ustprov.dll

Description: User State WMI Provider

Version: 10.0.19041.1

Architecture: 32-bit

Operating System: Windows NT

SHA256: 9c31804694ca182d13c458eb13a71423

File Size: 39.0 KB

Uploaded At: Dec. 1, 2025, 8:05 a.m.

Views: 21

Security Warning

This file has been flagged as potentially dangerous.

Reason: Detected potentially dangerous functions used for process injection: OpenProcess

Exported Functions

DllCanUnloadNow (Ordinal: 1, Address: 0x1eb0)
DllGetClassObject (Ordinal: 2, Address: 0x1e70)
DllRegisterServer (Ordinal: 3, Address: 0x21c0)
DllUnregisterServer (Ordinal: 4, Address: 0x21d0)

Imported DLLs & Functions

api-ms-win-core-com-l1-1-0.dll

CoCreateInstance (Address: 0x1000a078)
CoGetCallContext (Address: 0x1000a074)
CoRevertToSelf (Address: 0x1000a06c)
CoTaskMemFree (Address: 0x1000a070)
StringFromCLSID (Address: 0x1000a07c)

api-ms-win-core-errorhandling-l1-1-0.dll

GetLastError (Address: 0x1000a088)
SetLastError (Address: 0x1000a08c)
SetUnhandledExceptionFilter (Address: 0x1000a084)
UnhandledExceptionFilter (Address: 0x1000a090)

api-ms-win-core-handle-l1-1-0.dll

CloseHandle (Address: 0x1000a09c)
DuplicateHandle (Address: 0x1000a098)

api-ms-win-core-heap-l1-1-0.dll

GetProcessHeap (Address: 0x1000a0ac)
HeapAlloc (Address: 0x1000a0a8)
HeapFree (Address: 0x1000a0a4)

api-ms-win-core-heap-l2-1-0.dll

LocalFree (Address: 0x1000a0b4)

api-ms-win-core-libraryloader-l1-2-0.dll

DisableThreadLibraryCalls (Address: 0x1000a0c0)
GetModuleFileNameW (Address: 0x1000a0bc)

api-ms-win-core-processthreads-l1-1-0.dll

GetCurrentProcess (Address: 0x1000a0e0)
GetCurrentProcessId (Address: 0x1000a0d4)
GetCurrentThread (Address: 0x1000a0d0)
GetCurrentThreadId (Address: 0x1000a0c8)
OpenThreadToken (Address: 0x1000a0dc)
SetThreadToken (Address: 0x1000a0d8)
TerminateProcess (Address: 0x1000a0cc)

api-ms-win-core-processthreads-l1-1-1.dll

OpenProcess (Address: 0x1000a0e8)

api-ms-win-core-profile-l1-1-0.dll

QueryPerformanceCounter (Address: 0x1000a0f0)

api-ms-win-core-registry-l1-1-0.dll

RegCloseKey (Address: 0x1000a114)
RegCreateKeyExW (Address: 0x1000a0f8)
RegDeleteKeyExW (Address: 0x1000a104)
RegDeleteValueW (Address: 0x1000a0fc)
RegEnumValueW (Address: 0x1000a110)
RegOpenCurrentUser (Address: 0x1000a118)
RegOpenKeyExW (Address: 0x1000a10c)
RegQueryValueExW (Address: 0x1000a100)
RegSetValueExW (Address: 0x1000a108)

api-ms-win-core-string-l1-1-0.dll

CompareStringOrdinal (Address: 0x1000a120)

api-ms-win-core-synch-l1-2-0.dll

Sleep (Address: 0x1000a128)

api-ms-win-core-sysinfo-l1-1-0.dll

GetSystemTimeAsFileTime (Address: 0x1000a130)
GetTickCount (Address: 0x1000a134)

api-ms-win-security-base-l1-1-0.dll

GetTokenInformation (Address: 0x1000a144)
ImpersonateLoggedOnUser (Address: 0x1000a148)
IsValidSid (Address: 0x1000a140)
RevertToSelf (Address: 0x1000a13c)

api-ms-win-security-sddl-l1-1-0.dll

ConvertStringSidToSidW (Address: 0x1000a150)

msvcrt.dll

__CxxFrameHandler3 (Address: 0x1000a174)
__dllonexit (Address: 0x1000a15c)
_amsg_exit (Address: 0x1000a16c)
_callnewh (Address: 0x1000a180)
_CxxThrowException (Address: 0x1000a164)
_except_handler4_common (Address: 0x1000a188)
_initterm (Address: 0x1000a178)
_lock (Address: 0x1000a17c)
_onexit (Address: 0x1000a160)
_purecall (Address: 0x1000a194)
_unlock (Address: 0x1000a198)
_vsnwprintf (Address: 0x1000a184)
_XcptFilter (Address: 0x1000a18c)
??1type_info@@UAE@XZ (Address: 0x1000a168)
?terminate@@YAXXZ (Address: 0x1000a190)
free (Address: 0x1000a158)
malloc (Address: 0x1000a170)
memset (Address: 0x1000a19c)

ntdll.dll

EtwGetTraceEnableFlags (Address: 0x1000a1a8)
EtwGetTraceEnableLevel (Address: 0x1000a1ac)
EtwGetTraceLoggerHandle (Address: 0x1000a1b0)
EtwRegisterTraceGuidsW (Address: 0x1000a1b8)
EtwTraceMessage (Address: 0x1000a1b4)
EtwUnregisterTraceGuids (Address: 0x1000a1a4)

OLEAUT32.dll

SafeArrayCopy (Address: 0x1000a050)
SafeArrayCreate (Address: 0x1000a01c)
SafeArrayCreateVector (Address: 0x1000a034)
SafeArrayDestroy (Address: 0x1000a03c)
SafeArrayGetElement (Address: 0x1000a028)
SafeArrayGetLBound (Address: 0x1000a048)
SafeArrayGetUBound (Address: 0x1000a040)
SafeArrayGetVartype (Address: 0x1000a054)
SafeArrayLock (Address: 0x1000a024)
SafeArrayPutElement (Address: 0x1000a030)
SafeArrayRedim (Address: 0x1000a038)
SafeArrayUnlock (Address: 0x1000a044)
SysAllocString (Address: 0x1000a004)
SysAllocStringLen (Address: 0x1000a018)
SysFreeString (Address: 0x1000a008)
SysStringByteLen (Address: 0x1000a014)
SysStringLen (Address: 0x1000a020)
VariantChangeType (Address: 0x1000a010)
VariantClear (Address: 0x1000a000)
VariantCopy (Address: 0x1000a02c)
VariantCopyInd (Address: 0x1000a04c)
VariantInit (Address: 0x1000a00c)

SHLWAPI.dll

SHDeleteKeyW (Address: 0x1000a05c)

WTSAPI32.dll

WTSQueryUserToken (Address: 0x1000a064)