ProtectionManagement.dll

Description: Protection Management WMIv2 Provider

Version: 4.18.1909.6

Architecture: 64-bit

Operating System: Windows NT

SHA256: 049f84d124f419f11f47a2e24dba15f2

File Size: 678.9 KB

Uploaded At: Dec. 1, 2025, 8:30 a.m.

Views: 21

Security Warning

This file has been flagged as potentially dangerous.

Reason: Detected potentially dangerous functions used for process injection: OpenProcess

Exported Functions

DllCanUnloadNow (Ordinal: 1, Address: 0x1920)
DllGetClassObject (Ordinal: 2, Address: 0x1950)
DllMain (Ordinal: 3, Address: 0x15b0)
DllRegisterServer (Ordinal: 4, Address: 0x1880)
DllUnregisterServer (Ordinal: 5, Address: 0x18d0)
GetProviderClassID (Ordinal: 6, Address: 0x16d0)
MI_Main (Ordinal: 7, Address: 0x1a30)

Imported DLLs & Functions

ADVAPI32.dll

AdjustTokenPrivileges (Address: 0x1800735a8)
AllocateAndInitializeSid (Address: 0x1800735f8)
ChangeServiceConfigW (Address: 0x1800735d0)
CheckTokenMembership (Address: 0x1800735f0)
CloseServiceHandle (Address: 0x180073598)
ControlService (Address: 0x1800735c8)
ConvertStringSecurityDescriptorToSecurityDescriptorW (Address: 0x180073638)
CreateProcessAsUserW (Address: 0x180073590)
DeregisterEventSource (Address: 0x180073670)
DuplicateTokenEx (Address: 0x180073608)
FreeSid (Address: 0x1800735e8)
GetSidSubAuthority (Address: 0x180073600)
GetSidSubAuthorityCount (Address: 0x180073610)
GetTokenInformation (Address: 0x180073618)
GetTraceEnableFlags (Address: 0x180073690)
GetTraceEnableLevel (Address: 0x180073698)
GetTraceLoggerHandle (Address: 0x180073688)
InitiateSystemShutdownExW (Address: 0x1800735a0)
LookupPrivilegeNameW (Address: 0x1800736b0)
LookupPrivilegeValueW (Address: 0x1800735b8)
OpenProcessToken (Address: 0x180073620)
OpenSCManagerW (Address: 0x1800735e0)
OpenServiceW (Address: 0x1800735d8)
PrivilegeCheck (Address: 0x1800735b0)
QueryServiceStatus (Address: 0x1800735c0)
RegCloseKey (Address: 0x180073650)
RegCreateKeyExW (Address: 0x180073660)
RegDeleteKeyW (Address: 0x180073648)
RegDeleteValueW (Address: 0x180073640)
RegisterEventSourceW (Address: 0x180073668)
RegisterTraceGuidsW (Address: 0x1800736a0)
RegOpenKeyExW (Address: 0x180073630)
RegQueryValueExW (Address: 0x180073628)
RegSetValueExW (Address: 0x180073658)
ReportEventW (Address: 0x180073678)
TraceMessage (Address: 0x180073680)
UnregisterTraceGuids (Address: 0x1800736a8)

CRYPT32.dll

CertVerifyCertificateChainPolicy (Address: 0x1800736c0)

