mscoreei.dll

Description: Microsoft .NET Runtime Execution Engine

Version: 4.8.9093.0

Architecture: 32-bit

Operating System: Windows

SHA256: 8d1c6b8bb7769f30bd524f4444310696

File Size: 532.4 KB

Uploaded At: Dec. 1, 2025, 7:19 a.m.

Views: 25

Security Warning

This file has been flagged as potentially dangerous.

Reason: Detected potentially dangerous functions used for process injection: OpenProcess

Exported Functions

InitErrors (Ordinal: 17, Address: 0x2cb90)
PostError (Ordinal: 18, Address: 0x2cc70)
InitSSAutoEnterThread (Ordinal: 19, Address: 0x2cc90)
UpdateError (Ordinal: 20, Address: 0x2cce0)
CloseCtrs (Ordinal: 21, Address: 0x2eb90)
LoadStringRC (Ordinal: 22, Address: 0x2cd20)
ReOpenMetaDataWithMemory (Ordinal: 23, Address: 0x2ce10)
(Ordinal: 24, Address: 0xaad0)
CollectCtrs (Ordinal: 25, Address: 0x2eb60)
CorDllMainWorker (Ordinal: 26, Address: 0x2e780)
CorDllMainWorkerForThunk (Ordinal: 27, Address: 0x123c0)
EEDllGetClassObjectFromClass (Ordinal: 28, Address: 0x2d030)
GetPrivateContextsPerfCounters (Ordinal: 29, Address: 0x2d480)
GetProcessExecutableHeap (Ordinal: 30, Address: 0x1c50)
GetStartupFlags (Ordinal: 31, Address: 0x2bed0)
GetTargetForVTableEntry (Ordinal: 32, Address: 0x3b8c0)
GetTokenForVTableEntry (Ordinal: 33, Address: 0x3b830)
LogHelp_LogAssert (Ordinal: 34, Address: 0x2d350)
LogHelp_NoGuiOnAssert (Ordinal: 35, Address: 0x2d3c0)
LogHelp_TerminateOnAssert (Ordinal: 36, Address: 0x2d420)
OnShimDllMainCalled (Ordinal: 37, Address: 0xb2d0)
OpenCtrs (Ordinal: 38, Address: 0x2e900)
PostErrorVA (Ordinal: 39, Address: 0x2cbe0)
RegisterShimImplCallback (Ordinal: 40, Address: 0x1350)
SetTargetForVTableEntry (Ordinal: 41, Address: 0x3b8b0)
CLRCreateInstance (Ordinal: 42, Address: 0x9900)
CallFunctionShim (Ordinal: 43, Address: 0x2d570)
ClrCreateManagedInstance (Ordinal: 44, Address: 0x3200)
CoEEShutDownCOM (Ordinal: 45, Address: 0x2d0a0)
CoInitializeCor (Ordinal: 46, Address: 0x2c950)
CoInitializeEE (Ordinal: 47, Address: 0x3180)
CoUninitializeCor (Ordinal: 48, Address: 0x2c9d0)
CoUninitializeEE (Ordinal: 49, Address: 0x2c8d0)
CorBindToCurrentRuntime (Ordinal: 50, Address: 0x2a640)
CorBindToRuntime (Ordinal: 51, Address: 0x2a080)
CorBindToRuntimeByCfg (Ordinal: 52, Address: 0x2a430)
CorBindToRuntimeByPath (Ordinal: 53, Address: 0x29b20)
CorBindToRuntimeByPathEx (Ordinal: 54, Address: 0x29dd0)
CorBindToRuntimeEx (Ordinal: 55, Address: 0x2a370)
CorBindToRuntimeHost (Ordinal: 56, Address: 0x2a580)
CorExitProcess (Ordinal: 57, Address: 0x2d4f0)
CorGetSvc (Ordinal: 58, Address: 0x2b6f0)
CorIsLatestSvc (Ordinal: 59, Address: 0x2b8c0)
CorMarkThreadInThreadPool (Ordinal: 60, Address: 0x3c50)
CorTickleSvc (Ordinal: 61, Address: 0x2b950)
CreateConfigStream (Ordinal: 62, Address: 0xaff0)
CreateDebuggingInterfaceFromVersion (Ordinal: 63, Address: 0x30aa0)
CreateInterface (Ordinal: 64, Address: 0x9900)
DllCanUnloadNow (Ordinal: 65, Address: 0x2d5e0)
DllGetClassObject (Ordinal: 66, Address: 0x2de20)
DllRegisterServer (Ordinal: 67, Address: 0x2e280)
DllUnregisterServer (Ordinal: 68, Address: 0x2e330)
EEDllRegisterServer (Ordinal: 69, Address: 0x32d0)
EEDllUnregisterServer (Ordinal: 70, Address: 0x3350)
GetAssemblyMDImport (Ordinal: 71, Address: 0x2e3e0)
GetCORRequiredVersion (Ordinal: 72, Address: 0x2a810)
GetCORRootDirectory (Ordinal: 73, Address: 0x2b7d0)
GetCORSystemDirectory (Ordinal: 74, Address: 0x2bea0)
GetCORSystemDirectory_RetAddr (Ordinal: 75, Address: 0x2bc20)
GetCORVersion (Ordinal: 76, Address: 0x2a910)
