mscordbi.dll

Description: Microsoft .NET Runtime Debugging Services

Version: 4.8.4645.0

Architecture: 64-bit

Operating System: Windows

SHA256: fc006d2b995550df5773ac45a696b317

File Size: 1.6 MB

Uploaded At: Dec. 1, 2025, 8:29 a.m.

Views: 21

Security Warning

This file has been flagged as potentially dangerous.

Reason: Detected potentially dangerous functions used for process injection: WriteProcessMemory, OpenProcess

Exported Functions

CreateCordbObject (Ordinal: 1, Address: 0x1150)
DllGetClassObjectInternal (Ordinal: 2, Address: 0x1180)
OpenVirtualProcess (Ordinal: 3, Address: 0x1790)
OpenVirtualProcess2 (Ordinal: 4, Address: 0x1740)
OpenVirtualProcessImpl (Ordinal: 5, Address: 0x1520)

Imported DLLs & Functions

ADVAPI32.dll

AdjustTokenPrivileges (Address: 0x180114068)
CopySid (Address: 0x180114020)
DeregisterEventSource (Address: 0x180114090)
EqualSid (Address: 0x180114000)
EventWrite (Address: 0x180114060)
GetKernelObjectSecurity (Address: 0x180114030)
GetLengthSid (Address: 0x180114038)
GetSecurityDescriptorOwner (Address: 0x180114028)
GetSidSubAuthority (Address: 0x180114018)
GetSidSubAuthorityCount (Address: 0x180114010)
GetTokenInformation (Address: 0x180114040)
LookupPrivilegeValueW (Address: 0x180114078)
OpenProcessToken (Address: 0x180114070)
OpenThreadToken (Address: 0x1801140a0)
RegCloseKey (Address: 0x180114050)
RegisterEventSourceW (Address: 0x180114088)
RegOpenKeyExW (Address: 0x180114048)
RegQueryValueExW (Address: 0x180114058)
ReportEventW (Address: 0x180114080)
RevertToSelf (Address: 0x180114008)
SetThreadToken (Address: 0x180114098)