KERNEL32.dll

CloseHandle (Address: 0x1800738b8)
CompareFileTime (Address: 0x180073978)
CopyFileW (Address: 0x180073ad8)
CreateDirectoryW (Address: 0x180073af0)
CreateEventW (Address: 0x180073988)
CreateFileW (Address: 0x1800737b8)
CreateMutexW (Address: 0x180073ac8)
CreateProcessW (Address: 0x180073ad0)
CreateThread (Address: 0x180073a10)
CreateToolhelp32Snapshot (Address: 0x180073a88)
DeleteCriticalSection (Address: 0x180073860)
DeleteFileW (Address: 0x180073a40)
EncodePointer (Address: 0x1800737f8)
EnterCriticalSection (Address: 0x1800738c8)
ExitProcess (Address: 0x180073778)
ExitThread (Address: 0x180073958)
FileTimeToSystemTime (Address: 0x180073998)
FindClose (Address: 0x180073a50)
FindFirstFileExW (Address: 0x180073948)
FindFirstFileW (Address: 0x180073a60)
FindNextFileW (Address: 0x180073a58)
FindResourceExW (Address: 0x1800738d0)
FindResourceW (Address: 0x180073a70)
FlushFileBuffers (Address: 0x1800737a0)
FormatMessageW (Address: 0x180073af8)
FreeEnvironmentStringsW (Address: 0x180073928)
FreeLibrary (Address: 0x1800738f8)
FreeLibraryAndExitThread (Address: 0x180073950)
FreeResource (Address: 0x180073a68)
GetACP (Address: 0x180073748)
GetCommandLineA (Address: 0x180073940)
GetCommandLineW (Address: 0x180073938)
GetConsoleCP (Address: 0x180073790)
GetConsoleMode (Address: 0x180073798)
GetCPInfo (Address: 0x180073738)
GetCurrentProcess (Address: 0x180073808)
GetCurrentProcessId (Address: 0x1800737d0)
GetCurrentThreadId (Address: 0x1800736d8)
GetDiskFreeSpaceExW (Address: 0x180073a98)
GetDriveTypeW (Address: 0x1800739a8)
GetEnvironmentStringsW (Address: 0x180073930)
GetExitCodeProcess (Address: 0x180073980)
GetExitCodeThread (Address: 0x180073a00)
GetFileAttributesExW (Address: 0x180073960)
GetFileAttributesW (Address: 0x180073b08)
GetFileSize (Address: 0x180073a28)
GetFileSizeEx (Address: 0x180073758)
GetFileType (Address: 0x1800736e8)
GetLastError (Address: 0x180073908)
GetLocaleInfoW (Address: 0x180073730)
GetLocalTime (Address: 0x1800739b8)
GetLongPathNameW (Address: 0x180073a20)
GetModuleFileNameW (Address: 0x1800737a8)
GetModuleHandleExW (Address: 0x180073780)
GetModuleHandleW (Address: 0x180073830)
GetNativeSystemInfo (Address: 0x1800739c8)
GetOEMCP (Address: 0x180073750)
GetPrivateProfileIntW (Address: 0x1800739f0)
GetPrivateProfileStringW (Address: 0x1800739f8)
GetProcAddress (Address: 0x180073900)
GetProcessHeap (Address: 0x180073878)
GetStartupInfoW (Address: 0x1800736f0)
GetStdHandle (Address: 0x1800736e0)
GetStringTypeW (Address: 0x180073910)
GetSystemDefaultUILanguage (Address: 0x1800739e0)
GetSystemDirectoryW (Address: 0x180073918)
GetSystemTime (Address: 0x1800738a8)
GetSystemTimeAsFileTime (Address: 0x180073720)
GetTempFileNameW (Address: 0x180073ae0)
GetTempPathW (Address: 0x180073ae8)
GetTickCount (Address: 0x180073968)
GetTimeZoneInformation (Address: 0x1800738b0)
GetUserDefaultUILanguage (Address: 0x1800739d8)
GetVersionExW (Address: 0x1800739b0)
GetWindowsDirectoryW (Address: 0x180073aa0)
GlobalFindAtomW (Address: 0x1800739a0)
HeapAlloc (Address: 0x180073880)
HeapDestroy (Address: 0x180073870)
HeapFree (Address: 0x180073888)
HeapReAlloc (Address: 0x180073890)
HeapSize (Address: 0x180073898)
InitializeCriticalSection (Address: 0x180073868)
InitializeCriticalSectionAndSpinCount (Address: 0x1800736f8)
InitializeSListHead (Address: 0x1800737d8)
InterlockedFlushSList (Address: 0x1800737e8)
IsDebuggerPresent (Address: 0x180073820)
IsProcessorFeaturePresent (Address: 0x180073768)
IsValidCodePage (Address: 0x180073740)
IsWow64Process (Address: 0x180073ab8)
K32GetModuleFileNameExW (Address: 0x180073a38)
LCMapStringW (Address: 0x180073728)
LeaveCriticalSection (Address: 0x1800738c0)
LoadLibraryExW (Address: 0x1800738f0)
LoadResource (Address: 0x1800738d8)
LocalFree (Address: 0x180073ab0)
LockResource (Address: 0x1800738e0)
MoveFileW (Address: 0x180073a18)
MultiByteToWideChar (Address: 0x180073850)
OpenProcess (Address: 0x180073a90)
Process32FirstW (Address: 0x180073a80)
Process32NextW (Address: 0x180073a78)
ProcessIdToSessionId (Address: 0x1800739d0)
QueryPerformanceCounter (Address: 0x1800737c8)
RaiseException (Address: 0x180073858)
ReadFile (Address: 0x1800737b0)
ReleaseMutex (Address: 0x180073ac0)
RemoveDirectoryW (Address: 0x180073a48)
ResetEvent (Address: 0x180073a08)
RtlCaptureContext (Address: 0x180073840)
RtlLookupFunctionEntry (Address: 0x180073838)
RtlPcToFileHeader (Address: 0x1800737f0)
RtlUnwindEx (Address: 0x1800737e0)
RtlVirtualUnwind (Address: 0x180073828)
SetEvent (Address: 0x180073990)
SetFileAttributesW (Address: 0x180073b00)
SetFilePointerEx (Address: 0x180073760)
SetLastError (Address: 0x1800736d0)
SetStdHandle (Address: 0x180073770)
SetUnhandledExceptionFilter (Address: 0x180073810)
SizeofResource (Address: 0x1800738e8)
Sleep (Address: 0x180073aa8)
SwitchToThread (Address: 0x180073970)
SystemTimeToFileTime (Address: 0x1800739c0)
TerminateProcess (Address: 0x180073800)
TlsAlloc (Address: 0x180073700)
TlsFree (Address: 0x180073718)
TlsGetValue (Address: 0x180073708)
TlsSetValue (Address: 0x180073710)
TryEnterCriticalSection (Address: 0x180073b10)
UnhandledExceptionFilter (Address: 0x180073818)
VerifyVersionInfoW (Address: 0x180073a30)
WaitForSingleObject (Address: 0x1800738a0)
WaitForSingleObjectEx (Address: 0x180073920)
WideCharToMultiByte (Address: 0x180073848)
WriteConsoleW (Address: 0x1800737c0)
WriteFile (Address: 0x180073788)
WritePrivateProfileStringW (Address: 0x1800739e8)

