CloudExperienceHostUser.dll

Description: CloudExperienceHost User Operations

Version: 10.0.19041.4355

Architecture: 64-bit

Operating System: Windows NT

SHA256: f5dd3185b58f68350a4d2874caf52b8a

File Size: 265.0 KB

Uploaded At: Dec. 1, 2025, 7:24 a.m.

Views: 14

Security Warning

This file has been flagged as potentially dangerous.

Reason: Detected potentially dangerous functions used for process injection: OpenProcess

Exported Functions

DllCanUnloadNow (Ordinal: 1, Address: 0x5920)
DllGetActivationFactory (Ordinal: 2, Address: 0x5610)
DllGetClassObject (Ordinal: 3, Address: 0x57f0)

Imported DLLs & Functions

api-ms-win-core-apiquery-l1-1-0.dll

ApiSetQueryApiSetPresence (Address: 0x18002ff90)

api-ms-win-core-com-l1-1-0.dll

CoCreateFreeThreadedMarshaler (Address: 0x18002ffb0)
CoCreateInstance (Address: 0x18002ffa0)
CoGetCallContext (Address: 0x18002ffd0)
CoGetCallerTID (Address: 0x18002ffc8)
CoGetMalloc (Address: 0x180030010)
CoImpersonateClient (Address: 0x18002fff8)
CoMarshalInterface (Address: 0x18002ffd8)
CoReleaseMarshalData (Address: 0x18002ffe0)
CoRevertToSelf (Address: 0x180030000)
CoTaskMemAlloc (Address: 0x18002ffc0)
CoTaskMemFree (Address: 0x18002ffb8)
CoWaitForMultipleHandles (Address: 0x18002ffa8)
CreateStreamOnHGlobal (Address: 0x18002fff0)
PropVariantClear (Address: 0x180030008)
StringFromCLSID (Address: 0x18002ffe8)

api-ms-win-core-com-l1-1-1.dll

RoGetAgileReference (Address: 0x180030020)

api-ms-win-core-com-midlproxystub-l1-1-0.dll

CStdStubBuffer2_Connect (Address: 0x1800300a0)
CStdStubBuffer2_CountRefs (Address: 0x180030058)
CStdStubBuffer2_Disconnect (Address: 0x180030090)
CStdStubBuffer2_QueryInterface (Address: 0x180030050)
NdrProxyForwardingFunction3 (Address: 0x1800300a8)
NdrProxyForwardingFunction4 (Address: 0x180030060)
NdrProxyForwardingFunction5 (Address: 0x180030068)
ObjectStublessClient10 (Address: 0x180030088)
ObjectStublessClient11 (Address: 0x180030030)
ObjectStublessClient12 (Address: 0x180030040)
ObjectStublessClient13 (Address: 0x180030048)
ObjectStublessClient14 (Address: 0x180030038)
ObjectStublessClient15 (Address: 0x1800300b0)
ObjectStublessClient16 (Address: 0x1800300b8)
ObjectStublessClient6 (Address: 0x180030070)
ObjectStublessClient7 (Address: 0x180030098)
ObjectStublessClient8 (Address: 0x180030078)
ObjectStublessClient9 (Address: 0x180030080)

api-ms-win-core-debug-l1-1-0.dll

DebugBreak (Address: 0x1800300d8)
IsDebuggerPresent (Address: 0x1800300c8)
OutputDebugStringW (Address: 0x1800300d0)

api-ms-win-core-delayload-l1-1-0.dll

DelayLoadFailureHook (Address: 0x1800300e8)

api-ms-win-core-delayload-l1-1-1.dll

ResolveDelayLoadedAPI (Address: 0x1800300f8)

api-ms-win-core-errorhandling-l1-1-0.dll

GetLastError (Address: 0x180030110)
RaiseException (Address: 0x180030118)
SetLastError (Address: 0x180030108)
SetUnhandledExceptionFilter (Address: 0x180030120)
UnhandledExceptionFilter (Address: 0x180030128)

api-ms-win-core-handle-l1-1-0.dll

CloseHandle (Address: 0x180030140)
DuplicateHandle (Address: 0x180030138)

api-ms-win-core-heap-l1-1-0.dll

GetProcessHeap (Address: 0x180030158)
HeapAlloc (Address: 0x180030150)
HeapFree (Address: 0x180030160)

api-ms-win-core-heap-l2-1-0.dll

LocalAlloc (Address: 0x180030178)
LocalFree (Address: 0x180030170)

api-ms-win-core-interlocked-l1-1-0.dll

InitializeSListHead (Address: 0x180030188)

api-ms-win-core-libraryloader-l1-2-0.dll

DisableThreadLibraryCalls (Address: 0x1800301a8)
GetModuleFileNameA (Address: 0x1800301b8)
GetModuleHandleExW (Address: 0x180030198)
GetModuleHandleW (Address: 0x1800301a0)
GetProcAddress (Address: 0x1800301b0)

