filenameSystem.Data.dll
size3145216 (0x2ffe00)
md59cbb1b96cf309000c3abbfc12464d74d
typePE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x120

Rich Header

lib idversiontimes used
109403101
123507272
1234031020
10219
123506083
125506081
1095060811
130507271
109507271
1105072721
110506087
122507271
124507271
120507271

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x8664
NumberOfSections7
TimeDateStamp0x4fee6ddc
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xf0
Characteristics0x2022
Magic0x20b
LinkerVersion8.0
SizeOfCode0x2de600
SizeOfInitializedData0x21400
SizeOfUninitializedData0
AddressOfEntryPoint0x2d9ec4
BaseOfCode0x1000
ImageBase0x1b6d0000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.0
ImageVersion8.0
SubsystemVersion5.2
Reserved10
SizeOfImage0x30c000
SizeOfHeaders0x400
CheckSum0x30e112
Subsystem3
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x2de3c90x2de400R-X CODE
.nep0x2e00000x200x200R-X CODE
.data0x2e10000x80b80x800RW- IDATA
.pdata0x2ea0000x2cf40x2e00R-- IDATA
.sdbid0x2ed0000x4f650x5000RW- IDATA DISCARDABLE
.rsrc0x2f20000x1550c0x15600R-- IDATA
.reloc0x3080000x375e0x3800R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x2df2500x179
IMPORT0x2de1680xc8
RESOURCE0x2f20000x1550c
EXCEPTION0x2ea0000x2cf4
SECURITY00
BASERELOC0x3080000x1684
DEBUG0x16500x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x10000x5b8
Delay_IAT00
CLR_Header0x14fa00x48
typenamesizecp
IBCPROFILE_DATA856311252
VERSION#19481252
MANIFEST#24581252
module_namehintordfunction_name
MSVCR80.dll254_cexit
MSVCR80.dll104__FrameUnwindFilter
MSVCR80.dll131__crt_debugger_hook
MSVCR80.dll123__clean_type_info_names_internal
MSVCR80.dll749_onexit
MSVCR80.dll582_lock
MSVCR80.dll133__dllonexit
MSVCR80.dll942_unlock
MSVCR80.dll90__CppXcptFilter
MSVCR80.dll231_amsg_exit
MSVCR80.dll306_decode_pointer
MSVCR80.dll317_encoded_null
MSVCR80.dll472_initterm_e
MSVCR80.dll471_initterm
MSVCR80.dll599_malloc_crt
MSVCR80.dll316_encode_pointer
MSVCR80.dll1266malloc
MSVCR80.dll252_callnewh
MSVCR80.dll1345strtok_s
MSVCR80.dll1318srand
MSVCR80.dll914_time64
MSVCR80.dll1342strstr
MSVCR80.dll1276memcmp
MSVCR80.dll1322strcat_s
MSVCR80.dll1315sprintf_s
MSVCR80.dll1347strtoul
MSVCR80.dll1171calloc
MSVCR80.dll1327strcpy_s
MSVCR80.dll1279memmove
MSVCR80.dll1392wcsncmp
MSVCR80.dll1337strncpy_s
MSVCR80.dll1394wcsncpy_s
MSVCR80.dll986_vsnwprintf_s
MSVCR80.dll1280memmove_s
MSVCR80.dll240_atoi_l
MSVCR80.dll1209free
MSVCR80.dll313_dupenv_s
MSVCR80.dll867_stricmp
MSVCR80.dll1166atoi
MSVCR80.dll1027_wcsnicmp
MSVCR80.dll1335strncmp
MSVCR80.dll868_stricmp_l
MSVCR80.dll1323strchr
MSVCR80.dll878_strnicmp_l
MSVCR80.dll763_purecall
MSVCR80.dll982_vsnprintf_s
MSVCR80.dll1281memset
MSVCR80.dll89__C_specific_handler
MSVCR80.dll1277memcpy
MSVCR80.dll19void __cdecl operator delete(void * __ptr64)

