mscordbi.dll

Description: Microsoft .NET Runtime Debugging Services

Version: 4.8.4645.0

Architecture: 32-bit

Operating System: Windows

SHA256: bc344d3d9040eed585f018b1adcd6e48

File Size: 1.1 MB

Uploaded At: Dec. 1, 2025, 8:48 a.m.

Views: 7

Security Warning

This file has been flagged as potentially dangerous.

Reason: Detected potentially dangerous functions used for process injection: WriteProcessMemory, OpenProcess

Exported Functions

CreateCordbObject (Ordinal: 1, Address: 0x1d310)
DllGetClassObjectInternal (Ordinal: 2, Address: 0x1d340)
OpenVirtualProcess2 (Ordinal: 3, Address: 0x1d950)
OpenVirtualProcess (Ordinal: 4, Address: 0x1d9a0)
OpenVirtualProcessImpl (Ordinal: 5, Address: 0x1d6b0)

Imported DLLs & Functions

ADVAPI32.dll

AdjustTokenPrivileges (Address: 0x10113044)
CopySid (Address: 0x10113010)
DeregisterEventSource (Address: 0x10113000)
EqualSid (Address: 0x10113004)
EventWrite (Address: 0x10113034)
GetKernelObjectSecurity (Address: 0x10113018)
GetLengthSid (Address: 0x1011301c)
GetSecurityDescriptorOwner (Address: 0x10113014)
GetSidSubAuthority (Address: 0x10113024)
GetSidSubAuthorityCount (Address: 0x10113020)
GetTokenInformation (Address: 0x10113030)
LookupPrivilegeValueW (Address: 0x1011304c)
OpenProcessToken (Address: 0x10113048)
OpenThreadToken (Address: 0x1011302c)
RegCloseKey (Address: 0x10113038)
RegisterEventSourceW (Address: 0x10113008)
RegOpenKeyExW (Address: 0x1011303c)
RegQueryValueExW (Address: 0x10113040)
ReportEventW (Address: 0x1011300c)
RevertToSelf (Address: 0x10113050)
SetThreadToken (Address: 0x10113028)

