtInRect (Address: 0x6f73129c)
  • RegisterClassExW (Address: 0x6f731334)
  • RegisterDwmProcess (Address: 0x6f7312f0)
  • RegisterHotKey (Address: 0x6f731310)
  • RegisterUserApiHook (Address: 0x6f73135c)
  • ReleaseDC (Address: 0x6f731264)
  • SendInput (Address: 0x6f731298)
  • SendMessageW (Address: 0x6f731300)
  • SetRect (Address: 0x6f7312c0)
  • SetRectEmpty (Address: 0x6f731270)
  • SetThreadDesktop (Address: 0x6f731340)
  • SetTimer (Address: 0x6f731284)
  • SetWindowLongW (Address: 0x6f731308)
  • SetWindowPlacement (Address: 0x6f73128c)
  • SetWindowPos (Address: 0x6f731388)
  • SetWindowRgnEx (Address: 0x6f731268)
  • SwitchToThisWindow (Address: 0x6f7312e8)
  • SystemParametersInfoW (Address: 0x6f731378)
  • ThemeGetCurrentSection (Address: 0x6f731354)
  • ThemeSetCurrentSection (Address: 0x6f73134c)
  • TranslateMessage (Address: 0x6f731328)
  • UnregisterClassW (Address: 0x6f731320)
  • UnregisterDwmProcess (Address: 0x6f7312f8)
  • UnregisterHotKey (Address: 0x6f731314)
  • UnregisterUserApiHook (Address: 0x6f731358)
USERENV.dll
  • CreateEnvironmentBlock (Address: 0x6f731398)
  • DestroyEnvironmentBlock (Address: 0x6f731394)
uxdesk.dll
  • (Address: 0x6f7315ac)
  • (Address: 0x6f7315b0)
  • (Address: 0x6f7315b4)
  • (Address: 0x6f7315b8)
  • (Address: 0x6f7315bc)
  • (Address: 0x6f7315c0)
  • (Address: 0x6f7315c4)
  • (Address: 0x6f7315c8)
  • (Address: 0x6f7315cc)
  • (Address: 0x6f7315d0)
  • (Address: 0x6f7315d4)
UxTheme.dll
  • (Address: 0x6f7313a0)
  • (Address: 0x6f7313a4)
  • (Address: 0x6f7313a8)
  • (Address: 0x6f7313ac)
  • (Address: 0x6f7313b0)
  • (Address: 0x6f7313b8)
  • (Address: 0x6f7313bc)
  • (Address: 0x6f7313c0)
  • (Address: 0x6f7313c4)
  • (Address: 0x6f7313c8)
  • (Address: 0x6f7313cc)
  • (Address: 0x6f7313dc)
  • (Address: 0x6f7313e0)
  • (Address: 0x6f7313e4)
  • CloseThemeData (Address: 0x6f7313d8)
  • GetThemeBool (Address: 0x6f7313d4)
  • GetThemeStream (Address: 0x6f7313b4)
  • OpenThemeData (Address: 0x6f7313d0)
WindowsCodecs.dll
  • MILCreateCodecFactory (Address: 0x6f7313f4)
WTSAPI32.dll
  • WTSQueryUserToken (Address: 0x6f7313ec)