To give Yoy an idea how microsoft is ******** us with windows 10
Ian dismanteling the CloudExperienceHost and have a look what I found inside 3 times in different places
Spyware
-----------
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SecurityManager\CapabilityClasses\capabilityClass_DevUnlock_Internal]
;"AllCached
MemberCapability"=
çallJoynbluetooth
genericAttribute
Profilelpac
Mediablocked
ChatMessages
cortana
Permissions
S-1-15-3-2105443330-1210154068-4021178019-2481794518
microphoneoem
PublicDirectory
activityallow
Elevationautomated
AppLaunchbackground
SpatialPerception
bluetooth
.rfcomm
lowLevel
Devicesremovable
Storage
appointments
radioskinect
Videoproximity
background
MediaPlayback
location
bluetoothsystem
Dialog
wiFi
Controlbluetooth
Adapterbluetooth
Syncextended
BackgroundTask
TimehumanInterface
Devicecellular
Data
chatlpac
Printingpreview
Hfxremote
Systemcode
Generationapp
Broadcast
SettingsdateAndTime
DeviceSettings
voip
Callcom
Portuser
AccountInformation
contacts
objects3D
sms
documents
Libraryenterprise
Authenticationprojection
DeviceSettings
gaming
ContainerResources
gazeInput
phoneCallSystem
kinect
Face
globalMedia
ControldeviceManagement
EmailAccount
graphics
Captureinterop
Servicesinternet
ClientphoneCallphone
CallHistory
Publicera
Application
internetClient
Server
lowLevel
music
Library
spatialPerception
offlineMaps
Management
videosLibraryl
pac
EnterprisePolicyChange
Notifications
opticalsystem
Management
kinect
Audiobackground
MediaRecording
pictures
Library
network
Diagnostics
pointOfService
privateNetworkClient
Serverstore
OptionalPackageInstall
Management
recordedCalls
Folder
windowManagement
Systemsensors.
customgameBar
Servicesserial
Communicationdevice
Provisioning
Administrator
sharedUser
Certificates
usbuser
Notification
Listenerwi
FiDirectappCapture
Servicesuser
DataTasksbrowser
AppList
webcamwifi
Datacontent
Restrictionskinect
Expressionskinect
Gamechatkinect
Requiredkinect
VisionmultiplaneOverlay
S-1-15-3-2644377880-1328420871-3844924566-2531345009
S-1-15-3-395236244-1315033739-1586777234-200431208
S-1-15-3-3633849274-1266774400-1199443125-2736873758email
S-1-15-3-1809452355-1122967369-1860402327-3749013406
cortanaSettingsphone
CallHistorySystem
S-1-15-3-35640326-1307095065-539983240-598708775
holographicCompositor
S-1-15-3-15993189-1149757597-3280441496-4094800555
S-1-15-3-1849407097-1086866290-155560606-3624675039
oemDeploymentshellDisplayManagement
S-1-15-3-2015030808-1290041139-4103196845-2461361948
extendedExecutionUnconstrained
S-1-15-3-139472938-1339732804-1469114779-4031155563
S-1-15-3-2973957182-1175190094-721927306-1883016034
userManagementSystem
S-1-15-3-21215646-1208716416-3513598388-563624394
S-1-15-3-3845273463-1331427702-1186551195-1148109977wallet
SystemS-1-15-3-3896177193-1293452864-652350370-3283282805
S-1-15-3-1791129720-1096132346-2415494586-860822857
systemDialogEmergency
S-1-15-3-1293833650-298840431-285264776-805306385
S-1-15-3-3215430884-1339816292-89257616-1145831019
S-1-15-3-3870101518-1154309966-1696731070-4111764952
S-1-15-3-3137136191-1153415950-1121555896-4159670178
smsTransportSystem
S-1-15-3-787448254-1207972858-3558633622-1059886964
S-1-15-3-4214768333-1334025770-122408079-3919188833
S-1-15-3-1134239919-1079740757-715583641-1133364976
S-1-15-3-1356681776-298957450-23999-821364216
S-1-15-3-3351026466-1326260720-3261511323-869120041
deviceLockManagementemailSystem
S-1-15-3-3071617654-1314403908-1117750160-3581451107
teamEditionDeviceCredential
S-1-15-3-1408590600-298890943-2684416660-2348490441l
pacPnPNotifications
S-1-15-3-2980022703-1145824235-622914189-2568333173
S-1-15-3-715121970-1157172444-427173784-4221709359
activityDatabrowserCredentials
S-1-15-3-1999509746-1110018341-1399106725-3660531915