api-ms-win-core-localization-l1-2-0.dll

FormatMessageW (Address: 0x1800301c8)

api-ms-win-core-processthreads-l1-1-0.dll

GetCurrentProcess (Address: 0x180030210)
GetCurrentProcessId (Address: 0x180030200)
GetCurrentThread (Address: 0x1800301f8)
GetCurrentThreadId (Address: 0x180030208)
GetProcessId (Address: 0x1800301d8)
OpenProcessToken (Address: 0x1800301e0)
OpenThreadToken (Address: 0x1800301e8)
TerminateProcess (Address: 0x1800301f0)

api-ms-win-core-processthreads-l1-1-1.dll

IsProcessorFeaturePresent (Address: 0x180030228)
OpenProcess (Address: 0x180030220)

api-ms-win-core-profile-l1-1-0.dll

QueryPerformanceCounter (Address: 0x180030238)

api-ms-win-core-registry-l1-1-0.dll

RegCloseKey (Address: 0x180030260)
RegGetValueW (Address: 0x180030248)
RegOpenKeyExW (Address: 0x180030250)
RegSetValueExW (Address: 0x180030258)

api-ms-win-core-rtlsupport-l1-1-0.dll

RtlCaptureContext (Address: 0x180030278)
RtlLookupFunctionEntry (Address: 0x180030280)
RtlVirtualUnwind (Address: 0x180030270)

api-ms-win-core-string-l1-1-0.dll

MultiByteToWideChar (Address: 0x180030290)

api-ms-win-core-synch-l1-1-0.dll

AcquireSRWLockExclusive (Address: 0x1800302d8)
AcquireSRWLockShared (Address: 0x1800302c8)
CreateEventExW (Address: 0x1800302c0)
CreateMutexExW (Address: 0x1800302d0)
CreateSemaphoreExW (Address: 0x1800302e0)
OpenSemaphoreW (Address: 0x180030300)
ReleaseMutex (Address: 0x1800302f8)
ReleaseSemaphore (Address: 0x1800302f0)
ReleaseSRWLockExclusive (Address: 0x1800302b0)
ReleaseSRWLockShared (Address: 0x1800302a0)
SetEvent (Address: 0x1800302a8)
WaitForSingleObject (Address: 0x1800302b8)
WaitForSingleObjectEx (Address: 0x1800302e8)

api-ms-win-core-synch-l1-2-0.dll

InitOnceBeginInitialize (Address: 0x180030310)
InitOnceComplete (Address: 0x180030328)
InitOnceExecuteOnce (Address: 0x180030318)
Sleep (Address: 0x180030320)

api-ms-win-core-sysinfo-l1-1-0.dll

GetSystemTimeAsFileTime (Address: 0x180030340)
GetTickCount (Address: 0x180030348)
GetTickCount64 (Address: 0x180030338)

api-ms-win-core-util-l1-1-0.dll

DecodePointer (Address: 0x180030360)
EncodePointer (Address: 0x180030358)

api-ms-win-core-winrt-error-l1-1-0.dll

GetRestrictedErrorInfo (Address: 0x180030388)
RoOriginateError (Address: 0x180030378)
RoOriginateErrorW (Address: 0x180030390)
RoTransformError (Address: 0x180030370)
SetRestrictedErrorInfo (Address: 0x180030380)

api-ms-win-core-winrt-error-l1-1-1.dll

IsErrorPropagationEnabled (Address: 0x1800303b0)
RoGetMatchingRestrictedErrorInfo (Address: 0x1800303a8)
RoReportFailedDelegate (Address: 0x1800303a0)

api-ms-win-core-winrt-l1-1-0.dll

RoActivateInstance (Address: 0x1800303c0)
RoGetActivationFactory (Address: 0x1800303c8)

api-ms-win-core-winrt-string-l1-1-0.dll

HSTRING_UserFree (Address: 0x180030400)
HSTRING_UserFree64 (Address: 0x180030410)
HSTRING_UserMarshal (Address: 0x180030418)
HSTRING_UserMarshal64 (Address: 0x1800303f8)
HSTRING_UserSize (Address: 0x180030420)
HSTRING_UserSize64 (Address: 0x180030408)
HSTRING_UserUnmarshal (Address: 0x1800303f0)
HSTRING_UserUnmarshal64 (Address: 0x1800303e8)
WindowsCreateString (Address: 0x1800303d8)
WindowsCreateStringReference (Address: 0x180030428)
WindowsDeleteString (Address: 0x180030430)
WindowsDuplicateString (Address: 0x1800303e0)
WindowsGetStringRawBuffer (Address: 0x180030438)
WindowsIsStringEmpty (Address: 0x180030440)
WindowsStringHasEmbeddedNull (Address: 0x180030448)

