CloudExperienceHost.dll

Description: CloudExperienceHost

Version: 10.0.19041.6033

Architecture: 64-bit

Operating System: Windows NT

SHA256: b13787b76aa6094daf91b850a94a3ce9

File Size: 426.4 KB

Uploaded At: Dec. 1, 2025, 7:24 a.m.

Views: 19

Security Warning

This file has been flagged as potentially dangerous.

Reason: Detected potentially dangerous functions used for process injection: OpenProcess

Exported Functions

DllCanUnloadNow (Ordinal: 1, Address: 0x56e0)
DllGetActivationFactory (Ordinal: 2, Address: 0x53d0)
DllGetClassObject (Ordinal: 3, Address: 0x55b0)

Imported DLLs & Functions

api-ms-win-appmodel-runtime-l1-1-1.dll

FindPackagesByPackageFamily (Address: 0x18004f3f0)
ParseApplicationUserModelId (Address: 0x18004f3f8)

api-ms-win-core-apiquery-l1-1-0.dll

ApiSetQueryApiSetPresence (Address: 0x18004f408)

api-ms-win-core-com-midlproxystub-l1-1-0.dll

CStdStubBuffer2_Connect (Address: 0x18004f4a0)
CStdStubBuffer2_CountRefs (Address: 0x18004f468)
CStdStubBuffer2_Disconnect (Address: 0x18004f498)
CStdStubBuffer2_QueryInterface (Address: 0x18004f440)
NdrProxyForwardingFunction3 (Address: 0x18004f478)
NdrProxyForwardingFunction4 (Address: 0x18004f428)
NdrProxyForwardingFunction5 (Address: 0x18004f430)
ObjectStublessClient10 (Address: 0x18004f458)
ObjectStublessClient11 (Address: 0x18004f418)
ObjectStublessClient12 (Address: 0x18004f460)
ObjectStublessClient13 (Address: 0x18004f480)
ObjectStublessClient14 (Address: 0x18004f420)
ObjectStublessClient15 (Address: 0x18004f490)
ObjectStublessClient16 (Address: 0x18004f470)
ObjectStublessClient17 (Address: 0x18004f450)
ObjectStublessClient6 (Address: 0x18004f438)
ObjectStublessClient7 (Address: 0x18004f488)
ObjectStublessClient8 (Address: 0x18004f4a8)
ObjectStublessClient9 (Address: 0x18004f448)

api-ms-win-core-debug-l1-1-0.dll

DebugBreak (Address: 0x18004f4c0)
IsDebuggerPresent (Address: 0x18004f4c8)
OutputDebugStringW (Address: 0x18004f4b8)

api-ms-win-core-delayload-l1-1-0.dll

DelayLoadFailureHook (Address: 0x18004f4d8)

api-ms-win-core-delayload-l1-1-1.dll

ResolveDelayLoadedAPI (Address: 0x18004f4e8)

api-ms-win-core-errorhandling-l1-1-0.dll

GetLastError (Address: 0x18004f518)
RaiseException (Address: 0x18004f510)
SetLastError (Address: 0x18004f4f8)
SetUnhandledExceptionFilter (Address: 0x18004f500)
UnhandledExceptionFilter (Address: 0x18004f508)

api-ms-win-core-handle-l1-1-0.dll

CloseHandle (Address: 0x18004f528)

api-ms-win-core-heap-l1-1-0.dll

GetProcessHeap (Address: 0x18004f540)
HeapAlloc (Address: 0x18004f538)
HeapFree (Address: 0x18004f548)

api-ms-win-core-heap-l2-1-0.dll

LocalAlloc (Address: 0x18004f558)
LocalFree (Address: 0x18004f560)

api-ms-win-core-interlocked-l1-1-0.dll

InitializeSListHead (Address: 0x18004f570)

