Windows.Security.Authentication.Web.Core.dll

Description: Token Broker WinRT API

Version: 10.0.19041.5848

Architecture: 64-bit

Operating System: Windows NT

SHA256: 288c6765b8ee465ad597ab019cd83f14

File Size: 1.1 MB

Uploaded At: Dec. 1, 2025, 7:44 a.m.

Views: 5

Security Warning

This file has been flagged as potentially dangerous.

Reason: Detected potentially dangerous functions used for process injection: OpenProcess

Exported Functions

DllCanUnloadNow (Ordinal: 1, Address: 0x1b810)
DllGetActivationFactory (Ordinal: 2, Address: 0x1d7d0)
DllGetClassObject (Ordinal: 3, Address: 0x46770)
FreeIdentityProviderCookies (Ordinal: 4, Address: 0x467c0)
GetIdentityProviderCookies (Ordinal: 5, Address: 0x467d0)

Imported DLLs & Functions

api-ms-win-appmodel-identity-l1-2-0.dll

AppContainerDeriveSidFromMoniker (Address: 0x1800deda8)

api-ms-win-appmodel-runtime-l1-1-1.dll

GetPackageFamilyNameFromToken (Address: 0x1800dedb8)
GetPackageFullNameFromToken (Address: 0x1800dedc0)

api-ms-win-appmodel-state-l1-2-0.dll

CloseState (Address: 0x1800dede0)
GetStateRootFolder (Address: 0x1800dedd8)
OpenStateExplicit (Address: 0x1800dedd0)

api-ms-win-core-apiquery-l1-1-0.dll

ApiSetQueryApiSetPresence (Address: 0x1800dedf0)

api-ms-win-core-debug-l1-1-0.dll

DebugBreak (Address: 0x1800dee00)
IsDebuggerPresent (Address: 0x1800dee10)
OutputDebugStringW (Address: 0x1800dee08)

api-ms-win-core-delayload-l1-1-0.dll

DelayLoadFailureHook (Address: 0x1800dee20)

api-ms-win-core-delayload-l1-1-1.dll

ResolveDelayLoadedAPI (Address: 0x1800dee30)

api-ms-win-core-errorhandling-l1-1-0.dll

GetLastError (Address: 0x1800dee48)
RaiseException (Address: 0x1800dee60)
SetLastError (Address: 0x1800dee40)
SetUnhandledExceptionFilter (Address: 0x1800dee58)
UnhandledExceptionFilter (Address: 0x1800dee50)

api-ms-win-core-file-l1-1-0.dll

CompareFileTime (Address: 0x1800dee78)
CreateDirectoryW (Address: 0x1800dee80)
CreateFileW (Address: 0x1800deea0)
FindClose (Address: 0x1800deed0)
FindFirstFileW (Address: 0x1800deea8)
FindNextFileW (Address: 0x1800deeb0)
GetFileSizeEx (Address: 0x1800deec8)
GetFileTime (Address: 0x1800deeb8)
ReadFile (Address: 0x1800dee70)
SetEndOfFile (Address: 0x1800dee88)
SetFileInformationByHandle (Address: 0x1800deec0)
SetFilePointer (Address: 0x1800dee90)
WriteFile (Address: 0x1800dee98)

api-ms-win-core-handle-l1-1-0.dll

CloseHandle (Address: 0x1800deee8)
DuplicateHandle (Address: 0x1800deee0)

api-ms-win-core-heap-l1-1-0.dll

GetProcessHeap (Address: 0x1800def08)
HeapAlloc (Address: 0x1800def00)
HeapFree (Address: 0x1800deef8)

api-ms-win-core-heap-l2-1-0.dll

LocalAlloc (Address: 0x1800def18)
LocalFree (Address: 0x1800def20)

api-ms-win-core-interlocked-l1-1-0.dll

InitializeSListHead (Address: 0x1800def30)
InterlockedPushEntrySList (Address: 0x1800def38)

api-ms-win-core-largeinteger-l1-1-0.dll

MulDiv (Address: 0x1800def48)

api-ms-win-core-libraryloader-l1-2-0.dll

FreeLibrary (Address: 0x1800def70)
GetModuleFileNameA (Address: 0x1800def58)
GetModuleHandleExW (Address: 0x1800def60)
GetModuleHandleW (Address: 0x1800def78)
GetProcAddress (Address: 0x1800def68)