GetCompileInfo (Ordinal: 77, Address: 0x2d040)
GetFileVersion (Ordinal: 78, Address: 0x302b0)
GetHashFromAssemblyFile (Ordinal: 79, Address: 0x39ec0)
GetHashFromAssemblyFileW (Ordinal: 80, Address: 0x39f20)
GetHashFromBlob (Ordinal: 81, Address: 0x3a0a0)
GetHashFromFile (Ordinal: 82, Address: 0x39f80)
GetHashFromFileW (Ordinal: 83, Address: 0x39fe0)
GetHashFromHandle (Ordinal: 84, Address: 0x3a040)
GetHostConfigurationFile (Ordinal: 85, Address: 0x2bf30)
GetMetaDataInternalInterface (Ordinal: 86, Address: 0x2cb20)
GetMetaDataInternalInterfaceFromPublic (Ordinal: 87, Address: 0x2cab0)
GetMetaDataPublicInterfaceFromInternal (Ordinal: 88, Address: 0x2ca40)
GetPermissionRequests (Ordinal: 89, Address: 0x2cfa0)
GetRealProcAddress (Ordinal: 90, Address: 0x2c190)
GetRequestedRuntimeInfo (Ordinal: 91, Address: 0x2ae80)
GetRequestedRuntimeVersion (Ordinal: 92, Address: 0x2b1a0)
GetRequestedRuntimeVersionForCLSID (Ordinal: 93, Address: 0x2b3c0)
GetVersionFromProcess (Ordinal: 94, Address: 0x31210)
GetXMLElement (Ordinal: 95, Address: 0x4b0d0)
GetXMLElementAttribute (Ordinal: 96, Address: 0x4b0e0)
GetXMLObject (Ordinal: 97, Address: 0x1f160)
IEE (Ordinal: 98, Address: 0x2d520)
LoadLibraryShim (Ordinal: 99, Address: 0x2c270)
LoadLibraryWithPolicyShim (Ordinal: 100, Address: 0x2c1f0)
LoadStringRCEx (Ordinal: 101, Address: 0x2cd90)
LockClrVersion (Ordinal: 102, Address: 0x27c20)
MetaDataGetDispenser (Ordinal: 103, Address: 0x2c860)
ND_CopyObjDst (Ordinal: 104, Address: 0x2d330)
ND_CopyObjSrc (Ordinal: 105, Address: 0x2d310)
ND_RI2 (Ordinal: 106, Address: 0x124f0)
ND_RI4 (Ordinal: 107, Address: 0x2d280)
ND_RI8 (Ordinal: 108, Address: 0x2d290)
ND_RU1 (Ordinal: 109, Address: 0x12510)
ND_WI2 (Ordinal: 110, Address: 0x2d2b0)
ND_WI4 (Ordinal: 111, Address: 0x2d2d0)
ND_WI8 (Ordinal: 112, Address: 0x2d2f0)
ND_WU1 (Ordinal: 113, Address: 0x12530)
ReOpenMetaDataWithMemoryEx (Ordinal: 114, Address: 0x2ce80)
RunDll32ShimW (Ordinal: 115, Address: 0x2c4d0)
RuntimeOSHandle (Ordinal: 116, Address: 0x2d200)
RuntimeOpenImage (Ordinal: 117, Address: 0x2d100)
RuntimeReleaseHandle (Ordinal: 118, Address: 0x2d180)
StrongNameCompareAssemblies (Ordinal: 119, Address: 0x39da0)
StrongNameErrorInfo (Ordinal: 120, Address: 0x39790)
StrongNameFreeBuffer (Ordinal: 121, Address: 0x39820)
StrongNameGetBlob (Ordinal: 122, Address: 0x3a100)
StrongNameGetBlobFromImage (Ordinal: 123, Address: 0x3a160)
StrongNameGetPublicKey (Ordinal: 124, Address: 0x399f0)
StrongNameHashSize (Ordinal: 125, Address: 0x39e00)
StrongNameKeyDelete (Ordinal: 126, Address: 0x399a0)
StrongNameKeyGen (Ordinal: 127, Address: 0x39880)
StrongNameKeyGenEx (Ordinal: 128, Address: 0x398e0)
StrongNameKeyInstall (Ordinal: 129, Address: 0x39940)
StrongNameSignatureGeneration (Ordinal: 130, Address: 0x39a50)
StrongNameSignatureGenerationEx (Ordinal: 131, Address: 0x39ab0)
StrongNameSignatureSize (Ordinal: 132, Address: 0x39e60)
StrongNameSignatureVerification (Ordinal: 133, Address: 0x39c80)
StrongNameSignatureVerificationEx (Ordinal: 134, Address: 0x39ce0)
StrongNameSignatureVerificationFromImage (Ordinal: 135, Address: 0x39d40)
StrongNameTokenFromAssembly (Ordinal: 136, Address: 0x39b10)
StrongNameTokenFromAssemblyEx (Ordinal: 137, Address: 0x39b70)
StrongNameTokenFromPublicKey (Ordinal: 138, Address: 0x39c30)
TranslateSecurityAttributes (Ordinal: 139, Address: 0x2cf10)
_CorDllMain (Ordinal: 140, Address: 0x2e590)
_CorExeMain2 (Ordinal: 141, Address: 0xc5a0)
_CorExeMain (Ordinal: 142, Address: 0xa330)

