mscoreei.dll

Description: Microsoft .NET Runtime Execution Engine

Version: 4.8.4084.0

Architecture: 32-bit

Operating System: Windows

SHA256: c2a220cefaa1e9a63a5b03611500f0fe

File Size: 568.0 KB

Uploaded At: Dec. 1, 2025, 8:48 a.m.

Views: 23

Security Warning

This file has been flagged as potentially dangerous.

Reason: Detected potentially dangerous functions used for process injection: OpenProcess

Exported Functions

InitErrors (Ordinal: 17, Address: 0x30290)
PostError (Ordinal: 18, Address: 0x30390)
InitSSAutoEnterThread (Ordinal: 19, Address: 0x303b0)
UpdateError (Ordinal: 20, Address: 0x30400)
CloseCtrs (Ordinal: 21, Address: 0x32370)
LoadStringRC (Ordinal: 22, Address: 0x30450)
ReOpenMetaDataWithMemory (Ordinal: 23, Address: 0x30540)
(Ordinal: 24, Address: 0xe3f0)
CollectCtrs (Ordinal: 25, Address: 0x32340)
CorDllMainWorker (Ordinal: 26, Address: 0x31f50)
CorDllMainWorkerForThunk (Ordinal: 27, Address: 0xf750)
EEDllGetClassObjectFromClass (Ordinal: 28, Address: 0x30760)
GetPrivateContextsPerfCounters (Ordinal: 29, Address: 0x30bd0)
GetProcessExecutableHeap (Ordinal: 30, Address: 0x1e60)
GetStartupFlags (Ordinal: 31, Address: 0x2f5a0)
GetTargetForVTableEntry (Ordinal: 32, Address: 0x40010)
GetTokenForVTableEntry (Ordinal: 33, Address: 0x3ff70)
LogHelp_LogAssert (Ordinal: 34, Address: 0x30a80)
LogHelp_NoGuiOnAssert (Ordinal: 35, Address: 0x30af0)
LogHelp_TerminateOnAssert (Ordinal: 36, Address: 0x30b60)
OnShimDllMainCalled (Ordinal: 37, Address: 0x9630)
OpenCtrs (Ordinal: 38, Address: 0x320e0)
PostErrorVA (Ordinal: 39, Address: 0x302f0)
RegisterShimImplCallback (Ordinal: 40, Address: 0x14d0)
SetTargetForVTableEntry (Ordinal: 41, Address: 0x40000)
CLRCreateInstance (Ordinal: 42, Address: 0xb790)
CallFunctionShim (Ordinal: 43, Address: 0x30cd0)
ClrCreateManagedInstance (Ordinal: 44, Address: 0x32e0)
CoEEShutDownCOM (Ordinal: 45, Address: 0x307d0)
CoInitializeCor (Ordinal: 46, Address: 0x30050)
CoInitializeEE (Ordinal: 47, Address: 0x3260)
CoUninitializeCor (Ordinal: 48, Address: 0x300d0)
CoUninitializeEE (Ordinal: 49, Address: 0x2ffd0)
CorBindToCurrentRuntime (Ordinal: 50, Address: 0x2dce0)
CorBindToRuntime (Ordinal: 51, Address: 0x2d4b0)
CorBindToRuntimeByCfg (Ordinal: 52, Address: 0x2d940)
CorBindToRuntimeByPath (Ordinal: 53, Address: 0x2cec0)
CorBindToRuntimeByPathEx (Ordinal: 54, Address: 0x2d1b0)
CorBindToRuntimeEx (Ordinal: 55, Address: 0x2d7e0)
CorBindToRuntimeHost (Ordinal: 56, Address: 0x2db70)
CorExitProcess (Ordinal: 57, Address: 0x30c40)
CorGetSvc (Ordinal: 58, Address: 0x2ee50)
CorIsLatestSvc (Ordinal: 59, Address: 0x2f020)
CorMarkThreadInThreadPool (Ordinal: 60, Address: 0x4110)
CorTickleSvc (Ordinal: 61, Address: 0x2f0c0)
CreateConfigStream (Ordinal: 62, Address: 0x96a0)
CreateDebuggingInterfaceFromVersion (Ordinal: 63, Address: 0x347e0)
CreateInterface (Ordinal: 64, Address: 0xb790)
DllCanUnloadNow (Ordinal: 65, Address: 0x30d40)
DllGetClassObject (Ordinal: 66, Address: 0x31640)
DllRegisterServer (Ordinal: 67, Address: 0x31a60)
DllUnregisterServer (Ordinal: 68, Address: 0x31b10)
EEDllRegisterServer (Ordinal: 69, Address: 0x33f0)
EEDllUnregisterServer (Ordinal: 70, Address: 0x3470)
GetAssemblyMDImport (Ordinal: 71, Address: 0x31bc0)
GetCORRequiredVersion (Ordinal: 72, Address: 0x2df70)
GetCORRootDirectory (Ordinal: 73, Address: 0x2ef30)
GetCORSystemDirectory (Ordinal: 74, Address: 0x2f570)
GetCORSystemDirectory_RetAddr (Ordinal: 75, Address: 0x2f300)
GetCORVersion (Ordinal: 76, Address: 0x2e060)
