CloudExperienceHostUser.dll

Description: CloudExperienceHost User Operations

Version: 10.0.19041.4355

Architecture: 32-bit

Operating System: Windows NT

SHA256: 7fc30b11b1b5b5ee8a2a774ed7bc5b2c

File Size: 199.4 KB

Uploaded At: Dec. 1, 2025, 7:53 a.m.

Views: 5

Security Warning

This file has been flagged as potentially dangerous.

Reason: Detected potentially dangerous functions used for process injection: OpenProcess

Exported Functions

DllCanUnloadNow (Ordinal: 1, Address: 0xe110)
DllGetActivationFactory (Ordinal: 2, Address: 0xe0a0)
DllGetClassObject (Ordinal: 3, Address: 0xe0c0)

Imported DLLs & Functions

api-ms-win-core-apiquery-l1-1-0.dll

ApiSetQueryApiSetPresence (Address: 0x1002c048)

api-ms-win-core-com-l1-1-0.dll

CoCreateFreeThreadedMarshaler (Address: 0x1002c058)
CoCreateInstance (Address: 0x1002c06c)
CoGetCallContext (Address: 0x1002c054)
CoGetCallerTID (Address: 0x1002c084)
CoGetMalloc (Address: 0x1002c080)
CoImpersonateClient (Address: 0x1002c064)
CoMarshalInterface (Address: 0x1002c07c)
CoReleaseMarshalData (Address: 0x1002c068)
CoRevertToSelf (Address: 0x1002c060)
CoTaskMemAlloc (Address: 0x1002c078)
CoTaskMemFree (Address: 0x1002c074)
CoWaitForMultipleHandles (Address: 0x1002c05c)
CreateStreamOnHGlobal (Address: 0x1002c088)
PropVariantClear (Address: 0x1002c050)
StringFromCLSID (Address: 0x1002c070)

api-ms-win-core-com-l1-1-1.dll

RoGetAgileReference (Address: 0x1002c090)

api-ms-win-core-com-midlproxystub-l1-1-0.dll

CStdStubBuffer2_Connect (Address: 0x1002c0d0)
CStdStubBuffer2_CountRefs (Address: 0x1002c0c4)
CStdStubBuffer2_Disconnect (Address: 0x1002c0bc)
CStdStubBuffer2_QueryInterface (Address: 0x1002c0dc)
NdrProxyForwardingFunction3 (Address: 0x1002c09c)
NdrProxyForwardingFunction4 (Address: 0x1002c0cc)
NdrProxyForwardingFunction5 (Address: 0x1002c0c0)
ObjectStublessClient10 (Address: 0x1002c0a4)
ObjectStublessClient11 (Address: 0x1002c0c8)
ObjectStublessClient12 (Address: 0x1002c0d4)
ObjectStublessClient13 (Address: 0x1002c0b0)
ObjectStublessClient14 (Address: 0x1002c0d8)
ObjectStublessClient15 (Address: 0x1002c0a0)
ObjectStublessClient16 (Address: 0x1002c0b4)
ObjectStublessClient6 (Address: 0x1002c0b8)
ObjectStublessClient7 (Address: 0x1002c098)
ObjectStublessClient8 (Address: 0x1002c0ac)
ObjectStublessClient9 (Address: 0x1002c0a8)

api-ms-win-core-debug-l1-1-0.dll

DebugBreak (Address: 0x1002c0e8)
IsDebuggerPresent (Address: 0x1002c0ec)
OutputDebugStringW (Address: 0x1002c0e4)

api-ms-win-core-delayload-l1-1-0.dll

DelayLoadFailureHook (Address: 0x1002c0f4)

api-ms-win-core-delayload-l1-1-1.dll

ResolveDelayLoadedAPI (Address: 0x1002c0fc)

api-ms-win-core-errorhandling-l1-1-0.dll

GetLastError (Address: 0x1002c114)
RaiseException (Address: 0x1002c10c)
SetLastError (Address: 0x1002c104)
SetUnhandledExceptionFilter (Address: 0x1002c110)
UnhandledExceptionFilter (Address: 0x1002c108)

api-ms-win-core-handle-l1-1-0.dll

CloseHandle (Address: 0x1002c120)
DuplicateHandle (Address: 0x1002c11c)

api-ms-win-core-heap-l1-1-0.dll

GetProcessHeap (Address: 0x1002c130)
HeapAlloc (Address: 0x1002c128)
HeapFree (Address: 0x1002c12c)

api-ms-win-core-heap-l2-1-0.dll

LocalAlloc (Address: 0x1002c13c)
LocalFree (Address: 0x1002c138)

api-ms-win-core-interlocked-l1-1-0.dll

InitializeSListHead (Address: 0x1002c144)