api-ms-win-core-localization-l1-2-0.dll

FormatMessageW (Address: 0x1800def88)

api-ms-win-core-processthreads-l1-1-0.dll

GetCurrentProcess (Address: 0x1800defd8)
GetCurrentProcessId (Address: 0x1800def98)
GetCurrentThread (Address: 0x1800defc8)
GetCurrentThreadId (Address: 0x1800defa0)
GetProcessId (Address: 0x1800defa8)
OpenProcessToken (Address: 0x1800defb8)
OpenThreadToken (Address: 0x1800defc0)
SetThreadToken (Address: 0x1800defd0)
TerminateProcess (Address: 0x1800defb0)

api-ms-win-core-processthreads-l1-1-1.dll

IsProcessorFeaturePresent (Address: 0x1800defe8)
OpenProcess (Address: 0x1800deff0)

api-ms-win-core-profile-l1-1-0.dll

QueryPerformanceCounter (Address: 0x1800df000)

api-ms-win-core-psapi-l1-1-0.dll

QueryFullProcessImageNameW (Address: 0x1800df010)

api-ms-win-core-registry-l1-1-0.dll

RegCloseKey (Address: 0x1800df020)
RegEnumKeyExW (Address: 0x1800df030)
RegGetValueW (Address: 0x1800df028)

api-ms-win-core-registry-l2-1-0.dll

RegOpenKeyW (Address: 0x1800df040)

api-ms-win-core-rtlsupport-l1-1-0.dll

RtlCaptureContext (Address: 0x1800df060)
RtlLookupFunctionEntry (Address: 0x1800df058)
RtlVirtualUnwind (Address: 0x1800df050)

api-ms-win-core-shlwapi-legacy-l1-1-0.dll

PathFileExistsW (Address: 0x1800df078)
PathFindFileNameW (Address: 0x1800df070)

api-ms-win-core-string-l1-1-0.dll

CompareStringOrdinal (Address: 0x1800df088)

api-ms-win-core-string-l2-1-0.dll

CharLowerW (Address: 0x1800df098)

api-ms-win-core-synch-l1-1-0.dll

AcquireSRWLockExclusive (Address: 0x1800df0b0)
AcquireSRWLockShared (Address: 0x1800df118)
CreateEventExW (Address: 0x1800df108)
CreateMutexExW (Address: 0x1800df100)
CreateSemaphoreExW (Address: 0x1800df0f8)
DeleteCriticalSection (Address: 0x1800df130)
EnterCriticalSection (Address: 0x1800df0c0)
InitializeCriticalSectionEx (Address: 0x1800df0e0)
InitializeSRWLock (Address: 0x1800df128)
LeaveCriticalSection (Address: 0x1800df0d8)
OpenSemaphoreW (Address: 0x1800df0c8)
ReleaseMutex (Address: 0x1800df0e8)
ReleaseSemaphore (Address: 0x1800df120)
ReleaseSRWLockExclusive (Address: 0x1800df0a8)
ReleaseSRWLockShared (Address: 0x1800df0d0)
SetEvent (Address: 0x1800df110)
TryAcquireSRWLockExclusive (Address: 0x1800df138)
WaitForSingleObject (Address: 0x1800df0f0)
WaitForSingleObjectEx (Address: 0x1800df0b8)

api-ms-win-core-synch-l1-2-0.dll

InitOnceBeginInitialize (Address: 0x1800df148)
InitOnceComplete (Address: 0x1800df150)
InitOnceExecuteOnce (Address: 0x1800df158)
Sleep (Address: 0x1800df160)

api-ms-win-core-synch-l1-2-1.dll

CreateSemaphoreW (Address: 0x1800df170)

api-ms-win-core-sysinfo-l1-1-0.dll

GetSystemTimeAsFileTime (Address: 0x1800df180)
GetTickCount64 (Address: 0x1800df188)