api-ms-win-core-libraryloader-l1-2-0.dll

DisableThreadLibraryCalls (Address: 0x18004f5b0)
FreeLibrary (Address: 0x18004f598)
GetModuleFileNameA (Address: 0x18004f5a8)
GetModuleFileNameW (Address: 0x18004f588)
GetModuleHandleExW (Address: 0x18004f580)
GetModuleHandleW (Address: 0x18004f5b8)
GetProcAddress (Address: 0x18004f5a0)
LoadLibraryExW (Address: 0x18004f590)

api-ms-win-core-libraryloader-l1-2-1.dll

LoadLibraryW (Address: 0x18004f5c8)

api-ms-win-core-localization-l1-2-0.dll

FormatMessageW (Address: 0x18004f5d8)

api-ms-win-core-processenvironment-l1-1-0.dll

ExpandEnvironmentStringsW (Address: 0x18004f5e8)

api-ms-win-core-processthreads-l1-1-0.dll

GetCurrentProcess (Address: 0x18004f618)
GetCurrentProcessId (Address: 0x18004f620)
GetCurrentThreadId (Address: 0x18004f5f8)
GetProcessId (Address: 0x18004f600)
OpenProcessToken (Address: 0x18004f608)
TerminateProcess (Address: 0x18004f610)

api-ms-win-core-processthreads-l1-1-1.dll

GetProcessMitigationPolicy (Address: 0x18004f640)
IsProcessorFeaturePresent (Address: 0x18004f638)
OpenProcess (Address: 0x18004f630)

api-ms-win-core-profile-l1-1-0.dll

QueryPerformanceCounter (Address: 0x18004f650)

api-ms-win-core-quirks-l1-1-0.dll

QuirkIsEnabled (Address: 0x18004f660)

api-ms-win-core-registry-l1-1-0.dll

RegCloseKey (Address: 0x18004f6a8)
RegCreateKeyExW (Address: 0x18004f6b0)
RegDeleteTreeW (Address: 0x18004f670)
RegEnumKeyExW (Address: 0x18004f690)
RegGetValueW (Address: 0x18004f678)
RegOpenKeyExW (Address: 0x18004f680)
RegQueryInfoKeyW (Address: 0x18004f698)
RegQueryValueExW (Address: 0x18004f6a0)
RegSetValueExW (Address: 0x18004f688)

api-ms-win-core-rtlsupport-l1-1-0.dll

RtlCaptureContext (Address: 0x18004f6d0)
RtlLookupFunctionEntry (Address: 0x18004f6c8)
RtlVirtualUnwind (Address: 0x18004f6c0)

api-ms-win-core-shlwapi-legacy-l1-1-0.dll

PathCommonPrefixW (Address: 0x18004f6f0)
PathFindExtensionW (Address: 0x18004f6e0)
SHExpandEnvironmentStringsW (Address: 0x18004f6e8)

api-ms-win-core-string-l1-1-0.dll

CompareStringOrdinal (Address: 0x18004f708)
MultiByteToWideChar (Address: 0x18004f700)

api-ms-win-core-synch-l1-1-0.dll

AcquireSRWLockExclusive (Address: 0x18004f728)
AcquireSRWLockShared (Address: 0x18004f7a0)
CreateEventExW (Address: 0x18004f770)
CreateEventW (Address: 0x18004f780)
CreateMutexExW (Address: 0x18004f778)
CreateSemaphoreExW (Address: 0x18004f758)
DeleteCriticalSection (Address: 0x18004f790)
EnterCriticalSection (Address: 0x18004f798)
InitializeCriticalSectionEx (Address: 0x18004f788)
LeaveCriticalSection (Address: 0x18004f748)
OpenEventW (Address: 0x18004f768)
OpenSemaphoreW (Address: 0x18004f738)
ReleaseMutex (Address: 0x18004f730)
ReleaseSemaphore (Address: 0x18004f750)
ReleaseSRWLockExclusive (Address: 0x18004f720)
ReleaseSRWLockShared (Address: 0x18004f740)
SetEvent (Address: 0x18004f7a8)
WaitForSingleObject (Address: 0x18004f718)
WaitForSingleObjectEx (Address: 0x18004f760)

