UserDataAccountApis.dll

Description: DLL for UserDataAccountsRT

Version: 10.0.19041.4355

Architecture: 64-bit

Operating System: Windows NT

SHA256: c8b74a98230a17210e789d030d8a38db

File Size: 445.0 KB

Uploaded At: Dec. 1, 2025, 7:41 a.m.

Views: 3

Security Warning

This file has been flagged as potentially dangerous.

Reason: Detected potentially dangerous functions used for process injection: OpenProcess

Exported Functions

DllCanUnloadNow (Ordinal: 1, Address: 0x2780)
DllGetActivationFactory (Ordinal: 2, Address: 0x24b0)
DllGetClassObject (Ordinal: 3, Address: 0x2690)

Imported DLLs & Functions

api-ms-win-core-debug-l1-1-0.dll

DebugBreak (Address: 0x180059530)
IsDebuggerPresent (Address: 0x180059540)
OutputDebugStringW (Address: 0x180059538)

api-ms-win-core-delayload-l1-1-0.dll

DelayLoadFailureHook (Address: 0x180059550)

api-ms-win-core-delayload-l1-1-1.dll

ResolveDelayLoadedAPI (Address: 0x180059560)

api-ms-win-core-errorhandling-l1-1-0.dll

GetLastError (Address: 0x180059570)
RaiseException (Address: 0x180059588)
SetLastError (Address: 0x180059590)
SetUnhandledExceptionFilter (Address: 0x180059580)
UnhandledExceptionFilter (Address: 0x180059578)

api-ms-win-core-handle-l1-1-0.dll

CloseHandle (Address: 0x1800595a0)

api-ms-win-core-heap-l1-1-0.dll

GetProcessHeap (Address: 0x1800595b8)
HeapAlloc (Address: 0x1800595b0)
HeapFree (Address: 0x1800595c0)

api-ms-win-core-heap-l2-1-0.dll

LocalAlloc (Address: 0x1800595d0)
LocalFree (Address: 0x1800595d8)

api-ms-win-core-libraryloader-l1-2-0.dll

DisableThreadLibraryCalls (Address: 0x1800595e8)
FreeLibrary (Address: 0x1800595f0)
GetModuleFileNameA (Address: 0x1800595f8)
GetModuleHandleExW (Address: 0x180059608)
GetModuleHandleW (Address: 0x180059610)
GetProcAddress (Address: 0x180059600)

api-ms-win-core-libraryloader-l1-2-1.dll

LoadLibraryW (Address: 0x180059620)

api-ms-win-core-localization-l1-2-0.dll

FormatMessageW (Address: 0x180059630)

api-ms-win-core-processthreads-l1-1-0.dll

GetCurrentProcess (Address: 0x180059650)
GetCurrentProcessId (Address: 0x180059660)
GetCurrentThread (Address: 0x180059670)
GetCurrentThreadId (Address: 0x180059640)
OpenProcessToken (Address: 0x180059668)
OpenThreadToken (Address: 0x180059678)
SetThreadToken (Address: 0x180059658)
TerminateProcess (Address: 0x180059648)

api-ms-win-core-processthreads-l1-1-1.dll

OpenProcess (Address: 0x180059688)

api-ms-win-core-profile-l1-1-0.dll

QueryPerformanceCounter (Address: 0x180059698)

api-ms-win-core-rtlsupport-l1-1-0.dll

RtlCaptureContext (Address: 0x1800596a8)
RtlLookupFunctionEntry (Address: 0x1800596b0)
RtlVirtualUnwind (Address: 0x1800596b8)

api-ms-win-core-synch-l1-1-0.dll

AcquireSRWLockExclusive (Address: 0x1800596e0)
AcquireSRWLockShared (Address: 0x180059708)
CreateEventExW (Address: 0x180059738)
CreateEventW (Address: 0x180059758)
CreateMutexExW (Address: 0x180059710)
CreateSemaphoreExW (Address: 0x180059700)
DeleteCriticalSection (Address: 0x180059718)
EnterCriticalSection (Address: 0x180059728)
InitializeCriticalSectionEx (Address: 0x1800596e8)
InitializeSRWLock (Address: 0x180059720)
LeaveCriticalSection (Address: 0x180059740)
OpenSemaphoreW (Address: 0x180059750)
ReleaseMutex (Address: 0x1800596f0)
ReleaseSemaphore (Address: 0x180059730)
ReleaseSRWLockExclusive (Address: 0x1800596d0)
ReleaseSRWLockShared (Address: 0x180059748)
SetEvent (Address: 0x1800596d8)
WaitForSingleObject (Address: 0x1800596c8)
WaitForSingleObjectEx (Address: 0x1800596f8)