??3@YAXPEAX@Z

ntdll.dll749RtlLookupFunctionEntry
ntdll.dll927RtlVirtualUnwind
ntdll.dll469RtlCaptureContext
mscoree.dll14CorBindToRuntimeEx
mscoree.dll115_CorDllMain
KERNEL32.dll868TerminateProcess
KERNEL32.dll326GetCurrentProcessId
KERNEL32.dll671QueryPerformanceCounter
KERNEL32.dll142DisableThreadLibraryCalls
KERNEL32.dll506GlobalAlloc
KERNEL32.dll191ExpandEnvironmentStringsA
KERNEL32.dll811SetHandleInformation
KERNEL32.dll848SetUnhandledExceptionFilter
KERNEL32.dll565IsDebuggerPresent
KERNEL32.dll884UnhandledExceptionFilter
KERNEL32.dll82CreateEventA
KERNEL32.dll54CloseHandle
KERNEL32.dll654PostQueuedCompletionStatus
KERNEL32.dll860Sleep
KERNEL32.dll814SetLastError
KERNEL32.dll371GetLastError
KERNEL32.dll910VirtualQuery
KERNEL32.dll251FreeLibrary
KERNEL32.dll418GetProcAddress
KERNEL32.dll593LoadLibraryW
KERNEL32.dll980lstrcpynW
KERNEL32.dll192ExpandEnvironmentStringsW
KERNEL32.dll343GetDriveTypeW
KERNEL32.dll365GetFullPathNameW
KERNEL32.dll739SearchPathW
KERNEL32.dll983lstrlenW
KERNEL32.dll650OutputDebugStringW
KERNEL32.dll384GetModuleFileNameW
KERNEL32.dll455GetSystemInfo
KERNEL32.dll542HeapSize
KERNEL32.dll530HeapAlloc
KERNEL32.dll421GetProcessHeap
KERNEL32.dll536HeapFree
KERNEL32.dll110CreateSemaphoreA
KERNEL32.dll703ReleaseSemaphore
KERNEL32.dll329GetCurrentThreadId
KERNEL32.dll797SetEvent
KERNEL32.dll549InitializeCriticalSection
KERNEL32.dll155EnterCriticalSection
KERNEL32.dll589LeaveCriticalSection
KERNEL32.dll132DeleteCriticalSection
KERNEL32.dll590LoadLibraryA
KERNEL32.dll325GetCurrentProcess
KERNEL32.dll143DisconnectNamedPipe
KERNEL32.dll822SetNamedPipeHandleState
KERNEL32.dll920WaitNamedPipeA
KERNEL32.dll86CreateFileA
KERNEL32.dll481GetTickCount
KERNEL32.dll406GetOverlappedResult
KERNEL32.dll918WaitForSingleObject
KERNEL32.dll938WriteFile
KERNEL32.dll689ReadFile
KERNEL32.dll653PeekNamedPipe
KERNEL32.dll491GetVersionExA
KERNEL32.dll60CompareStringA
KERNEL32.dll576LCMapStringA
KERNEL32.dll922WideCharToMultiByte
KERNEL32.dll625MultiByteToWideChar
KERNEL32.dll916WaitForMultipleObjects
KERNEL32.dll460GetSystemTimeAsFileTime
KERNEL32.dll92CreateIoCompletionPort
KERNEL32.dll577LCMapStringW
KERNEL32.dll113CreateThread
KERNEL32.dll279GetComputerNameA
KERNEL32.dll451GetSystemDirectoryA
KERNEL32.dll874TlsFree
KERNEL32.dll875TlsGetValue
KERNEL32.dll876TlsSetValue
KERNEL32.dll873TlsAlloc
KERNEL32.dll247FormatMessageW
KERNEL32.dll438GetQueuedCompletionStatus
ADVAPI32.dll459RegCloseKey
ADVAPI32.dll493RegOpenKeyExW
ADVAPI32.dll497RegQueryInfoKeyA
ADVAPI32.dll478RegEnumKeyExA
ADVAPI32.dll140CryptDestroyKey
ADVAPI32.dll160CryptReleaseContext
ADVAPI32.dll492RegOpenKeyExA
ADVAPI32.dll503RegQueryValueExA
ADVAPI32.dll534RevertToSelf
ADVAPI32.dll305ImpersonateNamedPipeClient
ADVAPI32.dll504RegQueryValueExW
WS2_32.dll16
WS2_32.dll151
WS2_32.dll18
WS2_32.dll116
WS2_32.dll115
WS2_32.dll40WSAIoctl
WS2_32.dll22
WS2_32.dll2
WS2_32.dll4
WS2_32.dll15
WS2_32.dll68WSAStringToAddressA
WS2_32.dll52WSARecv
WS2_32.dll10
WS2_32.dll5
WS2_32.dll56
WS2_32.dll51
WS2_32.dll9
WS2_32.dll8
WS2_32.dll12
WS2_32.dll52
WS2_32.dll111
WS2_32.dll11
WS2_32.dll23
WS2_32.dll21
WS2_32.dll3
WS2_32.dll20
WS2_32.dll57WSASend
WS2_32.dll112
WS2_32.dll6
WS2_32.dll55
CRYPT32.dll70CertGetNameStringW
CRYPT32.dll64CertGetCertificateChain
CRYPT32.dll107CertVerifyCertificateChainPolicy
CRYPT32.dll58CertFreeCertificateChain
CRYPT32.dll60CertFreeCertificateContext
USER32.dll43CharNextExA
ole32.dll20CoCreateInstance
ordentry_vafunction_name
10x19cb90DllBidAssert
20x19cba0DllBidCtlProc
30x19cb60DllBidEnabledW
40x19cc40DllBidEntryPoint
50x19d290DllBidFinalize
60x19cb70DllBidIndent
70x19da10DllBidInitialize
80x19cb40DllBidPutStrW
90x19cbf0DllBidScopeEnterCW
100x19cb50DllBidScopeLeave
110x19cb80DllBidSnap
120x19cbd0DllBidTouch
130x19cc20DllBidTraceCW
module_nameSystem.Data.dll
flags0
timestamp2012-06-30 03:09:04
version0.0
ordinal_base1
nFunctions13
nNames13
Names(13)0x2df2ac
Functions(13)0x2df278
NameOrdinals(13)0x2df2e0

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescription.NET Framework
FileVersion2.0.50727.6387 (Win8RTM.050727-6300)
InternalNamesystem.data.dll
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenamesystem.data.dll
ProductNameMicrosoft® .NET Framework
ProductVersion2.0.50727.6387
CommentsFlavor=Retail

VS_FIXEDFILEINFO

FileVersion2.0.50727.6387
ProductVersion2.0.50727.6387
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS4
FileType2
FileSubtype0
offsetsizetypecomment
15c115HTM#
3c560246BMP(16 x 16)#
3c65c246BMP(16 x 16)#
3c758824BMP(16 x 16)#
3ca94246BMP(16 x 16)#
3cb90246BMP(16 x 16)#
3cc8c502BMP(48 x 16)#
3ce88246BMP(16 x 16)#
3cf84358BMP(22 x 20)#
3d0f0246BMP(16 x 16)#
3d1ec246BMP(16 x 16)#
3d2e8246BMP(16 x 16)#
45290246BMP(16 x 16)#
4538c246BMP(16 x 16)#
45488246BMP(16 x 16)#
4df84246BMP(16 x 16)#
4e080246BMP(16 x 16)#
4e17c246BMP(16 x 16)#
4e2722825102BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable







everything is OK