GetCompileInfo (Ordinal: 77, Address: 0x30770)
GetFileVersion (Ordinal: 78, Address: 0x34080)
GetHashFromAssemblyFile (Ordinal: 79, Address: 0x3e790)
GetHashFromAssemblyFileW (Ordinal: 80, Address: 0x3e800)
GetHashFromBlob (Ordinal: 81, Address: 0x3e9c0)
GetHashFromFile (Ordinal: 82, Address: 0x3e870)
GetHashFromFileW (Ordinal: 83, Address: 0x3e8e0)
GetHashFromHandle (Ordinal: 84, Address: 0x3e950)
GetHostConfigurationFile (Ordinal: 85, Address: 0x2f600)
GetMetaDataInternalInterface (Ordinal: 86, Address: 0x30220)
GetMetaDataInternalInterfaceFromPublic (Ordinal: 87, Address: 0x301b0)
GetMetaDataPublicInterfaceFromInternal (Ordinal: 88, Address: 0x30140)
GetPermissionRequests (Ordinal: 89, Address: 0x306d0)
GetRealProcAddress (Ordinal: 90, Address: 0x2f880)
GetRequestedRuntimeInfo (Ordinal: 91, Address: 0x2e520)
GetRequestedRuntimeVersion (Ordinal: 92, Address: 0x2e8e0)
GetRequestedRuntimeVersionForCLSID (Ordinal: 93, Address: 0x2eb90)
GetVersionFromProcess (Ordinal: 94, Address: 0x34ff0)
GetXMLElement (Ordinal: 95, Address: 0x50640)
GetXMLElementAttribute (Ordinal: 96, Address: 0x50650)
GetXMLObject (Ordinal: 97, Address: 0x221a0)
IEE (Ordinal: 98, Address: 0x30c70)
LoadLibraryShim (Ordinal: 99, Address: 0x2f970)
LoadLibraryWithPolicyShim (Ordinal: 100, Address: 0x2f8e0)
LoadStringRCEx (Ordinal: 101, Address: 0x304c0)
LockClrVersion (Ordinal: 102, Address: 0x2afb0)
MetaDataGetDispenser (Ordinal: 103, Address: 0x2ff60)
ND_CopyObjDst (Ordinal: 104, Address: 0x30a60)
ND_CopyObjSrc (Ordinal: 105, Address: 0x30a40)
ND_RI2 (Ordinal: 106, Address: 0x14610)
ND_RI4 (Ordinal: 107, Address: 0x309b0)
ND_RI8 (Ordinal: 108, Address: 0x309c0)
ND_RU1 (Ordinal: 109, Address: 0x14630)
ND_WI2 (Ordinal: 110, Address: 0x309e0)
ND_WI4 (Ordinal: 111, Address: 0x30a00)
ND_WI8 (Ordinal: 112, Address: 0x30a20)
ND_WU1 (Ordinal: 113, Address: 0x14650)
ReOpenMetaDataWithMemoryEx (Ordinal: 114, Address: 0x305b0)
RunDll32ShimW (Ordinal: 115, Address: 0x2fbd0)
RuntimeOSHandle (Ordinal: 116, Address: 0x30930)
RuntimeOpenImage (Ordinal: 117, Address: 0x30830)
RuntimeReleaseHandle (Ordinal: 118, Address: 0x308b0)
StrongNameCompareAssemblies (Ordinal: 119, Address: 0x3e670)
StrongNameErrorInfo (Ordinal: 120, Address: 0x3e000)
StrongNameFreeBuffer (Ordinal: 121, Address: 0x3e0a0)
StrongNameGetBlob (Ordinal: 122, Address: 0x3ea30)
StrongNameGetBlobFromImage (Ordinal: 123, Address: 0x3ea90)
StrongNameGetPublicKey (Ordinal: 124, Address: 0x3e280)
StrongNameHashSize (Ordinal: 125, Address: 0x3e6d0)
StrongNameKeyDelete (Ordinal: 126, Address: 0x3e220)
StrongNameKeyGen (Ordinal: 127, Address: 0x3e0f0)
StrongNameKeyGenEx (Ordinal: 128, Address: 0x3e150)
StrongNameKeyInstall (Ordinal: 129, Address: 0x3e1c0)
StrongNameSignatureGeneration (Ordinal: 130, Address: 0x3e2f0)
StrongNameSignatureGenerationEx (Ordinal: 131, Address: 0x3e360)
StrongNameSignatureSize (Ordinal: 132, Address: 0x3e730)
StrongNameSignatureVerification (Ordinal: 133, Address: 0x3e550)
StrongNameSignatureVerificationEx (Ordinal: 134, Address: 0x3e5b0)
StrongNameSignatureVerificationFromImage (Ordinal: 135, Address: 0x3e610)
StrongNameTokenFromAssembly (Ordinal: 136, Address: 0x3e3d0)
StrongNameTokenFromAssemblyEx (Ordinal: 137, Address: 0x3e430)
StrongNameTokenFromPublicKey (Ordinal: 138, Address: 0x3e500)
TranslateSecurityAttributes (Ordinal: 139, Address: 0x30640)
_CorDllMain (Ordinal: 140, Address: 0x31d70)
_CorExeMain2 (Ordinal: 141, Address: 0xd350)
_CorExeMain (Ordinal: 142, Address: 0xfa20)

