mscoreei.dll

Description: Microsoft .NET Runtime Execution Engine

Version: 4.8.4084.0

Architecture: 64-bit

Operating System: Windows

SHA256: efd083502688a90a83367ac850daa147

File Size: 672.5 KB

Uploaded At: Dec. 1, 2025, 8:29 a.m.

Views: 23

Security Warning

This file has been flagged as potentially dangerous.

Reason: Detected potentially dangerous functions used for process injection: OpenProcess

Exported Functions

InitErrors (Ordinal: 17, Address: 0x28a10)
PostError (Ordinal: 18, Address: 0x28b30)
InitSSAutoEnterThread (Ordinal: 19, Address: 0x28b60)
UpdateError (Ordinal: 20, Address: 0x28bc0)
CloseCtrs (Ordinal: 21, Address: 0x2b740)
LoadStringRC (Ordinal: 22, Address: 0x28c10)
ReOpenMetaDataWithMemory (Ordinal: 23, Address: 0x28da0)
(Ordinal: 24, Address: 0x9a80)
CollectCtrs (Ordinal: 25, Address: 0x2b6d0)
CorDllMainWorker (Ordinal: 26, Address: 0x2af40)
CorDllMainWorkerForThunk (Ordinal: 27, Address: 0x2b160)
EEDllGetClassObjectFromClass (Ordinal: 28, Address: 0x291f0)
GetPrivateContextsPerfCounters (Ordinal: 29, Address: 0x297a0)
GetProcessExecutableHeap (Ordinal: 30, Address: 0x2240)
GetStartupFlags (Ordinal: 31, Address: 0x10b90)
GetTargetForVTableEntry (Ordinal: 32, Address: 0x39990)
GetTokenForVTableEntry (Ordinal: 33, Address: 0x398c0)
LogHelp_LogAssert (Ordinal: 34, Address: 0x29660)
LogHelp_NoGuiOnAssert (Ordinal: 35, Address: 0x296e0)
LogHelp_TerminateOnAssert (Ordinal: 36, Address: 0x29740)
OnShimDllMainCalled (Ordinal: 37, Address: 0x1470)
OpenCtrs (Ordinal: 38, Address: 0x2b460)
PostErrorVA (Ordinal: 39, Address: 0x28a80)
RegisterShimImplCallback (Ordinal: 40, Address: 0x14e0)
SetTargetForVTableEntry (Ordinal: 41, Address: 0x39930)
CLRCreateInstance (Ordinal: 42, Address: 0xd780)
CallFunctionShim (Ordinal: 43, Address: 0x29930)
ClrCreateManagedInstance (Ordinal: 44, Address: 0x290e0)
CoEEShutDownCOM (Ordinal: 45, Address: 0x29260)
CoInitializeCor (Ordinal: 46, Address: 0x287e0)
CoInitializeEE (Ordinal: 47, Address: 0x286e0)
CoUninitializeCor (Ordinal: 48, Address: 0x28860)
CoUninitializeEE (Ordinal: 49, Address: 0x28760)
CorBindToCurrentRuntime (Ordinal: 50, Address: 0x267c0)
CorBindToRuntime (Ordinal: 51, Address: 0x25eb0)
CorBindToRuntimeByCfg (Ordinal: 52, Address: 0x26400)
CorBindToRuntimeByPath (Ordinal: 53, Address: 0x257e0)
CorBindToRuntimeByPathEx (Ordinal: 54, Address: 0x25b40)
CorBindToRuntimeEx (Ordinal: 55, Address: 0x26290)
CorBindToRuntimeHost (Ordinal: 56, Address: 0x26640)
CorExitProcess (Ordinal: 57, Address: 0x29900)
CorGetSvc (Ordinal: 58, Address: 0x27a10)
CorIsLatestSvc (Ordinal: 59, Address: 0x27be0)
CorMarkThreadInThreadPool (Ordinal: 60, Address: 0x1460)
CorTickleSvc (Ordinal: 61, Address: 0x27cb0)
CreateConfigStream (Ordinal: 62, Address: 0x68d0)
CreateDebuggingInterfaceFromVersion (Ordinal: 63, Address: 0x2d890)
CreateInterface (Ordinal: 64, Address: 0xd780)
DllCanUnloadNow (Ordinal: 65, Address: 0x299f0)
DllGetClassObject (Ordinal: 66, Address: 0x2a3f0)
DllRegisterServer (Ordinal: 67, Address: 0x2a8b0)
DllUnregisterServer (Ordinal: 68, Address: 0x2a960)
EEDllRegisterServer (Ordinal: 69, Address: 0x29800)
EEDllUnregisterServer (Ordinal: 70, Address: 0x29880)
GetAssemblyMDImport (Ordinal: 71, Address: 0x2aa10)
GetCORRequiredVersion (Ordinal: 72, Address: 0x26ac0)
GetCORRootDirectory (Ordinal: 73, Address: 0x27b00)
GetCORSystemDirectory (Ordinal: 74, Address: 0x27f50)
GetCORSystemDirectory_RetAddr (Ordinal: 75, Address: 0x10a30)
GetCORVersion (Ordinal: 76, Address: 0x10990)
