MpProvider.dll

Description: Microsoft Security Client Antimalware Provider

Version: 4.18.1907.16384

Architecture: 64-bit

Operating System: Windows NT

SHA256: b3ed873d535abbe0995a36541a33147d

File Size: 189.0 KB

Uploaded At: Dec. 1, 2025, 8:30 a.m.

Views: 22

Security Warning

This file has been flagged as potentially dangerous.

Reason: Detected potentially dangerous functions used for process injection: OpenProcess

Exported Functions

DllCanUnloadNow (Ordinal: 1, Address: 0x17d0)
DllGetClassObject (Ordinal: 2, Address: 0x1870)
DllRegisterServer (Ordinal: 3, Address: 0x1a00)
DllUnregisterServer (Ordinal: 4, Address: 0x1b50)

Imported DLLs & Functions

ADVAPI32.dll

AdjustTokenPrivileges (Address: 0x18001e880)
AllocateAndInitializeSid (Address: 0x18001e930)
ChangeServiceConfigW (Address: 0x18001e8a8)
CheckTokenMembership (Address: 0x18001e928)
CloseServiceHandle (Address: 0x18001e860)
ControlService (Address: 0x18001e8a0)
ControlTraceW (Address: 0x18001e828)
ConvertStringSecurityDescriptorToSecurityDescriptorW (Address: 0x18001e950)
CreateProcessAsUserW (Address: 0x18001e868)
DeregisterEventSource (Address: 0x18001e810)
DuplicateTokenEx (Address: 0x18001e940)
EnableTrace (Address: 0x18001e820)
FreeSid (Address: 0x18001e858)
GetSidSubAuthority (Address: 0x18001e938)
GetSidSubAuthorityCount (Address: 0x18001e948)
GetTokenInformation (Address: 0x18001e848)
GetTraceEnableFlags (Address: 0x18001e900)
GetTraceEnableLevel (Address: 0x18001e908)
GetTraceLoggerHandle (Address: 0x18001e910)
GetUserNameW (Address: 0x18001e840)
InitiateSystemShutdownExW (Address: 0x18001e878)
LookupPrivilegeNameW (Address: 0x18001e870)
LookupPrivilegeValueW (Address: 0x18001e890)
OpenProcessToken (Address: 0x18001e800)
OpenSCManagerW (Address: 0x18001e920)
OpenServiceW (Address: 0x18001e8b0)
OpenThreadToken (Address: 0x18001e850)
PrivilegeCheck (Address: 0x18001e888)
QueryServiceStatus (Address: 0x18001e898)
RegCloseKey (Address: 0x18001e8e8)
RegCreateKeyExW (Address: 0x18001e8c0)
RegDeleteKeyW (Address: 0x18001e830)
RegDeleteValueW (Address: 0x18001e8b8)
RegEnumKeyExW (Address: 0x18001e8d0)
RegisterEventSourceW (Address: 0x18001e818)
RegisterTraceGuidsW (Address: 0x18001e8f8)
RegOpenKeyExW (Address: 0x18001e8d8)
RegQueryInfoKeyW (Address: 0x18001e8e0)
RegQueryValueExW (Address: 0x18001e838)
RegSetValueExW (Address: 0x18001e8c8)
ReportEventW (Address: 0x18001e808)
TraceMessage (Address: 0x18001e918)
UnregisterTraceGuids (Address: 0x18001e8f0)

CRYPT32.dll

CertVerifyCertificateChainPolicy (Address: 0x18001e960)

