mscoreei.dll

Description: Microsoft .NET Runtime Execution Engine

Version: 4.8.9093.0

Architecture: 64-bit

Operating System: Windows

SHA256: 791e1a6f0c1024b2ac8142f0d85b25a7

File Size: 594.9 KB

Uploaded At: Dec. 1, 2025, 7:19 a.m.

Views: 18

Security Warning

This file has been flagged as potentially dangerous.

Reason: Detected potentially dangerous functions used for process injection: OpenProcess

Exported Functions

InitErrors (Ordinal: 17, Address: 0xaab0)
PostError (Ordinal: 18, Address: 0xabb0)
InitSSAutoEnterThread (Ordinal: 19, Address: 0xabe0)
UpdateError (Ordinal: 20, Address: 0xac30)
CloseCtrs (Ordinal: 21, Address: 0xdab0)
LoadStringRC (Ordinal: 22, Address: 0xac80)
ReOpenMetaDataWithMemory (Ordinal: 23, Address: 0xadf0)
(Ordinal: 24, Address: 0x3e2d0)
CollectCtrs (Ordinal: 25, Address: 0xda90)
CorDllMainWorker (Ordinal: 26, Address: 0xd150)
CorDllMainWorkerForThunk (Ordinal: 27, Address: 0xd320)
EEDllGetClassObjectFromClass (Ordinal: 28, Address: 0xb1c0)
GetPrivateContextsPerfCounters (Ordinal: 29, Address: 0xb5d0)
GetProcessExecutableHeap (Ordinal: 30, Address: 0x287a0)
GetStartupFlags (Ordinal: 31, Address: 0x9d20)
GetTargetForVTableEntry (Ordinal: 32, Address: 0x26730)
GetTokenForVTableEntry (Ordinal: 33, Address: 0x26660)
LogHelp_LogAssert (Ordinal: 34, Address: 0xb4c0)
LogHelp_NoGuiOnAssert (Ordinal: 35, Address: 0xb530)
LogHelp_TerminateOnAssert (Ordinal: 36, Address: 0xb580)
OnShimDllMainCalled (Ordinal: 37, Address: 0xbf20)
OpenCtrs (Ordinal: 38, Address: 0xd840)
PostErrorVA (Ordinal: 39, Address: 0xab10)
RegisterShimImplCallback (Ordinal: 40, Address: 0xdae0)
SetTargetForVTableEntry (Ordinal: 41, Address: 0x266d0)
CLRCreateInstance (Ordinal: 42, Address: 0x175c0)
CallFunctionShim (Ordinal: 43, Address: 0xb780)
ClrCreateManagedInstance (Ordinal: 44, Address: 0xb0d0)
CoEEShutDownCOM (Ordinal: 45, Address: 0xb220)
CoInitializeCor (Ordinal: 46, Address: 0xa810)
CoInitializeEE (Ordinal: 47, Address: 0xa730)
CoUninitializeCor (Ordinal: 48, Address: 0xa880)
CoUninitializeEE (Ordinal: 49, Address: 0xa7a0)
CorBindToCurrentRuntime (Ordinal: 50, Address: 0x8250)
CorBindToRuntime (Ordinal: 51, Address: 0x7a40)
CorBindToRuntimeByCfg (Ordinal: 52, Address: 0x7ee0)
CorBindToRuntimeByPath (Ordinal: 53, Address: 0x7250)
CorBindToRuntimeByPathEx (Ordinal: 54, Address: 0x7640)
CorBindToRuntimeEx (Ordinal: 55, Address: 0x7da0)
CorBindToRuntimeHost (Ordinal: 56, Address: 0x8110)
CorExitProcess (Ordinal: 57, Address: 0xb700)
CorGetSvc (Ordinal: 58, Address: 0x9510)
CorIsLatestSvc (Ordinal: 59, Address: 0x96d0)
CorMarkThreadInThreadPool (Ordinal: 60, Address: 0xb3f0)
CorTickleSvc (Ordinal: 61, Address: 0x97a0)
CreateConfigStream (Ordinal: 62, Address: 0x13430)
CreateDebuggingInterfaceFromVersion (Ordinal: 63, Address: 0x11740)
CreateInterface (Ordinal: 64, Address: 0x175c0)
DllCanUnloadNow (Ordinal: 65, Address: 0xb830)
DllGetClassObject (Ordinal: 66, Address: 0xc5c0)
DllRegisterServer (Ordinal: 67, Address: 0xcb40)
DllUnregisterServer (Ordinal: 68, Address: 0xcbe0)
EEDllRegisterServer (Ordinal: 69, Address: 0xb620)
EEDllUnregisterServer (Ordinal: 70, Address: 0xb690)
GetAssemblyMDImport (Ordinal: 71, Address: 0xcc80)
GetCORRequiredVersion (Ordinal: 72, Address: 0x8490)
GetCORRootDirectory (Ordinal: 73, Address: 0x95f0)
GetCORSystemDirectory (Ordinal: 74, Address: 0x9cd0)
GetCORSystemDirectory_RetAddr (Ordinal: 75, Address: 0x9a30)
GetCORVersion (Ordinal: 76, Address: 0x85b0)
