frprov.dll

Description: Folder Redirection WMI Provider

Version: 10.0.19041.1

Architecture: 32-bit

Operating System: Windows NT

SHA256: 66bc91f2e75bb32d5d73b1bd674fee15

File Size: 65.5 KB

Uploaded At: Dec. 1, 2025, 7:56 a.m.

Views: 6

Security Warning

This file has been flagged as potentially dangerous.

Reason: Detected potentially dangerous functions used for process injection: OpenProcess

Exported Functions

DllCanUnloadNow (Ordinal: 1, Address: 0x3c90)
DllGetClassObject (Ordinal: 2, Address: 0x3c50)
DllRegisterServer (Ordinal: 3, Address: 0x3fa0)
DllUnregisterServer (Ordinal: 4, Address: 0x3fb0)

Imported DLLs & Functions

api-ms-win-core-com-l1-1-0.dll

CLSIDFromString (Address: 0x10010078)
CoCreateInstance (Address: 0x1001007c)
CoGetCallContext (Address: 0x10010080)
CoRevertToSelf (Address: 0x1001006c)
CoTaskMemFree (Address: 0x10010084)
StringFromCLSID (Address: 0x10010070)
StringFromGUID2 (Address: 0x10010074)

api-ms-win-core-errorhandling-l1-1-0.dll

GetLastError (Address: 0x1001008c)
SetLastError (Address: 0x10010098)
SetUnhandledExceptionFilter (Address: 0x10010090)
UnhandledExceptionFilter (Address: 0x10010094)

api-ms-win-core-handle-l1-1-0.dll

CloseHandle (Address: 0x100100a4)
DuplicateHandle (Address: 0x100100a0)

api-ms-win-core-heap-l1-1-0.dll

GetProcessHeap (Address: 0x100100b4)
HeapAlloc (Address: 0x100100ac)
HeapFree (Address: 0x100100b0)

api-ms-win-core-heap-l2-1-0.dll

LocalFree (Address: 0x100100bc)

api-ms-win-core-libraryloader-l1-2-0.dll

DisableThreadLibraryCalls (Address: 0x100100c8)
GetModuleFileNameW (Address: 0x100100cc)
GetProcAddress (Address: 0x100100c4)

api-ms-win-core-libraryloader-l1-2-1.dll

LoadLibraryW (Address: 0x100100d4)

api-ms-win-core-processenvironment-l1-1-0.dll

ExpandEnvironmentStringsW (Address: 0x100100dc)

api-ms-win-core-processthreads-l1-1-0.dll

GetCurrentProcess (Address: 0x100100e4)
GetCurrentProcessId (Address: 0x100100f0)
GetCurrentThread (Address: 0x100100f8)
GetCurrentThreadId (Address: 0x100100ec)
OpenThreadToken (Address: 0x100100fc)
SetThreadToken (Address: 0x100100f4)
TerminateProcess (Address: 0x100100e8)

api-ms-win-core-processthreads-l1-1-1.dll

OpenProcess (Address: 0x10010104)

api-ms-win-core-profile-l1-1-0.dll

QueryPerformanceCounter (Address: 0x1001010c)

api-ms-win-core-registry-l1-1-0.dll

RegCloseKey (Address: 0x1001011c)
RegCreateKeyExW (Address: 0x10010130)
RegDeleteKeyExW (Address: 0x1001012c)
RegDeleteTreeW (Address: 0x10010118)
RegDeleteValueW (Address: 0x10010120)
RegEnumValueW (Address: 0x10010114)
RegGetValueW (Address: 0x10010124)
RegOpenCurrentUser (Address: 0x10010134)
RegOpenKeyExW (Address: 0x10010138)
RegQueryValueExW (Address: 0x10010128)
RegSetValueExW (Address: 0x1001013c)

api-ms-win-core-string-l1-1-0.dll

CompareStringOrdinal (Address: 0x10010144)

api-ms-win-core-synch-l1-2-0.dll

Sleep (Address: 0x1001014c)

