SHCore.dll
v10.0.19041.5794
64-bit
Windows NT
Analyzed
Security warning
This file has been flagged as potentially dangerous, and downloads are disabled.
Reason: Detected potentially dangerous functions used for process injection: OpenProcess
Exported functions 201
#1 · 0xa0a0
CommandLineToArgvW
#2 · 0x1e030
CreateRandomAccessStreamOnFile
#3 · 0x30d20
CreateRandomAccessStreamOverStream
#4 · 0x234b0
CreateStreamOverRandomAccessStream
#5 · 0x31440
DllCanUnloadNow
#6 · 0x326e0
DllGetActivationFactory
#7 · 0x567e0
DllGetClassObject
#8 · 0x302d0
GetCurrentProcessExplicitAppUserModelID
#9 · 0x72d50
GetDpiForMonitor
#10 · 0xb5a0
GetDpiForShellUIComponent
#11 · 0x30320
GetFeatureEnabledState
#12 · 0x2b3f0
GetFeatureVariant
#13 · 0x2b350
GetProcessDpiAwareness
#14 · 0x37620
GetProcessReference
#15 · 0x26390
GetScaleFactorForDevice
#16 · 0x32630
GetScaleFactorForMonitor
#17 · 0x2fac0
IStream_Copy
#18 · 0x2070
IStream_Read
#19 · 0xbd90
IStream_ReadStr
#20 · 0xb360
IStream_Reset
#21 · 0xedc0
IStream_Size
#22 · 0x30bd0
IStream_Write
#23 · 0x251e0
IStream_WriteStr
#24 · 0x25260
IUnknown_AtomicRelease
#25 · 0x568e0
IUnknown_GetSite
#26 · 0x28080
IUnknown_QueryService
#27 · 0x1f8f0
IUnknown_Set
#28 · 0x1f7f0
IUnknown_SetSite
#29 · 0x28110
IsOS
#30 · 0x1d1c0
IsProcessInIsolatedContainer
#31 · 0x31b60
IsProcessInWDAGContainer
#32 · 0x31a60
RecordFeatureError
#33 · 0x57210
RecordFeatureUsage
#34 · 0x19550
RegisterScaleChangeEvent
#35 · 0x384a0
RegisterScaleChangeNotifications
#36 · 0x59500
RevokeScaleChangeNotifications
#37 · 0x59840
SHAnsiToAnsi
#38 · 0x73790
SHAnsiToUnicode
#39 · 0x1faa0
SHCopyKeyA
#40 · 0x58080
SHCopyKeyW
#41 · 0x58100
SHCreateMemStream
#42 · 0x107d0
SHCreateStreamOnFileA
#43 · 0x6a2d0
SHCreateStreamOnFileEx
#44 · 0x319d0
SHCreateStreamOnFileW
#45 · 0x2a7d0
SHCreateThread
#46 · 0x26080
SHCreateThreadRef
#47 · 0x2bfc0
SHCreateThreadWithHandle
#48 · 0x26060
SHDeleteEmptyKeyA
#49 · 0x578e0
SHDeleteEmptyKeyW
#50 · 0x57b60
SHDeleteKeyA
#51 · 0x583d0
SHDeleteKeyW
#52 · 0x38a20
SHDeleteValueA
#53 · 0x579f0
SHDeleteValueW
#54 · 0x374e0
SHEnumKeyExA
#55 · 0x58450
SHEnumKeyExW
#56 · 0x35d60
SHEnumValueA
#57 · 0x58490
SHEnumValueW
#58 · 0x36d00
SHGetThreadRef
#59 · 0x266e0
SHGetValueA
#60 · 0x36680
SHGetValueW
#61 · 0x1b510
SHOpenRegStream2A
#62 · 0x69890
SHOpenRegStream2W
#63 · 0x2ca90
SHOpenRegStreamA
#64 · 0x69990
SHOpenRegStreamW
#65 · 0x699c0
SHQueryInfoKeyA
#66 · 0x58560
SHQueryInfoKeyW
#67 · 0x37d80
SHQueryValueExA
#68 · 0x585c0
SHQueryValueExW
#69 · 0x1b4c0
SHRegDuplicateHKey
#70 · 0x58600
SHRegGetIntW