GetCompileInfo (Ordinal: 77, Address: 0xb1d0)
GetFileVersion (Ordinal: 78, Address: 0x10110)
GetHashFromAssemblyFile (Ordinal: 79, Address: 0x230c0)
GetHashFromAssemblyFileW (Ordinal: 80, Address: 0x23160)
GetHashFromBlob (Ordinal: 81, Address: 0x233e0)
GetHashFromFile (Ordinal: 82, Address: 0x23200)
GetHashFromFileW (Ordinal: 83, Address: 0x232a0)
GetHashFromHandle (Ordinal: 84, Address: 0x23340)
GetHostConfigurationFile (Ordinal: 85, Address: 0x9d80)
GetMetaDataInternalInterface (Ordinal: 86, Address: 0xaa00)
GetMetaDataInternalInterfaceFromPublic (Ordinal: 87, Address: 0xa970)
GetMetaDataPublicInterfaceFromInternal (Ordinal: 88, Address: 0xa8e0)
GetPermissionRequests (Ordinal: 89, Address: 0xaff0)
GetRealProcAddress (Ordinal: 90, Address: 0x9f60)
GetRequestedRuntimeInfo (Ordinal: 91, Address: 0x8b00)
GetRequestedRuntimeVersion (Ordinal: 92, Address: 0x8f10)
GetRequestedRuntimeVersionForCLSID (Ordinal: 93, Address: 0x91c0)
GetVersionFromProcess (Ordinal: 94, Address: 0x11f80)
GetXMLElement (Ordinal: 95, Address: 0x39480)
GetXMLElementAttribute (Ordinal: 96, Address: 0x39480)
GetXMLObject (Ordinal: 97, Address: 0x395d0)
IEE (Ordinal: 98, Address: 0xb730)
LoadLibraryShim (Ordinal: 99, Address: 0xa080)
LoadLibraryWithPolicyShim (Ordinal: 100, Address: 0x9fe0)
LoadStringRCEx (Ordinal: 101, Address: 0xad20)
LockClrVersion (Ordinal: 102, Address: 0x30d0)
MetaDataGetDispenser (Ordinal: 103, Address: 0xa6a0)
ND_CopyObjDst (Ordinal: 104, Address: 0xb4a0)
ND_CopyObjSrc (Ordinal: 105, Address: 0xb480)
ND_RI2 (Ordinal: 106, Address: 0xb410)
ND_RI4 (Ordinal: 107, Address: 0xb420)
ND_RI8 (Ordinal: 108, Address: 0xb430)
ND_RU1 (Ordinal: 109, Address: 0xb400)
ND_WI2 (Ordinal: 110, Address: 0xb450)
ND_WI4 (Ordinal: 111, Address: 0xb460)
ND_WI8 (Ordinal: 112, Address: 0xb470)
ND_WU1 (Ordinal: 113, Address: 0xb440)
ReOpenMetaDataWithMemoryEx (Ordinal: 114, Address: 0xae80)
RunDll32ShimW (Ordinal: 115, Address: 0xa380)
RuntimeOSHandle (Ordinal: 116, Address: 0xb370)
RuntimeOpenImage (Ordinal: 117, Address: 0xb280)
RuntimeReleaseHandle (Ordinal: 118, Address: 0xb300)
StrongNameCompareAssemblies (Ordinal: 119, Address: 0x22f50)
StrongNameErrorInfo (Ordinal: 120, Address: 0x225b0)
StrongNameFreeBuffer (Ordinal: 121, Address: 0x22660)
StrongNameGetBlob (Ordinal: 122, Address: 0x234a0)
StrongNameGetBlobFromImage (Ordinal: 123, Address: 0x23520)
StrongNameGetPublicKey (Ordinal: 124, Address: 0x22900)
StrongNameHashSize (Ordinal: 125, Address: 0x22fd0)
StrongNameKeyDelete (Ordinal: 126, Address: 0x228a0)
StrongNameKeyGen (Ordinal: 127, Address: 0x226f0)
StrongNameKeyGenEx (Ordinal: 128, Address: 0x22780)
StrongNameKeyInstall (Ordinal: 129, Address: 0x22820)
StrongNameSignatureGeneration (Ordinal: 130, Address: 0x229a0)
StrongNameSignatureGenerationEx (Ordinal: 131, Address: 0x22a60)
StrongNameSignatureSize (Ordinal: 132, Address: 0x23040)
StrongNameSignatureVerification (Ordinal: 133, Address: 0x22dc0)
StrongNameSignatureVerificationEx (Ordinal: 134, Address: 0x22e40)
StrongNameSignatureVerificationFromImage (Ordinal: 135, Address: 0x22ec0)
StrongNameTokenFromAssembly (Ordinal: 136, Address: 0x22b40)
StrongNameTokenFromAssemblyEx (Ordinal: 137, Address: 0x22bc0)
StrongNameTokenFromPublicKey (Ordinal: 138, Address: 0x22c60)
TranslateSecurityAttributes (Ordinal: 139, Address: 0xaf20)
_CorDllMain (Ordinal: 140, Address: 0xce60)
_CorExeMain (Ordinal: 141, Address: 0xd5f0)
_CorExeMain2 (Ordinal: 142, Address: 0xd700)

