MicrosoftAccountWAMExtension.dll

Description: Microsoft Account WAM Extension DLL

Version: 10.0.19041.6033

Architecture: 64-bit

Operating System: Windows NT

SHA256: 3dbb60e0fe09b2f85ae3e10669cdacae

File Size: 562.5 KB

Uploaded At: Dec. 1, 2025, 7:33 a.m.

Views: 6

Security Warning

This file has been flagged as potentially dangerous.

Reason: Detected potentially dangerous functions used for process injection: OpenProcess

Exported Functions

DllCanUnloadNow (Ordinal: 1, Address: 0x6ff0)
DllGetActivationFactory (Ordinal: 2, Address: 0x6ce0)
DllGetClassObject (Ordinal: 3, Address: 0x6ec0)

Imported DLLs & Functions

api-ms-win-core-apiquery-l1-1-0.dll

ApiSetQueryApiSetPresence (Address: 0x18006a2d0)

api-ms-win-core-debug-l1-1-0.dll

DebugBreak (Address: 0x18006a2e8)
IsDebuggerPresent (Address: 0x18006a2e0)
OutputDebugStringW (Address: 0x18006a2f0)

api-ms-win-core-delayload-l1-1-0.dll

DelayLoadFailureHook (Address: 0x18006a300)

api-ms-win-core-delayload-l1-1-1.dll

ResolveDelayLoadedAPI (Address: 0x18006a310)

api-ms-win-core-errorhandling-l1-1-0.dll

GetLastError (Address: 0x18006a328)
RaiseException (Address: 0x18006a320)
SetLastError (Address: 0x18006a340)
SetUnhandledExceptionFilter (Address: 0x18006a338)
UnhandledExceptionFilter (Address: 0x18006a330)

api-ms-win-core-handle-l1-1-0.dll

CloseHandle (Address: 0x18006a358)
DuplicateHandle (Address: 0x18006a350)

api-ms-win-core-heap-l1-1-0.dll

GetProcessHeap (Address: 0x18006a380)
HeapAlloc (Address: 0x18006a368)
HeapDestroy (Address: 0x18006a390)
HeapFree (Address: 0x18006a378)
HeapReAlloc (Address: 0x18006a388)
HeapSize (Address: 0x18006a370)

api-ms-win-core-heap-l2-1-0.dll

LocalAlloc (Address: 0x18006a3a8)
LocalFree (Address: 0x18006a3a0)

api-ms-win-core-libraryloader-l1-2-0.dll

DisableThreadLibraryCalls (Address: 0x18006a3d0)
FindResourceExW (Address: 0x18006a3f8)
GetModuleFileNameA (Address: 0x18006a3e0)
GetModuleHandleExW (Address: 0x18006a3e8)
GetModuleHandleW (Address: 0x18006a3f0)
GetProcAddress (Address: 0x18006a3d8)
LoadResource (Address: 0x18006a3c8)
LockResource (Address: 0x18006a3b8)
SizeofResource (Address: 0x18006a3c0)

api-ms-win-core-localization-l1-2-0.dll

FormatMessageW (Address: 0x18006a408)

api-ms-win-core-processthreads-l1-1-0.dll

GetCurrentProcess (Address: 0x18006a450)
GetCurrentProcessId (Address: 0x18006a418)
GetCurrentThread (Address: 0x18006a428)
GetCurrentThreadId (Address: 0x18006a438)
OpenProcessToken (Address: 0x18006a440)
OpenThreadToken (Address: 0x18006a430)
SetThreadToken (Address: 0x18006a420)
TerminateProcess (Address: 0x18006a448)

api-ms-win-core-processthreads-l1-1-1.dll

OpenProcess (Address: 0x18006a460)

api-ms-win-core-profile-l1-1-0.dll

QueryPerformanceCounter (Address: 0x18006a470)

