mscoreei.dll

Description: Microsoft .NET Runtime Execution Engine

Version: 4.8.4180.0

Architecture: 64-bit

Operating System: Windows

SHA256: de05b03e37fb9ba5d74cf8fa36a6f0b1

File Size: 673.8 KB

Uploaded At: Dec. 1, 2025, 8:29 a.m.

Views: 25

Security Warning

This file has been flagged as potentially dangerous.

Reason: Detected potentially dangerous functions used for process injection: OpenProcess

Exported Functions

InitErrors (Ordinal: 17, Address: 0x28a20)
PostError (Ordinal: 18, Address: 0x28b40)
InitSSAutoEnterThread (Ordinal: 19, Address: 0x28b70)
UpdateError (Ordinal: 20, Address: 0x28bd0)
CloseCtrs (Ordinal: 21, Address: 0x2b750)
LoadStringRC (Ordinal: 22, Address: 0x28c20)
ReOpenMetaDataWithMemory (Ordinal: 23, Address: 0x28db0)
(Ordinal: 24, Address: 0xa430)
CollectCtrs (Ordinal: 25, Address: 0x2b6e0)
CorDllMainWorker (Ordinal: 26, Address: 0x2af50)
CorDllMainWorkerForThunk (Ordinal: 27, Address: 0x2b170)
EEDllGetClassObjectFromClass (Ordinal: 28, Address: 0x29200)
GetPrivateContextsPerfCounters (Ordinal: 29, Address: 0x297b0)
GetProcessExecutableHeap (Ordinal: 30, Address: 0x2c80)
GetStartupFlags (Ordinal: 31, Address: 0x10ba0)
GetTargetForVTableEntry (Ordinal: 32, Address: 0x399a0)
GetTokenForVTableEntry (Ordinal: 33, Address: 0x398d0)
LogHelp_LogAssert (Ordinal: 34, Address: 0x29670)
LogHelp_NoGuiOnAssert (Ordinal: 35, Address: 0x296f0)
LogHelp_TerminateOnAssert (Ordinal: 36, Address: 0x29750)
OnShimDllMainCalled (Ordinal: 37, Address: 0x11b0)
OpenCtrs (Ordinal: 38, Address: 0x2b470)
PostErrorVA (Ordinal: 39, Address: 0x28a90)
RegisterShimImplCallback (Ordinal: 40, Address: 0x1f20)
SetTargetForVTableEntry (Ordinal: 41, Address: 0x39940)
CLRCreateInstance (Ordinal: 42, Address: 0xd960)
CallFunctionShim (Ordinal: 43, Address: 0x29940)
ClrCreateManagedInstance (Ordinal: 44, Address: 0x290f0)
CoEEShutDownCOM (Ordinal: 45, Address: 0x29270)
CoInitializeCor (Ordinal: 46, Address: 0x287f0)
CoInitializeEE (Ordinal: 47, Address: 0x286f0)
CoUninitializeCor (Ordinal: 48, Address: 0x28870)
CoUninitializeEE (Ordinal: 49, Address: 0x28770)
CorBindToCurrentRuntime (Ordinal: 50, Address: 0x267d0)
CorBindToRuntime (Ordinal: 51, Address: 0x25ec0)
CorBindToRuntimeByCfg (Ordinal: 52, Address: 0x26410)
CorBindToRuntimeByPath (Ordinal: 53, Address: 0x257f0)
CorBindToRuntimeByPathEx (Ordinal: 54, Address: 0x25b50)
CorBindToRuntimeEx (Ordinal: 55, Address: 0x262a0)
CorBindToRuntimeHost (Ordinal: 56, Address: 0x26650)
CorExitProcess (Ordinal: 57, Address: 0x29910)
CorGetSvc (Ordinal: 58, Address: 0x27a20)
CorIsLatestSvc (Ordinal: 59, Address: 0x27bf0)
CorMarkThreadInThreadPool (Ordinal: 60, Address: 0x1000)
CorTickleSvc (Ordinal: 61, Address: 0x27cc0)
CreateConfigStream (Ordinal: 62, Address: 0x7390)
CreateDebuggingInterfaceFromVersion (Ordinal: 63, Address: 0x2d8a0)
CreateInterface (Ordinal: 64, Address: 0xd960)
DllCanUnloadNow (Ordinal: 65, Address: 0x29a00)
DllGetClassObject (Ordinal: 66, Address: 0x2a400)
DllRegisterServer (Ordinal: 67, Address: 0x2a8c0)
DllUnregisterServer (Ordinal: 68, Address: 0x2a970)
EEDllRegisterServer (Ordinal: 69, Address: 0x29810)
EEDllUnregisterServer (Ordinal: 70, Address: 0x29890)
GetAssemblyMDImport (Ordinal: 71, Address: 0x2aa20)
GetCORRequiredVersion (Ordinal: 72, Address: 0x26ad0)
GetCORRootDirectory (Ordinal: 73, Address: 0x27b10)
GetCORSystemDirectory (Ordinal: 74, Address: 0x27f60)
GetCORSystemDirectory_RetAddr (Ordinal: 75, Address: 0x10a40)
GetCORVersion (Ordinal: 76, Address: 0x109a0)