Imported DLLs & Functions

KERNEL32.dll

ActivateActCtx (Address: 0x1007e13c)
CloseHandle (Address: 0x1007e02c)
CreateActCtxW (Address: 0x1007e138)
CreateEventW (Address: 0x1007e18c)
CreateFileMappingW (Address: 0x1007e0a8)
CreateFileW (Address: 0x1007e074)
CreateMutexW (Address: 0x1007e060)
CreateProcessW (Address: 0x1007e178)
CreateSemaphoreW (Address: 0x1007e1a0)
CreateToolhelp32Snapshot (Address: 0x1007e0b8)
DeactivateActCtx (Address: 0x1007e140)
DebugBreak (Address: 0x1007e144)
DecodePointer (Address: 0x1007e1b4)
DeleteCriticalSection (Address: 0x1007e070)
DisableThreadLibraryCalls (Address: 0x1007e04c)
EncodePointer (Address: 0x1007e1b0)
EnterCriticalSection (Address: 0x1007e064)
ExitProcess (Address: 0x1007e054)
FindClose (Address: 0x1007e0d0)
FindFirstFileExA (Address: 0x1007e1f0)
FindFirstFileW (Address: 0x1007e0c8)
FindNextFileA (Address: 0x1007e1f4)
FindNextFileW (Address: 0x1007e0cc)
FlushFileBuffers (Address: 0x1007e094)
FlushInstructionCache (Address: 0x1007e0ec)
FormatMessageW (Address: 0x1007e120)
FreeEnvironmentStringsW (Address: 0x1007e130)
FreeLibrary (Address: 0x1007e014)
GetACP (Address: 0x1007e11c)
GetCommandLineA (Address: 0x1007e200)
GetCommandLineW (Address: 0x1007e204)
GetConsoleCP (Address: 0x1007e1e8)
GetConsoleMode (Address: 0x1007e1ec)
GetCPInfo (Address: 0x1007e118)
GetCurrentProcess (Address: 0x1007e050)
GetCurrentProcessId (Address: 0x1007e174)
GetCurrentThread (Address: 0x1007e15c)
GetCurrentThreadId (Address: 0x1007e088)
GetDateFormatW (Address: 0x1007e084)
GetEnvironmentStringsW (Address: 0x1007e134)
GetEnvironmentVariableW (Address: 0x1007e01c)
GetFileAttributesExW (Address: 0x1007e0f4)
GetFileAttributesW (Address: 0x1007e090)
GetFileSize (Address: 0x1007e0a4)
GetFileType (Address: 0x1007e1e0)
GetFullPathNameW (Address: 0x1007e004)
GetLastError (Address: 0x1007e008)
GetLocalTime (Address: 0x1007e07c)
GetModuleFileNameA (Address: 0x1007e1d8)
GetModuleFileNameW (Address: 0x1007e024)
GetModuleHandleA (Address: 0x1007e150)
GetModuleHandleExW (Address: 0x1007e00c)
GetModuleHandleW (Address: 0x1007e048)
GetOEMCP (Address: 0x1007e1fc)
GetProcAddress (Address: 0x1007e010)
GetProcessHeap (Address: 0x1007e114)
GetProcessId (Address: 0x1007e0dc)
GetStartupInfoW (Address: 0x1007e1c4)
GetStdHandle (Address: 0x1007e1dc)
GetStringTypeW (Address: 0x1007e1e4)
GetSystemDefaultLangID (Address: 0x1007e154)
GetSystemDefaultLCID (Address: 0x1007e0f8)
GetSystemDirectoryW (Address: 0x1007e098)
GetSystemInfo (Address: 0x1007e044)
GetSystemTimeAsFileTime (Address: 0x1007e158)
GetSystemWow64DirectoryW (Address: 0x1007e0f0)
GetTickCount (Address: 0x1007e08c)
