CloudExperienceHost.dll

Description: CloudExperienceHost

Version: 10.0.19041.1265

Architecture: 64-bit

Operating System: Windows NT

SHA256: c4ea459a2db057cada537471853deffa

File Size: 403.3 KB

Uploaded At: Dec. 1, 2025, 8:11 a.m.

Views: 37

Security Warning

This file has been flagged as potentially dangerous.

Reason: Detected potentially dangerous functions used for process injection: OpenProcess

Exported Functions

DllCanUnloadNow (Ordinal: 1, Address: 0x5360)
DllGetActivationFactory (Ordinal: 2, Address: 0x5050)
DllGetClassObject (Ordinal: 3, Address: 0x5230)

Imported DLLs & Functions

api-ms-win-appmodel-runtime-l1-1-1.dll

FindPackagesByPackageFamily (Address: 0x18004b058)
ParseApplicationUserModelId (Address: 0x18004b050)

api-ms-win-core-apiquery-l1-1-0.dll

ApiSetQueryApiSetPresence (Address: 0x18004b068)

api-ms-win-core-com-midlproxystub-l1-1-0.dll

CStdStubBuffer2_Connect (Address: 0x18004b090)
CStdStubBuffer2_CountRefs (Address: 0x18004b098)
CStdStubBuffer2_Disconnect (Address: 0x18004b0a8)
CStdStubBuffer2_QueryInterface (Address: 0x18004b0f8)
NdrProxyForwardingFunction3 (Address: 0x18004b088)
NdrProxyForwardingFunction4 (Address: 0x18004b0e0)
NdrProxyForwardingFunction5 (Address: 0x18004b0d8)
ObjectStublessClient10 (Address: 0x18004b108)
ObjectStublessClient11 (Address: 0x18004b0e8)
ObjectStublessClient12 (Address: 0x18004b078)
ObjectStublessClient13 (Address: 0x18004b0b0)
ObjectStublessClient14 (Address: 0x18004b0a0)
ObjectStublessClient15 (Address: 0x18004b0f0)
ObjectStublessClient16 (Address: 0x18004b100)
ObjectStublessClient17 (Address: 0x18004b0b8)
ObjectStublessClient6 (Address: 0x18004b0d0)
ObjectStublessClient7 (Address: 0x18004b080)
ObjectStublessClient8 (Address: 0x18004b0c8)
ObjectStublessClient9 (Address: 0x18004b0c0)

api-ms-win-core-debug-l1-1-0.dll

DebugBreak (Address: 0x18004b118)
IsDebuggerPresent (Address: 0x18004b128)
OutputDebugStringW (Address: 0x18004b120)

api-ms-win-core-delayload-l1-1-0.dll

DelayLoadFailureHook (Address: 0x18004b138)

api-ms-win-core-delayload-l1-1-1.dll

ResolveDelayLoadedAPI (Address: 0x18004b148)

api-ms-win-core-errorhandling-l1-1-0.dll

GetLastError (Address: 0x18004b158)
RaiseException (Address: 0x18004b170)
SetLastError (Address: 0x18004b168)
SetUnhandledExceptionFilter (Address: 0x18004b178)
UnhandledExceptionFilter (Address: 0x18004b160)

api-ms-win-core-handle-l1-1-0.dll

CloseHandle (Address: 0x18004b188)

api-ms-win-core-heap-l1-1-0.dll

GetProcessHeap (Address: 0x18004b1a0)
HeapAlloc (Address: 0x18004b198)
HeapFree (Address: 0x18004b1a8)

api-ms-win-core-heap-l2-1-0.dll

LocalAlloc (Address: 0x18004b1c0)
LocalFree (Address: 0x18004b1b8)

api-ms-win-core-interlocked-l1-1-0.dll

InitializeSListHead (Address: 0x18004b1d0)

api-ms-win-core-libraryloader-l1-2-0.dll

DisableThreadLibraryCalls (Address: 0x18004b208)
FreeLibrary (Address: 0x18004b200)
GetModuleFileNameA (Address: 0x18004b210)
GetModuleFileNameW (Address: 0x18004b1e0)
GetModuleHandleExW (Address: 0x18004b1e8)
GetModuleHandleW (Address: 0x18004b1f0)
GetProcAddress (Address: 0x18004b218)
LoadLibraryExW (Address: 0x18004b1f8)

api-ms-win-core-libraryloader-l1-2-1.dll

LoadLibraryW (Address: 0x18004b228)

api-ms-win-core-localization-l1-2-0.dll

FormatMessageW (Address: 0x18004b238)

api-ms-win-core-processenvironment-l1-1-0.dll

ExpandEnvironmentStringsW (Address: 0x18004b248)

api-ms-win-core-processthreads-l1-1-0.dll

GetCurrentProcess (Address: 0x18004b270)
GetCurrentProcessId (Address: 0x18004b278)
GetCurrentThreadId (Address: 0x18004b258)
GetProcessId (Address: 0x18004b268)
OpenProcessToken (Address: 0x18004b280)
TerminateProcess (Address: 0x18004b260)

