SHCore.dll

  • File Path: C:\Windows\system32\SHCore.dll
  • Description: SHCORE

Hashes

Type Hash
MD5 7DAF3CBAB27CAB7CCB2B6E1E93822859
SHA1 D3DFEEE4EA467F21DA189BF1656010BD83898B61
SHA256 DC33262BE78CC9166F697137CE47789DD6453A3DF05BC81DBD7C48CF56CE5325
SHA384 2B55F8E335E81A8F3F59D395AC3D6F324B317E436FDCB47EC628BA1EC72F432B05DEA99A2743AB026E8ABC26B4CA0781
SHA512 530E620366C18DE8D011FACF43E731FC25D0E4C39C296B8E191F45C0191612F915776DC25592F0B6EFDEE4B906EF2937523EF73F30E050DCD79CABFD99D3FA7C
SSDEEP 12288:YTMvw9O0YUF+3LG+Rz1drArA+Pv8ubmLZIesxO1R6DPbQ2:YyQYUF+3LG+Rz1drArJX8t9Ies0/6DP
IMP D1DDD1601DD746E8A293530ADAAE61B9
PESHA1 EDA9B938F74C5FCA58191F09C95A466A7832EB2D
PE256 D572D604E1BF0360CE65761642AF21018F12EBE60175DF3ACFA3B294FFC3620B

DLL Exports:

Function Name Ordinal Type
SHOpenRegStream2W 63 Exported Function
SHOpenRegStreamA 64 Exported Function
SHOpenRegStreamW 65 Exported Function
SHGetValueA 60 Exported Function
SHGetValueW 61 Exported Function
SHOpenRegStream2A 62 Exported Function
SHQueryValueExW 69 Exported Function
SHRegDuplicateHKey 70 Exported Function
SHRegGetIntW 71 Exported Function
SHQueryInfoKeyA 66 Exported Function
SHQueryInfoKeyW 67 Exported Function
SHQueryValueExA 68 Exported Function
SHDeleteKeyA 51 Exported Function
SHDeleteKeyW 52 Exported Function
SHDeleteValueA 53 Exported Function
SHCreateThreadWithHandle 48 Exported Function
SHDeleteEmptyKeyA 49 Exported Function
SHDeleteEmptyKeyW 50 Exported Function
SHEnumValueA 57 Exported Function
SHEnumValueW 58 Exported Function
SHGetThreadRef 59 Exported Function
SHDeleteValueW 54 Exported Function
SHEnumKeyExA 55 Exported Function
SHEnumKeyExW 56 Exported Function
SHTaskPoolGetCurrentThreadLifetime 86 Exported Function
SHTaskPoolGetUniqueContext 87 Exported Function
SHTaskPoolQueueTask 88 Exported Function
SHStrDupW 83 Exported Function
SHTaskPoolAllowThreadReuse 84 Exported Function
SHTaskPoolDoNotWaitForMoreTasks 85 Exported Function
SubscribeFeatureStateChangeNotification 95 Exported Function
UnregisterScaleChangeEvent 96 Exported Function
UnsubscribeFeatureStateChangeNotification 97 Exported Function
SHTaskPoolSetThreadReuseAllowed 89 Exported Function
SHUnicodeToAnsi 90 Exported Function
SHUnicodeToUnicode 91 Exported Function
SHRegGetValueFromHKCUHKLM 122 Exported Function
SHRegGetValueW 75 Exported Function
SHRegSetPathA 76 Exported Function
SHRegGetPathA 72 Exported Function
SHRegGetPathW 73 Exported Function
SHRegGetValueA 74 Exported Function
SHSetValueA 80 Exported Function
SHSetValueW 81 Exported Function
SHStrDupA 82 Exported Function
SHRegSetPathW 77 Exported Function
SHReleaseThreadRef 78 Exported Function
SHSetThreadRef 79 Exported Function
SHCreateThreadRef 47 Exported Function
GetScaleFactorForMonitor 17 Exported Function
IsOS 30 Exported Function
IsProcessInIsolatedContainer 31 Exported Function
GetProcessDpiAwareness 14 Exported Function
GetProcessReference 15 Exported Function
GetScaleFactorForDevice 16 Exported Function
IStream_ReadStr 20 Exported Function
IStream_Reset 21 Exported Function
IStream_Size 22 Exported Function
IsProcessInWDAGContainer 32 Exported Function
IStream_Copy 18 Exported Function
IStream_Read 19 Exported Function
CreateStreamOverRandomAccessStream 5 Exported Function
DllCanUnloadNow 6 Exported Function
DllGetActivationFactory 7 Exported Function
CommandLineToArgvW 2 Exported Function
CreateRandomAccessStreamOnFile 3 Exported Function
CreateRandomAccessStreamOverStream 4 Exported Function
GetDpiForShellUIComponent 11 Exported Function
GetFeatureEnabledState 12 Exported Function
GetFeatureVariant 13 Exported Function
DllGetClassObject 8 Exported Function
GetCurrentProcessExplicitAppUserModelID 9 Exported Function
GetDpiForMonitor 10 Exported Function
SHAnsiToAnsi 38 Exported Function
SHAnsiToUnicode 39 Exported Function
SHCopyKeyA 40 Exported Function
SetCurrentProcessExplicitAppUserModelID 92 Exported Function
SetProcessDpiAwareness 93 Exported Function
SetProcessReference 94 Exported Function
SHCreateStreamOnFileEx 44 Exported Function
SHCreateStreamOnFileW 45 Exported Function
SHCreateThread 46 Exported Function
SHCopyKeyW 41 Exported Function
SHCreateMemStream 42 Exported Function
SHCreateStreamOnFileA 43 Exported Function
IUnknown_GetSite 26 Exported Function
IUnknown_QueryService 27 Exported Function
IUnknown_Set 28 Exported Function
IStream_Write 23 Exported Function
IStream_WriteStr 24 Exported Function
IUnknown_AtomicRelease 25 Exported Function
RegisterScaleChangeEvent 35 Exported Function
RegisterScaleChangeNotifications 36 Exported Function
RevokeScaleChangeNotifications 37 Exported Function
IUnknown_SetSite 29 Exported Function
RecordFeatureError 33 Exported Function
RecordFeatureUsage 34 Exported Function

Signature

  • Status: Signature verified.
  • Serial: 3300000266BD1580EFA75CD6D3000000000266
  • Thumbprint: A4341B9FD50FB9964283220A36A1EF6F6FAA7840
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: SHCORE.dll.mui
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.19041.1 (WinBuild.160101.0800)
  • Product Version: 10.0.19041.1
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 64-bit

File Scan

  • VirusTotal Detections: 0/66
  • VirusTotal Link: https://www.virustotal.com/gui/file/dc33262be78cc9166f697137ce47789dd6453a3df05bc81dbd7c48cf56ce5325/detection/

Possible Misuse

The following table contains possible examples of SHCore.dll being misused. While SHCore.dll is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source Source File Example License
sigma image_load_mimikatz_inmemory_detection.yml - 'shcore.dll' DRL 1.0
malware-ioc part3.adoc shcore.dll © ESET 2014-2018

MIT License. Copyright (c) 2020-2021 Strontic.