#71 · 0x58640
SHRegGetPathA
#72 · 0x586f0
SHRegGetPathW
#73 · 0x58730
SHRegGetValueA
#74 · 0x366c0
SHRegGetValueW
#75 · 0x1ad60
SHRegSetPathA
#76 · 0x58770
SHRegSetPathW
#77 · 0x58820
SHReleaseThreadRef
#78 · 0x2c060
SHSetThreadRef
#79 · 0x2bf90
SHSetValueA
#80 · 0x57a80
SHSetValueW
#81 · 0x31350
SHStrDupA
#82 · 0x39f30
SHStrDupW
#83 · 0x150e0
SHTaskPoolAllowThreadReuse
#84 · 0x2efd0
SHTaskPoolDoNotWaitForMoreTasks
#85 · 0x573a0
SHTaskPoolGetCurrentThreadLifetime
#86 · 0x18e80
SHTaskPoolGetUniqueContext
#87 · 0x33c00
SHTaskPoolQueueTask
#88 · 0x15a10
SHTaskPoolSetThreadReuseAllowed
#89 · 0x573b0
SHUnicodeToAnsi
#90 · 0x306c0
SHUnicodeToUnicode
#91 · 0x73bc0
SetCurrentProcessExplicitAppUserModelID
#92 · 0x20f40
SetProcessDpiAwareness
#93 · 0x38c70
SetProcessReference
#94 · 0x37d70
SubscribeFeatureStateChangeNotification
#95 · 0x38c60
UnregisterScaleChangeEvent
#96 · 0x38ca0
UnsubscribeFeatureStateChangeNotification
#97 · 0x1df60
#100 · 0x141d0
#101 · 0xfa40
#102 · 0x37110
#103 · 0x2ad0
#104 · 0x13f70
#105 · 0x28830
#106 · 0x27690
#107 · 0x69780
#108 · 0x697f0
#109 · 0x2d3b0
#110 · 0x2d1b0
#111 · 0x695d0
#115 · 0x320e0
#116 · 0x6cb50
#117 · 0x64630
#120 · 0x14020
#121 · 0x37e10
SHRegGetValueFromHKCUHKLM
#122 · 0x1a910
#123 · 0x1c2b0
#124 · 0x584e0
#125 · 0x58520
#126 · 0x1d520
#127 · 0x11270
#130 · 0x1a710
#131 · 0x37c90
#132 · 0x573d0
#133 · 0x57410
#140 · 0x1f850
#141 · 0x25380
#142 · 0x1dae0
#143 · 0x25b40
#144 · 0x2ed10
#145 · 0x21530
#150 · 0x737f0
#151 · 0x306e0
#152 · 0x73a90
#153 · 0x73970
#160 · 0x73770
#161 · 0x26300
#162 · 0x30080
#170 · 0x255c0
#171 · 0x57510
#172 · 0x2bb30
#173 · 0x25b80
#174 · 0x267c0
#175 · 0x57440
#181 · 0xef30
#182 · 0xb980
#183 · 0xd450
#184 · 0x38e30
#185 · 0x73de0
#186 · 0x30680
#187 · 0x2f530
#188 · 0x310b0
#189 · 0x2f3b0
#190 · 0x12710
#191 · 0x36520
#192 · 0x1cfc0
#193 · 0x1b1e0
#200 · 0x1e400
#210 · 0x1dfe0
#211 · 0x253f0
#212 · 0x73df0
#213 · 0x25680
#220 · 0x591e0
#222 · 0x325f0
#223 · 0x594c0
#224 · 0x59950
#225 · 0x59180
#226 · 0x59350
#227 · 0x595f0
#228 · 0x599a0
#229 · 0x59290
#230 · 0x3100
#231 · 0x72ab0
#232 · 0x72be0
#233 · 0x34c0
#234 · 0x31270
#240 · 0x32060
#241 · 0x598f0
#242 · 0x596b0
#244 · 0x123b0
#245 · 0x31fa0
#246 · 0x34eb0
#247 · 0x32440
#248 · 0x1d8c0
#249 · 0x5a560
#250 · 0x7f30
#251 · 0x6cb0
#252 · 0x743a0
#253 · 0x74840
#254 · 0x7040
#255 · 0x19460
#260 · 0x593a0
#261 · 0x59720
#270 · 0x2b640
#280 · 0x2b050
#281 · 0x2b210
#282 · 0x74990
#283 · 0x748e0
#284 · 0x2b270
#290 · 0x2b030
#291 · 0x74910
#292 · 0x2b010
No function matches your filter.
