CoreShellExtFramework.dll

Description: Core Shell SI Host Extension Framework for Composable Shell

Version: 10.0.19041.4355

Architecture: 64-bit

Operating System: Windows NT

SHA256: aafccff8fc8a613a43ef23730ba36a27

File Size: 103.5 KB

Uploaded At: Dec. 1, 2025, 7:24 a.m.

Views: 11

Security Warning

This file has been flagged as potentially dangerous.

Reason: Detected potentially dangerous functions used for process injection: OpenProcess

Exported Functions

DllCanUnloadNow (Ordinal: 1, Address: 0x5650)
DllGetActivationFactory (Ordinal: 2, Address: 0x5380)
DllGetClassObject (Ordinal: 3, Address: 0x5560)

Imported DLLs & Functions

api-ms-win-appmodel-identity-l1-2-0.dll

AppContainerDeriveSidFromMoniker (Address: 0x180012c48)

api-ms-win-appmodel-runtime-l1-1-1.dll

GetApplicationUserModelIdFromToken (Address: 0x180012c58)

api-ms-win-core-apiquery-l1-1-0.dll

ApiSetQueryApiSetPresence (Address: 0x180012c68)

api-ms-win-core-com-l1-1-0.dll

CoCreateFreeThreadedMarshaler (Address: 0x180012c90)
CoCreateInstance (Address: 0x180012ca0)
CoGetCallContext (Address: 0x180012c80)
CoRegisterClassObject (Address: 0x180012c98)
CoRevokeClassObject (Address: 0x180012c78)
CoTaskMemAlloc (Address: 0x180012ca8)
CoTaskMemFree (Address: 0x180012c88)

api-ms-win-core-debug-l1-1-0.dll

DebugBreak (Address: 0x180012cc0)
IsDebuggerPresent (Address: 0x180012cb8)
OutputDebugStringW (Address: 0x180012cc8)

api-ms-win-core-delayload-l1-1-0.dll

DelayLoadFailureHook (Address: 0x180012cd8)

api-ms-win-core-delayload-l1-1-1.dll

ResolveDelayLoadedAPI (Address: 0x180012ce8)

api-ms-win-core-errorhandling-l1-1-0.dll

GetLastError (Address: 0x180012d00)
RaiseException (Address: 0x180012d18)
SetLastError (Address: 0x180012cf8)
SetUnhandledExceptionFilter (Address: 0x180012d10)
UnhandledExceptionFilter (Address: 0x180012d08)

api-ms-win-core-handle-l1-1-0.dll

CloseHandle (Address: 0x180012d28)
DuplicateHandle (Address: 0x180012d30)

api-ms-win-core-heap-l1-1-0.dll

GetProcessHeap (Address: 0x180012d40)
HeapAlloc (Address: 0x180012d50)
HeapFree (Address: 0x180012d48)

api-ms-win-core-interlocked-l1-1-0.dll

InitializeSListHead (Address: 0x180012d60)

api-ms-win-core-libraryloader-l1-2-0.dll

DisableThreadLibraryCalls (Address: 0x180012d80)
GetModuleFileNameA (Address: 0x180012d90)
GetModuleHandleExW (Address: 0x180012d88)
GetModuleHandleW (Address: 0x180012d70)
GetProcAddress (Address: 0x180012d78)

api-ms-win-core-localization-l1-2-0.dll

FormatMessageW (Address: 0x180012da0)

api-ms-win-core-processthreads-l1-1-0.dll

CreateProcessAsUserW (Address: 0x180012db8)
CreateProcessW (Address: 0x180012dc0)
GetCurrentProcess (Address: 0x180012dd8)
GetCurrentProcessId (Address: 0x180012dd0)
GetCurrentThreadId (Address: 0x180012df0)
InitializeProcThreadAttributeList (Address: 0x180012de8)
OpenProcessToken (Address: 0x180012de0)
TerminateProcess (Address: 0x180012dc8)
UpdateProcThreadAttribute (Address: 0x180012db0)

api-ms-win-core-processthreads-l1-1-1.dll

IsProcessorFeaturePresent (Address: 0x180012e08)
OpenProcess (Address: 0x180012e00)

api-ms-win-core-profile-l1-1-0.dll

QueryPerformanceCounter (Address: 0x180012e18)

api-ms-win-core-registry-l1-1-0.dll

RegGetValueW (Address: 0x180012e28)

api-ms-win-core-rtlsupport-l1-1-0.dll

RtlCaptureContext (Address: 0x180012e48)
RtlLookupFunctionEntry (Address: 0x180012e40)
RtlVirtualUnwind (Address: 0x180012e38)

api-ms-win-core-synch-l1-1-0.dll

AcquireSRWLockExclusive (Address: 0x180012e80)
AcquireSRWLockShared (Address: 0x180012ea8)
CreateMutexExW (Address: 0x180012e68)
CreateSemaphoreExW (Address: 0x180012e90)
OpenSemaphoreW (Address: 0x180012e98)
ReleaseMutex (Address: 0x180012e60)
ReleaseSemaphore (Address: 0x180012e88)
ReleaseSRWLockExclusive (Address: 0x180012e78)
ReleaseSRWLockShared (Address: 0x180012ea0)
WaitForSingleObject (Address: 0x180012e70)
WaitForSingleObjectEx (Address: 0x180012e58)