api-ms-win-core-threadpool-l1-2-0.dll

CloseThreadpool (Address: 0x1800df198)
CloseThreadpoolTimer (Address: 0x1800df1d0)
CloseThreadpoolWork (Address: 0x1800df1a0)
CreateThreadpool (Address: 0x1800df1e0)
CreateThreadpoolTimer (Address: 0x1800df1c0)
CreateThreadpoolWork (Address: 0x1800df1d8)
FreeLibraryWhenCallbackReturns (Address: 0x1800df1a8)
SetThreadpoolTimer (Address: 0x1800df1b0)
SubmitThreadpoolWork (Address: 0x1800df1c8)
WaitForThreadpoolTimerCallbacks (Address: 0x1800df1b8)

api-ms-win-core-util-l1-1-0.dll

DecodePointer (Address: 0x1800df1f0)
EncodePointer (Address: 0x1800df1f8)

api-ms-win-core-winrt-error-l1-1-0.dll

GetRestrictedErrorInfo (Address: 0x1800df218)
RoOriginateError (Address: 0x1800df208)
RoOriginateErrorW (Address: 0x1800df210)
RoTransformError (Address: 0x1800df228)
SetRestrictedErrorInfo (Address: 0x1800df220)

api-ms-win-core-winrt-error-l1-1-1.dll

IsErrorPropagationEnabled (Address: 0x1800df250)
RoGetMatchingRestrictedErrorInfo (Address: 0x1800df240)
RoOriginateLanguageException (Address: 0x1800df248)
RoReportFailedDelegate (Address: 0x1800df238)

api-ms-win-core-winrt-l1-1-0.dll

RoActivateInstance (Address: 0x1800df278)
RoGetActivationFactory (Address: 0x1800df270)
RoInitialize (Address: 0x1800df260)
RoUninitialize (Address: 0x1800df268)

api-ms-win-core-winrt-propertysetprivate-l1-1-1.dll

RoCreatePropertySetSerializer (Address: 0x1800df288)

api-ms-win-core-winrt-string-l1-1-0.dll

WindowsCompareStringOrdinal (Address: 0x1800df2a8)
WindowsConcatString (Address: 0x1800df2a0)
WindowsCreateString (Address: 0x1800df298)
WindowsCreateStringReference (Address: 0x1800df2c8)
WindowsDeleteString (Address: 0x1800df2d8)
WindowsDuplicateString (Address: 0x1800df2b0)
WindowsGetStringLen (Address: 0x1800df2c0)
WindowsGetStringRawBuffer (Address: 0x1800df2d0)
WindowsIsStringEmpty (Address: 0x1800df2e0)
WindowsStringHasEmbeddedNull (Address: 0x1800df2e8)
WindowsSubstringWithSpecifiedLength (Address: 0x1800df2b8)

api-ms-win-crt-math-l1-1-0.dll

ceilf (Address: 0x1800df2f8)

api-ms-win-crt-private-l1-1-0.dll

__C_specific_handler (Address: 0x1800df390)
__CxxFrameHandler3 (Address: 0x1800df398)
__CxxFrameHandler4 (Address: 0x1800df410)
__std_terminate (Address: 0x1800df408)
_CxxThrowException (Address: 0x1800df3a0)
_o___std_exception_copy (Address: 0x1800df400)
_o___std_exception_destroy (Address: 0x1800df3f8)
_o___std_type_info_destroy_list (Address: 0x1800df3f0)
_o___stdio_common_vsnprintf_s (Address: 0x1800df3e8)
_o___stdio_common_vswprintf (Address: 0x1800df3e0)
_o___stdio_common_vswprintf_s (Address: 0x1800df3d8)
_o__callnewh (Address: 0x1800df3d0)
_o__cexit (Address: 0x1800df3c8)
_o__configure_narrow_argv (Address: 0x1800df3c0)
_o__crt_atexit (Address: 0x1800df3b8)
_o__errno (Address: 0x1800df3b0)
_o__execute_onexit_table (Address: 0x1800df3a8)
_o__initialize_narrow_environment (Address: 0x1800df308)
_o__initialize_onexit_table (Address: 0x1800df310)
_o__invalid_parameter_noinfo (Address: 0x1800df318)
_o__invalid_parameter_noinfo_noreturn (Address: 0x1800df320)
_o__purecall (Address: 0x1800df328)
_o__register_onexit_function (Address: 0x1800df330)
_o__seh_filter_dll (Address: 0x1800df338)
_o__wcsicmp (Address: 0x1800df348)
_o__wcsnicmp (Address: 0x1800df350)
_o_free (Address: 0x1800df358)
_o_iswspace (Address: 0x1800df360)
_o_malloc (Address: 0x1800df368)
_o_realloc (Address: 0x1800df370)
_o_terminate (Address: 0x1800df378)
_o_towlower (Address: 0x1800df380)
_o_wcstoul (Address: 0x1800df388)
memcmp (Address: 0x1800df418)
memcpy (Address: 0x1800df420)
memmove (Address: 0x1800df340)