api-ms-win-core-synch-l1-2-0.dll

InitOnceBeginInitialize (Address: 0x180059770)
InitOnceComplete (Address: 0x180059768)
InitOnceExecuteOnce (Address: 0x180059780)
Sleep (Address: 0x180059778)

api-ms-win-core-sysinfo-l1-1-0.dll

GetSystemTimeAsFileTime (Address: 0x180059790)
GetTickCount (Address: 0x1800597a0)
GetTickCount64 (Address: 0x180059798)

api-ms-win-core-threadpool-l1-2-0.dll

CloseThreadpoolWait (Address: 0x1800597d0)
CloseThreadpoolWork (Address: 0x1800597e8)
CreateThreadpoolWait (Address: 0x1800597e0)
CreateThreadpoolWork (Address: 0x1800597b8)
FreeLibraryWhenCallbackReturns (Address: 0x1800597b0)
SetThreadpoolWait (Address: 0x1800597c8)
SubmitThreadpoolWork (Address: 0x1800597c0)
WaitForThreadpoolWaitCallbacks (Address: 0x1800597d8)

api-ms-win-core-util-l1-1-0.dll

DecodePointer (Address: 0x180059800)
EncodePointer (Address: 0x1800597f8)

api-ms-win-core-winrt-propertysetprivate-l1-1-1.dll

RoCreatePropertySetSerializer (Address: 0x180059810)

api-ms-win-eventing-provider-l1-1-0.dll

EventActivityIdControl (Address: 0x180059830)
EventRegister (Address: 0x180059840)
EventSetInformation (Address: 0x180059828)
EventUnregister (Address: 0x180059838)
EventWriteTransfer (Address: 0x180059820)

api-ms-win-service-management-l1-1-0.dll

CloseServiceHandle (Address: 0x180059850)
OpenSCManagerW (Address: 0x180059860)
OpenServiceW (Address: 0x180059858)

api-ms-win-service-winsvc-l1-1-0.dll

QueryServiceStatus (Address: 0x180059870)

api-ms-win-shcore-stream-winrt-l1-1-0.dll

CreateStreamOverRandomAccessStream (Address: 0x180059880)

msvcrt.dll

__C_specific_handler (Address: 0x180059930)
__CxxFrameHandler3 (Address: 0x1800598a0)
__dllonexit (Address: 0x1800598c0)
_amsg_exit (Address: 0x1800598e0)
_callnewh (Address: 0x1800598f0)
_initterm (Address: 0x1800598d8)
_lock (Address: 0x180059948)
_onexit (Address: 0x1800598a8)
_purecall (Address: 0x180059938)
_unlock (Address: 0x1800598c8)
_vsnwprintf (Address: 0x1800598d0)
_XcptFilter (Address: 0x1800598e8)
free (Address: 0x180059908)
malloc (Address: 0x180059910)
memcmp (Address: 0x1800598b8)
memcpy (Address: 0x1800598b0)
memcpy_s (Address: 0x180059940)
memmove (Address: 0x180059890)
memmove_s (Address: 0x180059918)
memset (Address: 0x180059898)
realloc (Address: 0x1800598f8)
wcscmp (Address: 0x180059950)
wcscpy_s (Address: 0x180059928)
wcsncmp (Address: 0x180059920)
wcstoul (Address: 0x180059900)

ntdll.dll

RtlQueryWnfStateData (Address: 0x180059960)
RtlSubscribeWnfStateChangeNotification (Address: 0x180059968)
RtlUnsubscribeWnfNotificationWaitForCompletion (Address: 0x180059970)

UserDataPlatformHelperUtil.dll

GenerateUserModeServiceName (Address: 0x180059518)
GetUserContextFromHandle (Address: 0x180059508)
GetUserTokenFromContext (Address: 0x180059510)
IsCommsSystemService (Address: 0x180059500)
RunServicesInProc (Address: 0x180059520)
StartAndWaitForServiceForUser (Address: 0x1800594f8)