api-ms-win-core-synch-l1-2-0.dll

InitOnceBeginInitialize (Address: 0x18004f7b8)
InitOnceComplete (Address: 0x18004f7d0)
InitOnceExecuteOnce (Address: 0x18004f7c8)
Sleep (Address: 0x18004f7c0)

api-ms-win-core-sysinfo-l1-1-0.dll

GetSystemDirectoryW (Address: 0x18004f7f8)
GetSystemTimeAsFileTime (Address: 0x18004f808)
GetTickCount (Address: 0x18004f7e8)
GetTickCount64 (Address: 0x18004f7f0)
GetVersionExA (Address: 0x18004f7e0)
GetVersionExW (Address: 0x18004f800)

api-ms-win-core-threadpool-l1-2-0.dll

CloseThreadpoolTimer (Address: 0x18004f828)
CreateThreadpoolTimer (Address: 0x18004f818)
SetThreadpoolTimer (Address: 0x18004f830)
WaitForThreadpoolTimerCallbacks (Address: 0x18004f820)

api-ms-win-core-timezone-l1-1-0.dll

FileTimeToSystemTime (Address: 0x18004f840)
SystemTimeToFileTime (Address: 0x18004f848)

api-ms-win-core-util-l1-1-0.dll

DecodePointer (Address: 0x18004f858)
EncodePointer (Address: 0x18004f860)

api-ms-win-core-winrt-l1-1-0.dll

RoActivateInstance (Address: 0x18004f878)
RoGetActivationFactory (Address: 0x18004f870)

api-ms-win-crt-private-l1-1-0.dll

__C_specific_handler (Address: 0x18004f918)
__CxxFrameHandler3 (Address: 0x18004f950)
__CxxFrameHandler4 (Address: 0x18004f990)
__std_terminate (Address: 0x18004f980)
_CxxThrowException (Address: 0x18004f940)
_o___std_exception_copy (Address: 0x18004f970)
_o___std_exception_destroy (Address: 0x18004f968)
_o___std_type_info_destroy_list (Address: 0x18004f960)
_o___stdio_common_vsnprintf_s (Address: 0x18004f958)
_o___stdio_common_vswprintf (Address: 0x18004f948)
_o__callnewh (Address: 0x18004f938)
_o__cexit (Address: 0x18004f930)
_o__configure_narrow_argv (Address: 0x18004f928)
_o__crt_atexit (Address: 0x18004f920)
_o__errno (Address: 0x18004f988)
_o__execute_onexit_table (Address: 0x18004f978)
_o__get_errno (Address: 0x18004f888)
_o__initialize_narrow_environment (Address: 0x18004f890)
_o__initialize_onexit_table (Address: 0x18004f898)
_o__invalid_parameter_noinfo (Address: 0x18004f8a0)
_o__invalid_parameter_noinfo_noreturn (Address: 0x18004f8a8)
_o__purecall (Address: 0x18004f8b0)
_o__register_onexit_function (Address: 0x18004f8b8)
_o__seh_filter_dll (Address: 0x18004f8c0)
_o__set_errno (Address: 0x18004f8c8)
_o__wcsicmp (Address: 0x18004f8d8)
_o__wcsnicmp (Address: 0x18004f8e0)
_o_free (Address: 0x18004f8e8)
_o_iswspace (Address: 0x18004f8f0)
_o_malloc (Address: 0x18004f8f8)
_o_memcpy_s (Address: 0x18004f900)
_o_terminate (Address: 0x18004f908)
_o_toupper (Address: 0x18004f910)
memcmp (Address: 0x18004f998)
memcpy (Address: 0x18004f9a0)
memmove (Address: 0x18004f8d0)