KERNEL32.dll

AcquireSRWLockExclusive (Address: 0x18001eb90)
CloseHandle (Address: 0x18001ea50)
CompareStringW (Address: 0x18001ea08)
CopyFileW (Address: 0x18001ebf0)
CreateDirectoryW (Address: 0x18001ea80)
CreateEventW (Address: 0x18001eaf8)
CreateFileW (Address: 0x18001ead8)
CreateMutexW (Address: 0x18001ec00)
CreateProcessW (Address: 0x18001eb28)
CreateThread (Address: 0x18001ec78)
CreateToolhelp32Snapshot (Address: 0x18001ec28)
DecodePointer (Address: 0x18001ea38)
DeleteCriticalSection (Address: 0x18001ebd0)
DeleteFileW (Address: 0x18001eb08)
DisableThreadLibraryCalls (Address: 0x18001eb40)
EncodePointer (Address: 0x18001ea40)
EnterCriticalSection (Address: 0x18001ea18)
ExpandEnvironmentStringsW (Address: 0x18001eab0)
FileTimeToSystemTime (Address: 0x18001ea60)
FindClose (Address: 0x18001eac8)
FindFirstFileW (Address: 0x18001ea90)
FindNextFileW (Address: 0x18001eaa0)
FindResourceExW (Address: 0x18001e9d8)
FindResourceW (Address: 0x18001ec40)
FreeLibrary (Address: 0x18001ea00)
FreeResource (Address: 0x18001ec48)
GetCurrentProcess (Address: 0x18001e990)
GetCurrentProcessId (Address: 0x18001e978)
GetCurrentThread (Address: 0x18001ea48)
GetCurrentThreadId (Address: 0x18001e970)
GetDiskFreeSpaceExW (Address: 0x18001ec20)
GetDriveTypeW (Address: 0x18001ecc0)
GetExitCodeProcess (Address: 0x18001eb30)
GetExitCodeThread (Address: 0x18001ec80)
GetFileAttributesW (Address: 0x18001eae0)
GetFileSize (Address: 0x18001ec60)
GetFileSizeEx (Address: 0x18001ea98)
GetLastError (Address: 0x18001ebb0)
GetLocaleInfoW (Address: 0x18001ebf8)
GetLocalTime (Address: 0x18001eb50)
GetLongPathNameW (Address: 0x18001ec68)
GetModuleFileNameW (Address: 0x18001eba8)
GetModuleHandleW (Address: 0x18001ea20)
GetNativeSystemInfo (Address: 0x18001eb10)
GetPrivateProfileIntW (Address: 0x18001ec90)
GetPrivateProfileStringW (Address: 0x18001ec88)
GetProcAddress (Address: 0x18001ea30)
GetProcessHeap (Address: 0x18001eb78)
GetSystemDefaultUILanguage (Address: 0x18001eca0)
GetSystemDirectoryW (Address: 0x18001eae8)
GetSystemTimeAsFileTime (Address: 0x18001e9b0)
GetTempFileNameW (Address: 0x18001ebe8)
GetTempPathW (Address: 0x18001eac0)
GetThreadLocale (Address: 0x18001ebc0)
GetTickCount (Address: 0x18001e9c8)
GetUserDefaultUILanguage (Address: 0x18001eca8)
GetVersionExW (Address: 0x18001ecb8)
GetWindowsDirectoryW (Address: 0x18001ec18)
GlobalFindAtomW (Address: 0x18001ecc8)
HeapAlloc (Address: 0x18001eb70)
HeapDestroy (Address: 0x18001eb80)
HeapFree (Address: 0x18001eb68)
HeapReAlloc (Address: 0x18001eb60)
HeapSize (Address: 0x18001eb58)
InitializeCriticalSection (Address: 0x18001e9c0)
InitializeCriticalSectionAndSpinCount (Address: 0x18001eb38)
IsWow64Process (Address: 0x18001ec10)
K32GetModuleFileNameExW (Address: 0x18001ec50)
LeaveCriticalSection (Address: 0x18001ea10)
LoadLibraryExW (Address: 0x18001ea28)
LoadResource (Address: 0x18001e9e0)
LocalFree (Address: 0x18001eb20)
LockResource (Address: 0x18001ea70)
lstrcmpiW (Address: 0x18001e9f8)
MoveFileW (Address: 0x18001ec70)
MultiByteToWideChar (Address: 0x18001e9f0)
OpenProcess (Address: 0x18001eaf0)
OutputDebugStringA (Address: 0x18001ebe0)
Process32FirstW (Address: 0x18001ec30)
Process32NextW (Address: 0x18001ec38)
ProcessIdToSessionId (Address: 0x18001ecb0)
QueryPerformanceCounter (Address: 0x18001e980)
RaiseException (Address: 0x18001ebc8)
ReadFile (Address: 0x18001ea88)
ReleaseMutex (Address: 0x18001ec08)
ReleaseSRWLockExclusive (Address: 0x18001eb88)
RemoveDirectoryW (Address: 0x18001eab8)
ResetEvent (Address: 0x18001eb18)
RtlCaptureContext (Address: 0x18001e9b8)
RtlLookupFunctionEntry (Address: 0x18001e9d0)
RtlVirtualUnwind (Address: 0x18001e9a8)
SetEvent (Address: 0x18001eb00)
SetLastError (Address: 0x18001ea78)
SetThreadLocale (Address: 0x18001ebb8)
SetUnhandledExceptionFilter (Address: 0x18001e998)
SizeofResource (Address: 0x18001e9e8)
Sleep (Address: 0x18001ebd8)
SleepConditionVariableSRW (Address: 0x18001eba0)
SwitchToThread (Address: 0x18001ea68)
SystemTimeToFileTime (Address: 0x18001ea58)
TerminateProcess (Address: 0x18001e988)
UnhandledExceptionFilter (Address: 0x18001e9a0)
VerifyVersionInfoW (Address: 0x18001ec58)
VirtualLock (Address: 0x18001eb48)
WaitForSingleObject (Address: 0x18001ead0)
WakeAllConditionVariable (Address: 0x18001eb98)
WriteFile (Address: 0x18001eaa8)
WritePrivateProfileStringW (Address: 0x18001ec98)