api-ms-win-core-registry-l1-1-0.dll

RegCloseKey (Address: 0x18006a490)
RegCreateKeyExW (Address: 0x18006a4c8)
RegDeleteKeyExW (Address: 0x18006a4a0)
RegDeleteTreeW (Address: 0x18006a4b0)
RegDeleteValueW (Address: 0x18006a4a8)
RegEnumKeyExW (Address: 0x18006a4e0)
RegEnumValueW (Address: 0x18006a4d0)
RegGetValueW (Address: 0x18006a488)
RegOpenCurrentUser (Address: 0x18006a480)
RegOpenKeyExW (Address: 0x18006a498)
RegQueryInfoKeyW (Address: 0x18006a4b8)
RegQueryValueExW (Address: 0x18006a4c0)
RegSetValueExW (Address: 0x18006a4d8)

api-ms-win-core-rtlsupport-l1-1-0.dll

RtlCaptureContext (Address: 0x18006a500)
RtlLookupFunctionEntry (Address: 0x18006a4f8)
RtlVirtualUnwind (Address: 0x18006a4f0)

api-ms-win-core-string-l1-1-0.dll

CompareStringOrdinal (Address: 0x18006a518)
MultiByteToWideChar (Address: 0x18006a510)

api-ms-win-core-synch-l1-1-0.dll

AcquireSRWLockExclusive (Address: 0x18006a558)
AcquireSRWLockShared (Address: 0x18006a568)
CreateEventExW (Address: 0x18006a5c0)
CreateEventW (Address: 0x18006a548)
CreateMutexExW (Address: 0x18006a580)
CreateSemaphoreExW (Address: 0x18006a588)
DeleteCriticalSection (Address: 0x18006a528)
EnterCriticalSection (Address: 0x18006a570)
InitializeCriticalSection (Address: 0x18006a578)
InitializeCriticalSectionEx (Address: 0x18006a540)
InitializeSRWLock (Address: 0x18006a5c8)
LeaveCriticalSection (Address: 0x18006a530)
OpenSemaphoreW (Address: 0x18006a5a0)
ReleaseMutex (Address: 0x18006a5b0)
ReleaseSemaphore (Address: 0x18006a590)
ReleaseSRWLockExclusive (Address: 0x18006a550)
ReleaseSRWLockShared (Address: 0x18006a560)
SetEvent (Address: 0x18006a538)
WaitForMultipleObjectsEx (Address: 0x18006a5b8)
WaitForSingleObject (Address: 0x18006a598)
WaitForSingleObjectEx (Address: 0x18006a5a8)

api-ms-win-core-synch-l1-2-0.dll

InitOnceBeginInitialize (Address: 0x18006a5e0)
InitOnceComplete (Address: 0x18006a5e8)
InitOnceExecuteOnce (Address: 0x18006a5d8)
Sleep (Address: 0x18006a5f0)

api-ms-win-core-sysinfo-l1-1-0.dll

GetSystemTimeAsFileTime (Address: 0x18006a610)
GetTickCount (Address: 0x18006a608)
GetTickCount64 (Address: 0x18006a600)

api-ms-win-core-threadpool-l1-2-0.dll

CloseThreadpoolTimer (Address: 0x18006a620)
CreateThreadpoolTimer (Address: 0x18006a638)
SetThreadpoolTimer (Address: 0x18006a630)
WaitForThreadpoolTimerCallbacks (Address: 0x18006a628)

api-ms-win-core-util-l1-1-0.dll

DecodePointer (Address: 0x18006a650)
EncodePointer (Address: 0x18006a648)

api-ms-win-eventing-provider-l1-1-0.dll

EventActivityIdControl (Address: 0x18006a660)
EventRegister (Address: 0x18006a670)
EventSetInformation (Address: 0x18006a678)
EventUnregister (Address: 0x18006a668)
EventWriteTransfer (Address: 0x18006a680)

api-ms-win-service-winsvc-l1-1-0.dll

QueryServiceStatus (Address: 0x18006a690)

api-ms-win-shcore-stream-winrt-l1-1-0.dll

CreateRandomAccessStreamOnFile (Address: 0x18006a6a0)

