mscordbi.dll

Description: Microsoft .NET Runtime Debugging Services

Version: 4.8.4084.0

Architecture: 64-bit

Operating System: Windows

SHA256: f1ed727cc43e31cacc2730385500e96b

File Size: 1.6 MB

Uploaded At: Dec. 1, 2025, 8:29 a.m.

Views: 23

Security Warning

This file has been flagged as potentially dangerous.

Reason: Detected potentially dangerous functions used for process injection: WriteProcessMemory, OpenProcess

Exported Functions

CreateCordbObject (Ordinal: 1, Address: 0x1150)
DllGetClassObjectInternal (Ordinal: 2, Address: 0x1180)
OpenVirtualProcess (Ordinal: 3, Address: 0x1790)
OpenVirtualProcess2 (Ordinal: 4, Address: 0x1740)
OpenVirtualProcessImpl (Ordinal: 5, Address: 0x1520)

Imported DLLs & Functions

ADVAPI32.dll

AdjustTokenPrivileges (Address: 0x180113070)
CopySid (Address: 0x180113030)
DeregisterEventSource (Address: 0x180113098)
EqualSid (Address: 0x180113008)
EventWrite (Address: 0x180113068)
GetKernelObjectSecurity (Address: 0x180113040)
GetLengthSid (Address: 0x180113048)
GetSecurityDescriptorOwner (Address: 0x180113038)
GetSidSubAuthority (Address: 0x180113018)
GetSidSubAuthorityCount (Address: 0x180113010)
GetTokenInformation (Address: 0x1801130a0)
LookupPrivilegeValueW (Address: 0x180113080)
OpenProcessToken (Address: 0x180113078)
OpenThreadToken (Address: 0x180113028)
RegCloseKey (Address: 0x180113058)
RegisterEventSourceW (Address: 0x180113090)
RegOpenKeyExW (Address: 0x180113050)
RegQueryValueExW (Address: 0x180113060)
ReportEventW (Address: 0x180113088)
RevertToSelf (Address: 0x180113000)
SetThreadToken (Address: 0x180113020)