S-1-15-3-3259236285-1172912892-2704004019-3320563595
S-1-15-3-2354057264-1085470914-1625701259-973047895
activitySystem
deviceManagement
WapSecurityPolicies
S-1-15-3-2826977944-1122184543-2359046549-3458853689
S-1-15-3-2262880736-298877065-582812-1931423806
S-1-15-3-2569730672-1095266119-53537203-1209375796l
pacIME
S-1-15-3-194973768-3701127499-1342101326-3943512813
S-1-15-3-4177661182-1301448398-3844223645-4185687095
S-1-15-3-3739755759-1242460827-297211036-396899197
S-1-15-3-3251780300-1139111211-244140164-3604388945
gameMonitor
S-1-15-3-1119633358-1293340626-3514748059-2207892402
accessoryManager
packageManagementall
AppModspreview
InkWorkspace
appBroadcast
appBroadcastServices
appCaptureSettings
appDiagnosticscellularDeviceControl
appLicensing
appManagement
Systemshell
Experience
appointments
SystemaudioDevice
Configurationbackground
VoIP
bluetooth
DeviceSettings
chat
Systembroad
FileSystem
Accesscellular
Messagingcomponent
UiInWebContent
camera
Processing
ExtensionchildebContent
capabilityAccess
Consent
DeviceSettings
cellularDevice
Identityregion
Settingsrelated
Packagesconfirm
AppClose
contactsSystem
cortanaSpeech
Accessorycortana
SurfacedeviceIdentity
Managementinput
Foreground
Observationdevice
Encryption
Managementstore
LicenseManagementvisual
VoiceMail
deviceManagement
Administratordevice
ManagementDevice
LockPoliciespreview
Storedevice
ManagementD
mAccountdeviceManagement
FoundationdeviceManagement
Registrationdevice
PortalProviderdevice
Unlockstore
AppInstallationdisplay
DeviceSettingsdualSimTiles
enterpriseCloud
SSOenterpriseData
Policyenterprise
DeviceLockdown
expandedResources
extendedExecution
BackgroundAudio
extendedExecution
Criticalfeature
StagingInfo
firstSignIn
SettingsflashPlayer
Supportgame
ListhevcPlayback
mmsTransport
SystemteamEditionExperiencexbox
LiveAuthentication
Providerhid
Telephonyinput
SettingsinputInjection
inputInjection
Brokeredwindows
PerformanceCountersinput
Observationinput
Suppressionkeyboard
DeviceSettingslanguageAndRegion
DeviceSettings
languageSettings
locationHistory
locationSystemlpac
AppExperience
lpacClipboard
lpacCom
lpacCryptoServices
lpacIdentityServices
lpacInstrumentation
secondaryAuthentication
FactorlpacPackageManager
OperationlpacPayments
lpacServicesManagement
lpacSessionManagement
lpacWebPlatformrun
FullTrustnetworkConnectionManager
ProvisioningnetworkDataPlan
ProvisioningnetworkData
UsageManagementnetwork
DeviceSettingsvm
WorkerProcessnetworking
VpnProvidernfc
Systemnotifications
DeviceSettings
oneProcess
VoIPpackage
PolicySystempackage
Querypackage
WriteRedirection
CompatibilityShimfeedback
LogCollection
perceptionMonitoring
perceptionSensors
Experimentalpersonalization
DeviceSettings
phoneCallHistoryphone
LineTransportManagementpreemptive
CameracontentDeliveryManager
Settingspower
DeviceSettings
previewPenWorkspace
previewUiComposition
protectedAppregistry
ReadremotePassport
Authenticationreset
PhonescreenDuplication
secureAssessment
fullFileSystemAccessslapi
QueryLicense
Valuesmbiosshared
MachineKeysCapability
smsSendsms
Systemcloud
Storestart
ScreenManagement
userPrincipal
NametargetedContent
teamEdition
Viewthumbnail
Cache
timezoneui
Accessui
AutomationSystemupdateAndSecurityDevice
SettingsuserDataAccounts
ProvideruserData
SystemuserData
TasksSystem
userSystemId
webPlatform
MediaExtension
windowsHello
CredentialAccessxbox
AccessoryManagementxbox
Broadcasterxbox
SystemApplicationClipQueryxbox
TrackingStreamapplication
Defaultsapplication
ViewActivation
biometricSystem
cloudExperienceHost
storeApp
Installcore
Shellcurated
TileCollections
dependency
Targetdeveloper
Settingsdiagnostics
gameConfig
StoreManagementhfx
SystemholographicCompositor
SystemimeSystem
indexedContentinProcess
MediaExtensionsystem
RegistrarliveIdService
localExperienceInternal
