SHCore.dll

  • File Path: C:\Windows\SysWOW64\SHCore.dll
  • Description: SHCORE

Hashes

Type Hash
MD5 5168C8E5F7E1880ABC27551B53ABBA5C
SHA1 9471A9FC525E16A43F325684DAEF79918877BA14
SHA256 E5C8A9098F242B0C6AC8B7EEE94F50966E34558EBDFDBDF7C06E686F61864A8F
SHA384 BF503F35FE30F23A721DE297604642424847535705764A595E770EB5CBC94A4D73CFB98CD1A4CFCAF28CF02AC8C91E14
SHA512 666E687E645906151742B5AAB2D47026205C6E84C26F8CD59BA33EAB9753B7CB8D51045498362993928ED5615DC51D374F432B6198796AFB92BB956C7F342497
SSDEEP 12288:uovLbwUxodJQ1OD2WR/W8I98umXGtyy0p0J6OpNiQM1AJ09N5v0MCrZeDtzy6sUi:uovnwUqdyfsqBRmqZY8lk36TVFV
IMP 6A8F1F06C7FC39E6099BBA153CD75BAB
PESHA1 80ED81FDB382ED5B877A30AC9705D19833C80040
PE256 42C24A14E6A6B3412DDD4622ABF06C7609640A434487B67215DFA2269DF0CF09

DLL Exports:

Function Name Ordinal Type
SHOpenRegStream2W 63 Exported Function
SHOpenRegStreamA 64 Exported Function
SHOpenRegStreamW 65 Exported Function
SHGetValueA 60 Exported Function
SHGetValueW 61 Exported Function
SHOpenRegStream2A 62 Exported Function
SHQueryValueExW 69 Exported Function
SHRegDuplicateHKey 70 Exported Function
SHRegGetIntW 71 Exported Function
SHQueryInfoKeyA 66 Exported Function
SHQueryInfoKeyW 67 Exported Function
SHQueryValueExA 68 Exported Function
SHDeleteKeyA 51 Exported Function
SHDeleteKeyW 52 Exported Function
SHDeleteValueA 53 Exported Function
SHCreateThreadWithHandle 48 Exported Function
SHDeleteEmptyKeyA 49 Exported Function
SHDeleteEmptyKeyW 50 Exported Function
SHEnumValueA 57 Exported Function
SHEnumValueW 58 Exported Function
SHGetThreadRef 59 Exported Function
SHDeleteValueW 54 Exported Function
SHEnumKeyExA 55 Exported Function
SHEnumKeyExW 56 Exported Function
SHTaskPoolGetCurrentThreadLifetime 86 Exported Function
SHTaskPoolGetUniqueContext 87 Exported Function
SHTaskPoolQueueTask 88 Exported Function
SHStrDupW 83 Exported Function
SHTaskPoolAllowThreadReuse 84 Exported Function
SHTaskPoolDoNotWaitForMoreTasks 85 Exported Function
SubscribeFeatureStateChangeNotification 95 Exported Function
UnregisterScaleChangeEvent 96 Exported Function
UnsubscribeFeatureStateChangeNotification 97 Exported Function
SHTaskPoolSetThreadReuseAllowed 89 Exported Function
SHUnicodeToAnsi 90 Exported Function
SHUnicodeToUnicode 91 Exported Function
SHRegGetValueFromHKCUHKLM 122 Exported Function
SHRegGetValueW 75 Exported Function
SHRegSetPathA 76 Exported Function
SHRegGetPathA 72 Exported Function
SHRegGetPathW 73 Exported Function
SHRegGetValueA 74 Exported Function
SHSetValueA 80 Exported Function
SHSetValueW 81 Exported Function
SHStrDupA 82 Exported Function
SHRegSetPathW 77 Exported Function
SHReleaseThreadRef 78 Exported Function
SHSetThreadRef 79 Exported Function
SHCreateThreadRef 47 Exported Function
GetScaleFactorForMonitor 17 Exported Function
IsOS 30 Exported Function
IsProcessInIsolatedContainer 31 Exported Function
GetProcessDpiAwareness 14 Exported Function
GetProcessReference 15 Exported Function
GetScaleFactorForDevice 16 Exported Function
IStream_ReadStr 20 Exported Function
IStream_Reset 21 Exported Function
IStream_Size 22 Exported Function
IsProcessInWDAGContainer 32 Exported Function
IStream_Copy 18 Exported Function
IStream_Read 19 Exported Function
CreateStreamOverRandomAccessStream 5 Exported Function
DllCanUnloadNow 6 Exported Function
DllGetActivationFactory 7 Exported Function
CommandLineToArgvW 2 Exported Function
CreateRandomAccessStreamOnFile 3 Exported Function
CreateRandomAccessStreamOverStream 4 Exported Function
GetDpiForShellUIComponent 11 Exported Function
GetFeatureEnabledState 12 Exported Function
GetFeatureVariant 13 Exported Function
DllGetClassObject 8 Exported Function
GetCurrentProcessExplicitAppUserModelID 9 Exported Function
GetDpiForMonitor 10 Exported Function
SHAnsiToAnsi 38 Exported Function
SHAnsiToUnicode 39 Exported Function
SHCopyKeyA 40 Exported Function
SetCurrentProcessExplicitAppUserModelID 92 Exported Function
SetProcessDpiAwareness 93 Exported Function
SetProcessReference 94 Exported Function
SHCreateStreamOnFileEx 44 Exported Function
SHCreateStreamOnFileW 45 Exported Function
SHCreateThread 46 Exported Function
SHCopyKeyW 41 Exported Function
SHCreateMemStream 42 Exported Function
SHCreateStreamOnFileA 43 Exported Function
IUnknown_GetSite 26 Exported Function
IUnknown_QueryService 27 Exported Function
IUnknown_Set 28 Exported Function
IStream_Write 23 Exported Function
IStream_WriteStr 24 Exported Function
IUnknown_AtomicRelease 25 Exported Function
RegisterScaleChangeEvent 35 Exported Function
RegisterScaleChangeNotifications 36 Exported Function
RevokeScaleChangeNotifications 37 Exported Function
IUnknown_SetSite 29 Exported Function
RecordFeatureError 33 Exported Function
RecordFeatureUsage 34 Exported Function

Signature

  • Status: Signature verified.
  • Serial: 3300000266BD1580EFA75CD6D3000000000266
  • Thumbprint: A4341B9FD50FB9964283220A36A1EF6F6FAA7840
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: SHCORE.dll
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.19041.488 (WinBuild.160101.0800)
  • Product Version: 10.0.19041.488
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 32-bit

File Scan

  • VirusTotal Detections: 0/68
  • VirusTotal Link: https://www.virustotal.com/gui/file/e5c8a9098f242b0c6ac8b7eee94f50966e34558ebdfdbdf7c06e686f61864a8f/detection/

Possible Misuse

The following table contains possible examples of SHCore.dll being misused. While SHCore.dll is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source Source File Example License
sigma image_load_mimikatz_inmemory_detection.yml - 'shcore.dll' DRL 1.0
malware-ioc part3.adoc shcore.dll © ESET 2014-2018

MIT License. Copyright (c) 2020-2021 Strontic.