Imported DLLs & Functions

KERNEL32.dll

ActivateActCtx (Address: 0x10084138)
CloseHandle (Address: 0x1008402c)
CreateActCtxW (Address: 0x10084134)
CreateEventW (Address: 0x10084188)
CreateFileMappingW (Address: 0x100840a8)
CreateFileW (Address: 0x10084074)
CreateMutexW (Address: 0x10084060)
CreateProcessW (Address: 0x10084174)
CreateSemaphoreW (Address: 0x1008419c)
CreateToolhelp32Snapshot (Address: 0x100840b8)
DeactivateActCtx (Address: 0x1008413c)
DebugBreak (Address: 0x10084140)
DecodePointer (Address: 0x100841b0)
DeleteCriticalSection (Address: 0x10084070)
DisableThreadLibraryCalls (Address: 0x1008404c)
EncodePointer (Address: 0x100841ac)
EnterCriticalSection (Address: 0x10084064)
ExitProcess (Address: 0x10084054)
FindClose (Address: 0x100840d0)
FindFirstFileExA (Address: 0x100841ec)
FindFirstFileW (Address: 0x100840c8)
FindNextFileA (Address: 0x100841f0)
FindNextFileW (Address: 0x100840cc)
FlushFileBuffers (Address: 0x10084094)
FlushInstructionCache (Address: 0x100840ec)
FormatMessageW (Address: 0x1008411c)
FreeEnvironmentStringsW (Address: 0x1008412c)
FreeLibrary (Address: 0x10084014)
GetACP (Address: 0x10084118)
GetCommandLineA (Address: 0x100841fc)
GetCommandLineW (Address: 0x10084200)
GetConsoleCP (Address: 0x100841e4)
GetConsoleMode (Address: 0x100841e8)
GetCPInfo (Address: 0x10084114)
GetCurrentProcess (Address: 0x10084050)
GetCurrentProcessId (Address: 0x10084170)
GetCurrentThread (Address: 0x10084158)
GetCurrentThreadId (Address: 0x10084088)
GetDateFormatW (Address: 0x10084084)
GetEnvironmentStringsW (Address: 0x10084130)
GetEnvironmentVariableW (Address: 0x1008401c)
GetFileAttributesExW (Address: 0x100840f4)
GetFileAttributesW (Address: 0x10084090)
GetFileSize (Address: 0x100840a4)
GetFileType (Address: 0x100841dc)
GetFullPathNameW (Address: 0x10084004)
GetLastError (Address: 0x10084008)
GetLocalTime (Address: 0x1008407c)
GetModuleFileNameA (Address: 0x100841d4)
GetModuleFileNameW (Address: 0x10084024)
GetModuleHandleA (Address: 0x1008414c)
GetModuleHandleExW (Address: 0x1008400c)
GetModuleHandleW (Address: 0x10084048)
GetOEMCP (Address: 0x100841f8)
GetProcAddress (Address: 0x10084010)
GetProcessHeap (Address: 0x10084110)
GetProcessId (Address: 0x100840dc)
GetStartupInfoW (Address: 0x100841c0)
GetStdHandle (Address: 0x100841d8)
GetStringTypeW (Address: 0x100841e0)
GetSystemDefaultLangID (Address: 0x10084150)
GetSystemDefaultLCID (Address: 0x100840f8)
GetSystemDirectoryW (Address: 0x10084098)
GetSystemInfo (Address: 0x10084044)
GetSystemTimeAsFileTime (Address: 0x10084154)
GetSystemWow64DirectoryW (Address: 0x100840f0)
GetTickCount (Address: 0x1008408c)