msvcrt.dll

__C_specific_handler (Address: 0x18001f000)
__CxxFrameHandler3 (Address: 0x18001ef20)
__dllonexit (Address: 0x18001ef60)
_amsg_exit (Address: 0x18001ef90)
_CxxThrowException (Address: 0x18001efc0)
_errno (Address: 0x18001ef50)
_initterm (Address: 0x18001ef88)
_lock (Address: 0x18001ef70)
_onexit (Address: 0x18001ef58)
_purecall (Address: 0x18001f008)
_unlock (Address: 0x18001ef68)
_vscwprintf (Address: 0x18001ef38)
_vsnprintf (Address: 0x18001ef28)
_vsnwprintf (Address: 0x18001f038)
_wchmod (Address: 0x18001ef30)
_XcptFilter (Address: 0x18001ef98)
??0exception@@QEAA@AEBQEBD@Z (Address: 0x18001efa0)
??0exception@@QEAA@AEBQEBDH@Z (Address: 0x18001efd8)
??0exception@@QEAA@AEBV0@@Z (Address: 0x18001efd0)
??0exception@@QEAA@XZ (Address: 0x18001efa8)
??1exception@@UEAA@XZ (Address: 0x18001efe0)
??1type_info@@UEAA@XZ (Address: 0x18001ef78)
?terminate@@YAXXZ (Address: 0x18001ef80)
?what@exception@@UEBAPEBDXZ (Address: 0x18001efe8)
free (Address: 0x18001f020)
iswalpha (Address: 0x18001f040)
malloc (Address: 0x18001eff0)
memcpy (Address: 0x18001efb8)
memcpy_s (Address: 0x18001eff8)
memmove (Address: 0x18001efb0)
memmove_s (Address: 0x18001efc8)
memset (Address: 0x18001f050)
realloc (Address: 0x18001ef48)
vswprintf_s (Address: 0x18001ef40)
wcscat_s (Address: 0x18001f018)
wcschr (Address: 0x18001f030)
wcscpy_s (Address: 0x18001f028)
wcsncpy_s (Address: 0x18001f010)
wcsrchr (Address: 0x18001f048)

ntdll.dll

RtlGetVersion (Address: 0x18001f060)
RtlNtStatusToDosError (Address: 0x18001f068)

ole32.dll

CoCreateGuid (Address: 0x18001f080)
CoCreateInstance (Address: 0x18001f0a8)
CoGetClassObject (Address: 0x18001f088)
CoImpersonateClient (Address: 0x18001f078)
CoRevertToSelf (Address: 0x18001f0b8)
CoTaskMemAlloc (Address: 0x18001f090)
CoTaskMemFree (Address: 0x18001f0a0)
CoTaskMemRealloc (Address: 0x18001f098)
StringFromGUID2 (Address: 0x18001f0b0)