KERNEL32.dll

ActivateActCtx (Address: 0x180113308)
CloseHandle (Address: 0x180113488)
ContinueDebugEvent (Address: 0x1801130e0)
CreateActCtxW (Address: 0x180113300)
CreateEventW (Address: 0x180113478)
CreateFileMappingW (Address: 0x180113120)
CreateFileW (Address: 0x180113110)
CreateMutexW (Address: 0x1801132b0)
CreateProcessW (Address: 0x180113270)
CreateSemaphoreW (Address: 0x1801132d8)
CreateThread (Address: 0x1801130b8)
CreateToolhelp32Snapshot (Address: 0x180113140)
DeactivateActCtx (Address: 0x180113318)
DebugActiveProcess (Address: 0x180113178)
DebugBreak (Address: 0x1801130d0)
DeleteCriticalSection (Address: 0x1801134a8)
DuplicateHandle (Address: 0x1801130b0)
EncodePointer (Address: 0x180113338)
EnterCriticalSection (Address: 0x180113490)
ExitProcess (Address: 0x180113368)
FindClose (Address: 0x180113220)
FindFirstFileExA (Address: 0x1801133c0)
FindNextFileA (Address: 0x1801133c8)
FlushFileBuffers (Address: 0x180113398)
FlushInstructionCache (Address: 0x180113448)
FormatMessageW (Address: 0x180113250)
FreeEnvironmentStringsW (Address: 0x180113208)
FreeLibrary (Address: 0x1801130f0)
GetACP (Address: 0x180113248)
GetCommandLineA (Address: 0x1801133e0)
GetCommandLineW (Address: 0x1801133e8)
GetConsoleCP (Address: 0x1801133a8)
GetConsoleMode (Address: 0x1801133b0)
GetCPInfo (Address: 0x180113240)
GetCurrentProcess (Address: 0x180113450)
GetCurrentProcessId (Address: 0x180113190)
GetCurrentThread (Address: 0x180113230)
GetCurrentThreadId (Address: 0x180113458)
GetEnvironmentStringsW (Address: 0x180113210)
GetEnvironmentVariableW (Address: 0x180113200)
GetFileAttributesExW (Address: 0x180113428)
GetFileSize (Address: 0x180113118)
GetFileType (Address: 0x180113388)
GetLastError (Address: 0x180113468)
GetModuleFileNameA (Address: 0x180113378)
GetModuleFileNameW (Address: 0x180113168)
GetModuleHandleExW (Address: 0x180113370)
GetModuleHandleW (Address: 0x180113440)
GetOEMCP (Address: 0x1801133d8)
GetProcAddress (Address: 0x1801134b0)
GetProcessHeap (Address: 0x1801131d8)
GetStartupInfoW (Address: 0x180113360)
GetStdHandle (Address: 0x180113380)
GetStringTypeW (Address: 0x180113390)
GetSystemInfo (Address: 0x1801131e8)
GetSystemTimeAsFileTime (Address: 0x1801131b8)
GetThreadContext (Address: 0x1801130c0)
GetWindowsDirectoryW (Address: 0x180113320)
HeapAlloc (Address: 0x1801131d0)
HeapCreate (Address: 0x180113280)
HeapDestroy (Address: 0x1801132d0)
HeapFree (Address: 0x1801131c8)
HeapReAlloc (Address: 0x180113410)
HeapSize (Address: 0x180113408)
HeapValidate (Address: 0x1801132b8)
InitializeCriticalSection (Address: 0x180113480)
InitializeCriticalSectionAndSpinCount (Address: 0x1801133b8)
InitializeSListHead (Address: 0x180113358)
InterlockedFlushSList (Address: 0x180113418)
IsDBCSLeadByte (Address: 0x180113258)
IsDebuggerPresent (Address: 0x180113330)
IsProcessorFeaturePresent (Address: 0x180113350)
IsValidCodePage (Address: 0x1801133d0)
IsWow64Process (Address: 0x180113198)
LCMapStringW (Address: 0x180113268)
LeaveCriticalSection (Address: 0x180113498)
LoadLibraryExW (Address: 0x1801130e8)
LocalFree (Address: 0x180113260)
MapViewOfFile (Address: 0x180113128)
Module32FirstW (Address: 0x180113158)
Module32NextW (Address: 0x180113160)
MultiByteToWideChar (Address: 0x180113228)
OpenFileMappingW (Address: 0x180113420)
OpenProcess (Address: 0x1801130f8)
OpenThread (Address: 0x180113188)
OutputDebugStringW (Address: 0x1801131f8)
QueryPerformanceCounter (Address: 0x1801131c0)
QueryPerformanceFrequency (Address: 0x1801131b0)
RaiseException (Address: 0x1801131e0)
ReadFile (Address: 0x180113438)
ReadProcessMemory (Address: 0x180113108)
ReleaseActCtx (Address: 0x180113328)
ReleaseMutex (Address: 0x180113100)
ReleaseSemaphore (Address: 0x1801132a0)
ResetEvent (Address: 0x180113460)
ResumeThread (Address: 0x180113278)
SetErrorMode (Address: 0x180113310)
SetEvent (Address: 0x180113470)
SetFilePointer (Address: 0x180113430)
SetFilePointerEx (Address: 0x1801133f8)
SetLastError (Address: 0x1801131a8)
SetStdHandle (Address: 0x1801133f0)
SetThreadContext (Address: 0x1801130d8)
SetUnhandledExceptionFilter (Address: 0x180113348)
Sleep (Address: 0x180113138)
SleepEx (Address: 0x1801132e0)
SuspendThread (Address: 0x1801132f0)
SwitchToThread (Address: 0x180113238)
TerminateProcess (Address: 0x1801130c8)
Thread32First (Address: 0x180113148)
Thread32Next (Address: 0x180113150)
TlsAlloc (Address: 0x1801132c8)
TlsFree (Address: 0x1801134c0)
TlsGetValue (Address: 0x1801132e8)
TlsSetValue (Address: 0x180113288)
UnhandledExceptionFilter (Address: 0x180113340)
UnmapViewOfFile (Address: 0x180113130)
VerifyVersionInfoW (Address: 0x1801131f0)
VirtualAlloc (Address: 0x1801132a8)
VirtualFree (Address: 0x180113298)
VirtualProtect (Address: 0x180113290)
VirtualQuery (Address: 0x1801132f8)
VirtualQueryEx (Address: 0x180113170)
WaitForDebugEvent (Address: 0x180113180)
WaitForMultipleObjectsEx (Address: 0x1801134a0)
WaitForSingleObject (Address: 0x1801134b8)
WaitForSingleObjectEx (Address: 0x1801132c0)
WideCharToMultiByte (Address: 0x180113218)
WriteConsoleW (Address: 0x180113400)
WriteFile (Address: 0x1801133a0)
WriteProcessMemory (Address: 0x1801131a0)

ntdll.dll

RtlCaptureContext (Address: 0x180113538)
RtlLookupFunctionEntry (Address: 0x180113540)
RtlPcToFileHeader (Address: 0x180113530)
RtlUnwindEx (Address: 0x180113528)
RtlVirtualUnwind (Address: 0x180113550)
VerSetConditionMask (Address: 0x180113548)

ole32.dll

CoCreateFreeThreadedMarshaler (Address: 0x180113580)
CoCreateGuid (Address: 0x180113570)
CoTaskMemAlloc (Address: 0x180113588)
CoTaskMemFree (Address: 0x180113560)
CreateStreamOnHGlobal (Address: 0x180113578)
IIDFromString (Address: 0x180113568)

OLEAUT32.dll

CreateErrorInfo (Address: 0x1801134d0)
SetErrorInfo (Address: 0x1801134e0)
VariantInit (Address: 0x1801134d8)

USER32.dll

GetProcessWindowStation (Address: 0x180113500)
GetUserObjectInformationW (Address: 0x1801134f8)
LoadStringW (Address: 0x1801134f0)

WTSAPI32.dll

WTSEnumerateProcessesW (Address: 0x180113510)
WTSFreeMemory (Address: 0x180113518)