wlidprov.dll

Description: Microsoft® Account Provider

Version: 10.0.19041.5794

Architecture: 32-bit

Operating System: Windows NT

SHA256: 0a8491b8ee6251684b6f72cbdd3e8d20

File Size: 515.5 KB

Uploaded At: Dec. 1, 2025, 8:07 a.m.

Views: 12

Security Warning

This file has been flagged as potentially dangerous.

Reason: Detected potentially dangerous functions used for process injection: OpenProcess

Exported Functions

DllCanUnloadNow (Ordinal: 1, Address: 0x17160)
DllGetClassObject (Ordinal: 2, Address: 0x171a0)
DllRegisterServer (Ordinal: 3, Address: 0x1f7a0)
DllUnregisterServer (Ordinal: 4, Address: 0x1f7a0)

Imported DLLs & Functions

api-ms-win-core-apiquery-l1-1-0.dll

ApiSetQueryApiSetPresence (Address: 0x1006d0bc)

api-ms-win-core-com-l1-1-0.dll

CoCreateFreeThreadedMarshaler (Address: 0x1006d0dc)
CoCreateInstance (Address: 0x1006d0c4)
CoGetApartmentType (Address: 0x1006d0cc)
CoGetCallerTID (Address: 0x1006d0e0)
CoMarshalInterface (Address: 0x1006d0e8)
CoReleaseMarshalData (Address: 0x1006d0d4)
CoTaskMemAlloc (Address: 0x1006d0f0)
CoTaskMemFree (Address: 0x1006d0d8)
CoTaskMemRealloc (Address: 0x1006d0f4)
CoUninitialize (Address: 0x1006d0ec)
CoWaitForMultipleHandles (Address: 0x1006d0d0)
CreateStreamOnHGlobal (Address: 0x1006d0e4)
PropVariantClear (Address: 0x1006d0c8)

api-ms-win-core-com-l1-1-1.dll

RoGetAgileReference (Address: 0x1006d0fc)

api-ms-win-core-com-midlproxystub-l1-1-0.dll

CStdAsyncStubBuffer_AddRef (Address: 0x1006d114)
CStdAsyncStubBuffer_Connect (Address: 0x1006d11c)
CStdAsyncStubBuffer_Disconnect (Address: 0x1006d134)
CStdAsyncStubBuffer_Invoke (Address: 0x1006d10c)
CStdAsyncStubBuffer_QueryInterface (Address: 0x1006d104)
CStdAsyncStubBuffer_Release (Address: 0x1006d12c)
ObjectStublessClient10 (Address: 0x1006d128)
ObjectStublessClient3 (Address: 0x1006d130)
ObjectStublessClient4 (Address: 0x1006d138)
ObjectStublessClient5 (Address: 0x1006d118)
ObjectStublessClient6 (Address: 0x1006d108)
ObjectStublessClient7 (Address: 0x1006d120)
ObjectStublessClient8 (Address: 0x1006d110)
ObjectStublessClient9 (Address: 0x1006d124)

api-ms-win-core-debug-l1-1-0.dll

DebugBreak (Address: 0x1006d140)
IsDebuggerPresent (Address: 0x1006d144)
OutputDebugStringA (Address: 0x1006d14c)
OutputDebugStringW (Address: 0x1006d148)

api-ms-win-core-delayload-l1-1-0.dll

DelayLoadFailureHook (Address: 0x1006d154)

api-ms-win-core-delayload-l1-1-1.dll

ResolveDelayLoadedAPI (Address: 0x1006d15c)

api-ms-win-core-errorhandling-l1-1-0.dll

GetLastError (Address: 0x1006d170)
RaiseException (Address: 0x1006d168)
SetLastError (Address: 0x1006d164)
SetUnhandledExceptionFilter (Address: 0x1006d174)
UnhandledExceptionFilter (Address: 0x1006d16c)

api-ms-win-core-handle-l1-1-0.dll

CloseHandle (Address: 0x1006d17c)

api-ms-win-core-heap-l1-1-0.dll

GetProcessHeap (Address: 0x1006d18c)
HeapAlloc (Address: 0x1006d198)
HeapDestroy (Address: 0x1006d190)
HeapFree (Address: 0x1006d194)
HeapReAlloc (Address: 0x1006d184)
HeapSize (Address: 0x1006d188)