OLEAUT32.dll

SafeArrayCreate (Address: 0x18001ecf8)
SafeArrayDestroy (Address: 0x18001ed18)
SafeArrayGetLBound (Address: 0x18001ed08)
SafeArrayGetUBound (Address: 0x18001ed10)
SafeArrayGetVartype (Address: 0x18001ed20)
SafeArrayLock (Address: 0x18001ece8)
SafeArrayUnlock (Address: 0x18001ed00)
SysAllocString (Address: 0x18001ed48)
SysAllocStringLen (Address: 0x18001ed50)
SysFreeString (Address: 0x18001ed40)
SysStringByteLen (Address: 0x18001ecd8)
SysStringLen (Address: 0x18001ed38)
VarBstrCat (Address: 0x18001ecf0)
VariantClear (Address: 0x18001ed30)
VariantInit (Address: 0x18001ed28)
VarUI4FromStr (Address: 0x18001ece0)

SHELL32.dll

SHGetFolderPathW (Address: 0x18001ed70)
SHGetPathFromIDListW (Address: 0x18001ed68)
SHGetSpecialFolderLocation (Address: 0x18001ed60)

SHLWAPI.dll

PathAppendW (Address: 0x18001eda0)
PathCombineW (Address: 0x18001eda8)
PathFileExistsW (Address: 0x18001ed88)
PathFindFileNameW (Address: 0x18001ed80)
PathIsDirectoryW (Address: 0x18001edb8)
PathIsRelativeW (Address: 0x18001ed90)
PathMatchSpecW (Address: 0x18001edb0)
PathRemoveFileSpecW (Address: 0x18001ed98)

USER32.dll

AdjustWindowRectEx (Address: 0x18001ee50)
CharNextW (Address: 0x18001ee00)
CreateDialogParamW (Address: 0x18001edc8)
DestroyWindow (Address: 0x18001edd8)
FindWindowW (Address: 0x18001ee10)
GetSystemMetrics (Address: 0x18001ee08)
GetWindowThreadProcessId (Address: 0x18001ee18)
IsDialogMessageW (Address: 0x18001ee40)
KillTimer (Address: 0x18001ee38)
LoadIconW (Address: 0x18001edd0)
LoadStringW (Address: 0x18001edf0)
MessageBoxW (Address: 0x18001ee20)
PostMessageW (Address: 0x18001edf8)
PostThreadMessageW (Address: 0x18001ee48)
SendMessageW (Address: 0x18001ede0)
SetForegroundWindow (Address: 0x18001ee28)
SetTimer (Address: 0x18001ee30)
SetWindowTextW (Address: 0x18001ee60)
ShowWindow (Address: 0x18001ede8)
UnregisterClassA (Address: 0x18001ee58)

USERENV.dll

CreateEnvironmentBlock (Address: 0x18001ee70)
DestroyEnvironmentBlock (Address: 0x18001ee78)

VERSION.dll

GetFileVersionInfoSizeW (Address: 0x18001ee98)
GetFileVersionInfoW (Address: 0x18001ee88)
VerQueryValueW (Address: 0x18001ee90)

WINTRUST.dll

CryptCATAdminAcquireContext (Address: 0x18001eed8)
CryptCATAdminCalcHashFromFileHandle (Address: 0x18001eee0)
CryptCATAdminEnumCatalogFromHash (Address: 0x18001eed0)
CryptCATAdminReleaseCatalogContext (Address: 0x18001eec0)
CryptCATAdminReleaseContext (Address: 0x18001eeb8)
CryptCATCatalogInfoFromContext (Address: 0x18001eec8)
WinVerifyTrust (Address: 0x18001eee8)
WTHelperGetProvSignerFromChain (Address: 0x18001eeb0)
WTHelperProvDataFromStateData (Address: 0x18001eea8)

WTSAPI32.dll

WTSEnumerateSessionsW (Address: 0x18001ef00)
WTSFreeMemory (Address: 0x18001ef08)
WTSQuerySessionInformationW (Address: 0x18001eef8)
WTSQueryUserToken (Address: 0x18001ef10)