api-ms-win-crt-runtime-l1-1-0.dll

_initterm (Address: 0x18004f9b8)
_initterm_e (Address: 0x18004f9b0)

api-ms-win-crt-string-l1-1-0.dll

memset (Address: 0x18004f9c8)
wcscmp (Address: 0x18004f9d0)
wcscspn (Address: 0x18004f9d8)

api-ms-win-eventing-classicprovider-l1-1-0.dll

TraceMessage (Address: 0x18004f9e8)

api-ms-win-eventing-provider-l1-1-0.dll

EventProviderEnabled (Address: 0x18004fa08)
EventRegister (Address: 0x18004f9f8)
EventSetInformation (Address: 0x18004fa10)
EventUnregister (Address: 0x18004fa18)
EventWriteTransfer (Address: 0x18004fa00)

api-ms-win-oobe-notification-l1-1-0.dll

OOBEComplete (Address: 0x18004fa28)

api-ms-win-rtcore-ntuser-window-l1-1-0.dll

GetDesktopWindow (Address: 0x18004fa48)
GetForegroundWindow (Address: 0x18004fa40)
IsWindow (Address: 0x18004fa38)

api-ms-win-security-base-l1-1-0.dll

CheckTokenMembership (Address: 0x18004fa70)
CreateWellKnownSid (Address: 0x18004fa78)
DuplicateToken (Address: 0x18004fa68)
DuplicateTokenEx (Address: 0x18004fa60)
GetTokenInformation (Address: 0x18004fa58)

api-ms-win-security-capability-l1-1-0.dll

CapabilityCheck (Address: 0x18004fa88)

api-ms-win-shcore-taskpool-l1-1-0.dll

SHTaskPoolAllowThreadReuse (Address: 0x18004fa98)
SHTaskPoolQueueTask (Address: 0x18004faa0)

api-ms-win-stateseparation-helpers-l1-1-0.dll

GetPersistedRegistryLocationW (Address: 0x18004fab0)

msvcp_win.dll

?_Xlength_error@std@@YAXPEBD@Z (Address: 0x18004fac0)

ntdll.dll

NtQueryInformationToken (Address: 0x18004fae8)
NtQueryWnfStateData (Address: 0x18004fae0)
RtlIsStateSeparationEnabled (Address: 0x18004fad0)
RtlPublishWnfStateData (Address: 0x18004fad8)

OLEAUT32.dll

SysAllocString (Address: 0x18004f330)
SysFreeString (Address: 0x18004f338)
SysStringLen (Address: 0x18004f340)

RPCRT4.dll

CStdStubBuffer_AddRef (Address: 0x18004f3b0)
CStdStubBuffer_DebugServerQueryInterface (Address: 0x18004f3c8)
CStdStubBuffer_DebugServerRelease (Address: 0x18004f358)
CStdStubBuffer_Invoke (Address: 0x18004f378)
CStdStubBuffer_IsIIDSupported (Address: 0x18004f388)
IUnknown_AddRef_Proxy (Address: 0x18004f3c0)
IUnknown_QueryInterface_Proxy (Address: 0x18004f350)
IUnknown_Release_Proxy (Address: 0x18004f3a8)
NdrCStdStubBuffer2_Release (Address: 0x18004f380)
NdrDllCanUnloadNow (Address: 0x18004f370)
NdrDllGetClassObject (Address: 0x18004f368)
NdrOleAllocate (Address: 0x18004f3a0)
NdrOleFree (Address: 0x18004f3b8)
NdrStubCall3 (Address: 0x18004f360)
NdrStubForwardingFunction (Address: 0x18004f398)
UuidFromStringW (Address: 0x18004f390)

twinapi.appcore.dll

(Address: 0x18004faf8)
(Address: 0x18004fb00)

USER32.dll

MonitorFromPoint (Address: 0x18004f3e0)
MonitorFromWindow (Address: 0x18004f3d8)