GetTimeFormatW (Address: 0x1007e080)
GetVersionExW (Address: 0x1007e0e8)
GetWindowsDirectoryW (Address: 0x1007e034)
GlobalMemoryStatus (Address: 0x1007e038)
HeapAlloc (Address: 0x1007e110)
HeapCreate (Address: 0x1007e0fc)
HeapDestroy (Address: 0x1007e100)
HeapFree (Address: 0x1007e10c)
HeapReAlloc (Address: 0x1007e218)
HeapSize (Address: 0x1007e214)
HeapValidate (Address: 0x1007e188)
InitializeCriticalSection (Address: 0x1007e06c)
InitializeCriticalSectionAndSpinCount (Address: 0x1007e0b0)
InitializeSListHead (Address: 0x1007e1cc)
InterlockedDecrement (Address: 0x1007e104)
InterlockedFlushSList (Address: 0x1007e1d4)
InterlockedIncrement (Address: 0x1007e220)
IsDBCSLeadByte (Address: 0x1007e124)
IsDBCSLeadByteEx (Address: 0x1007e21c)
IsDebuggerPresent (Address: 0x1007e14c)
IsProcessorFeaturePresent (Address: 0x1007e1c0)
IsValidCodePage (Address: 0x1007e1f8)
IsWow64Process (Address: 0x1007e16c)
LCMapStringW (Address: 0x1007e12c)
LeaveCriticalSection (Address: 0x1007e068)
LoadLibraryExA (Address: 0x1007e0d4)
LoadLibraryExW (Address: 0x1007e018)
LocalFree (Address: 0x1007e128)
lstrlenW (Address: 0x1007e0c4)
MapViewOfFile (Address: 0x1007e0ac)
Module32FirstW (Address: 0x1007e0e0)
Module32NextW (Address: 0x1007e0e4)
MultiByteToWideChar (Address: 0x1007e09c)
OpenProcess (Address: 0x1007e170)
OutputDebugStringW (Address: 0x1007e058)
QueryPerformanceCounter (Address: 0x1007e1c8)
RaiseException (Address: 0x1007e108)
ReadFile (Address: 0x1007e0c0)
ReadProcessMemory (Address: 0x1007e0bc)
ReleaseActCtx (Address: 0x1007e148)
ReleaseMutex (Address: 0x1007e05c)
ReleaseSemaphore (Address: 0x1007e184)
ResetEvent (Address: 0x1007e19c)
RtlUnwind (Address: 0x1007e1d0)
SetEnvironmentVariableW (Address: 0x1007e030)
SetErrorMode (Address: 0x1007e020)
SetEvent (Address: 0x1007e190)
SetFilePointerEx (Address: 0x1007e20c)
SetLastError (Address: 0x1007e0a0)
SetStdHandle (Address: 0x1007e208)
SetUnhandledExceptionFilter (Address: 0x1007e1bc)
SleepEx (Address: 0x1007e1a4)
TerminateProcess (Address: 0x1007e160)
TlsAlloc (Address: 0x1007e198)
TlsFree (Address: 0x1007e1ac)
TlsGetValue (Address: 0x1007e1a8)
TlsSetValue (Address: 0x1007e17c)
UnhandledExceptionFilter (Address: 0x1007e1b8)
UnmapViewOfFile (Address: 0x1007e0b4)
VerifyVersionInfoW (Address: 0x1007e168)
VerSetConditionMask (Address: 0x1007e164)
VirtualAlloc (Address: 0x1007e040)
VirtualFree (Address: 0x1007e180)
VirtualProtect (Address: 0x1007e0d8)
VirtualQuery (Address: 0x1007e03c)
WaitForSingleObject (Address: 0x1007e028)
WaitForSingleObjectEx (Address: 0x1007e194)
WideCharToMultiByte (Address: 0x1007e000)
WriteConsoleW (Address: 0x1007e210)
WriteFile (Address: 0x1007e078)