Imported DLLs & functions 242
ApiSetQueryApiSetPresence
0x180082e70
GlobalAddAtomExW
0x180082e80
GlobalDeleteAtom
0x180082e90
GlobalGetAtomNameW
0x180082e88
DebugBreak
0x180082ea8
IsDebuggerPresent
0x180082ea0
OutputDebugStringW
0x180082eb0
DelayLoadFailureHook
0x180082ec0
ResolveDelayLoadedAPI
0x180082ed0
GetLastError
0x180082ee8
RaiseException
0x180082ee0
SetLastError
0x180082ef8
SetUnhandledExceptionFilter
0x180082f00
UnhandledExceptionFilter
0x180082ef0
RaiseFailFastException
0x180082f10
CreateDirectoryW
0x180082f40
CreateFileW
0x180082f90
DeleteFileW
0x180082f58
FlushFileBuffers
0x180082f20
GetDriveTypeW
0x180082f50
GetFileAttributesExW
0x180082fa8
GetFileAttributesW
0x180082f68
GetFileInformationByHandle
0x180082f88
GetFileSizeEx
0x180082fa0
GetVolumeInformationByHandleW
0x180082f30
LockFileEx
0x180082f38
ReadFile
0x180082f28
SetEndOfFile
0x180082f78
SetFileInformationByHandle
0x180082f98
SetFilePointer
0x180082f80
SetFilePointerEx
0x180082f48
UnlockFileEx
0x180082f70
WriteFile
0x180082f60
CreateFile2
0x180082fb8
GetProcessHeap
0x180083008
HeapAlloc
0x180082ff8
HeapFree
0x180083000
LocalAlloc
0x180083020
LocalFree
0x180083018
LocalReAlloc
0x180083028
CancelIoEx
0x180083048
DeviceIoControl
0x180083038
GetOverlappedResult
0x180083040
MulDiv
0x180083058
DisableThreadLibraryCalls
0x180083078
FindResourceExW
0x1800830b0
FreeLibrary
0x1800830b8
FreeLibraryAndExitThread
0x180083098
GetModuleFileNameA
0x1800830c8
GetModuleFileNameW
0x1800830c0
GetModuleHandleExW
0x180083090
GetModuleHandleW
0x1800830a0
GetProcAddress
0x180083070
LoadLibraryExW
0x180083088
LoadResource
0x180083080
LockResource
0x1800830a8
SizeofResource
0x180083068
GetUserDefaultUILanguage
0x1800830f0
CreateFileMappingW
0x180083100
MapViewOfFile
0x180083118
OpenFileMappingW
0x180083110
UnmapViewOfFile
0x180083108
PathCchAddBackslashEx
0x180083128
ExpandEnvironmentStringsA
0x180083138
ExpandEnvironmentStringsW
0x180083140
CreateThread
0x180083178
GetCurrentProcess
0x1800831c8
GetCurrentProcessId
0x1800831a0
GetCurrentThread
0x180083168
GetCurrentThreadId
0x180083188
GetProcessId
0x180083170
GetStartupInfoW
0x1800831b0
GetThreadPriority
0x1800831a8
OpenProcessToken
0x1800831d0
OpenThreadToken
0x180083160
ResumeThread
0x180083150
SetThreadPriority
0x1800831b8
TerminateProcess
0x180083180
TlsAlloc
0x180083158
TlsFree
0x1800831c0
TlsGetValue
0x180083198
TlsSetValue
0x180083190
OpenProcess
0x1800831e0
QueryPerformanceCounter
0x1800831f0
QuirkIsEnabled
0x180083200
RegCloseKey
0x180083270
RegCreateKeyExA
0x1800832a0
RegCreateKeyExW
0x180083248
RegDeleteKeyExA
0x1800832a8
RegDeleteKeyExW
0x180083218
RegDeleteValueA
0x180083220
RegDeleteValueW
0x180083250
RegEnumKeyExA
0x180083258
RegEnumKeyExW
0x180083240
RegEnumValueA
0x180083260
RegEnumValueW
0x180083228
RegGetValueW
0x180083230
RegOpenKeyExA
0x180083288
RegOpenKeyExW
0x180083290
RegQueryInfoKeyA
0x180083238
RegQueryInfoKeyW
0x180083210
RegQueryValueExA
0x180083268
RegQueryValueExW
0x180083280
RegSetValueExA
0x180083298
RegSetValueExW
0x180083278
RtlCaptureContext
0x1800832c8
RtlLookupFunctionEntry
0x1800832c0
RtlVirtualUnwind
0x1800832b8
PathCombineW
0x1800832f8
PathFileExistsW
0x1800832d8
PathFindExtensionW
0x180083310
PathFindFileNameW
0x180083308
PathGetDriveNumberW
0x180083320
PathIsRelativeW
0x1800832e8
PathIsUNCW
0x180083318
PathRemoveFileSpecW
0x1800832f0
PathUnExpandEnvStringsA
0x1800832e0
PathUnExpandEnvStringsW