GetTimeFormatW (Address: 0x10084080)
GetVersionExW (Address: 0x100840e8)
GetWindowsDirectoryW (Address: 0x10084034)
GlobalMemoryStatus (Address: 0x10084038)
HeapAlloc (Address: 0x1008410c)
HeapCreate (Address: 0x100840fc)
HeapDestroy (Address: 0x10084100)
HeapFree (Address: 0x10084108)
HeapReAlloc (Address: 0x10084214)
HeapSize (Address: 0x10084210)
HeapValidate (Address: 0x10084184)
InitializeCriticalSection (Address: 0x1008406c)
InitializeCriticalSectionAndSpinCount (Address: 0x100840b0)
InitializeSListHead (Address: 0x100841c8)
InterlockedDecrement (Address: 0x1008421c)
InterlockedFlushSList (Address: 0x100841d0)
InterlockedIncrement (Address: 0x10084220)
IsDBCSLeadByte (Address: 0x10084120)
IsDBCSLeadByteEx (Address: 0x10084218)
IsDebuggerPresent (Address: 0x10084148)
IsProcessorFeaturePresent (Address: 0x100841bc)
IsValidCodePage (Address: 0x100841f4)
IsWow64Process (Address: 0x10084168)
LCMapStringW (Address: 0x10084128)
LeaveCriticalSection (Address: 0x10084068)
LoadLibraryExA (Address: 0x100840d4)
LoadLibraryExW (Address: 0x10084018)
LocalFree (Address: 0x10084124)
lstrlenW (Address: 0x100840c4)
MapViewOfFile (Address: 0x100840ac)
Module32FirstW (Address: 0x100840e0)
Module32NextW (Address: 0x100840e4)
MultiByteToWideChar (Address: 0x1008409c)
OpenProcess (Address: 0x1008416c)
OutputDebugStringW (Address: 0x10084058)
QueryPerformanceCounter (Address: 0x100841c4)
RaiseException (Address: 0x10084104)
ReadFile (Address: 0x100840c0)
ReadProcessMemory (Address: 0x100840bc)
ReleaseActCtx (Address: 0x10084144)
ReleaseMutex (Address: 0x1008405c)
ReleaseSemaphore (Address: 0x10084180)
ResetEvent (Address: 0x10084198)
RtlUnwind (Address: 0x100841cc)
SetEnvironmentVariableW (Address: 0x10084030)
SetErrorMode (Address: 0x10084020)
SetEvent (Address: 0x1008418c)
SetFilePointerEx (Address: 0x10084208)
SetLastError (Address: 0x100840a0)
SetStdHandle (Address: 0x10084204)
SetUnhandledExceptionFilter (Address: 0x100841b8)
SleepEx (Address: 0x100841a0)
TerminateProcess (Address: 0x1008415c)
TlsAlloc (Address: 0x10084194)
TlsFree (Address: 0x100841a8)
TlsGetValue (Address: 0x100841a4)
TlsSetValue (Address: 0x10084178)
UnhandledExceptionFilter (Address: 0x100841b4)
UnmapViewOfFile (Address: 0x100840b4)
VerifyVersionInfoW (Address: 0x10084164)
VerSetConditionMask (Address: 0x10084160)
VirtualAlloc (Address: 0x10084040)
VirtualFree (Address: 0x1008417c)
VirtualProtect (Address: 0x100840d8)
VirtualQuery (Address: 0x1008403c)
WaitForSingleObject (Address: 0x10084028)
WaitForSingleObjectEx (Address: 0x10084190)
WideCharToMultiByte (Address: 0x10084000)
WriteConsoleW (Address: 0x1008420c)
WriteFile (Address: 0x10084078)