api-ms-win-core-sysinfo-l1-1-0.dll

GetSystemTimeAsFileTime (Address: 0x10010154)
GetTickCount (Address: 0x1001015c)
GetVersionExW (Address: 0x10010158)

api-ms-win-security-base-l1-1-0.dll

GetTokenInformation (Address: 0x10010168)
ImpersonateLoggedOnUser (Address: 0x1001016c)
IsValidSid (Address: 0x10010170)
RevertToSelf (Address: 0x10010164)

api-ms-win-security-sddl-l1-1-0.dll

ConvertSidToStringSidW (Address: 0x1001017c)
ConvertStringSidToSidW (Address: 0x10010178)

msvcrt.dll

__CxxFrameHandler3 (Address: 0x100101e8)
__dllonexit (Address: 0x100101b0)
_amsg_exit (Address: 0x100101c4)
_callnewh (Address: 0x100101a8)
_CxxThrowException (Address: 0x100101a4)
_except_handler4_common (Address: 0x100101cc)
_initterm (Address: 0x100101ec)
_lock (Address: 0x100101c8)
_onexit (Address: 0x1001019c)
_purecall (Address: 0x100101b8)
_unlock (Address: 0x100101d4)
_vsnwprintf (Address: 0x100101e0)
_XcptFilter (Address: 0x10010184)
??_V@YAXPAX@Z (Address: 0x100101b4)
??0exception@@QAE@ABQBD@Z (Address: 0x10010190)
??0exception@@QAE@ABQBDH@Z (Address: 0x1001018c)
??0exception@@QAE@ABV0@@Z (Address: 0x100101d0)
??1exception@@UAE@XZ (Address: 0x100101e4)
??1type_info@@UAE@XZ (Address: 0x100101c0)
??3@YAXPAX@Z (Address: 0x100101d8)
?terminate@@YAXXZ (Address: 0x100101bc)
?what@exception@@UBEPBDXZ (Address: 0x10010188)
free (Address: 0x10010194)
malloc (Address: 0x100101ac)
memcpy (Address: 0x100101a0)
memcpy_s (Address: 0x100101dc)
memmove (Address: 0x10010198)
memset (Address: 0x100101f0)

ntdll.dll

EtwGetTraceEnableFlags (Address: 0x1001020c)
EtwGetTraceEnableLevel (Address: 0x10010200)
EtwGetTraceLoggerHandle (Address: 0x10010204)
EtwRegisterTraceGuidsW (Address: 0x100101fc)
EtwTraceMessage (Address: 0x10010208)
EtwUnregisterTraceGuids (Address: 0x100101f8)

OLEAUT32.dll

SafeArrayCopy (Address: 0x1001004c)
SafeArrayCreate (Address: 0x10010020)
SafeArrayCreateVector (Address: 0x10010044)
SafeArrayDestroy (Address: 0x10010054)
SafeArrayGetElement (Address: 0x10010038)
SafeArrayGetLBound (Address: 0x10010034)
SafeArrayGetUBound (Address: 0x10010048)
SafeArrayGetVartype (Address: 0x10010008)
SafeArrayLock (Address: 0x10010028)
SafeArrayPutElement (Address: 0x10010040)
SafeArrayRedim (Address: 0x10010050)
SafeArrayUnlock (Address: 0x1001003c)
SysAllocString (Address: 0x10010010)
SysAllocStringLen (Address: 0x1001000c)
SysFreeString (Address: 0x10010000)
SysStringByteLen (Address: 0x10010004)
SysStringLen (Address: 0x1001002c)
VariantChangeType (Address: 0x10010018)
VariantClear (Address: 0x10010014)
VariantCopy (Address: 0x1001001c)
VariantCopyInd (Address: 0x10010030)
VariantInit (Address: 0x10010024)

SHLWAPI.dll

SHDeleteKeyW (Address: 0x1001005c)

WTSAPI32.dll

WTSQueryUserToken (Address: 0x10010064)