KERNEL32.dll

ActivateActCtx (Address: 0x1801142f0)
CloseHandle (Address: 0x180114480)
ContinueDebugEvent (Address: 0x1801140d0)
CreateActCtxW (Address: 0x1801142e8)
CreateEventW (Address: 0x180114470)
CreateFileMappingW (Address: 0x180114110)
CreateFileW (Address: 0x180114100)
CreateMutexW (Address: 0x180114298)
CreateProcessW (Address: 0x180114260)
CreateSemaphoreW (Address: 0x1801142c0)
CreateThread (Address: 0x180114268)
CreateToolhelp32Snapshot (Address: 0x180114130)
DeactivateActCtx (Address: 0x180114300)
DebugActiveProcess (Address: 0x180114168)
DebugBreak (Address: 0x1801140c0)
DeleteCriticalSection (Address: 0x1801144a0)
DuplicateHandle (Address: 0x1801142e0)
EncodePointer (Address: 0x180114320)
EnterCriticalSection (Address: 0x180114488)
ExitProcess (Address: 0x180114350)
FindClose (Address: 0x180114210)
FindFirstFileExA (Address: 0x1801143a8)
FindNextFileA (Address: 0x1801143b0)
FlushFileBuffers (Address: 0x180114380)
FlushInstructionCache (Address: 0x180114440)
FormatMessageW (Address: 0x180114240)
FreeEnvironmentStringsW (Address: 0x1801141f8)
FreeLibrary (Address: 0x1801140e0)
GetACP (Address: 0x180114238)
GetCommandLineA (Address: 0x1801143c8)
GetCommandLineW (Address: 0x1801143d0)
GetConsoleCP (Address: 0x180114390)
GetConsoleMode (Address: 0x180114398)
GetCPInfo (Address: 0x180114230)
GetCurrentProcess (Address: 0x180114448)
GetCurrentProcessId (Address: 0x180114180)
GetCurrentThread (Address: 0x180114220)
GetCurrentThreadId (Address: 0x180114450)
GetEnvironmentStringsW (Address: 0x180114200)
GetEnvironmentVariableW (Address: 0x1801141f0)
GetFileAttributesExW (Address: 0x180114410)
GetFileSize (Address: 0x180114108)
GetFileType (Address: 0x180114370)
GetLastError (Address: 0x180114460)
GetModuleFileNameA (Address: 0x180114360)
GetModuleFileNameW (Address: 0x180114158)
GetModuleHandleExW (Address: 0x180114358)
GetModuleHandleW (Address: 0x180114438)
GetOEMCP (Address: 0x1801143c0)
GetProcAddress (Address: 0x1801144a8)
GetProcessHeap (Address: 0x1801141c8)
GetStartupInfoW (Address: 0x180114348)
GetStdHandle (Address: 0x180114368)
GetStringTypeW (Address: 0x180114378)
GetSystemInfo (Address: 0x1801141d8)
GetSystemTimeAsFileTime (Address: 0x1801141a8)
GetThreadContext (Address: 0x1801140b0)
GetWindowsDirectoryW (Address: 0x180114308)
HeapAlloc (Address: 0x1801141c0)
HeapCreate (Address: 0x1801144b8)
HeapDestroy (Address: 0x1801142b8)
HeapFree (Address: 0x1801141b8)
HeapReAlloc (Address: 0x1801143f8)
HeapSize (Address: 0x1801143f0)
HeapValidate (Address: 0x1801142a0)
InitializeCriticalSection (Address: 0x180114478)
InitializeCriticalSectionAndSpinCount (Address: 0x1801143a0)
InitializeSListHead (Address: 0x180114340)
InterlockedFlushSList (Address: 0x180114400)
IsDBCSLeadByte (Address: 0x180114248)
IsDebuggerPresent (Address: 0x180114318)
IsProcessorFeaturePresent (Address: 0x180114338)
IsValidCodePage (Address: 0x1801143b8)
IsWow64Process (Address: 0x180114188)
LCMapStringW (Address: 0x180114258)
LeaveCriticalSection (Address: 0x180114490)
LoadLibraryExW (Address: 0x1801140d8)
LocalFree (Address: 0x180114250)
MapViewOfFile (Address: 0x180114118)
Module32FirstW (Address: 0x180114148)
Module32NextW (Address: 0x180114150)
MultiByteToWideChar (Address: 0x180114218)
OpenFileMappingW (Address: 0x180114408)
OpenProcess (Address: 0x1801140e8)
OpenThread (Address: 0x180114178)
OutputDebugStringW (Address: 0x1801141e8)
QueryPerformanceCounter (Address: 0x1801141b0)
QueryPerformanceFrequency (Address: 0x1801141a0)
RaiseException (Address: 0x1801141d0)
ReadFile (Address: 0x180114420)
ReadProcessMemory (Address: 0x1801140f8)
ReleaseActCtx (Address: 0x180114310)
ReleaseMutex (Address: 0x1801140f0)
ReleaseSemaphore (Address: 0x180114288)
ResetEvent (Address: 0x180114458)
ResumeThread (Address: 0x180114428)
SetErrorMode (Address: 0x1801142f8)
SetEvent (Address: 0x180114468)
SetFilePointer (Address: 0x180114418)
SetFilePointerEx (Address: 0x1801143e0)
SetLastError (Address: 0x180114198)
SetStdHandle (Address: 0x1801143d8)
SetThreadContext (Address: 0x1801140c8)
SetUnhandledExceptionFilter (Address: 0x180114330)
Sleep (Address: 0x180114128)
SleepEx (Address: 0x1801142c8)
SuspendThread (Address: 0x180114430)
SwitchToThread (Address: 0x180114228)
TerminateProcess (Address: 0x1801140b8)
Thread32First (Address: 0x180114138)
Thread32Next (Address: 0x180114140)
TlsAlloc (Address: 0x1801142b0)
TlsFree (Address: 0x1801142d8)
TlsGetValue (Address: 0x1801142d0)
TlsSetValue (Address: 0x180114270)
UnhandledExceptionFilter (Address: 0x180114328)
UnmapViewOfFile (Address: 0x180114120)
VerifyVersionInfoW (Address: 0x1801141e0)
VirtualAlloc (Address: 0x180114290)
VirtualFree (Address: 0x180114280)
VirtualProtect (Address: 0x180114278)
VirtualQuery (Address: 0x1801144c0)
VirtualQueryEx (Address: 0x180114160)
WaitForDebugEvent (Address: 0x180114170)
WaitForMultipleObjectsEx (Address: 0x180114498)
WaitForSingleObject (Address: 0x1801144b0)
WaitForSingleObjectEx (Address: 0x1801142a8)
WideCharToMultiByte (Address: 0x180114208)
WriteConsoleW (Address: 0x1801143e8)
WriteFile (Address: 0x180114388)
WriteProcessMemory (Address: 0x180114190)

ntdll.dll

RtlCaptureContext (Address: 0x180114538)
RtlLookupFunctionEntry (Address: 0x180114540)
RtlPcToFileHeader (Address: 0x180114530)
RtlUnwindEx (Address: 0x180114528)
RtlVirtualUnwind (Address: 0x180114550)
VerSetConditionMask (Address: 0x180114548)

ole32.dll

CoCreateFreeThreadedMarshaler (Address: 0x180114580)
CoCreateGuid (Address: 0x180114570)
CoTaskMemAlloc (Address: 0x180114588)
CoTaskMemFree (Address: 0x180114560)
CreateStreamOnHGlobal (Address: 0x180114578)
IIDFromString (Address: 0x180114568)

OLEAUT32.dll

CreateErrorInfo (Address: 0x1801144d0)
SetErrorInfo (Address: 0x1801144e0)
VariantInit (Address: 0x1801144d8)

USER32.dll

GetProcessWindowStation (Address: 0x180114500)
GetUserObjectInformationW (Address: 0x1801144f8)
LoadStringW (Address: 0x1801144f0)

WTSAPI32.dll

WTSEnumerateProcessesW (Address: 0x180114510)
WTSFreeMemory (Address: 0x180114518)