CloudDomainJoinDataModelServer.dll

Description: CloudDomainJoinDataModelServer

Version: 10.0.19041.6328

Architecture: 64-bit

Operating System: Windows NT

SHA256: f2d307bba62c1fdae83e0b62955ec92f

File Size: 480.0 KB

Uploaded At: Dec. 1, 2025, 7:24 a.m.

Views: 8

Security Warning

This file has been flagged as potentially dangerous.

Reason: Detected potentially dangerous functions used for process injection: OpenProcess

Exported Functions

DllCanUnloadNow (Ordinal: 1, Address: 0x59b0)
DllGetActivationFactory (Ordinal: 2, Address: 0x56e0)
DllGetClassObject (Ordinal: 3, Address: 0x58c0)

Imported DLLs & Functions

AADAUTHHELPER.DLL

CreateAuthBuffer (Address: 0x18005b018)
CreateTokenAuthBuffer (Address: 0x18005b010)
CreateTokenAuthBufferEx (Address: 0x18005b020)

api-ms-win-core-apiquery-l1-1-0.dll

ApiSetQueryApiSetPresence (Address: 0x18005b0a8)

api-ms-win-core-datetime-l1-1-1.dll

GetDateFormatEx (Address: 0x18005b0b8)
GetTimeFormatEx (Address: 0x18005b0c0)

api-ms-win-core-debug-l1-1-0.dll

DebugBreak (Address: 0x18005b0d0)
IsDebuggerPresent (Address: 0x18005b0d8)
OutputDebugStringW (Address: 0x18005b0e0)

api-ms-win-core-delayload-l1-1-0.dll

DelayLoadFailureHook (Address: 0x18005b0f0)

api-ms-win-core-delayload-l1-1-1.dll

ResolveDelayLoadedAPI (Address: 0x18005b100)

api-ms-win-core-errorhandling-l1-1-0.dll

GetLastError (Address: 0x18005b128)
RaiseException (Address: 0x18005b130)
SetLastError (Address: 0x18005b118)
SetUnhandledExceptionFilter (Address: 0x18005b110)
UnhandledExceptionFilter (Address: 0x18005b120)

api-ms-win-core-file-l1-1-0.dll

CompareFileTime (Address: 0x18005b140)

api-ms-win-core-handle-l1-1-0.dll

CloseHandle (Address: 0x18005b158)
DuplicateHandle (Address: 0x18005b150)

api-ms-win-core-heap-l1-1-0.dll

GetProcessHeap (Address: 0x18005b170)
HeapAlloc (Address: 0x18005b180)
HeapDestroy (Address: 0x18005b190)
HeapFree (Address: 0x18005b178)
HeapReAlloc (Address: 0x18005b188)
HeapSize (Address: 0x18005b168)

api-ms-win-core-heap-l2-1-0.dll

LocalAlloc (Address: 0x18005b1a8)
LocalFree (Address: 0x18005b1a0)

api-ms-win-core-heap-obsolete-l1-1-0.dll

LocalSize (Address: 0x18005b1b8)

api-ms-win-core-libraryloader-l1-2-0.dll

DisableThreadLibraryCalls (Address: 0x18005b1e8)
FindResourceExW (Address: 0x18005b200)
FreeLibrary (Address: 0x18005b1f0)
GetModuleFileNameA (Address: 0x18005b208)
GetModuleFileNameW (Address: 0x18005b1e0)
GetModuleHandleExW (Address: 0x18005b218)
GetModuleHandleW (Address: 0x18005b210)
GetProcAddress (Address: 0x18005b1f8)
LoadResource (Address: 0x18005b1c8)
LockResource (Address: 0x18005b1d0)
SizeofResource (Address: 0x18005b1d8)

api-ms-win-core-localization-l1-2-0.dll

FormatMessageW (Address: 0x18005b228)

api-ms-win-core-processthreads-l1-1-0.dll

GetCurrentProcess (Address: 0x18005b260)
GetCurrentProcessId (Address: 0x18005b270)
GetCurrentThread (Address: 0x18005b248)
GetCurrentThreadId (Address: 0x18005b238)
GetProcessId (Address: 0x18005b250)
OpenProcessToken (Address: 0x18005b258)
OpenThreadToken (Address: 0x18005b240)
TerminateProcess (Address: 0x18005b268)

api-ms-win-core-processthreads-l1-1-1.dll

GetProcessMitigationPolicy (Address: 0x18005b280)
OpenProcess (Address: 0x18005b288)

api-ms-win-core-profile-l1-1-0.dll

QueryPerformanceCounter (Address: 0x18005b298)