GetCompileInfo (Ordinal: 77, Address: 0x29200)
GetFileVersion (Ordinal: 78, Address: 0x2d3e0)
GetHashFromAssemblyFile (Ordinal: 79, Address: 0x37250)
GetHashFromAssemblyFileW (Ordinal: 80, Address: 0x37320)
GetHashFromBlob (Ordinal: 81, Address: 0x37660)
GetHashFromFile (Ordinal: 82, Address: 0x373f0)
GetHashFromFileW (Ordinal: 83, Address: 0x374c0)
GetHashFromHandle (Ordinal: 84, Address: 0x37590)
GetHostConfigurationFile (Ordinal: 85, Address: 0x10c00)
GetMetaDataInternalInterface (Ordinal: 86, Address: 0x10d30)
GetMetaDataInternalInterfaceFromPublic (Ordinal: 87, Address: 0x28970)
GetMetaDataPublicInterfaceFromInternal (Ordinal: 88, Address: 0x288d0)
GetPermissionRequests (Ordinal: 89, Address: 0x28fd0)
GetRealProcAddress (Ordinal: 90, Address: 0x27fa0)
GetRequestedRuntimeInfo (Ordinal: 91, Address: 0x270a0)
GetRequestedRuntimeVersion (Ordinal: 92, Address: 0x27460)
GetRequestedRuntimeVersionForCLSID (Ordinal: 93, Address: 0x27710)
GetVersionFromProcess (Ordinal: 94, Address: 0x2e1f0)
GetXMLElement (Ordinal: 95, Address: 0x47be0)
GetXMLElementAttribute (Ordinal: 96, Address: 0x47be0)
GetXMLObject (Ordinal: 97, Address: 0x141d0)
IEE (Ordinal: 98, Address: 0x10df0)
LoadLibraryShim (Ordinal: 99, Address: 0x280d0)
LoadLibraryWithPolicyShim (Ordinal: 100, Address: 0x28020)
LoadStringRCEx (Ordinal: 101, Address: 0x28cc0)
LockClrVersion (Ordinal: 102, Address: 0x23c10)
MetaDataGetDispenser (Ordinal: 103, Address: 0x28640)
ND_CopyObjDst (Ordinal: 104, Address: 0x29640)
ND_CopyObjSrc (Ordinal: 105, Address: 0x29620)
ND_RI2 (Ordinal: 106, Address: 0xff90)
ND_RI4 (Ordinal: 107, Address: 0x295d0)
ND_RI8 (Ordinal: 108, Address: 0x295e0)
ND_RU1 (Ordinal: 109, Address: 0xff80)
ND_WI2 (Ordinal: 110, Address: 0x295f0)
ND_WI4 (Ordinal: 111, Address: 0x29600)
ND_WI8 (Ordinal: 112, Address: 0x29610)
ND_WU1 (Ordinal: 113, Address: 0xffa0)
ReOpenMetaDataWithMemoryEx (Ordinal: 114, Address: 0x28e40)
RunDll32ShimW (Ordinal: 115, Address: 0x28300)
RuntimeOSHandle (Ordinal: 116, Address: 0x29540)
RuntimeOpenImage (Ordinal: 117, Address: 0x29430)
RuntimeReleaseHandle (Ordinal: 118, Address: 0x294c0)
StrongNameCompareAssemblies (Ordinal: 119, Address: 0x37080)
StrongNameErrorInfo (Ordinal: 120, Address: 0x36510)
StrongNameFreeBuffer (Ordinal: 121, Address: 0x365f0)
StrongNameGetBlob (Ordinal: 122, Address: 0x37740)
StrongNameGetBlobFromImage (Ordinal: 123, Address: 0x377e0)
StrongNameGetPublicKey (Ordinal: 124, Address: 0x36910)
StrongNameHashSize (Ordinal: 125, Address: 0x37120)
StrongNameKeyDelete (Ordinal: 126, Address: 0x36890)
StrongNameKeyGen (Ordinal: 127, Address: 0x36670)
StrongNameKeyGenEx (Ordinal: 128, Address: 0x36720)
StrongNameKeyInstall (Ordinal: 129, Address: 0x367f0)
StrongNameSignatureGeneration (Ordinal: 130, Address: 0x369e0)
StrongNameSignatureGenerationEx (Ordinal: 131, Address: 0x36ac0)
StrongNameSignatureSize (Ordinal: 132, Address: 0x371b0)
StrongNameSignatureVerification (Ordinal: 133, Address: 0x36e90)
StrongNameSignatureVerificationEx (Ordinal: 134, Address: 0x36f30)
StrongNameSignatureVerificationFromImage (Ordinal: 135, Address: 0x36fd0)
StrongNameTokenFromAssembly (Ordinal: 136, Address: 0x36bc0)
StrongNameTokenFromAssemblyEx (Ordinal: 137, Address: 0x36c60)
StrongNameTokenFromPublicKey (Ordinal: 138, Address: 0x36d30)
TranslateSecurityAttributes (Ordinal: 139, Address: 0x28ef0)
_CorDllMain (Ordinal: 140, Address: 0x2ac40)
_CorExeMain (Ordinal: 141, Address: 0x81a0)
_CorExeMain2 (Ordinal: 142, Address: 0x2b2a0)