GetCompileInfo (Ordinal: 77, Address: 0x29210)
GetFileVersion (Ordinal: 78, Address: 0x2d3f0)
GetHashFromAssemblyFile (Ordinal: 79, Address: 0x37260)
GetHashFromAssemblyFileW (Ordinal: 80, Address: 0x37330)
GetHashFromBlob (Ordinal: 81, Address: 0x37670)
GetHashFromFile (Ordinal: 82, Address: 0x37400)
GetHashFromFileW (Ordinal: 83, Address: 0x374d0)
GetHashFromHandle (Ordinal: 84, Address: 0x375a0)
GetHostConfigurationFile (Ordinal: 85, Address: 0x10c10)
GetMetaDataInternalInterface (Ordinal: 86, Address: 0x10d40)
GetMetaDataInternalInterfaceFromPublic (Ordinal: 87, Address: 0x28980)
GetMetaDataPublicInterfaceFromInternal (Ordinal: 88, Address: 0x288e0)
GetPermissionRequests (Ordinal: 89, Address: 0x28fe0)
GetRealProcAddress (Ordinal: 90, Address: 0x27fb0)
GetRequestedRuntimeInfo (Ordinal: 91, Address: 0x270b0)
GetRequestedRuntimeVersion (Ordinal: 92, Address: 0x27470)
GetRequestedRuntimeVersionForCLSID (Ordinal: 93, Address: 0x27720)
GetVersionFromProcess (Ordinal: 94, Address: 0x2e200)
GetXMLElement (Ordinal: 95, Address: 0x47cd0)
GetXMLElementAttribute (Ordinal: 96, Address: 0x47cd0)
GetXMLObject (Ordinal: 97, Address: 0x141e0)
IEE (Ordinal: 98, Address: 0x10e00)
LoadLibraryShim (Ordinal: 99, Address: 0x280e0)
LoadLibraryWithPolicyShim (Ordinal: 100, Address: 0x28030)
LoadStringRCEx (Ordinal: 101, Address: 0x28cd0)
LockClrVersion (Ordinal: 102, Address: 0x23c20)
MetaDataGetDispenser (Ordinal: 103, Address: 0x28650)
ND_CopyObjDst (Ordinal: 104, Address: 0x29650)
ND_CopyObjSrc (Ordinal: 105, Address: 0x29630)
ND_RI2 (Ordinal: 106, Address: 0xffa0)
ND_RI4 (Ordinal: 107, Address: 0x295e0)
ND_RI8 (Ordinal: 108, Address: 0x295f0)
ND_RU1 (Ordinal: 109, Address: 0xff90)
ND_WI2 (Ordinal: 110, Address: 0x29600)
ND_WI4 (Ordinal: 111, Address: 0x29610)
ND_WI8 (Ordinal: 112, Address: 0x29620)
ND_WU1 (Ordinal: 113, Address: 0xffb0)
ReOpenMetaDataWithMemoryEx (Ordinal: 114, Address: 0x28e50)
RunDll32ShimW (Ordinal: 115, Address: 0x28310)
RuntimeOSHandle (Ordinal: 116, Address: 0x29550)
RuntimeOpenImage (Ordinal: 117, Address: 0x29440)
RuntimeReleaseHandle (Ordinal: 118, Address: 0x294d0)
StrongNameCompareAssemblies (Ordinal: 119, Address: 0x37090)
StrongNameErrorInfo (Ordinal: 120, Address: 0x36520)
StrongNameFreeBuffer (Ordinal: 121, Address: 0x36600)
StrongNameGetBlob (Ordinal: 122, Address: 0x37750)
StrongNameGetBlobFromImage (Ordinal: 123, Address: 0x377f0)
StrongNameGetPublicKey (Ordinal: 124, Address: 0x36920)
StrongNameHashSize (Ordinal: 125, Address: 0x37130)
StrongNameKeyDelete (Ordinal: 126, Address: 0x368a0)
StrongNameKeyGen (Ordinal: 127, Address: 0x36680)
StrongNameKeyGenEx (Ordinal: 128, Address: 0x36730)
StrongNameKeyInstall (Ordinal: 129, Address: 0x36800)
StrongNameSignatureGeneration (Ordinal: 130, Address: 0x369f0)
StrongNameSignatureGenerationEx (Ordinal: 131, Address: 0x36ad0)
StrongNameSignatureSize (Ordinal: 132, Address: 0x371c0)
StrongNameSignatureVerification (Ordinal: 133, Address: 0x36ea0)
StrongNameSignatureVerificationEx (Ordinal: 134, Address: 0x36f40)
StrongNameSignatureVerificationFromImage (Ordinal: 135, Address: 0x36fe0)
StrongNameTokenFromAssembly (Ordinal: 136, Address: 0x36bd0)
StrongNameTokenFromAssemblyEx (Ordinal: 137, Address: 0x36c70)
StrongNameTokenFromPublicKey (Ordinal: 138, Address: 0x36d40)
TranslateSecurityAttributes (Ordinal: 139, Address: 0x28f00)
_CorDllMain (Ordinal: 140, Address: 0x2ac50)
_CorExeMain (Ordinal: 141, Address: 0x8b90)
_CorExeMain2 (Ordinal: 142, Address: 0x2b2b0)

