mscorsvc.dll

Description: .NET Runtime Optimization Service

Version: 4.8.4320.0

Architecture: 64-bit

Operating System: Windows

SHA256: 65b61226d9cdf224d4434add181a8d18

File Size: 544.9 KB

Uploaded At: Dec. 1, 2025, 8:29 a.m.

Views: 16

Security Warning

This file has been flagged as potentially dangerous.

Reason: Detected potentially dangerous functions used for process injection: OpenProcess

Exported Functions

CorCreateNGenProcess (Ordinal: 1, Address: 0x35280)
CorGetNGenPolicy (Ordinal: 2, Address: 0x35510)
CorGetSvc (Ordinal: 3, Address: 0x8ce0)
CorInitSvcLogger (Ordinal: 4, Address: 0x18dd0)
CorSetCriticalTaskState (Ordinal: 5, Address: 0x26000)
CorStopNonCriticalTask (Ordinal: 6, Address: 0x264c0)
CorSvcLog (Ordinal: 7, Address: 0x18e40)

Imported DLLs & Functions

ADVAPI32.dll

ConvertSidToStringSidW (Address: 0x180053050)
ConvertStringSidToSidW (Address: 0x180053068)
CreateProcessAsUserW (Address: 0x180053080)
DeregisterEventSource (Address: 0x180053088)
DuplicateTokenEx (Address: 0x180053060)
EventWrite (Address: 0x1800530a0)
FreeSid (Address: 0x180053058)
GetLengthSid (Address: 0x180053078)
GetSidSubAuthority (Address: 0x1800530c0)
GetSidSubAuthorityCount (Address: 0x1800530b8)
GetTokenInformation (Address: 0x180053048)
OpenProcessToken (Address: 0x180053040)
RegCloseKey (Address: 0x180053008)
RegCreateKeyExW (Address: 0x1800530a8)
RegDeleteKeyW (Address: 0x180053010)
RegDeleteValueW (Address: 0x180053028)
RegEnumKeyExW (Address: 0x180053030)
RegEnumValueW (Address: 0x180053038)
RegisterEventSourceW (Address: 0x180053090)
RegNotifyChangeKeyValue (Address: 0x180053000)
RegOpenKeyExW (Address: 0x1800530b0)
RegQueryValueExW (Address: 0x180053018)
RegSetValueExW (Address: 0x180053020)
ReportEventW (Address: 0x180053098)
SetTokenInformation (Address: 0x180053070)

fusion.dll

CreateApplicationContext (Address: 0x1800536e8)
CreateAssemblyCache (Address: 0x1800536f0)
CreateAssemblyNameObject (Address: 0x1800536f8)
InitializeFusion (Address: 0x180053700)