api-ms-win-core-processthreads-l1-1-1.dll

GetProcessMitigationPolicy (Address: 0x18004b290)
IsProcessorFeaturePresent (Address: 0x18004b2a0)
OpenProcess (Address: 0x18004b298)

api-ms-win-core-profile-l1-1-0.dll

QueryPerformanceCounter (Address: 0x18004b2b0)

api-ms-win-core-quirks-l1-1-0.dll

QuirkIsEnabled (Address: 0x18004b2c0)

api-ms-win-core-registry-l1-1-0.dll

RegCloseKey (Address: 0x18004b300)
RegCreateKeyExW (Address: 0x18004b310)
RegDeleteTreeW (Address: 0x18004b2d0)
RegEnumKeyExW (Address: 0x18004b2e0)
RegGetValueW (Address: 0x18004b2f8)
RegOpenKeyExW (Address: 0x18004b2e8)
RegQueryInfoKeyW (Address: 0x18004b308)
RegQueryValueExW (Address: 0x18004b2d8)
RegSetValueExW (Address: 0x18004b2f0)

api-ms-win-core-rtlsupport-l1-1-0.dll

RtlCaptureContext (Address: 0x18004b320)
RtlLookupFunctionEntry (Address: 0x18004b328)
RtlVirtualUnwind (Address: 0x18004b330)

api-ms-win-core-shlwapi-legacy-l1-1-0.dll

PathCommonPrefixW (Address: 0x18004b348)
PathFindExtensionW (Address: 0x18004b340)
SHExpandEnvironmentStringsW (Address: 0x18004b350)

api-ms-win-core-string-l1-1-0.dll

CompareStringOrdinal (Address: 0x18004b360)
MultiByteToWideChar (Address: 0x18004b368)

api-ms-win-core-synch-l1-1-0.dll

AcquireSRWLockExclusive (Address: 0x18004b3d0)
AcquireSRWLockShared (Address: 0x18004b3c8)
CreateEventExW (Address: 0x18004b378)
CreateEventW (Address: 0x18004b388)
CreateMutexExW (Address: 0x18004b3a8)
CreateSemaphoreExW (Address: 0x18004b3e0)
OpenEventW (Address: 0x18004b3a0)
OpenSemaphoreW (Address: 0x18004b3b0)
ReleaseMutex (Address: 0x18004b3c0)
ReleaseSemaphore (Address: 0x18004b3d8)
ReleaseSRWLockExclusive (Address: 0x18004b380)
ReleaseSRWLockShared (Address: 0x18004b398)
SetEvent (Address: 0x18004b390)
WaitForSingleObject (Address: 0x18004b3b8)
WaitForSingleObjectEx (Address: 0x18004b3e8)

api-ms-win-core-synch-l1-2-0.dll

InitOnceBeginInitialize (Address: 0x18004b3f8)
InitOnceComplete (Address: 0x18004b410)
InitOnceExecuteOnce (Address: 0x18004b408)
Sleep (Address: 0x18004b400)

api-ms-win-core-sysinfo-l1-1-0.dll

GetSystemDirectoryW (Address: 0x18004b430)
GetSystemTimeAsFileTime (Address: 0x18004b448)
GetTickCount (Address: 0x18004b440)
GetTickCount64 (Address: 0x18004b428)
GetVersionExA (Address: 0x18004b438)
GetVersionExW (Address: 0x18004b420)

api-ms-win-core-timezone-l1-1-0.dll

FileTimeToSystemTime (Address: 0x18004b458)
SystemTimeToFileTime (Address: 0x18004b460)

api-ms-win-core-util-l1-1-0.dll

DecodePointer (Address: 0x18004b470)
EncodePointer (Address: 0x18004b478)

api-ms-win-core-winrt-l1-1-0.dll

RoActivateInstance (Address: 0x18004b490)
RoGetActivationFactory (Address: 0x18004b488)