mpclient.dll

MpAllocMemory (Address: 0x180073e38)
MpCleanOpen (Address: 0x180073e30)
MpCleanStart (Address: 0x180073de0)
MpClientUtilExportFunctions (Address: 0x180073e40)
MpConfigClose (Address: 0x180073d70)
MpConfigGetValue (Address: 0x180073d60)
MpConfigGetValueAlloc (Address: 0x180073d68)
MpConfigInitialize (Address: 0x180073e50)
MpConfigIteratorClose (Address: 0x180073d78)
MpConfigIteratorEnum (Address: 0x180073e60)
MpConfigIteratorOpen (Address: 0x180073d98)
MpConfigOpen (Address: 0x180073d90)
MpConfigRegisterForNotifications (Address: 0x180073d88)
MpConfigUninitialize (Address: 0x180073e48)
MpConfigUnregisterNotifications (Address: 0x180073d80)
MpCreateComInstance (Address: 0x180073db8)
MpDetectionEnumerate (Address: 0x180073d58)
MpElevateCleanHandle (Address: 0x180073e10)
MpElevationHandleAcquire (Address: 0x180073e18)
MpFreeMemory (Address: 0x180073e58)
MpGetCallistoDetections (Address: 0x180073da0)
MpGetTPStateInfo (Address: 0x180073db0)
MpHandleClose (Address: 0x180073e08)
MpManagerOpen (Address: 0x180073e00)
MpManagerStatusQueryEx (Address: 0x180073df0)
MpManagerVersionQuery (Address: 0x180073da8)
MpNotificationRegister (Address: 0x180073df8)
MpOfflineScanInstall (Address: 0x180073dd0)
MpScanStartEx (Address: 0x180073dc0)
MpThreatEnumerate (Address: 0x180073de8)
MpThreatOpen (Address: 0x180073d48)
MpThreatQuery (Address: 0x180073e20)
MpThreatRollup (Address: 0x180073d50)
MpTriggerHeartbeatOnUninstall (Address: 0x180073dd8)
MpUpdateStartEx (Address: 0x180073dc8)
MpUtilsExportFunctions (Address: 0x180073e28)

ole32.dll

CoCreateGuid (Address: 0x180073e80)
CoCreateInstance (Address: 0x180073e70)
StringFromGUID2 (Address: 0x180073e78)