Imported DLLs & Functions

KERNEL32.dll

ActivateActCtx (Address: 0x18006e268)
CloseHandle (Address: 0x18006e058)
CreateActCtxW (Address: 0x18006e260)
CreateEventW (Address: 0x18006e300)
CreateFileMappingW (Address: 0x18006e148)
CreateFileW (Address: 0x18006e0e0)
CreateMutexW (Address: 0x18006e0b8)
CreateProcessW (Address: 0x18006e2d8)
CreateSemaphoreW (Address: 0x18006e328)
CreateToolhelp32Snapshot (Address: 0x18006e168)
DeactivateActCtx (Address: 0x18006e270)
DebugBreak (Address: 0x18006e1a8)
DeleteCriticalSection (Address: 0x18006e0d8)
DisableThreadLibraryCalls (Address: 0x18006e090)
EncodePointer (Address: 0x18006e348)
EnterCriticalSection (Address: 0x18006e0c0)
ExitProcess (Address: 0x18006e0a0)
FindClose (Address: 0x18006e198)
FindFirstFileExA (Address: 0x18006e3d8)
FindFirstFileW (Address: 0x18006e188)
FindNextFileA (Address: 0x18006e3e0)
FindNextFileW (Address: 0x18006e190)
FlushFileBuffers (Address: 0x18006e120)
FlushInstructionCache (Address: 0x18006e1d8)
FormatMessageW (Address: 0x18006e230)
FreeEnvironmentStringsW (Address: 0x18006e250)
FreeLibrary (Address: 0x18006e028)
GetACP (Address: 0x18006e228)
GetCommandLineA (Address: 0x18006e3f8)
GetCommandLineW (Address: 0x18006e400)
GetConsoleCP (Address: 0x18006e3c8)
GetConsoleMode (Address: 0x18006e3d0)
GetCPInfo (Address: 0x18006e220)
GetCurrentProcess (Address: 0x18006e098)
GetCurrentProcessId (Address: 0x18006e2d0)
GetCurrentThread (Address: 0x18006e2a8)
GetCurrentThreadId (Address: 0x18006e108)
GetDateFormatW (Address: 0x18006e100)
GetEnvironmentStringsW (Address: 0x18006e258)
GetEnvironmentVariableW (Address: 0x18006e038)
GetFileAttributesExW (Address: 0x18006e1e0)
GetFileAttributesW (Address: 0x18006e118)
GetFileSize (Address: 0x18006e140)
GetFileType (Address: 0x18006e3b8)
GetFullPathNameW (Address: 0x18006e008)
GetLastError (Address: 0x18006e010)
GetLocalTime (Address: 0x18006e0f0)
GetModuleFileNameA (Address: 0x18006e3a8)
GetModuleFileNameW (Address: 0x18006e048)
GetModuleHandleA (Address: 0x18006e288)
GetModuleHandleExW (Address: 0x18006e018)
GetModuleHandleW (Address: 0x18006e088)
GetOEMCP (Address: 0x18006e3f0)
GetProcAddress (Address: 0x18006e020)
GetProcessHeap (Address: 0x18006e218)
GetProcessId (Address: 0x18006e1b0)
GetStartupInfoW (Address: 0x18006e380)
GetStdHandle (Address: 0x18006e3b0)
GetStringTypeW (Address: 0x18006e3c0)
GetSystemDefaultLangID (Address: 0x18006e290)
GetSystemDefaultLCID (Address: 0x18006e1e8)
GetSystemDirectoryW (Address: 0x18006e128)
GetSystemInfo (Address: 0x18006e080)
GetSystemTimeAsFileTime (Address: 0x18006e298)
GetTickCount (Address: 0x18006e110)
GetTimeFormatW (Address: 0x18006e0f8)
GetVersionExW (Address: 0x18006e1c8)