api-ms-win-crt-private-l1-1-0.dll

__C_specific_handler (Address: 0x18004b530)
__CxxFrameHandler3 (Address: 0x18004b578)
__CxxFrameHandler4 (Address: 0x18004b5a0)
__std_terminate (Address: 0x18004b598)
_CxxThrowException (Address: 0x18004b568)
_o___std_exception_copy (Address: 0x18004b560)
_o___std_exception_destroy (Address: 0x18004b558)
_o___std_type_info_destroy_list (Address: 0x18004b550)
_o___stdio_common_vsnprintf_s (Address: 0x18004b548)
_o___stdio_common_vswprintf (Address: 0x18004b540)
_o__callnewh (Address: 0x18004b590)
_o__cexit (Address: 0x18004b570)
_o__configure_narrow_argv (Address: 0x18004b538)
_o__crt_atexit (Address: 0x18004b5b8)
_o__errno (Address: 0x18004b588)
_o__execute_onexit_table (Address: 0x18004b580)
_o__get_errno (Address: 0x18004b4a0)
_o__initialize_narrow_environment (Address: 0x18004b4a8)
_o__initialize_onexit_table (Address: 0x18004b4b0)
_o__invalid_parameter_noinfo (Address: 0x18004b4b8)
_o__invalid_parameter_noinfo_noreturn (Address: 0x18004b4c0)
_o__purecall (Address: 0x18004b4c8)
_o__register_onexit_function (Address: 0x18004b4d0)
_o__seh_filter_dll (Address: 0x18004b4d8)
_o__set_errno (Address: 0x18004b4e0)
_o__wcsicmp (Address: 0x18004b4f0)
_o__wcsnicmp (Address: 0x18004b4f8)
_o_free (Address: 0x18004b500)
_o_iswspace (Address: 0x18004b508)
_o_malloc (Address: 0x18004b510)
_o_memcpy_s (Address: 0x18004b518)
_o_terminate (Address: 0x18004b520)
_o_toupper (Address: 0x18004b528)
memcmp (Address: 0x18004b5a8)
memcpy (Address: 0x18004b5b0)
memmove (Address: 0x18004b4e8)

api-ms-win-crt-runtime-l1-1-0.dll

_initterm (Address: 0x18004b5d0)
_initterm_e (Address: 0x18004b5c8)

api-ms-win-crt-string-l1-1-0.dll

memset (Address: 0x18004b5e0)
wcscmp (Address: 0x18004b5e8)
wcscspn (Address: 0x18004b5f0)

api-ms-win-eventing-classicprovider-l1-1-0.dll

TraceMessage (Address: 0x18004b600)

api-ms-win-eventing-provider-l1-1-0.dll

EventProviderEnabled (Address: 0x18004b620)
EventRegister (Address: 0x18004b610)
EventSetInformation (Address: 0x18004b628)
EventUnregister (Address: 0x18004b630)
EventWriteTransfer (Address: 0x18004b618)

api-ms-win-oobe-notification-l1-1-0.dll

OOBEComplete (Address: 0x18004b640)

api-ms-win-rtcore-ntuser-window-l1-1-0.dll

GetDesktopWindow (Address: 0x18004b660)
GetForegroundWindow (Address: 0x18004b658)
IsWindow (Address: 0x18004b650)

api-ms-win-security-base-l1-1-0.dll

CheckTokenMembership (Address: 0x18004b688)
CreateWellKnownSid (Address: 0x18004b690)
DuplicateToken (Address: 0x18004b680)
DuplicateTokenEx (Address: 0x18004b678)
GetTokenInformation (Address: 0x18004b670)

api-ms-win-security-capability-l1-1-0.dll

CapabilityCheck (Address: 0x18004b6a0)

api-ms-win-shcore-taskpool-l1-1-0.dll

SHTaskPoolAllowThreadReuse (Address: 0x18004b6b0)
SHTaskPoolQueueTask (Address: 0x18004b6b8)

api-ms-win-stateseparation-helpers-l1-1-0.dll

GetPersistedRegistryLocationW (Address: 0x18004b6c8)

msvcp_win.dll

?_Xlength_error@std@@YAXPEBD@Z (Address: 0x18004b6d8)

ntdll.dll

NtQueryInformationToken (Address: 0x18004b700)
NtQueryWnfStateData (Address: 0x18004b6f8)
RtlIsStateSeparationEnabled (Address: 0x18004b6e8)
RtlPublishWnfStateData (Address: 0x18004b6f0)

OLEAUT32.dll

SysAllocString (Address: 0x18004af90)
SysFreeString (Address: 0x18004af98)
SysStringLen (Address: 0x18004afa0)

RPCRT4.dll

CStdStubBuffer_AddRef (Address: 0x18004afb0)
CStdStubBuffer_DebugServerQueryInterface (Address: 0x18004afb8)
CStdStubBuffer_DebugServerRelease (Address: 0x18004afd8)
CStdStubBuffer_Invoke (Address: 0x18004b000)
CStdStubBuffer_IsIIDSupported (Address: 0x18004b020)
IUnknown_AddRef_Proxy (Address: 0x18004b018)
IUnknown_QueryInterface_Proxy (Address: 0x18004afe0)
IUnknown_Release_Proxy (Address: 0x18004afc8)
NdrCStdStubBuffer2_Release (Address: 0x18004afe8)
NdrDllCanUnloadNow (Address: 0x18004aff8)
NdrDllGetClassObject (Address: 0x18004aff0)
NdrOleAllocate (Address: 0x18004afd0)
NdrOleFree (Address: 0x18004b028)
NdrStubCall3 (Address: 0x18004b010)
NdrStubForwardingFunction (Address: 0x18004b008)
UuidFromStringW (Address: 0x18004afc0)

twinapi.appcore.dll

(Address: 0x18004b710)
(Address: 0x18004b718)

USER32.dll

MonitorFromPoint (Address: 0x18004b040)
MonitorFromWindow (Address: 0x18004b038)