OLEAUT32.dll

SafeArrayCreate (Address: 0x180073b48)
SysAllocString (Address: 0x180073b20)
SysAllocStringByteLen (Address: 0x180073b58)
SysAllocStringLen (Address: 0x180073b40)
SysFreeString (Address: 0x180073b50)
SysStringByteLen (Address: 0x180073b60)
SysStringLen (Address: 0x180073b68)
VarBstrCat (Address: 0x180073b38)
VariantClear (Address: 0x180073b30)
VariantInit (Address: 0x180073b28)

SHELL32.dll

SHGetFolderPathW (Address: 0x180073b80)
SHGetPathFromIDListW (Address: 0x180073b78)
SHGetSpecialFolderLocation (Address: 0x180073b88)

SHLWAPI.dll

PathAppendW (Address: 0x180073bc8)
PathCombineW (Address: 0x180073bc0)
PathFileExistsW (Address: 0x180073bb8)
PathFindFileNameW (Address: 0x180073b98)
PathIsDirectoryW (Address: 0x180073bb0)
PathIsRelativeW (Address: 0x180073ba0)
PathMatchSpecW (Address: 0x180073bd0)
PathRemoveFileSpecW (Address: 0x180073ba8)

USER32.dll

AdjustWindowRectEx (Address: 0x180073c70)
CreateDialogParamW (Address: 0x180073bf0)
DestroyIcon (Address: 0x180073be8)
DestroyWindow (Address: 0x180073c00)
FindWindowW (Address: 0x180073c30)
GetLastActivePopup (Address: 0x180073c80)
GetSystemMetrics (Address: 0x180073c28)
GetWindowThreadProcessId (Address: 0x180073c38)
IsDialogMessageW (Address: 0x180073c60)
KillTimer (Address: 0x180073c58)
LoadIconW (Address: 0x180073bf8)
LoadImageW (Address: 0x180073be0)
LoadStringW (Address: 0x180073c18)
MessageBoxW (Address: 0x180073c40)
PostMessageW (Address: 0x180073c20)
PostThreadMessageW (Address: 0x180073c68)
SendMessageW (Address: 0x180073c08)
SetForegroundWindow (Address: 0x180073c48)
SetTimer (Address: 0x180073c50)
SetWindowTextW (Address: 0x180073c78)
ShowWindow (Address: 0x180073c10)
UnregisterClassA (Address: 0x180073c88)

USERENV.dll

CreateEnvironmentBlock (Address: 0x180073ca0)
DestroyEnvironmentBlock (Address: 0x180073c98)

VERSION.dll

GetFileVersionInfoSizeW (Address: 0x180073cb0)
GetFileVersionInfoW (Address: 0x180073cb8)
VerQueryValueW (Address: 0x180073cc0)

WINTRUST.dll

CryptCATAdminAcquireContext (Address: 0x180073cf8)
CryptCATAdminCalcHashFromFileHandle (Address: 0x180073cf0)
CryptCATAdminEnumCatalogFromHash (Address: 0x180073cd8)
CryptCATAdminReleaseCatalogContext (Address: 0x180073d08)
CryptCATAdminReleaseContext (Address: 0x180073d10)
CryptCATCatalogInfoFromContext (Address: 0x180073ce8)
WinVerifyTrust (Address: 0x180073ce0)
WTHelperGetProvSignerFromChain (Address: 0x180073cd0)
WTHelperProvDataFromStateData (Address: 0x180073d00)

WTSAPI32.dll

WTSEnumerateSessionsW (Address: 0x180073d28)
WTSFreeMemory (Address: 0x180073d30)
WTSQuerySessionInformationW (Address: 0x180073d20)
WTSQueryUserToken (Address: 0x180073d38)