api-ms-win-crt-runtime-l1-1-0.dll

_initterm (Address: 0x1800df430)
_initterm_e (Address: 0x1800df438)

api-ms-win-crt-string-l1-1-0.dll

memset (Address: 0x1800df448)

api-ms-win-eventing-provider-l1-1-0.dll

EventActivityIdControl (Address: 0x1800df458)
EventRegister (Address: 0x1800df478)
EventSetInformation (Address: 0x1800df470)
EventUnregister (Address: 0x1800df468)
EventWriteTransfer (Address: 0x1800df460)

api-ms-win-security-base-l1-1-0.dll

CreateWellKnownSid (Address: 0x1800df4b0)
DuplicateTokenEx (Address: 0x1800df4c0)
FreeSid (Address: 0x1800df490)
GetLengthSid (Address: 0x1800df4b8)
GetTokenInformation (Address: 0x1800df4a8)
ImpersonateLoggedOnUser (Address: 0x1800df4a0)
IsWellKnownSid (Address: 0x1800df498)
RevertToSelf (Address: 0x1800df488)

api-ms-win-security-base-l1-2-0.dll

CheckTokenMembershipEx (Address: 0x1800df4d0)

api-ms-win-security-sddl-l1-1-0.dll

ConvertSidToStringSidW (Address: 0x1800df4e8)
ConvertStringSidToSidW (Address: 0x1800df4e0)

api-ms-win-service-private-l1-1-0.dll

I_QueryTagInformation (Address: 0x1800df4f8)

api-ms-win-shcore-stream-winrt-l1-1-0.dll

CreateRandomAccessStreamOverStream (Address: 0x1800df508)
CreateStreamOverRandomAccessStream (Address: 0x1800df510)

api-ms-win-shcore-taskpool-l1-1-0.dll

SHTaskPoolAllowThreadReuse (Address: 0x1800df520)
SHTaskPoolQueueTask (Address: 0x1800df528)

combase.dll

(Address: 0x1800df548)
(Address: 0x1800df538)
(Address: 0x1800df540)

msvcp_win.dll

?_Xlength_error@std@@YAXPEBD@Z (Address: 0x1800df558)

ntdll.dll

NtQueryInformationToken (Address: 0x1800df5b8)
NtQueryWnfStateData (Address: 0x1800df5d0)
RtlAcquireSRWLockExclusive (Address: 0x1800df600)
RtlCapabilityCheck (Address: 0x1800df590)
RtlCheckTokenCapability (Address: 0x1800df588)
RtlCheckTokenMembership (Address: 0x1800df5a0)
RtlCheckTokenMembershipEx (Address: 0x1800df598)
RtlEqualSid (Address: 0x1800df608)
RtlFreeSid (Address: 0x1800df568)
RtlGetDeviceFamilyInfoEnum (Address: 0x1800df5e8)
RtlInitializeSid (Address: 0x1800df5b0)
RtlIsMultiSessionSku (Address: 0x1800df570)
RtlLoadString (Address: 0x1800df5c0)
RtlNtStatusToDosError (Address: 0x1800df5f8)
RtlReleaseSRWLockExclusive (Address: 0x1800df580)
RtlSleepConditionVariableSRW (Address: 0x1800df5e0)
RtlSubAuthoritySid (Address: 0x1800df5a8)
RtlSubscribeWnfStateChangeNotification (Address: 0x1800df5d8)
RtlUnsubscribeWnfNotificationWaitForCompletion (Address: 0x1800df5c8)
RtlUnsubscribeWnfStateChangeNotification (Address: 0x1800df578)
RtlWakeAllConditionVariable (Address: 0x1800df5f0)