api-ms-win-core-libraryloader-l1-2-0.dll

DisableThreadLibraryCalls (Address: 0x1002c14c)
GetModuleFileNameA (Address: 0x1002c154)
GetModuleHandleExW (Address: 0x1002c15c)
GetModuleHandleW (Address: 0x1002c158)
GetProcAddress (Address: 0x1002c150)

api-ms-win-core-localization-l1-2-0.dll

FormatMessageW (Address: 0x1002c164)

api-ms-win-core-processthreads-l1-1-0.dll

GetCurrentProcess (Address: 0x1002c174)
GetCurrentProcessId (Address: 0x1002c184)
GetCurrentThread (Address: 0x1002c188)
GetCurrentThreadId (Address: 0x1002c16c)
GetProcessId (Address: 0x1002c17c)
OpenProcessToken (Address: 0x1002c170)
OpenThreadToken (Address: 0x1002c180)
TerminateProcess (Address: 0x1002c178)

api-ms-win-core-processthreads-l1-1-1.dll

IsProcessorFeaturePresent (Address: 0x1002c194)
OpenProcess (Address: 0x1002c190)

api-ms-win-core-profile-l1-1-0.dll

QueryPerformanceCounter (Address: 0x1002c19c)

api-ms-win-core-registry-l1-1-0.dll

RegCloseKey (Address: 0x1002c1a8)
RegGetValueW (Address: 0x1002c1a4)
RegOpenKeyExW (Address: 0x1002c1b0)
RegSetValueExW (Address: 0x1002c1ac)

api-ms-win-core-string-l1-1-0.dll

MultiByteToWideChar (Address: 0x1002c1b8)

api-ms-win-core-synch-l1-1-0.dll

AcquireSRWLockExclusive (Address: 0x1002c1d8)
AcquireSRWLockShared (Address: 0x1002c1d0)
CreateEventExW (Address: 0x1002c1c0)
CreateMutexExW (Address: 0x1002c1d4)
CreateSemaphoreExW (Address: 0x1002c1c4)
OpenSemaphoreW (Address: 0x1002c1e0)
ReleaseMutex (Address: 0x1002c1e4)
ReleaseSemaphore (Address: 0x1002c1cc)
ReleaseSRWLockExclusive (Address: 0x1002c1f0)
ReleaseSRWLockShared (Address: 0x1002c1e8)
SetEvent (Address: 0x1002c1c8)
WaitForSingleObject (Address: 0x1002c1dc)
WaitForSingleObjectEx (Address: 0x1002c1ec)

api-ms-win-core-synch-l1-2-0.dll

InitOnceBeginInitialize (Address: 0x1002c204)
InitOnceComplete (Address: 0x1002c1fc)
InitOnceExecuteOnce (Address: 0x1002c1f8)
Sleep (Address: 0x1002c200)

api-ms-win-core-sysinfo-l1-1-0.dll

GetSystemTimeAsFileTime (Address: 0x1002c210)
GetTickCount (Address: 0x1002c20c)
GetTickCount64 (Address: 0x1002c214)

api-ms-win-core-util-l1-1-0.dll

DecodePointer (Address: 0x1002c21c)
EncodePointer (Address: 0x1002c220)

api-ms-win-core-winrt-error-l1-1-0.dll

GetRestrictedErrorInfo (Address: 0x1002c230)
RoOriginateError (Address: 0x1002c234)
RoOriginateErrorW (Address: 0x1002c228)
RoTransformError (Address: 0x1002c238)
SetRestrictedErrorInfo (Address: 0x1002c22c)

api-ms-win-core-winrt-error-l1-1-1.dll

IsErrorPropagationEnabled (Address: 0x1002c244)
RoGetMatchingRestrictedErrorInfo (Address: 0x1002c240)
RoReportFailedDelegate (Address: 0x1002c248)

api-ms-win-core-winrt-l1-1-0.dll

RoActivateInstance (Address: 0x1002c254)
RoGetActivationFactory (Address: 0x1002c250)

api-ms-win-core-winrt-string-l1-1-0.dll

HSTRING_UserFree (Address: 0x1002c268)
HSTRING_UserMarshal (Address: 0x1002c26c)
HSTRING_UserSize (Address: 0x1002c270)
HSTRING_UserUnmarshal (Address: 0x1002c264)
WindowsCreateString (Address: 0x1002c25c)
WindowsCreateStringReference (Address: 0x1002c274)
WindowsDeleteString (Address: 0x1002c278)
WindowsDuplicateString (Address: 0x1002c260)
WindowsGetStringRawBuffer (Address: 0x1002c27c)
WindowsIsStringEmpty (Address: 0x1002c280)
WindowsStringHasEmbeddedNull (Address: 0x1002c284)