lockScreen
Creativesmicrosoft
EdgeRemoteDebugging
mixedReality
Environment
Internalpackage
Contentsperception
Systemremote
FileAccess
windowManagement
searchSettings
settingSync
Configurationshell
ExperienceComposer
storeConfiguration
telemetry
Dataterminal
PowerManagement
userDataAccountSetup
userSigninSupport
userWebAccounts
visualElements
Systemxbox
Game
SpeechWindow
End Spyware
Adresses sent
-----------------
[HKEY_USERS\S-1-5-21-318110369-2606555740-3962479297-1000\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.CloudExperienceHost_10.0.19041.1_neutral_neutral_cw5n1h2txyewy\Applications\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy!App]
"ApplicationContentUris"=
;Addresses Where Windows 10 sends Info
;https://prod.rewardsplatform.microsoft.com/
;https://www.microsoft.com/officeoobe/
;https://wwwqa.microsoft.com/officeoobe/
;https://onedrive.live.com/windows/
;https://account.live.com/
;https://login.live.com/
;https://oloobe.officeapps.live.com/
;https://oloobe.officeapps.live-int.com/
;https://login.microsoftonline.com/
;https://login.microsoft.com/
;https://login.windows.net/
;https://login.windows-ppe.net/
;https://signup.live.com/
;https://account.live-int.com/+
;https://login.live-int.com/
;https://signup.live-int.com/
;https://buy.live.com/
;https://buy.live-int.com/
;https://passwordreset.microsoftonline.com/
;https://account.activedirectory.windowsazure.com/
;https://tip.passwordreset.microsoftonline.com/
;https://account.activedirectory.windowsazure.us/
;https://account.activedirectory.windowsazure.cn/
;https://passwordreset.activedirectory.windowsazure.cn/
;https://password.ccsctp.com/
;https://account.activedirectory-ppe.windowsazure.com/
;https://sdx.microsoft.com/
;https://sdx.microsoft-ppe.com/
;https://sdx.microsoft-int.com/
;https://canary.sdx.microsoft.com/ms-appx-web:///webapps/ms-appx-web:///views/+ms-appx-web:///RetailDemo/ms-appx-web:///core/
;ttps://login.microsoftonline.us/
;https://login.microsoftonline.de/
;https://login.partner.microsoftonline.cn/
Are They doing it for themselves or are they working for the U.S. goverment ? mayby also the chinese goverment ??
icy
Ian dismanteling the CloudExperienceHost and have a look what I found inside 3 times in different places
Spyware
-----------
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SecurityManager\CapabilityClasses\capabilityClass_DevUnlock_Internal]
;"AllCached
MemberCapability"=
çallJoynbluetooth
genericAttribute
Profilelpac
Mediablocked
ChatMessages
cortana
Permissions
S-1-15-3-2105443330-1210154068-4021178019-2481794518
microphoneoem
PublicDirectory
activityallow
Elevationautomated
AppLaunchbackground
SpatialPerception
bluetooth
.rfcomm
lowLevel
Devicesremovable
Storage
appointments
radioskinect
Videoproximity
background
MediaPlayback
location
bluetoothsystem
Dialog
wiFi
Controlbluetooth
Adapterbluetooth
Syncextended
BackgroundTask
TimehumanInterface
Devicecellular
Data
chatlpac
Printingpreview
Hfxremote
Systemcode
Generationapp
Broadcast
SettingsdateAndTime
DeviceSettings
voip
Callcom
Portuser
AccountInformation
contacts
objects3D
sms
documents
Libraryenterprise
Authenticationprojection
DeviceSettings
gaming
ContainerResources
gazeInput
phoneCallSystem
kinect
Face
globalMedia
ControldeviceManagement
EmailAccount
graphics
Captureinterop
Servicesinternet
ClientphoneCallphone
CallHistory
Publicera
Application
internetClient
Server
lowLevel
music
Library
spatialPerception
offlineMaps
Management
videosLibraryl
pac
EnterprisePolicyChange
Notifications
opticalsystem
Management
kinect
Audiobackground
MediaRecording
pictures
Library
network
Diagnostics
pointOfService
privateNetworkClient
Serverstore
OptionalPackageInstall
Management
recordedCalls
Folder
windowManagement
Systemsensors.