GetWindowsDirectoryW (Address: 0x18006e068)
HeapAlloc (Address: 0x18006e210)
HeapCreate (Address: 0x18006e1f0)
HeapDestroy (Address: 0x18006e1f8)
HeapFree (Address: 0x18006e208)
HeapReAlloc (Address: 0x18006e428)
HeapSize (Address: 0x18006e420)
HeapValidate (Address: 0x18006e2f8)
InitializeCriticalSection (Address: 0x18006e0d0)
InitializeCriticalSectionAndSpinCount (Address: 0x18006e158)
InitializeSListHead (Address: 0x18006e388)
InterlockedFlushSList (Address: 0x18006e398)
IsDBCSLeadByte (Address: 0x18006e238)
IsDBCSLeadByteEx (Address: 0x18006e430)
IsDebuggerPresent (Address: 0x18006e280)
IsProcessorFeaturePresent (Address: 0x18006e378)
IsValidCodePage (Address: 0x18006e3e8)
LCMapStringW (Address: 0x18006e248)
LeaveCriticalSection (Address: 0x18006e0c8)
LoadLibraryExA (Address: 0x18006e1a0)
LoadLibraryExW (Address: 0x18006e030)
LocalFree (Address: 0x18006e240)
lstrlenW (Address: 0x18006e180)
MapViewOfFile (Address: 0x18006e150)
Module32FirstW (Address: 0x18006e1b8)
Module32NextW (Address: 0x18006e1c0)
MultiByteToWideChar (Address: 0x18006e130)
OpenProcess (Address: 0x18006e2c8)
OutputDebugStringW (Address: 0x18006e0a8)
QueryPerformanceCounter (Address: 0x18006e2a0)
RaiseException (Address: 0x18006e200)
ReadFile (Address: 0x18006e178)
ReadProcessMemory (Address: 0x18006e170)
ReleaseActCtx (Address: 0x18006e278)
ReleaseMutex (Address: 0x18006e0b0)
ReleaseSemaphore (Address: 0x18006e2f0)
ResetEvent (Address: 0x18006e320)
RtlCaptureContext (Address: 0x18006e350)
RtlLookupFunctionEntry (Address: 0x18006e358)
RtlPcToFileHeader (Address: 0x18006e3a0)
RtlUnwindEx (Address: 0x18006e390)
RtlVirtualUnwind (Address: 0x18006e360)
SetEnvironmentVariableW (Address: 0x18006e060)
SetErrorMode (Address: 0x18006e040)
SetEvent (Address: 0x18006e308)
SetFilePointerEx (Address: 0x18006e410)
SetLastError (Address: 0x18006e138)
SetStdHandle (Address: 0x18006e408)
SetUnhandledExceptionFilter (Address: 0x18006e370)
SleepEx (Address: 0x18006e330)
TerminateProcess (Address: 0x18006e2b0)
TlsAlloc (Address: 0x18006e318)
TlsFree (Address: 0x18006e340)
TlsGetValue (Address: 0x18006e338)
TlsSetValue (Address: 0x18006e2e0)
UnhandledExceptionFilter (Address: 0x18006e368)
UnmapViewOfFile (Address: 0x18006e160)
VerifyVersionInfoW (Address: 0x18006e2c0)
VerSetConditionMask (Address: 0x18006e2b8)
VirtualAlloc (Address: 0x18006e078)
VirtualFree (Address: 0x18006e2e8)
VirtualProtect (Address: 0x18006e1d0)
VirtualQuery (Address: 0x18006e070)
WaitForSingleObject (Address: 0x18006e050)
WaitForSingleObjectEx (Address: 0x18006e310)
WideCharToMultiByte (Address: 0x18006e000)
WriteConsoleW (Address: 0x18006e418)
WriteFile (Address: 0x18006e0e8)