KERNEL32.dll

ActivateActCtx (Address: 0x1800532f0)
CloseHandle (Address: 0x180053398)
CreateActCtxW (Address: 0x1800532f8)
CreateDirectoryW (Address: 0x180053120)
CreateEventW (Address: 0x1800533a0)
CreateFileMappingW (Address: 0x180053138)
CreateFileW (Address: 0x180053248)
CreateMutexW (Address: 0x1800532a0)
CreatePipe (Address: 0x180053188)
CreateProcessW (Address: 0x1800531d0)
CreateSemaphoreW (Address: 0x180053270)
CreateThread (Address: 0x1800533b0)
DeactivateActCtx (Address: 0x1800532e8)
DebugBreak (Address: 0x1800530d0)
DeleteCriticalSection (Address: 0x180053350)
DeleteFileW (Address: 0x180053378)
EnterCriticalSection (Address: 0x180053328)
ExitProcess (Address: 0x180053160)
FileTimeToSystemTime (Address: 0x1800533e8)
FindClose (Address: 0x1800531f0)
FindFirstFileW (Address: 0x180053390)
FindNextFileW (Address: 0x1800532d8)
FormatMessageW (Address: 0x180053430)
FreeLibrary (Address: 0x180053198)
GetACP (Address: 0x180053440)
GetCommandLineW (Address: 0x180053150)
GetCPInfo (Address: 0x180053448)
GetCurrentProcess (Address: 0x1800530e0)
GetCurrentProcessId (Address: 0x180053170)
GetCurrentThreadId (Address: 0x1800531c0)
GetEnvironmentVariableW (Address: 0x180053100)
GetExitCodeProcess (Address: 0x180053158)
GetFileAttributesExW (Address: 0x180053308)
GetFileAttributesW (Address: 0x1800533d0)
GetFileSize (Address: 0x180053130)
GetFileSizeEx (Address: 0x180053310)
GetFullPathNameW (Address: 0x1800533c8)
GetLastError (Address: 0x1800533a8)
GetLocalTime (Address: 0x1800531b8)
GetModuleFileNameW (Address: 0x180053200)
GetModuleHandleW (Address: 0x180053208)
GetProcAddress (Address: 0x1800533c0)
GetProcessAffinityMask (Address: 0x180053388)
GetProcessHeap (Address: 0x180053450)
GetSystemDirectoryW (Address: 0x180053380)
GetSystemInfo (Address: 0x180053410)
GetSystemPowerStatus (Address: 0x1800533b8)
GetSystemTime (Address: 0x1800533d8)
GetSystemTimeAsFileTime (Address: 0x180053320)
GetSystemWindowsDirectoryW (Address: 0x1800531e8)
GetTickCount (Address: 0x180053340)
GetVersionExW (Address: 0x1800530e8)
GetWindowsDirectoryW (Address: 0x1800531e0)
GlobalAlloc (Address: 0x180053180)
GlobalMemoryStatusEx (Address: 0x180053110)
HeapAlloc (Address: 0x1800533f8)
HeapCreate (Address: 0x1800532d0)
HeapDestroy (Address: 0x180053278)
HeapFree (Address: 0x1800533f0)
HeapValidate (Address: 0x180053290)
InitializeCriticalSection (Address: 0x180053348)
InitializeSListHead (Address: 0x180053210)
IsDBCSLeadByte (Address: 0x180053428)
IsDebuggerPresent (Address: 0x180053370)
IsProcessorFeaturePresent (Address: 0x180053218)
LCMapStringW (Address: 0x180053420)
LeaveCriticalSection (Address: 0x180053330)
LoadLibraryExA (Address: 0x1800531f8)
LoadLibraryExW (Address: 0x180053148)
LocalFree (Address: 0x1800531a8)
MapViewOfFile (Address: 0x180053140)
MoveFileExW (Address: 0x180053300)
MultiByteToWideChar (Address: 0x180053438)
OpenEventW (Address: 0x180053168)
OpenProcess (Address: 0x180053190)
OutputDebugStringW (Address: 0x1800531c8)
QueryPerformanceCounter (Address: 0x180053318)
RaiseException (Address: 0x1800531b0)
ReadFile (Address: 0x180053178)
ReleaseActCtx (Address: 0x1800532e0)
ReleaseMutex (Address: 0x180053298)
ReleaseSemaphore (Address: 0x1800532b0)
ResetEvent (Address: 0x180053358)
RtlCaptureContext (Address: 0x180053240)
RtlLookupFunctionEntry (Address: 0x180053238)
RtlVirtualUnwind (Address: 0x180053230)
SetConsoleCtrlHandler (Address: 0x1800530f0)
SetEnvironmentVariableW (Address: 0x180053108)
SetErrorMode (Address: 0x180053118)
SetEvent (Address: 0x180053338)
SetLastError (Address: 0x180053128)
SetProcessShutdownParameters (Address: 0x1800530f8)
SetUnhandledExceptionFilter (Address: 0x180053220)
SleepEx (Address: 0x180053268)
SystemTimeToFileTime (Address: 0x1800533e0)
TerminateProcess (Address: 0x1800530d8)
TlsAlloc (Address: 0x180053280)
TlsFree (Address: 0x180053258)
TlsGetValue (Address: 0x180053260)
TlsSetValue (Address: 0x1800532c8)
UnhandledExceptionFilter (Address: 0x180053228)
UnmapViewOfFile (Address: 0x1800531a0)
VerifyVersionInfoW (Address: 0x180053400)
VerSetConditionMask (Address: 0x180053408)
VirtualAlloc (Address: 0x1800532a8)
VirtualFree (Address: 0x1800532b8)
VirtualProtect (Address: 0x1800532c0)
VirtualQuery (Address: 0x180053250)
WaitForMultipleObjects (Address: 0x180053368)
WaitForSingleObject (Address: 0x180053360)
WaitForSingleObjectEx (Address: 0x180053288)
WideCharToMultiByte (Address: 0x180053418)
WriteFile (Address: 0x1800531d8)