api-ms-win-crt-private-l1-1-0.dll

__C_specific_handler (Address: 0x1800304c0)
__CxxFrameHandler3 (Address: 0x1800304e0)
__CxxFrameHandler4 (Address: 0x180030538)
__std_terminate (Address: 0x180030530)
_CxxThrowException (Address: 0x1800304c8)
_o___std_exception_copy (Address: 0x180030510)
_o___std_exception_destroy (Address: 0x180030508)
_o___std_type_info_destroy_list (Address: 0x180030500)
_o___stdio_common_vsnprintf_s (Address: 0x1800304f8)
_o___stdio_common_vswprintf (Address: 0x1800304e8)
_o__callnewh (Address: 0x180030528)
_o__cexit (Address: 0x180030520)
_o__configure_narrow_argv (Address: 0x180030518)
_o__crt_atexit (Address: 0x1800304f0)
_o__errno (Address: 0x1800304d8)
_o__execute_onexit_table (Address: 0x1800304d0)
_o__initialize_narrow_environment (Address: 0x180030458)
_o__initialize_onexit_table (Address: 0x180030460)
_o__invalid_parameter_noinfo (Address: 0x180030468)
_o__invalid_parameter_noinfo_noreturn (Address: 0x180030470)
_o__purecall (Address: 0x180030478)
_o__register_onexit_function (Address: 0x180030480)
_o__seh_filter_dll (Address: 0x180030488)
_o__wtol (Address: 0x180030498)
_o_free (Address: 0x1800304a0)
_o_malloc (Address: 0x1800304a8)
_o_terminate (Address: 0x1800304b0)
_o_toupper (Address: 0x1800304b8)
memcmp (Address: 0x180030540)
memcpy (Address: 0x180030548)
memmove (Address: 0x180030490)

api-ms-win-crt-runtime-l1-1-0.dll

_initterm (Address: 0x180030560)
_initterm_e (Address: 0x180030558)

api-ms-win-crt-string-l1-1-0.dll

memset (Address: 0x180030570)

api-ms-win-eventing-provider-l1-1-0.dll

EventActivityIdControl (Address: 0x1800305a8)
EventProviderEnabled (Address: 0x180030580)
EventRegister (Address: 0x180030590)
EventSetInformation (Address: 0x180030598)
EventUnregister (Address: 0x180030588)
EventWriteTransfer (Address: 0x1800305a0)

api-ms-win-security-base-l1-1-0.dll

DuplicateTokenEx (Address: 0x1800305d0)
EqualSid (Address: 0x1800305c8)
GetAce (Address: 0x1800305b8)
GetTokenInformation (Address: 0x1800305c0)
RevertToSelf (Address: 0x1800305d8)

api-ms-win-stateseparation-helpers-l1-1-0.dll

GetPersistedRegistryLocationW (Address: 0x1800305e8)

combase.dll

(Address: 0x1800305f8)

msvcp_win.dll

?_Xlength_error@std@@YAXPEBD@Z (Address: 0x180030608)

ntdll.dll

NtQuerySecurityObject (Address: 0x180030640)
NtSetSecurityObject (Address: 0x180030630)
RtlAddAccessAllowedAce (Address: 0x180030660)
RtlAddAce (Address: 0x180030648)
RtlCreateAcl (Address: 0x180030658)
RtlCreateSecurityDescriptor (Address: 0x180030628)
RtlGetAce (Address: 0x180030650)
RtlGetDaclSecurityDescriptor (Address: 0x180030618)
RtlLengthSid (Address: 0x180030668)
RtlNtStatusToDosError (Address: 0x180030620)
RtlQueryInformationAcl (Address: 0x180030670)
RtlSetDaclSecurityDescriptor (Address: 0x180030638)

PROPSYS.dll

PropVariantToStringAlloc (Address: 0x18002ff00)

RPCRT4.dll

CStdStubBuffer_AddRef (Address: 0x18002ff58)
CStdStubBuffer_DebugServerQueryInterface (Address: 0x18002ff48)
CStdStubBuffer_DebugServerRelease (Address: 0x18002ff80)
CStdStubBuffer_Invoke (Address: 0x18002ff30)
CStdStubBuffer_IsIIDSupported (Address: 0x18002ff70)
IUnknown_AddRef_Proxy (Address: 0x18002ff40)
IUnknown_QueryInterface_Proxy (Address: 0x18002ff60)
IUnknown_Release_Proxy (Address: 0x18002ff10)
NdrCStdStubBuffer2_Release (Address: 0x18002ff18)
NdrDllCanUnloadNow (Address: 0x18002ff28)
NdrDllGetClassObject (Address: 0x18002ff20)
NdrOleAllocate (Address: 0x18002ff68)
NdrOleFree (Address: 0x18002ff50)
NdrStubCall3 (Address: 0x18002ff78)
NdrStubForwardingFunction (Address: 0x18002ff38)

twinapi.appcore.dll

(Address: 0x180030680)
(Address: 0x180030688)