api-ms-win-core-synch-l1-2-0.dll

InitOnceBeginInitialize (Address: 0x180012ec8)
InitOnceComplete (Address: 0x180012ec0)
InitOnceExecuteOnce (Address: 0x180012eb8)

api-ms-win-core-sysinfo-l1-1-0.dll

GetSystemTimeAsFileTime (Address: 0x180012ed8)
GetTickCount (Address: 0x180012ee0)

api-ms-win-core-util-l1-1-0.dll

DecodePointer (Address: 0x180012ef0)
EncodePointer (Address: 0x180012ef8)

api-ms-win-core-winrt-error-l1-1-0.dll

RoOriginateError (Address: 0x180012f10)
RoOriginateErrorW (Address: 0x180012f08)

api-ms-win-core-winrt-l1-1-0.dll

RoGetActivationFactory (Address: 0x180012f20)

api-ms-win-core-winrt-string-l1-1-0.dll

WindowsCreateStringReference (Address: 0x180012f30)
WindowsDeleteString (Address: 0x180012f38)
WindowsDuplicateString (Address: 0x180012f58)
WindowsGetStringRawBuffer (Address: 0x180012f40)
WindowsIsStringEmpty (Address: 0x180012f50)
WindowsStringHasEmbeddedNull (Address: 0x180012f48)

api-ms-win-crt-private-l1-1-0.dll

__C_specific_handler (Address: 0x180012fd0)
__CxxFrameHandler3 (Address: 0x180013028)
__CxxFrameHandler4 (Address: 0x180013040)
__std_terminate (Address: 0x180013038)
_CxxThrowException (Address: 0x180013020)
_o___std_exception_copy (Address: 0x180013018)
_o___std_exception_destroy (Address: 0x180013010)
_o___std_type_info_destroy_list (Address: 0x180013008)
_o___stdio_common_vsnprintf_s (Address: 0x180012fe8)
_o___stdio_common_vswprintf (Address: 0x180012fe0)
_o__callnewh (Address: 0x180012ff8)
_o__cexit (Address: 0x180012ff0)
_o__configure_narrow_argv (Address: 0x180012fd8)
_o__crt_atexit (Address: 0x180013000)
_o__errno (Address: 0x180012f68)
_o__execute_onexit_table (Address: 0x180012f70)
_o__initialize_narrow_environment (Address: 0x180012f78)
_o__initialize_onexit_table (Address: 0x180012f80)
_o__invalid_parameter_noinfo (Address: 0x180012f88)
_o__invalid_parameter_noinfo_noreturn (Address: 0x180012f90)
_o__purecall (Address: 0x180012f98)
_o__register_onexit_function (Address: 0x180012fa0)
_o__seh_filter_dll (Address: 0x180012fa8)
_o_free (Address: 0x180012fb8)
_o_malloc (Address: 0x180012fc0)
_o_terminate (Address: 0x180012fc8)
memcpy (Address: 0x180013048)
memmove (Address: 0x180012fb0)
wcschr (Address: 0x180013030)

api-ms-win-crt-runtime-l1-1-0.dll

_initterm (Address: 0x180013060)
_initterm_e (Address: 0x180013058)

api-ms-win-crt-string-l1-1-0.dll

memset (Address: 0x180013070)

api-ms-win-eventing-provider-l1-1-0.dll

EventActivityIdControl (Address: 0x180013080)
EventRegister (Address: 0x180013098)
EventSetInformation (Address: 0x180013090)
EventUnregister (Address: 0x180013088)
EventWriteTransfer (Address: 0x1800130a0)

api-ms-win-security-base-l1-1-0.dll

DuplicateTokenEx (Address: 0x1800130b0)
FreeSid (Address: 0x1800130b8)

api-ms-win-security-capability-l1-1-0.dll

CapabilityCheck (Address: 0x1800130c8)

api-ms-win-security-sddl-l1-1-0.dll

ConvertStringSidToSidW (Address: 0x1800130d8)

api-ms-win-service-management-l1-1-0.dll

CloseServiceHandle (Address: 0x1800130f0)
OpenSCManagerW (Address: 0x1800130f8)
OpenServiceW (Address: 0x1800130e8)

api-ms-win-service-private-l1-1-0.dll

WaitServiceState (Address: 0x180013108)

api-ms-win-service-winsvc-l1-1-0.dll

QueryServiceStatus (Address: 0x180013118)

api-ms-win-shcore-taskpool-l1-1-0.dll

SHTaskPoolQueueTask (Address: 0x180013128)

combase.dll

(Address: 0x180013138)

msvcp_win.dll

?_Xlength_error@std@@YAXPEBD@Z (Address: 0x180013148)

ntdll.dll

NtQueryInformationToken (Address: 0x180013158)
RtlAllocateHeap (Address: 0x180013178)
RtlCompareUnicodeString (Address: 0x180013168)
RtlFreeHeap (Address: 0x180013160)
RtlInitUnicodeString (Address: 0x180013170)
RtlNtStatusToDosErrorNoTeb (Address: 0x180013180)

twinapi.appcore.dll

(Address: 0x180013190)
(Address: 0x180013198)

USERENV.dll

CreateAppContainerProfile (Address: 0x180012c38)