mscoree.dll

CLRCreateInstance (Address: 0x1800536c8)
CreateConfigStream (Address: 0x1800536c0)
GetRequestedRuntimeInfo (Address: 0x1800536d0)
GetXMLObject (Address: 0x1800536d8)

ole32.dll

CoAddRefServerProcess (Address: 0x180053620)
CoCreateGuid (Address: 0x180053610)
CoCreateInstance (Address: 0x180053600)
CoDisconnectObject (Address: 0x180053608)
CoInitializeEx (Address: 0x180053640)
CoReleaseServerProcess (Address: 0x180053618)
CoTaskMemFree (Address: 0x180053628)
CoUninitialize (Address: 0x180053648)
CoUnmarshalInterface (Address: 0x180053638)
CreateStreamOnHGlobal (Address: 0x180053630)

OLEAUT32.dll

SafeArrayCreateVector (Address: 0x180053660)
SafeArrayDestroy (Address: 0x180053678)
SafeArrayGetElement (Address: 0x180053668)
SafeArrayGetUBound (Address: 0x180053670)
SafeArrayPutElement (Address: 0x180053658)
SetErrorInfo (Address: 0x1800536a0)
SysAllocString (Address: 0x1800536b0)
SysFreeString (Address: 0x1800536a8)
SysStringLen (Address: 0x180053680)
VariantChangeType (Address: 0x180053688)
VariantClear (Address: 0x180053690)
VariantInit (Address: 0x180053698)

ucrtbase_clr0400.dll

__acrt_iob_func (Address: 0x180053530)
__stdio_common_vfwprintf (Address: 0x180053520)
__stdio_common_vsnprintf_s (Address: 0x180053510)
__stdio_common_vsnwprintf_s (Address: 0x180053518)
__stdio_common_vswprintf_s (Address: 0x180053550)
_cexit (Address: 0x1800535b8)
_configure_narrow_argv (Address: 0x180053588)
_crt_atexit (Address: 0x1800535b0)
_errno (Address: 0x1800534f8)
_execute_onexit_table (Address: 0x1800535a8)
_flushall (Address: 0x1800534d0)
_initialize_narrow_environment (Address: 0x180053590)
_initialize_onexit_table (Address: 0x180053598)
_initterm (Address: 0x1800534f0)
_initterm_e (Address: 0x180053578)
_putws (Address: 0x1800534c8)
_register_onexit_function (Address: 0x1800535a0)
_seh_filter_dll (Address: 0x180053580)
_wcsicmp (Address: 0x180053560)
_wcsnicmp (Address: 0x180053548)
_wtoi (Address: 0x180053558)
fflush (Address: 0x180053528)
free (Address: 0x1800535c8)
iswspace (Address: 0x1800534e8)
malloc (Address: 0x1800534c0)
strcpy_s (Address: 0x180053508)
strncmp (Address: 0x180053500)
wcscat_s (Address: 0x1800534e0)
wcscpy_s (Address: 0x180053540)
wcsncmp (Address: 0x1800535c0)
wcsncpy_s (Address: 0x180053538)
wcstok_s (Address: 0x1800534d8)
wcstol (Address: 0x180053568)
wcstoul (Address: 0x180053570)

USER32.dll

GetProcessWindowStation (Address: 0x1800535d8)
GetUserObjectInformationW (Address: 0x1800535e8)
LoadStringW (Address: 0x1800535f0)
SystemParametersInfoW (Address: 0x1800535e0)

VCRUNTIME140_CLR0400.dll

__C_specific_handler (Address: 0x180053488)
__CxxFrameHandler3 (Address: 0x180053478)
__std_type_info_destroy_list (Address: 0x180053470)
_CxxThrowException (Address: 0x180053490)
_purecall (Address: 0x180053498)
memcpy (Address: 0x180053460)
memmove (Address: 0x180053480)
memset (Address: 0x180053468)
wcschr (Address: 0x1800534b0)
wcsrchr (Address: 0x1800534a0)
wcsstr (Address: 0x1800534a8)