api-ms-win-core-heap-l2-1-0.dll

LocalAlloc (Address: 0x1006d1a4)
LocalFree (Address: 0x1006d1a0)

api-ms-win-core-heap-obsolete-l1-1-0.dll

LocalSize (Address: 0x1006d1ac)

api-ms-win-core-kernel32-legacy-l1-1-0.dll

GetComputerNameW (Address: 0x1006d1b4)

api-ms-win-core-libraryloader-l1-2-0.dll

DisableThreadLibraryCalls (Address: 0x1006d1bc)
FindResourceExW (Address: 0x1006d1d4)
FreeLibrary (Address: 0x1006d1c4)
GetModuleFileNameA (Address: 0x1006d1e4)
GetModuleFileNameW (Address: 0x1006d1d8)
GetModuleHandleExW (Address: 0x1006d1d0)
GetModuleHandleW (Address: 0x1006d1c8)
GetProcAddress (Address: 0x1006d1e8)
LoadLibraryExW (Address: 0x1006d1e0)
LoadResource (Address: 0x1006d1c0)
LockResource (Address: 0x1006d1dc)
SizeofResource (Address: 0x1006d1cc)

api-ms-win-core-libraryloader-l1-2-1.dll

LoadLibraryW (Address: 0x1006d1f0)

api-ms-win-core-localization-l1-2-0.dll

FormatMessageW (Address: 0x1006d200)
GetThreadPreferredUILanguages (Address: 0x1006d1fc)
GetUserDefaultLocaleName (Address: 0x1006d1f8)

api-ms-win-core-localization-obsolete-l1-2-0.dll

GetUserDefaultUILanguage (Address: 0x1006d208)

api-ms-win-core-marshal-l1-1-0.dll

HWND_UserFree (Address: 0x1006d210)
HWND_UserMarshal (Address: 0x1006d21c)
HWND_UserSize (Address: 0x1006d218)
HWND_UserUnmarshal (Address: 0x1006d214)

api-ms-win-core-processthreads-l1-1-0.dll

CreateThread (Address: 0x1006d234)
GetCurrentProcess (Address: 0x1006d248)
GetCurrentProcessId (Address: 0x1006d238)
GetCurrentThread (Address: 0x1006d240)
GetCurrentThreadId (Address: 0x1006d24c)
GetProcessIdOfThread (Address: 0x1006d23c)
OpenProcessToken (Address: 0x1006d22c)
OpenThread (Address: 0x1006d224)
OpenThreadToken (Address: 0x1006d228)
SetThreadToken (Address: 0x1006d230)
TerminateProcess (Address: 0x1006d244)

api-ms-win-core-processthreads-l1-1-1.dll

OpenProcess (Address: 0x1006d254)

api-ms-win-core-profile-l1-1-0.dll

QueryPerformanceCounter (Address: 0x1006d25c)

api-ms-win-core-registry-l1-1-0.dll

RegCloseKey (Address: 0x1006d268)
RegCreateKeyExW (Address: 0x1006d264)
RegDeleteKeyExW (Address: 0x1006d27c)
RegDeleteTreeW (Address: 0x1006d278)
RegDeleteValueW (Address: 0x1006d294)
RegEnumKeyExW (Address: 0x1006d290)
RegEnumValueW (Address: 0x1006d274)
RegGetValueW (Address: 0x1006d280)
RegOpenCurrentUser (Address: 0x1006d284)
RegOpenKeyExW (Address: 0x1006d298)
RegQueryInfoKeyW (Address: 0x1006d270)
RegQueryValueExW (Address: 0x1006d28c)
RegSetKeySecurity (Address: 0x1006d288)
RegSetValueExW (Address: 0x1006d26c)

api-ms-win-core-string-l1-1-0.dll

CompareStringOrdinal (Address: 0x1006d2a0)
MultiByteToWideChar (Address: 0x1006d2a8)
WideCharToMultiByte (Address: 0x1006d2a4)

api-ms-win-core-string-l2-1-0.dll

CharNextW (Address: 0x1006d2b0)

api-ms-win-core-string-obsolete-l1-1-0.dll

lstrcmpiW (Address: 0x1006d2b8)