0x180083300
QISearch
0x180083340
StrChrW
0x180083348
StrCmpICW
0x180083350
StrCmpNICW
0x180083360
StrCmpNIW
0x180083330
StrDupA
0x180083368
StrDupW
0x180083358
StrToIntW
0x180083338
SHLoadIndirectString
0x180083390
AcquireSRWLockExclusive
0x1800833d0
AcquireSRWLockShared
0x180083400
CreateEventExW
0x1800833c0
CreateEventW
0x180083420
CreateMutexExW
0x1800833f0
CreateMutexW
0x180083458
CreateSemaphoreExW
0x180083440
DeleteCriticalSection
0x1800833f8
EnterCriticalSection
0x180083448
InitializeCriticalSection
0x180083460
InitializeCriticalSectionEx
0x180083428
InitializeSRWLock
0x180083470
LeaveCriticalSection
0x180083438
OpenEventW
0x180083418
OpenSemaphoreW
0x1800833e0
ReleaseMutex
0x1800833b8
ReleaseSemaphore
0x180083430
ReleaseSRWLockExclusive
0x180083410
ReleaseSRWLockShared
0x1800833e8
SetEvent
0x180083408
TryAcquireSRWLockExclusive
0x180083468
WaitForMultipleObjectsEx
0x180083450
WaitForSingleObject
0x1800833c8
WaitForSingleObjectEx
0x1800833d8
InitOnceBeginInitialize
0x180083498
InitOnceComplete
0x180083480
InitOnceExecuteOnce
0x180083490
Sleep
0x180083488
GetSystemTimeAsFileTime
0x1800834c0
GetTickCount
0x1800834a8
GetTickCount64
0x1800834b0
GetVersionExW
0x1800834b8
GetOsSafeBootMode
0x1800834d0
CallbackMayRunLong
0x1800834e0
CloseThreadpoolTimer
0x1800834e8
CloseThreadpoolWait
0x180083510
CreateThreadpoolTimer
0x180083520
CreateThreadpoolWait
0x180083500
DisassociateCurrentThreadFromCallback
0x180083518
FreeLibraryWhenCallbackReturns
0x180083528
SetThreadpoolTimer
0x1800834f8
SetThreadpoolWait
0x180083538
TrySubmitThreadpoolCallback
0x180083530
WaitForThreadpoolTimerCallbacks
0x1800834f0
WaitForThreadpoolWaitCallbacks
0x180083508
CreateTimerQueueTimer
0x180083548
DeleteTimerQueueTimer
0x180083558
QueueUserWorkItem
0x180083550
GetFileVersionInfoExW
0x180083590
GetFileVersionInfoSizeExW
0x180083588
VerQueryValueW
0x180083580
Wow64SetThreadDefaultGuestMachine
0x1800835a0
EventProviderEnabled
0x1800835c8
EventRegister
0x1800835b8
EventSetInformation
0x1800835d0
EventUnregister
0x1800835c0
EventWriteTransfer
0x1800835b0
AdjustTokenPrivileges
0x1800835e8
CheckTokenMembership
0x1800835f8
GetTokenInformation
0x180083600
ImpersonateLoggedOnUser
0x1800835f0
RevertToSelf
0x1800835e0
0x180083610
msvcrt.dll
20
__C_specific_handler
0x180083670
__CxxFrameHandler3
0x180083650
__dllonexit
0x180083658
_amsg_exit
0x180083628
_callnewh
0x180083648
_initterm
0x1800836b0
_lock
0x1800836a8
_onexit
0x180083660
_purecall
0x180083688
_unlock
0x180083690
_vsnwprintf
0x1800836a0
_XcptFilter
0x180083678
floor
0x180083620
free
0x180083680
malloc
0x180083630
memcmp
0x180083638
memcpy
0x180083640
memcpy_s
0x180083698
memmove
0x180083668
memset
0x1800836b8
ntdll.dll
20
_vsnprintf_s
0x1800836d0
memmove_s
0x1800836c8
NtCreateFile
0x180083730
NtQueryInformationProcess
0x180083728
NtQuerySystemInformation
0x180083710
NtQuerySystemInformationEx
0x180083760
RtlAcquireSRWLockExclusive
0x180083720
RtlAreLongPathsEnabled
0x1800836f0
RtlInitUnicodeString
0x180083738
RtlNtStatusToDosError
0x180083740
RtlQueryWnfStateData
0x180083750
RtlReleaseSRWLockExclusive
0x180083718
RtlSleepConditionVariableSRW
0x180083708
RtlSubscribeWnfStateChangeNotification
0x180083758
RtlUnsubscribeWnfNotificationWaitForCompletion
0x180083748
RtlWakeAllConditionVariable
0x180083700
toupper
0x1800836f8
wcschr
0x1800836e0
wcsncmp
0x1800836d8
wcsrchr
0x1800836e8
No function matches your filter.