qingshellext.dll

Description: qingbangong shellext

Version: 12.1.0.23542

Architecture: 32-bit

Operating System: Windows NT

SHA256: 61314c6cb608b19b0f9cf29911849ab2

File Size: 667.0 KB

Uploaded At: Dec. 4, 2025, 6:12 a.m.

Views: 6

Security Warning

This file has been flagged as potentially dangerous.

Reason: Detected potentially dangerous functions used for process injection: OpenProcess

Exported Functions

DllCanUnloadNow (Ordinal: 1, Address: 0x3400)
DllGetClassObject (Ordinal: 2, Address: 0x3470)
DllInstall (Ordinal: 3, Address: 0x3610)
DllRegisterServer (Ordinal: 4, Address: 0x3640)
DllUnregisterServer (Ordinal: 5, Address: 0x3d70)

Imported DLLs & Functions

KERNEL32.dll

AcquireSRWLockExclusive (Address: 0x10070194)
AreFileApisANSI (Address: 0x100701b0)
CloseHandle (Address: 0x1007006c)
CreateEventW (Address: 0x100700c4)
CreateFileMappingW (Address: 0x1007011c)
CreateFileW (Address: 0x10070060)
CreateMutexW (Address: 0x10070114)
CreateToolhelp32Snapshot (Address: 0x10070104)
DecodePointer (Address: 0x10070000)
DeleteCriticalSection (Address: 0x10070010)
DeleteFileW (Address: 0x1007008c)
DeviceIoControl (Address: 0x100700f8)
DisableThreadLibraryCalls (Address: 0x10070014)
EncodePointer (Address: 0x1007001c)
EnterCriticalSection (Address: 0x10070038)
EnumSystemLocalesW (Address: 0x10070220)
ExitProcess (Address: 0x10070204)
ExpandEnvironmentStringsW (Address: 0x1007014c)
FindClose (Address: 0x10070090)
FindFirstFileExW (Address: 0x100701a0)
FindFirstFileW (Address: 0x10070094)
FindNextFileW (Address: 0x10070098)
FindResourceExW (Address: 0x10070040)
FindResourceW (Address: 0x1007005c)
FlushFileBuffers (Address: 0x1007022c)
FormatMessageA (Address: 0x10070184)
FreeEnvironmentStringsW (Address: 0x1007024c)
FreeLibrary (Address: 0x10070080)
FreeResource (Address: 0x100700e4)
GetACP (Address: 0x1007023c)
GetCommandLineA (Address: 0x10070244)
GetCommandLineW (Address: 0x1007012c)
GetConsoleCP (Address: 0x10070230)
GetConsoleMode (Address: 0x10070224)
GetCPInfo (Address: 0x100701c0)
GetCurrentProcess (Address: 0x10070150)
GetCurrentProcessId (Address: 0x10070154)
GetCurrentThread (Address: 0x10070158)
GetCurrentThreadId (Address: 0x100700c8)
GetDriveTypeW (Address: 0x100700f4)
GetEnvironmentStringsW (Address: 0x10070248)
GetEnvironmentVariableW (Address: 0x10070144)
GetFileAttributesExW (Address: 0x100701a4)
GetFileAttributesW (Address: 0x100700dc)
GetFileInformationByHandleEx (Address: 0x100701b4)
GetFileSizeEx (Address: 0x10070234)
GetFileType (Address: 0x1007020c)
GetLastError (Address: 0x10070008)
GetLocaleInfoW (Address: 0x10070214)
GetLongPathNameW (Address: 0x10070168)
GetModuleFileNameW (Address: 0x10070044)
GetModuleHandleExW (Address: 0x100700fc)
GetModuleHandleW (Address: 0x10070048)
GetOEMCP (Address: 0x10070240)
GetPrivateProfileIntW (Address: 0x10070138)
GetPrivateProfileStringW (Address: 0x1007013c)
GetProcAddress (Address: 0x1007004c)
GetProcessHeap (Address: 0x10070034)
GetProcessId (Address: 0x100700b0)
GetStartupInfoW (Address: 0x100701e4)
GetStdHandle (Address: 0x10070208)
GetStringTypeW (Address: 0x10070188)
GetSystemDirectoryW (Address: 0x10070130)
GetSystemInfo (Address: 0x10070178)
GetSystemTimeAsFileTime (Address: 0x100701bc)