api-ms-win-core-synch-l1-1-0.dll

AcquireSRWLockExclusive (Address: 0x1006d304)
AcquireSRWLockShared (Address: 0x1006d2c4)
CreateEventExW (Address: 0x1006d30c)
CreateEventW (Address: 0x1006d2d8)
CreateMutexExW (Address: 0x1006d2e4)
CreateSemaphoreExW (Address: 0x1006d2dc)
DeleteCriticalSection (Address: 0x1006d2e0)
EnterCriticalSection (Address: 0x1006d300)
InitializeCriticalSection (Address: 0x1006d2f0)
InitializeCriticalSectionEx (Address: 0x1006d2cc)
InitializeSRWLock (Address: 0x1006d2c0)
LeaveCriticalSection (Address: 0x1006d308)
OpenEventW (Address: 0x1006d2f4)
OpenSemaphoreW (Address: 0x1006d2e8)
ReleaseMutex (Address: 0x1006d314)
ReleaseSemaphore (Address: 0x1006d310)
ReleaseSRWLockExclusive (Address: 0x1006d2f8)
ReleaseSRWLockShared (Address: 0x1006d2d0)
ResetEvent (Address: 0x1006d2ec)
SetEvent (Address: 0x1006d2d4)
WaitForMultipleObjectsEx (Address: 0x1006d2c8)
WaitForSingleObject (Address: 0x1006d2fc)
WaitForSingleObjectEx (Address: 0x1006d318)

api-ms-win-core-synch-l1-2-0.dll

InitOnceBeginInitialize (Address: 0x1006d328)
InitOnceComplete (Address: 0x1006d320)
InitOnceExecuteOnce (Address: 0x1006d324)
Sleep (Address: 0x1006d32c)

api-ms-win-core-sysinfo-l1-1-0.dll

GetSystemDirectoryW (Address: 0x1006d338)
GetSystemTimeAsFileTime (Address: 0x1006d33c)
GetTickCount (Address: 0x1006d340)
GetTickCount64 (Address: 0x1006d344)
GetVersionExW (Address: 0x1006d334)

api-ms-win-core-threadpool-l1-2-0.dll

CloseThreadpoolTimer (Address: 0x1006d358)
CreateThreadpoolTimer (Address: 0x1006d350)
SetThreadpoolTimer (Address: 0x1006d34c)
WaitForThreadpoolTimerCallbacks (Address: 0x1006d354)

api-ms-win-core-timezone-l1-1-0.dll

SystemTimeToFileTime (Address: 0x1006d360)

api-ms-win-core-url-l1-1-0.dll

UrlEscapeW (Address: 0x1006d368)

api-ms-win-core-version-l1-1-0.dll

GetFileVersionInfoExW (Address: 0x1006d374)
GetFileVersionInfoSizeExW (Address: 0x1006d370)
VerQueryValueW (Address: 0x1006d378)

api-ms-win-core-winrt-error-l1-1-0.dll

GetRestrictedErrorInfo (Address: 0x1006d380)
RoOriginateError (Address: 0x1006d390)
RoOriginateErrorW (Address: 0x1006d384)
RoTransformError (Address: 0x1006d388)
SetRestrictedErrorInfo (Address: 0x1006d38c)

api-ms-win-core-winrt-error-l1-1-1.dll

IsErrorPropagationEnabled (Address: 0x1006d39c)
RoGetMatchingRestrictedErrorInfo (Address: 0x1006d398)
RoReportFailedDelegate (Address: 0x1006d3a0)

api-ms-win-core-winrt-l1-1-0.dll

RoActivateInstance (Address: 0x1006d3ac)
RoGetActivationFactory (Address: 0x1006d3a8)

api-ms-win-core-winrt-string-l1-1-0.dll

HSTRING_UserFree (Address: 0x1006d3c8)
HSTRING_UserMarshal (Address: 0x1006d3cc)
HSTRING_UserSize (Address: 0x1006d3c0)
HSTRING_UserUnmarshal (Address: 0x1006d3b4)
WindowsCreateString (Address: 0x1006d3b8)
WindowsCreateStringReference (Address: 0x1006d3d0)
WindowsDeleteString (Address: 0x1006d3bc)
WindowsDuplicateString (Address: 0x1006d3dc)
WindowsGetStringRawBuffer (Address: 0x1006d3c4)
WindowsIsStringEmpty (Address: 0x1006d3d4)
WindowsStringHasEmbeddedNull (Address: 0x1006d3d8)