api-ms-win-crt-private-l1-1-0.dll

__CxxFrameHandler3 (Address: 0x1002c2f8)
__std_terminate (Address: 0x1002c2f4)
_CxxThrowException (Address: 0x1002c2d0)
_except_handler4_common (Address: 0x1002c2c8)
_o___std_exception_copy (Address: 0x1002c2f0)
_o___std_exception_destroy (Address: 0x1002c2ec)
_o___std_type_info_destroy_list (Address: 0x1002c2e8)
_o___stdio_common_vsnprintf_s (Address: 0x1002c2e4)
_o___stdio_common_vswprintf (Address: 0x1002c2e0)
_o__callnewh (Address: 0x1002c2dc)
_o__cexit (Address: 0x1002c2d8)
_o__configure_narrow_argv (Address: 0x1002c2d4)
_o__crt_atexit (Address: 0x1002c2cc)
_o__errno (Address: 0x1002c28c)
_o__execute_onexit_table (Address: 0x1002c290)
_o__initialize_narrow_environment (Address: 0x1002c294)
_o__initialize_onexit_table (Address: 0x1002c298)
_o__invalid_parameter_noinfo (Address: 0x1002c29c)
_o__invalid_parameter_noinfo_noreturn (Address: 0x1002c2a0)
_o__purecall (Address: 0x1002c2a4)
_o__register_onexit_function (Address: 0x1002c2a8)
_o__seh_filter_dll (Address: 0x1002c2ac)
_o__wtol (Address: 0x1002c2b4)
_o_free (Address: 0x1002c2b8)
_o_malloc (Address: 0x1002c2bc)
_o_terminate (Address: 0x1002c2c0)
_o_toupper (Address: 0x1002c2c4)
memcmp (Address: 0x1002c2fc)
memcpy (Address: 0x1002c300)
memmove (Address: 0x1002c2b0)

api-ms-win-crt-runtime-l1-1-0.dll

_initterm (Address: 0x1002c30c)
_initterm_e (Address: 0x1002c308)

api-ms-win-crt-string-l1-1-0.dll

memset (Address: 0x1002c314)

api-ms-win-eventing-provider-l1-1-0.dll

EventActivityIdControl (Address: 0x1002c320)
EventProviderEnabled (Address: 0x1002c31c)
EventRegister (Address: 0x1002c328)
EventSetInformation (Address: 0x1002c32c)
EventUnregister (Address: 0x1002c324)
EventWriteTransfer (Address: 0x1002c330)

api-ms-win-security-base-l1-1-0.dll

DuplicateTokenEx (Address: 0x1002c344)
EqualSid (Address: 0x1002c340)
GetAce (Address: 0x1002c33c)
GetTokenInformation (Address: 0x1002c348)
RevertToSelf (Address: 0x1002c338)

api-ms-win-stateseparation-helpers-l1-1-0.dll

GetPersistedRegistryLocationW (Address: 0x1002c350)

combase.dll

(Address: 0x1002c358)

msvcp_win.dll

?_Xlength_error@std@@YAXPBD@Z (Address: 0x1002c360)

ntdll.dll

NtQuerySecurityObject (Address: 0x1002c378)
NtSetSecurityObject (Address: 0x1002c370)
RtlAddAccessAllowedAce (Address: 0x1002c37c)
RtlAddAce (Address: 0x1002c390)
RtlCreateAcl (Address: 0x1002c36c)
RtlCreateSecurityDescriptor (Address: 0x1002c374)
RtlGetAce (Address: 0x1002c384)
RtlGetDaclSecurityDescriptor (Address: 0x1002c394)
RtlLengthSid (Address: 0x1002c388)
RtlNtStatusToDosError (Address: 0x1002c368)
RtlQueryInformationAcl (Address: 0x1002c38c)
RtlSetDaclSecurityDescriptor (Address: 0x1002c380)

PROPSYS.dll

PropVariantToStringAlloc (Address: 0x1002c000)

RPCRT4.dll

CStdStubBuffer_AddRef (Address: 0x1002c034)
CStdStubBuffer_DebugServerQueryInterface (Address: 0x1002c028)
CStdStubBuffer_DebugServerRelease (Address: 0x1002c040)
CStdStubBuffer_Invoke (Address: 0x1002c018)
CStdStubBuffer_IsIIDSupported (Address: 0x1002c024)
IUnknown_AddRef_Proxy (Address: 0x1002c008)
IUnknown_QueryInterface_Proxy (Address: 0x1002c02c)
IUnknown_Release_Proxy (Address: 0x1002c038)
NdrCStdStubBuffer2_Release (Address: 0x1002c00c)
NdrDllCanUnloadNow (Address: 0x1002c014)
NdrDllGetClassObject (Address: 0x1002c010)
NdrOleAllocate (Address: 0x1002c03c)
NdrOleFree (Address: 0x1002c030)
NdrStubCall2 (Address: 0x1002c020)
NdrStubForwardingFunction (Address: 0x1002c01c)

twinapi.appcore.dll

(Address: 0x1002c39c)
(Address: 0x1002c3a0)