Imported DLLs & Functions

KERNEL32.dll

ActivateActCtx (Address: 0x18006e268)
CloseHandle (Address: 0x18006e058)
CreateActCtxW (Address: 0x18006e260)
CreateEventW (Address: 0x18006e300)
CreateFileMappingW (Address: 0x18006e148)
CreateFileW (Address: 0x18006e0e0)
CreateMutexW (Address: 0x18006e0b8)
CreateProcessW (Address: 0x18006e2d8)
CreateSemaphoreW (Address: 0x18006e328)
CreateToolhelp32Snapshot (Address: 0x18006e168)
DeactivateActCtx (Address: 0x18006e270)
DebugBreak (Address: 0x18006e1a8)
DeleteCriticalSection (Address: 0x18006e0d8)
DisableThreadLibraryCalls (Address: 0x18006e090)
EncodePointer (Address: 0x18006e348)
EnterCriticalSection (Address: 0x18006e0c0)
ExitProcess (Address: 0x18006e0a0)
FindClose (Address: 0x18006e198)
FindFirstFileExA (Address: 0x18006e3d8)
FindFirstFileW (Address: 0x18006e188)
FindNextFileA (Address: 0x18006e3e0)
FindNextFileW (Address: 0x18006e190)
FlushFileBuffers (Address: 0x18006e120)
FlushInstructionCache (Address: 0x18006e1d8)
FormatMessageW (Address: 0x18006e230)
FreeEnvironmentStringsW (Address: 0x18006e250)
FreeLibrary (Address: 0x18006e028)
GetACP (Address: 0x18006e228)
GetCommandLineA (Address: 0x18006e3f8)
GetCommandLineW (Address: 0x18006e400)
GetConsoleCP (Address: 0x18006e3c8)
GetConsoleMode (Address: 0x18006e3d0)
GetCPInfo (Address: 0x18006e220)
GetCurrentProcess (Address: 0x18006e098)
GetCurrentProcessId (Address: 0x18006e2d0)
GetCurrentThread (Address: 0x18006e2a8)
GetCurrentThreadId (Address: 0x18006e108)
GetDateFormatW (Address: 0x18006e100)
GetEnvironmentStringsW (Address: 0x18006e258)
GetEnvironmentVariableW (Address: 0x18006e038)
GetFileAttributesExW (Address: 0x18006e1e0)
GetFileAttributesW (Address: 0x18006e118)
GetFileSize (Address: 0x18006e140)
GetFileType (Address: 0x18006e3b8)
GetFullPathNameW (Address: 0x18006e008)
GetLastError (Address: 0x18006e010)
GetLocalTime (Address: 0x18006e0f0)
GetModuleFileNameA (Address: 0x18006e3a8)
GetModuleFileNameW (Address: 0x18006e048)
GetModuleHandleA (Address: 0x18006e288)
GetModuleHandleExW (Address: 0x18006e018)
GetModuleHandleW (Address: 0x18006e088)
GetOEMCP (Address: 0x18006e3f0)
GetProcAddress (Address: 0x18006e020)
GetProcessHeap (Address: 0x18006e218)
GetProcessId (Address: 0x18006e1b0)
GetStartupInfoW (Address: 0x18006e380)
GetStdHandle (Address: 0x18006e3b0)
GetStringTypeW (Address: 0x18006e3c0)
GetSystemDefaultLangID (Address: 0x18006e290)
GetSystemDefaultLCID (Address: 0x18006e1e8)
GetSystemDirectoryW (Address: 0x18006e128)
GetSystemInfo (Address: 0x18006e080)
GetSystemTimeAsFileTime (Address: 0x18006e298)
GetTickCount (Address: 0x18006e110)
GetTimeFormatW (Address: 0x18006e0f8)
GetVersionExW (Address: 0x18006e1c8)