KERNEL32.dll

ActivateActCtx (Address: 0x10113160)
CloseHandle (Address: 0x10113240)
ContinueDebugEvent (Address: 0x10113130)
CreateActCtxW (Address: 0x1011315c)
CreateEventW (Address: 0x10113238)
CreateFileMappingW (Address: 0x10113074)
CreateFileW (Address: 0x1011306c)
CreateMutexW (Address: 0x10113134)
CreateProcessW (Address: 0x10113118)
CreateSemaphoreW (Address: 0x10113148)
CreateThread (Address: 0x1011320c)
CreateToolhelp32Snapshot (Address: 0x10113084)
DeactivateActCtx (Address: 0x10113260)
DebugActiveProcess (Address: 0x101130a0)
DebugBreak (Address: 0x101130dc)
DecodePointer (Address: 0x1011317c)
DeleteCriticalSection (Address: 0x10113250)
DuplicateHandle (Address: 0x10113210)
EncodePointer (Address: 0x10113178)
EnterCriticalSection (Address: 0x10113244)
ExitProcess (Address: 0x10113198)
FindClose (Address: 0x101130f0)
FindFirstFileExA (Address: 0x101131c4)
FindNextFileA (Address: 0x101131c8)
FlushFileBuffers (Address: 0x101131b0)
FlushInstructionCache (Address: 0x10113220)
FormatMessageW (Address: 0x10113108)
FreeEnvironmentStringsW (Address: 0x101130e4)
FreeLibrary (Address: 0x1011305c)
GetACP (Address: 0x10113104)
GetCommandLineA (Address: 0x101131d4)
GetCommandLineW (Address: 0x101131d8)
GetConsoleCP (Address: 0x101131b8)
GetConsoleMode (Address: 0x101131bc)
GetCPInfo (Address: 0x10113100)
GetCurrentProcess (Address: 0x10113224)
GetCurrentProcessId (Address: 0x101130ac)
GetCurrentThread (Address: 0x101130f8)
GetCurrentThreadId (Address: 0x10113228)
GetEnvironmentStringsW (Address: 0x101130e8)
GetEnvironmentVariableW (Address: 0x101130e0)
GetFileAttributesExW (Address: 0x101131f8)
GetFileSize (Address: 0x10113070)
GetFileType (Address: 0x101131a8)
GetLastError (Address: 0x10113230)
GetModuleFileNameA (Address: 0x101131a0)
GetModuleFileNameW (Address: 0x10113098)
GetModuleHandleExW (Address: 0x1011319c)
GetModuleHandleW (Address: 0x1011321c)
GetOEMCP (Address: 0x101131d0)
GetProcAddress (Address: 0x10113254)
GetProcessHeap (Address: 0x101130c8)
GetStartupInfoW (Address: 0x10113194)
GetStdHandle (Address: 0x101131a4)
GetStringTypeW (Address: 0x101131ac)
GetSystemInfo (Address: 0x101130d0)
GetSystemTimeAsFileTime (Address: 0x101130bc)
GetThreadContext (Address: 0x10113208)
GetWindowsDirectoryW (Address: 0x1011316c)
HeapAlloc (Address: 0x101130c4)
HeapCreate (Address: 0x1011311c)
HeapDestroy (Address: 0x10113144)
HeapFree (Address: 0x101130c0)
HeapReAlloc (Address: 0x101131ec)
HeapSize (Address: 0x101131e8)
HeapValidate (Address: 0x10113138)
InitializeCriticalSection (Address: 0x1011323c)
InitializeCriticalSectionAndSpinCount (Address: 0x101131c0)
InitializeSListHead (Address: 0x10113190)
InterlockedFlushSList (Address: 0x101131f0)
IsDBCSLeadByte (Address: 0x1011310c)
IsDebuggerPresent (Address: 0x10113174)
IsProcessorFeaturePresent (Address: 0x10113188)
IsValidCodePage (Address: 0x101131cc)
IsWow64Process (Address: 0x101130b0)
LCMapStringW (Address: 0x10113114)
LeaveCriticalSection (Address: 0x10113248)
LoadLibraryExW (Address: 0x10113058)
LocalFree (Address: 0x10113110)
MapViewOfFile (Address: 0x10113078)
Module32FirstW (Address: 0x10113090)
Module32NextW (Address: 0x10113094)
MultiByteToWideChar (Address: 0x101130f4)
OpenFileMappingW (Address: 0x101131f4)
OpenProcess (Address: 0x10113060)
OpenThread (Address: 0x101130a8)
OutputDebugStringW (Address: 0x101130d8)
QueryPerformanceCounter (Address: 0x1011318c)
RaiseException (Address: 0x101130cc)
ReadFile (Address: 0x10113200)
ReadProcessMemory (Address: 0x10113068)
ReleaseActCtx (Address: 0x10113170)
ReleaseMutex (Address: 0x10113064)
ReleaseSemaphore (Address: 0x1011312c)
ResetEvent (Address: 0x1011322c)
ResumeThread (Address: 0x10113214)
SetErrorMode (Address: 0x10113164)
SetEvent (Address: 0x10113234)
SetFilePointer (Address: 0x101131fc)
SetFilePointerEx (Address: 0x101131e0)
SetLastError (Address: 0x101130b8)
SetStdHandle (Address: 0x101131dc)
SetThreadContext (Address: 0x10113168)
SetUnhandledExceptionFilter (Address: 0x10113184)
Sleep (Address: 0x10113080)
SleepEx (Address: 0x1011314c)
SuspendThread (Address: 0x10113218)
SwitchToThread (Address: 0x101130fc)
TerminateProcess (Address: 0x10113204)
Thread32First (Address: 0x10113088)
Thread32Next (Address: 0x1011308c)
TlsAlloc (Address: 0x10113140)
TlsFree (Address: 0x10113154)
TlsGetValue (Address: 0x10113150)
TlsSetValue (Address: 0x10113120)
UnhandledExceptionFilter (Address: 0x10113180)
UnmapViewOfFile (Address: 0x1011307c)
VerifyVersionInfoW (Address: 0x101130d4)
VirtualAlloc (Address: 0x1011325c)
VirtualFree (Address: 0x10113128)
VirtualProtect (Address: 0x10113124)
VirtualQuery (Address: 0x10113158)
VirtualQueryEx (Address: 0x1011309c)
WaitForDebugEvent (Address: 0x101130a4)
WaitForMultipleObjectsEx (Address: 0x1011324c)
WaitForSingleObject (Address: 0x10113258)
WaitForSingleObjectEx (Address: 0x1011313c)
WideCharToMultiByte (Address: 0x101130ec)
WriteConsoleW (Address: 0x101131e4)
WriteFile (Address: 0x101131b4)
WriteProcessMemory (Address: 0x101130b4)

ntdll.dll

RtlUnwind (Address: 0x10113298)
VerSetConditionMask (Address: 0x10113294)

ole32.dll

CoCreateFreeThreadedMarshaler (Address: 0x101132ac)
CoCreateGuid (Address: 0x101132a8)
CoTaskMemAlloc (Address: 0x101132b4)
CoTaskMemFree (Address: 0x101132a0)
CreateStreamOnHGlobal (Address: 0x101132a4)
IIDFromString (Address: 0x101132b0)

OLEAUT32.dll

CreateErrorInfo (Address: 0x10113268)
SetErrorInfo (Address: 0x10113270)
VariantInit (Address: 0x1011326c)

USER32.dll

GetProcessWindowStation (Address: 0x10113280)
GetUserObjectInformationW (Address: 0x1011327c)
LoadStringW (Address: 0x10113278)

WTSAPI32.dll

WTSEnumerateProcessesW (Address: 0x10113288)
WTSFreeMemory (Address: 0x1011328c)