api-ms-win-core-registry-l1-1-0.dll

RegCloseKey (Address: 0x18005b2b0)
RegCreateKeyExW (Address: 0x18005b2c8)
RegGetValueW (Address: 0x18005b2c0)
RegOpenKeyExW (Address: 0x18005b2a8)
RegQueryValueExW (Address: 0x18005b2d0)
RegSetValueExW (Address: 0x18005b2b8)

api-ms-win-core-registry-l2-1-0.dll

RegDeleteKeyW (Address: 0x18005b2e0)

api-ms-win-core-rtlsupport-l1-1-0.dll

RtlCaptureContext (Address: 0x18005b300)
RtlLookupFunctionEntry (Address: 0x18005b2f0)
RtlVirtualUnwind (Address: 0x18005b2f8)

api-ms-win-core-string-l1-1-0.dll

CompareStringOrdinal (Address: 0x18005b310)
WideCharToMultiByte (Address: 0x18005b318)

api-ms-win-core-synch-l1-1-0.dll

AcquireSRWLockExclusive (Address: 0x18005b3b0)
AcquireSRWLockShared (Address: 0x18005b358)
CreateEventExW (Address: 0x18005b390)
CreateMutexExW (Address: 0x18005b348)
CreateSemaphoreExW (Address: 0x18005b388)
DeleteCriticalSection (Address: 0x18005b370)
EnterCriticalSection (Address: 0x18005b378)
InitializeCriticalSection (Address: 0x18005b3a8)
InitializeCriticalSectionEx (Address: 0x18005b368)
LeaveCriticalSection (Address: 0x18005b380)
OpenSemaphoreW (Address: 0x18005b340)
ReleaseMutex (Address: 0x18005b330)
ReleaseSemaphore (Address: 0x18005b350)
ReleaseSRWLockExclusive (Address: 0x18005b398)
ReleaseSRWLockShared (Address: 0x18005b360)
SetEvent (Address: 0x18005b3a0)
WaitForSingleObject (Address: 0x18005b338)
WaitForSingleObjectEx (Address: 0x18005b328)

api-ms-win-core-synch-l1-2-0.dll

InitOnceBeginInitialize (Address: 0x18005b3c8)
InitOnceComplete (Address: 0x18005b3d0)
InitOnceExecuteOnce (Address: 0x18005b3c0)
Sleep (Address: 0x18005b3d8)

api-ms-win-core-sysinfo-l1-1-0.dll

GetComputerNameExW (Address: 0x18005b3f0)
GetSystemTime (Address: 0x18005b3f8)
GetSystemTimeAsFileTime (Address: 0x18005b400)
GetTickCount (Address: 0x18005b3e8)
GetTickCount64 (Address: 0x18005b408)

api-ms-win-core-threadpool-l1-2-0.dll

CloseThreadpoolTimer (Address: 0x18005b418)
CreateThreadpoolTimer (Address: 0x18005b430)
SetThreadpoolTimer (Address: 0x18005b420)
WaitForThreadpoolTimerCallbacks (Address: 0x18005b428)

api-ms-win-core-util-l1-1-0.dll

DecodePointer (Address: 0x18005b440)
EncodePointer (Address: 0x18005b448)

api-ms-win-core-winrt-l1-1-0.dll

RoActivateInstance (Address: 0x18005b458)
RoGetActivationFactory (Address: 0x18005b460)

api-ms-win-eventing-provider-l1-1-0.dll

EventActivityIdControl (Address: 0x18005b490)
EventProviderEnabled (Address: 0x18005b498)
EventRegister (Address: 0x18005b470)
EventSetInformation (Address: 0x18005b488)
EventUnregister (Address: 0x18005b480)
EventWriteTransfer (Address: 0x18005b478)

api-ms-win-oobe-notification-l1-1-0.dll

OOBEComplete (Address: 0x18005b4a8)

api-ms-win-security-base-l1-1-0.dll

CopySid (Address: 0x18005b4c8)
CreateWellKnownSid (Address: 0x18005b4d8)
DuplicateToken (Address: 0x18005b4e0)
DuplicateTokenEx (Address: 0x18005b4d0)
EqualSid (Address: 0x18005b500)
GetAce (Address: 0x18005b4f8)
GetLengthSid (Address: 0x18005b4c0)
GetTokenInformation (Address: 0x18005b4f0)
IsValidSid (Address: 0x18005b4b8)
RevertToSelf (Address: 0x18005b4e8)

api-ms-win-security-base-l1-2-0.dll

CheckTokenMembershipEx (Address: 0x18005b510)

api-ms-win-security-credentials-l1-1-0.dll

CredProtectW (Address: 0x18005b520)