api-ms-win-eventing-provider-l1-1-0.dll

EventActivityIdControl (Address: 0x1006d3f4)
EventRegister (Address: 0x1006d3e4)
EventSetInformation (Address: 0x1006d3f0)
EventUnregister (Address: 0x1006d3e8)
EventWriteTransfer (Address: 0x1006d3ec)

api-ms-win-security-base-l1-1-0.dll

AllocateAndInitializeSid (Address: 0x1006d400)
CreateWellKnownSid (Address: 0x1006d418)
FreeSid (Address: 0x1006d3fc)
GetSecurityDescriptorDacl (Address: 0x1006d408)
GetSecurityDescriptorSacl (Address: 0x1006d404)
GetTokenInformation (Address: 0x1006d41c)
ImpersonateLoggedOnUser (Address: 0x1006d40c)
IsValidSid (Address: 0x1006d414)
RevertToSelf (Address: 0x1006d410)

api-ms-win-security-credentials-l1-1-0.dll

CredIsProtectedW (Address: 0x1006d424)
CredUnprotectW (Address: 0x1006d428)

api-ms-win-security-lsalookup-l1-1-2.dll

LsaLookupUserAccountType (Address: 0x1006d430)

api-ms-win-security-sddl-l1-1-0.dll

ConvertSidToStringSidW (Address: 0x1006d438)
ConvertStringSecurityDescriptorToSecurityDescriptorW (Address: 0x1006d43c)
ConvertStringSidToSidW (Address: 0x1006d440)

api-ms-win-service-management-l1-1-0.dll

CloseServiceHandle (Address: 0x1006d450)
OpenSCManagerW (Address: 0x1006d44c)
OpenServiceW (Address: 0x1006d448)

api-ms-win-service-winsvc-l1-1-0.dll

QueryServiceStatus (Address: 0x1006d458)

api-ms-win-shcore-taskpool-l1-1-0.dll

SHTaskPoolAllowThreadReuse (Address: 0x1006d464)
SHTaskPoolQueueTask (Address: 0x1006d460)

api-ms-win-stateseparation-helpers-l1-1-0.dll

GetPersistedRegistryLocationW (Address: 0x1006d46c)

bcrypt.dll

BCryptGenRandom (Address: 0x1006d474)

msvcrt.dll

__CxxFrameHandler3 (Address: 0x1006d4c4)
__dllonexit (Address: 0x1006d4c8)
_amsg_exit (Address: 0x1006d4b8)
_callnewh (Address: 0x1006d47c)
_CxxThrowException (Address: 0x1006d484)
_errno (Address: 0x1006d4a0)
_except_handler4_common (Address: 0x1006d49c)
_ftol2 (Address: 0x1006d4a8)
_get_errno (Address: 0x1006d4d4)
_initterm (Address: 0x1006d498)
_lock (Address: 0x1006d4bc)
_onexit (Address: 0x1006d4d8)
_purecall (Address: 0x1006d4f0)
_set_errno (Address: 0x1006d4d0)
_time64 (Address: 0x1006d4cc)
_unlock (Address: 0x1006d4c0)
_vsnprintf_s (Address: 0x1006d494)
_vsnwprintf (Address: 0x1006d4e0)
_XcptFilter (Address: 0x1006d490)
??0exception@@QAE@ABV0@@Z (Address: 0x1006d500)
??0exception@@QAE@XZ (Address: 0x1006d4dc)
??1exception@@UAE@XZ (Address: 0x1006d4a4)
??1type_info@@UAE@XZ (Address: 0x1006d4b4)
?terminate@@YAXXZ (Address: 0x1006d4b0)
?what@exception@@UBEPBDXZ (Address: 0x1006d480)
calloc (Address: 0x1006d48c)
free (Address: 0x1006d4ec)
malloc (Address: 0x1006d4e8)
memcmp (Address: 0x1006d4fc)
memcpy (Address: 0x1006d4f8)
memcpy_s (Address: 0x1006d4f4)
memmove_s (Address: 0x1006d488)
memset (Address: 0x1006d504)
realloc (Address: 0x1006d4ac)
wcsncpy_s (Address: 0x1006d4e4)