customgameBar
Servicesserial
Communicationdevice
Provisioning
Administrator
sharedUser
Certificates
usbuser
Notification
Listenerwi
FiDirectappCapture
Servicesuser
DataTasksbrowser
AppList
webcamwifi
Datacontent
Restrictionskinect
Expressionskinect
Gamechatkinect
Requiredkinect
VisionmultiplaneOverlay
S-1-15-3-2644377880-1328420871-3844924566-2531345009
S-1-15-3-395236244-1315033739-1586777234-200431208
S-1-15-3-3633849274-1266774400-1199443125-2736873758email
S-1-15-3-1809452355-1122967369-1860402327-3749013406
cortanaSettingsphone
CallHistorySystem
S-1-15-3-35640326-1307095065-539983240-598708775
holographicCompositor
S-1-15-3-15993189-1149757597-3280441496-4094800555
S-1-15-3-1849407097-1086866290-155560606-3624675039
oemDeploymentshellDisplayManagement
S-1-15-3-2015030808-1290041139-4103196845-2461361948
extendedExecutionUnconstrained
S-1-15-3-139472938-1339732804-1469114779-4031155563
S-1-15-3-2973957182-1175190094-721927306-1883016034
userManagementSystem
S-1-15-3-21215646-1208716416-3513598388-563624394
S-1-15-3-3845273463-1331427702-1186551195-1148109977wallet
SystemS-1-15-3-3896177193-1293452864-652350370-3283282805
S-1-15-3-1791129720-1096132346-2415494586-860822857
systemDialogEmergency
S-1-15-3-1293833650-298840431-285264776-805306385
S-1-15-3-3215430884-1339816292-89257616-1145831019
S-1-15-3-3870101518-1154309966-1696731070-4111764952
S-1-15-3-3137136191-1153415950-1121555896-4159670178
smsTransportSystem
S-1-15-3-787448254-1207972858-3558633622-1059886964
S-1-15-3-4214768333-1334025770-122408079-3919188833
S-1-15-3-1134239919-1079740757-715583641-1133364976
S-1-15-3-1356681776-298957450-23999-821364216
S-1-15-3-3351026466-1326260720-3261511323-869120041
deviceLockManagementemailSystem
S-1-15-3-3071617654-1314403908-1117750160-3581451107
teamEditionDeviceCredential
S-1-15-3-1408590600-298890943-2684416660-2348490441l
pacPnPNotifications
S-1-15-3-2980022703-1145824235-622914189-2568333173
S-1-15-3-715121970-1157172444-427173784-4221709359
activityDatabrowserCredentials
S-1-15-3-1999509746-1110018341-1399106725-3660531915
S-1-15-3-3259236285-1172912892-2704004019-3320563595
S-1-15-3-2354057264-1085470914-1625701259-973047895
activitySystem
deviceManagement
WapSecurityPolicies
S-1-15-3-2826977944-1122184543-2359046549-3458853689
S-1-15-3-2262880736-298877065-582812-1931423806
S-1-15-3-2569730672-1095266119-53537203-1209375796l
pacIME
S-1-15-3-194973768-3701127499-1342101326-3943512813
S-1-15-3-4177661182-1301448398-3844223645-4185687095
S-1-15-3-3739755759-1242460827-297211036-396899197
S-1-15-3-3251780300-1139111211-244140164-3604388945
gameMonitor
S-1-15-3-1119633358-1293340626-3514748059-2207892402
accessoryManager
packageManagementall
AppModspreview
InkWorkspace
appBroadcast
appBroadcastServices
appCaptureSettings
appDiagnosticscellularDeviceControl
appLicensing
appManagement
Systemshell
Experience
appointments
SystemaudioDevice
Configurationbackground
VoIP
bluetooth
DeviceSettings
chat
Systembroad
FileSystem
Accesscellular
Messagingcomponent
UiInWebContent
camera
Processing
ExtensionchildebContent
capabilityAccess
Consent
DeviceSettings
cellularDevice
Identityregion
Settingsrelated
Packagesconfirm
AppClose
contactsSystem
cortanaSpeech
Accessorycortana
SurfacedeviceIdentity
Managementinput
Foreground
Observationdevice
Encryption
Managementstore
LicenseManagementvisual
VoiceMail
deviceManagement
Administratordevice
ManagementDevice
LockPoliciespreview
Storedevice
ManagementD
mAccountdeviceManagement
FoundationdeviceManagement
Registrationdevice
PortalProviderdevice
Unlockstore
AppInstallationdisplay
DeviceSettingsdualSimTiles
enterpriseCloud
SSOenterpriseData
Policyenterprise
DeviceLockdown
expandedResources
extendedExecution
BackgroundAudio
extendedExecution
Criticalfeature
StagingInfo
firstSignIn
SettingsflashPlayer
Supportgame
ListhevcPlayback
mmsTransport
SystemteamEditionExperiencexbox
LiveAuthentication
Providerhid
Telephonyinput
SettingsinputInjection
inputInjection
Brokeredwindows
PerformanceCountersinput