GetWindowsDirectoryW (Address: 0x18006e068)
HeapAlloc (Address: 0x18006e210)
HeapCreate (Address: 0x18006e1f0)
HeapDestroy (Address: 0x18006e1f8)
HeapFree (Address: 0x18006e208)
HeapReAlloc (Address: 0x18006e428)
HeapSize (Address: 0x18006e420)
HeapValidate (Address: 0x18006e2f8)
InitializeCriticalSection (Address: 0x18006e0d0)
InitializeCriticalSectionAndSpinCount (Address: 0x18006e158)
InitializeSListHead (Address: 0x18006e388)
InterlockedFlushSList (Address: 0x18006e398)
IsDBCSLeadByte (Address: 0x18006e238)
IsDBCSLeadByteEx (Address: 0x18006e430)
IsDebuggerPresent (Address: 0x18006e280)
IsProcessorFeaturePresent (Address: 0x18006e378)
IsValidCodePage (Address: 0x18006e3e8)
LCMapStringW (Address: 0x18006e248)
LeaveCriticalSection (Address: 0x18006e0c8)
LoadLibraryExA (Address: 0x18006e1a0)
LoadLibraryExW (Address: 0x18006e030)
LocalFree (Address: 0x18006e240)
lstrlenW (Address: 0x18006e180)
MapViewOfFile (Address: 0x18006e150)
Module32FirstW (Address: 0x18006e1b8)
Module32NextW (Address: 0x18006e1c0)
MultiByteToWideChar (Address: 0x18006e130)
OpenProcess (Address: 0x18006e2c8)
OutputDebugStringW (Address: 0x18006e0a8)
QueryPerformanceCounter (Address: 0x18006e2a0)
RaiseException (Address: 0x18006e200)
ReadFile (Address: 0x18006e178)
ReadProcessMemory (Address: 0x18006e170)
ReleaseActCtx (Address: 0x18006e278)
ReleaseMutex (Address: 0x18006e0b0)
ReleaseSemaphore (Address: 0x18006e2f0)
ResetEvent (Address: 0x18006e320)
RtlCaptureContext (Address: 0x18006e350)
RtlLookupFunctionEntry (Address: 0x18006e358)
RtlPcToFileHeader (Address: 0x18006e3a0)
RtlUnwindEx (Address: 0x18006e390)
RtlVirtualUnwind (Address: 0x18006e360)
SetEnvironmentVariableW (Address: 0x18006e060)
SetErrorMode (Address: 0x18006e040)
SetEvent (Address: 0x18006e308)
SetFilePointerEx (Address: 0x18006e410)
SetLastError (Address: 0x18006e138)
SetStdHandle (Address: 0x18006e408)
SetUnhandledExceptionFilter (Address: 0x18006e370)
SleepEx (Address: 0x18006e330)
TerminateProcess (Address: 0x18006e2b0)
TlsAlloc (Address: 0x18006e318)
TlsFree (Address: 0x18006e340)
TlsGetValue (Address: 0x18006e338)
TlsSetValue (Address: 0x18006e2e0)
UnhandledExceptionFilter (Address: 0x18006e368)
UnmapViewOfFile (Address: 0x18006e160)
VerifyVersionInfoW (Address: 0x18006e2c0)
VerSetConditionMask (Address: 0x18006e2b8)
VirtualAlloc (Address: 0x18006e078)
VirtualFree (Address: 0x18006e2e8)
VirtualProtect (Address: 0x18006e1d0)
VirtualQuery (Address: 0x18006e070)
WaitForSingleObject (Address: 0x18006e050)
WaitForSingleObjectEx (Address: 0x18006e310)
WideCharToMultiByte (Address: 0x18006e000)
WriteConsoleW (Address: 0x18006e418)
WriteFile (Address: 0x18006e0e8)