api-ms-win-shcore-taskpool-l1-1-0.dll

SHTaskPoolAllowThreadReuse (Address: 0x18006a6b8)
SHTaskPoolQueueTask (Address: 0x18006a6b0)

combase.dll

(Address: 0x18006a6c8)
(Address: 0x18006a6d0)
(Address: 0x18006a6d8)
(Address: 0x18006a6e0)
(Address: 0x18006a6e8)
(Address: 0x18006a6f0)
(Address: 0x18006a6f8)
(Address: 0x18006a700)
(Address: 0x18006a708)
(Address: 0x18006a710)
(Address: 0x18006a720)
(Address: 0x18006a728)
(Address: 0x18006a730)
(Address: 0x18006a740)
(Address: 0x18006a748)
(Address: 0x18006a750)
(Address: 0x18006a758)
(Address: 0x18006a760)
CStdStubBuffer2_Connect (Address: 0x18006a770)
CStdStubBuffer2_CountRefs (Address: 0x18006a768)
CStdStubBuffer2_Disconnect (Address: 0x18006a738)
CStdStubBuffer2_QueryInterface (Address: 0x18006a718)

msvcrt.dll

__C_specific_handler (Address: 0x18006a7d8)
__CxxFrameHandler3 (Address: 0x18006a890)
__dllonexit (Address: 0x18006a800)
_amsg_exit (Address: 0x18006a7a0)
_callnewh (Address: 0x18006a7b8)
_CxxThrowException (Address: 0x18006a7b0)
_initterm (Address: 0x18006a7d0)
_lock (Address: 0x18006a7f0)
_onexit (Address: 0x18006a808)
_purecall (Address: 0x18006a7e0)
_unlock (Address: 0x18006a7f8)
_vsnprintf_s (Address: 0x18006a858)
_vsnwprintf (Address: 0x18006a8a0)
_vsnwprintf_s (Address: 0x18006a818)
_wcsicmp (Address: 0x18006a828)
_wcsnicmp (Address: 0x18006a838)
_XcptFilter (Address: 0x18006a798)
??_V@YAXPEAX@Z (Address: 0x18006a820)
??0exception@@QEAA@AEBQEBD@Z (Address: 0x18006a780)
??0exception@@QEAA@AEBQEBDH@Z (Address: 0x18006a788)
??0exception@@QEAA@AEBV0@@Z (Address: 0x18006a860)
??0exception@@QEAA@XZ (Address: 0x18006a868)
??1exception@@UEAA@XZ (Address: 0x18006a870)
??1type_info@@UEAA@XZ (Address: 0x18006a8a8)
??3@YAXPEAX@Z (Address: 0x18006a878)
?terminate@@YAXXZ (Address: 0x18006a7e8)
?what@exception@@UEBAPEBDXZ (Address: 0x18006a790)
free (Address: 0x18006a7c8)
malloc (Address: 0x18006a7c0)
memcmp (Address: 0x18006a888)
memcpy (Address: 0x18006a7a8)
memcpy_s (Address: 0x18006a880)
memmove (Address: 0x18006a898)
memmove_s (Address: 0x18006a810)
memset (Address: 0x18006a8b0)
realloc (Address: 0x18006a830)
swprintf_s (Address: 0x18006a840)
wcsrchr (Address: 0x18006a850)
wcsstr (Address: 0x18006a848)

ntdll.dll

NtQuerySecurityObject (Address: 0x18006a8d0)
NtSetSecurityObject (Address: 0x18006a8c8)
RtlAddAccessAllowedAce (Address: 0x18006a8e0)
RtlAddAce (Address: 0x18006a8e8)
RtlCreateAcl (Address: 0x18006a8f8)
RtlCreateSecurityDescriptor (Address: 0x18006a918)
RtlGetAce (Address: 0x18006a8f0)
RtlGetDaclSecurityDescriptor (Address: 0x18006a910)
RtlLengthSid (Address: 0x18006a900)
RtlNtStatusToDosError (Address: 0x18006a8c0)
RtlQueryInformationAcl (Address: 0x18006a908)
RtlSetDaclSecurityDescriptor (Address: 0x18006a8d8)