Imported DLLs & Functions

KERNEL32.dll

ActivateActCtx (Address: 0x180064270)
CloseHandle (Address: 0x180064058)
CreateActCtxW (Address: 0x180064268)
CreateEventW (Address: 0x180064308)
CreateFileMappingW (Address: 0x180064148)
CreateFileW (Address: 0x1800640e0)
CreateMutexW (Address: 0x1800640b8)
CreateProcessW (Address: 0x1800642e0)
CreateSemaphoreW (Address: 0x180064330)
CreateToolhelp32Snapshot (Address: 0x180064168)
DeactivateActCtx (Address: 0x180064278)
DebugBreak (Address: 0x1800641a8)
DeleteCriticalSection (Address: 0x1800640d8)
DisableThreadLibraryCalls (Address: 0x180064090)
EncodePointer (Address: 0x180064350)
EnterCriticalSection (Address: 0x1800640c0)
ExitProcess (Address: 0x1800640a0)
FindClose (Address: 0x180064198)
FindFirstFileExA (Address: 0x1800643e0)
FindFirstFileW (Address: 0x180064188)
FindNextFileA (Address: 0x1800643e8)
FindNextFileW (Address: 0x180064190)
FlushFileBuffers (Address: 0x180064120)
FlushInstructionCache (Address: 0x1800641d8)
FormatMessageW (Address: 0x180064238)
FreeEnvironmentStringsW (Address: 0x180064258)
FreeLibrary (Address: 0x180064028)
GetACP (Address: 0x180064230)
GetCommandLineA (Address: 0x180064400)
GetCommandLineW (Address: 0x180064408)
GetConsoleCP (Address: 0x1800643d0)
GetConsoleMode (Address: 0x1800643d8)
GetCPInfo (Address: 0x180064228)
GetCurrentProcess (Address: 0x180064098)
GetCurrentProcessId (Address: 0x1800642d8)
GetCurrentThread (Address: 0x1800642b0)
GetCurrentThreadId (Address: 0x180064108)
GetDateFormatW (Address: 0x180064100)
GetEnvironmentStringsW (Address: 0x180064260)
GetEnvironmentVariableW (Address: 0x180064038)
GetFileAttributesExW (Address: 0x1800641e0)
GetFileAttributesW (Address: 0x180064118)
GetFileSize (Address: 0x180064140)
GetFileType (Address: 0x1800643c0)
GetFullPathNameW (Address: 0x180064008)
GetLastError (Address: 0x180064010)
GetLocalTime (Address: 0x1800640f0)
GetModuleFileNameA (Address: 0x1800643b0)
GetModuleFileNameW (Address: 0x180064048)
GetModuleHandleA (Address: 0x180064290)
GetModuleHandleExW (Address: 0x180064018)
GetModuleHandleW (Address: 0x180064088)
GetOEMCP (Address: 0x1800643f8)
GetProcAddress (Address: 0x180064020)
GetProcessHeap (Address: 0x180064220)
GetProcessId (Address: 0x1800641b0)
GetStartupInfoW (Address: 0x180064388)
GetStdHandle (Address: 0x1800643b8)
GetStringTypeW (Address: 0x1800643c8)
GetSystemDefaultLangID (Address: 0x180064298)
GetSystemDefaultLCID (Address: 0x1800641e8)
GetSystemDirectoryW (Address: 0x180064128)
GetSystemInfo (Address: 0x180064080)
GetSystemTimeAsFileTime (Address: 0x1800642a0)
GetTickCount (Address: 0x180064110)
GetTimeFormatW (Address: 0x1800640f8)
GetVersionExW (Address: 0x1800641c8)