Observationinput
Suppressionkeyboard
DeviceSettingslanguageAndRegion
DeviceSettings
languageSettings
locationHistory
locationSystemlpac
AppExperience
lpacClipboard
lpacCom
lpacCryptoServices
lpacIdentityServices
lpacInstrumentation
secondaryAuthentication
FactorlpacPackageManager
OperationlpacPayments
lpacServicesManagement
lpacSessionManagement
lpacWebPlatformrun
FullTrustnetworkConnectionManager
ProvisioningnetworkDataPlan
ProvisioningnetworkData
UsageManagementnetwork
DeviceSettingsvm
WorkerProcessnetworking
VpnProvidernfc
Systemnotifications
DeviceSettings
oneProcess
VoIPpackage
PolicySystempackage
Querypackage
WriteRedirection
CompatibilityShimfeedback
LogCollection
perceptionMonitoring
perceptionSensors
Experimentalpersonalization
DeviceSettings
phoneCallHistoryphone
LineTransportManagementpreemptive
CameracontentDeliveryManager
Settingspower
DeviceSettings
previewPenWorkspace
previewUiComposition
protectedAppregistry
ReadremotePassport
Authenticationreset
PhonescreenDuplication
secureAssessment
fullFileSystemAccessslapi
QueryLicense
Valuesmbiosshared
MachineKeysCapability
smsSendsms
Systemcloud
Storestart
ScreenManagement
userPrincipal
NametargetedContent
teamEdition
Viewthumbnail
Cache
timezoneui
Accessui
AutomationSystemupdateAndSecurityDevice
SettingsuserDataAccounts
ProvideruserData
SystemuserData
TasksSystem
userSystemId
webPlatform
MediaExtension
windowsHello
CredentialAccessxbox
AccessoryManagementxbox
Broadcasterxbox
SystemApplicationClipQueryxbox
TrackingStreamapplication
Defaultsapplication
ViewActivation
biometricSystem
cloudExperienceHost
storeApp
Installcore
Shellcurated
TileCollections
dependency
Targetdeveloper
Settingsdiagnostics
gameConfig
StoreManagementhfx
SystemholographicCompositor
SystemimeSystem
indexedContentinProcess
MediaExtensionsystem
RegistrarliveIdService
localExperienceInternal
lockScreen
Creativesmicrosoft
EdgeRemoteDebugging
mixedReality
Environment
Internalpackage
Contentsperception
Systemremote
FileAccess
windowManagement
searchSettings
settingSync
Configurationshell
ExperienceComposer
storeConfiguration
telemetry
Dataterminal
PowerManagement
userDataAccountSetup
userSigninSupport
userWebAccounts
visualElements
Systemxbox
Game
SpeechWindow
End Spyware
Adresses sent
-----------------
[HKEY_USERS\S-1-5-21-318110369-2606555740-3962479297-1000\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.CloudExperienceHost_10.0.19041.1_neutral_neutral_cw5n1h2txyewy\Applications\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy!App]
"ApplicationContentUris"=
;Addresses Where Windows 10 sends Info
;https://prod.rewardsplatform.microsoft.com/
;https://www.microsoft.com/officeoobe/
;https://wwwqa.microsoft.com/officeoobe/
;https://onedrive.live.com/windows/
;https://account.live.com/
;https://login.live.com/
;https://oloobe.officeapps.live.com/
;https://oloobe.officeapps.live-int.com/
;https://login.microsoftonline.com/
;https://login.microsoft.com/
;https://login.windows.net/
;https://login.windows-ppe.net/
;https://signup.live.com/
;https://account.live-int.com/+
;https://login.live-int.com/
;https://signup.live-int.com/
;https://buy.live.com/
;https://buy.live-int.com/
;https://passwordreset.microsoftonline.com/
;https://account.activedirectory.windowsazure.com/
;https://tip.passwordreset.microsoftonline.com/
;https://account.activedirectory.windowsazure.us/
;https://account.activedirectory.windowsazure.cn/
;https://passwordreset.activedirectory.windowsazure.cn/
;https://password.ccsctp.com/
;https://account.activedirectory-ppe.windowsazure.com/
;https://sdx.microsoft.com/
;https://sdx.microsoft-ppe.com/
;https://sdx.microsoft-int.com/
;https://canary.sdx.microsoft.com/ms-appx-web:///webapps/ms-appx-web:///views/+ms-appx-web:///RetailDemo/ms-appx-web:///core/
;ttps://login.microsoftonline.us/
;https://login.microsoftonline.de/
;https://login.partner.microsoftonline.cn/
Are They doing it for themselves or are they working for the U.S. goverment ? mayby also the chinese goverment ??
icy