ntdll.dll

_vscwprintf (Address: 0x1006d550)
_vsnprintf (Address: 0x1006d518)
_wcsicmp (Address: 0x1006d544)
_wcslwr_s (Address: 0x1006d530)
isdigit (Address: 0x1006d51c)
iswspace (Address: 0x1006d540)
RtlAcquireSRWLockExclusive (Address: 0x1006d510)
RtlGetDeviceFamilyInfoEnum (Address: 0x1006d52c)
RtlReleaseSRWLockExclusive (Address: 0x1006d514)
RtlSleepConditionVariableSRW (Address: 0x1006d528)
RtlWakeAllConditionVariable (Address: 0x1006d50c)
strrchr (Address: 0x1006d558)
toupper (Address: 0x1006d520)
vswprintf_s (Address: 0x1006d554)
wcschr (Address: 0x1006d524)
wcscspn (Address: 0x1006d548)
wcsspn (Address: 0x1006d54c)
wcsstr (Address: 0x1006d53c)
wcstol (Address: 0x1006d538)
WinSqmAddToStreamEx (Address: 0x1006d534)

OLEAUT32.dll

SysAllocStringLen (Address: 0x1006d000)
VariantClear (Address: 0x1006d008)
VarUI4FromStr (Address: 0x1006d004)

RPCRT4.dll

CStdStubBuffer_AddRef (Address: 0x1006d08c)
CStdStubBuffer_Connect (Address: 0x1006d068)
CStdStubBuffer_CountRefs (Address: 0x1006d084)
CStdStubBuffer_DebugServerQueryInterface (Address: 0x1006d094)
CStdStubBuffer_DebugServerRelease (Address: 0x1006d078)
CStdStubBuffer_Disconnect (Address: 0x1006d074)
CStdStubBuffer_Invoke (Address: 0x1006d09c)
CStdStubBuffer_IsIIDSupported (Address: 0x1006d06c)
CStdStubBuffer_QueryInterface (Address: 0x1006d080)
I_RpcBindingInqLocalClientPID (Address: 0x1006d050)
I_RpcExceptionFilter (Address: 0x1006d064)
I_RpcMapWin32Status (Address: 0x1006d0ac)
IUnknown_AddRef_Proxy (Address: 0x1006d098)
IUnknown_QueryInterface_Proxy (Address: 0x1006d070)
IUnknown_Release_Proxy (Address: 0x1006d088)
MesBufferHandleReset (Address: 0x1006d05c)
MesDecodeBufferHandleCreate (Address: 0x1006d0b4)
MesEncodeFixedBufferHandleCreate (Address: 0x1006d060)
MesHandleFree (Address: 0x1006d058)
NdrAsyncClientCall2 (Address: 0x1006d044)
NdrClientCall4 (Address: 0x1006d04c)
NdrCStdStubBuffer_Release (Address: 0x1006d0a0)
NdrDllCanUnloadNow (Address: 0x1006d0a4)
NdrDllGetClassObject (Address: 0x1006d0a8)
NdrMesTypeAlignSize2 (Address: 0x1006d018)
NdrMesTypeDecode2 (Address: 0x1006d020)
NdrMesTypeEncode2 (Address: 0x1006d024)
NdrMesTypeFree2 (Address: 0x1006d01c)
NdrOleAllocate (Address: 0x1006d07c)
NdrOleFree (Address: 0x1006d090)
RpcAsyncCancelCall (Address: 0x1006d03c)
RpcAsyncCompleteCall (Address: 0x1006d040)
RpcAsyncInitializeHandle (Address: 0x1006d0b0)
RpcBindingBind (Address: 0x1006d010)
RpcBindingCreateW (Address: 0x1006d014)
RpcBindingFree (Address: 0x1006d028)
RpcBindingFromStringBindingW (Address: 0x1006d038)
RpcBindingSetAuthInfoExW (Address: 0x1006d030)
RpcSsDestroyClientContext (Address: 0x1006d048)
RpcStringBindingComposeW (Address: 0x1006d034)
RpcStringFreeW (Address: 0x1006d02c)
UuidCreate (Address: 0x1006d054)

samcli.dll

NetLocalGroupAddMembers (Address: 0x1006d564)
NetUserDel (Address: 0x1006d560)