GetSystemWow64DirectoryW (Address: 0x100700cc)
GetTempFileNameW (Address: 0x1007009c)
GetTempPathW (Address: 0x100700a8)
GetUserDefaultLCID (Address: 0x1007021c)
GetUserDefaultUILanguage (Address: 0x10070140)
GlobalAlloc (Address: 0x100700e8)
GlobalFree (Address: 0x100700ec)
GlobalLock (Address: 0x100700d4)
GlobalUnlock (Address: 0x100700d0)
HeapAlloc (Address: 0x10070024)
HeapDestroy (Address: 0x10070020)
HeapFree (Address: 0x1007002c)
HeapReAlloc (Address: 0x10070028)
HeapSize (Address: 0x10070030)
InitializeCriticalSectionAndSpinCount (Address: 0x1007000c)
InitializeCriticalSectionEx (Address: 0x10070198)
InitializeSListHead (Address: 0x100701e0)
InitializeSRWLock (Address: 0x1007018c)
InterlockedFlushSList (Address: 0x100701ec)
IsDebuggerPresent (Address: 0x100701c4)
IsProcessorFeaturePresent (Address: 0x100701dc)
IsValidCodePage (Address: 0x10070238)
IsValidLocale (Address: 0x10070218)
LCMapStringEx (Address: 0x100701b8)
LCMapStringW (Address: 0x10070210)
LeaveCriticalSection (Address: 0x1007003c)
LoadLibraryExA (Address: 0x10070180)
LoadLibraryExW (Address: 0x10070084)
LoadLibraryW (Address: 0x10070100)
LoadResource (Address: 0x10070050)
LocalFree (Address: 0x100700b4)
LockResource (Address: 0x10070054)
lstrcmpiW (Address: 0x10070088)
lstrlenW (Address: 0x10070134)
MapViewOfFile (Address: 0x10070124)
MulDiv (Address: 0x100700f0)
MultiByteToWideChar (Address: 0x10070078)
OpenFileMappingW (Address: 0x10070120)
OpenMutexW (Address: 0x100700ac)
OpenProcess (Address: 0x10070160)
OutputDebugStringW (Address: 0x10070018)
Process32FirstW (Address: 0x10070108)
Process32NextW (Address: 0x1007010c)
ProcessIdToSessionId (Address: 0x1007015c)
QueryPerformanceCounter (Address: 0x1007016c)
QueryPerformanceFrequency (Address: 0x10070170)
RaiseException (Address: 0x10070004)
ReadConsoleW (Address: 0x10070228)
ReadFile (Address: 0x10070064)
ReleaseMutex (Address: 0x10070110)
ReleaseSRWLockExclusive (Address: 0x10070190)
ResetEvent (Address: 0x100701c8)
RtlUnwind (Address: 0x100701e8)
SetEndOfFile (Address: 0x100701a8)
SetEnvironmentVariableW (Address: 0x10070148)
SetEvent (Address: 0x100700bc)
SetFileAttributesW (Address: 0x100700a0)
SetFilePointer (Address: 0x100700a4)
SetFilePointerEx (Address: 0x100701ac)
SetLastError (Address: 0x10070164)
SetNamedPipeHandleState (Address: 0x10070070)
SetStdHandle (Address: 0x10070174)
SetUnhandledExceptionFilter (Address: 0x100701d4)
SizeofResource (Address: 0x10070058)
Sleep (Address: 0x100700b8)
TerminateProcess (Address: 0x100701d8)
TlsAlloc (Address: 0x100701f0)
TlsFree (Address: 0x100701fc)
TlsGetValue (Address: 0x100701f4)
TlsSetValue (Address: 0x100701f8)
TryEnterCriticalSection (Address: 0x1007019c)
UnhandledExceptionFilter (Address: 0x100701d0)
UnmapViewOfFile (Address: 0x10070128)
VerifyVersionInfoW (Address: 0x100700e0)
VerSetConditionMask (Address: 0x100700d8)
VirtualAlloc (Address: 0x10070200)
VirtualProtect (Address: 0x1007017c)
VirtualQuery (Address: 0x10070118)
WaitForSingleObject (Address: 0x100700c0)
WaitForSingleObjectEx (Address: 0x100701cc)
WaitNamedPipeW (Address: 0x10070074)
WideCharToMultiByte (Address: 0x1007007c)
WriteConsoleW (Address: 0x10070250)
WriteFile (Address: 0x10070068)