api-ms-win-security-lsalookup-l1-1-0.dll

LookupAccountNameLocalW (Address: 0x18005b530)

api-ms-win-security-lsalookup-l1-1-2.dll

LsaLookupUserAccountType (Address: 0x18005b540)

api-ms-win-security-sddl-l1-1-0.dll

ConvertSidToStringSidW (Address: 0x18005b550)

api-ms-win-shcore-taskpool-l1-1-0.dll

SHTaskPoolAllowThreadReuse (Address: 0x18005b568)
SHTaskPoolQueueTask (Address: 0x18005b560)

api-ms-win-stateseparation-helpers-l1-1-0.dll

GetPersistedRegistryLocationW (Address: 0x18005b578)

combase.dll

(Address: 0x18005b588)

CRYPT32.dll

CryptProtectMemory (Address: 0x18005b038)
CryptStringToBinaryW (Address: 0x18005b040)
CryptUnprotectMemory (Address: 0x18005b030)

cryptngc.dll

NgcQueryEnabled (Address: 0x18005b598)

msvcrt.dll

__C_specific_handler (Address: 0x18005b5f8)
__CxxFrameHandler3 (Address: 0x18005b630)
__dllonexit (Address: 0x18005b5b0)
_amsg_exit (Address: 0x18005b648)
_callnewh (Address: 0x18005b5b8)
_CxxThrowException (Address: 0x18005b680)
_initterm (Address: 0x18005b600)
_lock (Address: 0x18005b5f0)
_onexit (Address: 0x18005b5c0)
_purecall (Address: 0x18005b668)
_unlock (Address: 0x18005b5a8)
_vsnwprintf (Address: 0x18005b5e8)
_wcsnicmp (Address: 0x18005b628)
_XcptFilter (Address: 0x18005b650)
??0exception@@QEAA@AEBQEBD@Z (Address: 0x18005b658)
??0exception@@QEAA@AEBQEBDH@Z (Address: 0x18005b660)
??0exception@@QEAA@AEBV0@@Z (Address: 0x18005b678)
??1exception@@UEAA@XZ (Address: 0x18005b638)
??1type_info@@UEAA@XZ (Address: 0x18005b5d8)
??3@YAXPEAX@Z (Address: 0x18005b670)
?what@exception@@UEBAPEBDXZ (Address: 0x18005b698)
free (Address: 0x18005b640)
malloc (Address: 0x18005b608)
memcmp (Address: 0x18005b5d0)
memcpy (Address: 0x18005b688)
memcpy_s (Address: 0x18005b690)
memmove (Address: 0x18005b5e0)
memmove_s (Address: 0x18005b618)
memset (Address: 0x18005b5c8)
toupper (Address: 0x18005b620)
wcschr (Address: 0x18005b610)
wcscmp (Address: 0x18005b6a0)

netutils.dll

NetApiBufferFree (Address: 0x18005b6b0)

ntdll.dll

NtQuerySecurityObject (Address: 0x18005b6e0)
NtSetSecurityObject (Address: 0x18005b728)
RtlAddAccessAllowedAce (Address: 0x18005b6f0)
RtlAddAce (Address: 0x18005b6f8)
RtlCreateAcl (Address: 0x18005b708)
RtlCreateSecurityDescriptor (Address: 0x18005b6d8)
RtlGetAce (Address: 0x18005b700)
RtlGetDaclSecurityDescriptor (Address: 0x18005b720)
RtlGetDeviceFamilyInfoEnum (Address: 0x18005b6c8)
RtlInitUnicodeString (Address: 0x18005b6c0)
RtlIsMultiSessionSku (Address: 0x18005b6d0)
RtlLengthSid (Address: 0x18005b710)
RtlQueryInformationAcl (Address: 0x18005b718)
RtlSetDaclSecurityDescriptor (Address: 0x18005b6e8)

RPCRT4.dll

I_RpcExceptionFilter (Address: 0x18005b078)
I_RpcMapWin32Status (Address: 0x18005b068)
NdrClientCall3 (Address: 0x18005b080)
RpcBindingBind (Address: 0x18005b050)
RpcBindingCreateW (Address: 0x18005b070)
RpcBindingFree (Address: 0x18005b058)
RpcBindingFromStringBindingW (Address: 0x18005b090)
RpcSsDestroyClientContext (Address: 0x18005b060)
RpcStringBindingComposeW (Address: 0x18005b098)
RpcStringFreeW (Address: 0x18005b088)

twinapi.appcore.dll

(Address: 0x18005b738)
(Address: 0x18005b740)

wkscli.dll

NetGetJoinInformation (Address: 0x18005b750)