GetWindowsDirectoryW (Address: 0x180064068)
HeapAlloc (Address: 0x180064218)
HeapCreate (Address: 0x1800641f0)
HeapDestroy (Address: 0x1800641f8)
HeapFree (Address: 0x180064210)
HeapReAlloc (Address: 0x180064430)
HeapSize (Address: 0x180064428)
HeapValidate (Address: 0x180064300)
InitializeCriticalSection (Address: 0x1800640d0)
InitializeCriticalSectionAndSpinCount (Address: 0x180064158)
InitializeSListHead (Address: 0x180064390)
InterlockedFlushSList (Address: 0x1800643a0)
IsDBCSLeadByte (Address: 0x180064240)
IsDBCSLeadByteEx (Address: 0x180064200)
IsDebuggerPresent (Address: 0x180064288)
IsProcessorFeaturePresent (Address: 0x180064380)
IsValidCodePage (Address: 0x1800643f0)
LCMapStringW (Address: 0x180064250)
LeaveCriticalSection (Address: 0x1800640c8)
LoadLibraryExA (Address: 0x1800641a0)
LoadLibraryExW (Address: 0x180064030)
LocalFree (Address: 0x180064248)
lstrlenW (Address: 0x180064180)
MapViewOfFile (Address: 0x180064150)
Module32FirstW (Address: 0x1800641b8)
Module32NextW (Address: 0x1800641c0)
MultiByteToWideChar (Address: 0x180064130)
OpenProcess (Address: 0x1800642d0)
OutputDebugStringW (Address: 0x1800640a8)
QueryPerformanceCounter (Address: 0x1800642a8)
RaiseException (Address: 0x180064208)
ReadFile (Address: 0x180064178)
ReadProcessMemory (Address: 0x180064170)
ReleaseActCtx (Address: 0x180064280)
ReleaseMutex (Address: 0x1800640b0)
ReleaseSemaphore (Address: 0x1800642f8)
ResetEvent (Address: 0x180064328)
RtlCaptureContext (Address: 0x180064358)
RtlLookupFunctionEntry (Address: 0x180064360)
RtlPcToFileHeader (Address: 0x1800643a8)
RtlUnwindEx (Address: 0x180064398)
RtlVirtualUnwind (Address: 0x180064368)
SetEnvironmentVariableW (Address: 0x180064060)
SetErrorMode (Address: 0x180064040)
SetEvent (Address: 0x180064310)
SetFilePointerEx (Address: 0x180064418)
SetLastError (Address: 0x180064138)
SetStdHandle (Address: 0x180064410)
SetUnhandledExceptionFilter (Address: 0x180064378)
SleepEx (Address: 0x180064338)
TerminateProcess (Address: 0x1800642b8)
TlsAlloc (Address: 0x180064320)
TlsFree (Address: 0x180064348)
TlsGetValue (Address: 0x180064340)
TlsSetValue (Address: 0x1800642e8)
UnhandledExceptionFilter (Address: 0x180064370)
UnmapViewOfFile (Address: 0x180064160)
VerifyVersionInfoW (Address: 0x1800642c8)
VerSetConditionMask (Address: 0x1800642c0)
VirtualAlloc (Address: 0x180064078)
VirtualFree (Address: 0x1800642f0)
VirtualProtect (Address: 0x1800641d0)
VirtualQuery (Address: 0x180064070)
WaitForSingleObject (Address: 0x180064050)
WaitForSingleObjectEx (Address: 0x180064318)
WideCharToMultiByte (Address: 0x180064000)
WriteConsoleW (Address: 0x180064420)
WriteFile (Address: 0x1800640e8)