filenameeeenhcsp64.dll
size1011200 (0xf6e00)
md502de02a1dd7aa476facebd4ae363555d
typePE32+ executable (DLL) (GUI) x86-64, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x100

Rich Header

lib idversiontimes used
156303192
152201151
158303192
1703031911
1473072915
10290
17130319138
155303191
154303191
157303191

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x8664
NumberOfSections6
TimeDateStamp0x4fa94764
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xf0
Characteristics0x2022
Magic0x20b
LinkerVersion10.0
SizeOfCode0x9fe00
SizeOfInitializedData0x56c00
SizeOfUninitializedData0
AddressOfEntryPoint0x95a24
BaseOfCode0x1000
ImageBase0x62000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.2
ImageVersion0.0
SubsystemVersion5.2
Reserved10
SizeOfImage0x10a000
SizeOfHeaders0x400
CheckSum0xfef3d
Subsystem2
DllCharacteristics0x140
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x9fd370x9fe00R-X CODE
.rdata0xa10000x473580x47400R-- IDATA
.data0xe90000x151a80x6400RW- IDATA
.pdata0xff0000x61d40x6200R-- IDATA
.rsrc0x1060000x7ac0x800R-- IDATA
.reloc0x1070000x29de0x2a00R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0xe80b00x2a8
IMPORT0xe6d7c0x78
RESOURCE0x1060000x7ac
EXCEPTION0xff0000x61d4
SECURITY00
BASERELOC0x1070000x1d8c
DEBUG0xa19300x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0xa10000x658
Delay_IAT00
CLR_Header00
typenamesizecp
RCDATA#60081252
RCDATA#6661441252
VERSION#111841252
MANIFEST#23461252
module_namehintordfunction_name
WS2_32.dll52
WS2_32.dll57
WS2_32.dll11
WS2_32.dll115
WS2_32.dll12
WS2_32.dll116
WS2_32.dll112
WS2_32.dll56
WS2_32.dll15
WS2_32.dll51
WS2_32.dll9
WS2_32.dll55
WS2_32.dll8
WS2_32.dll111
KERNEL32.dll308FindClose
KERNEL32.dll329FindNextFileA
KERNEL32.dll312FindFirstFileA
KERNEL32.dll520GetLastError
KERNEL32.dll1152SetLastError
KERNEL32.dll746InitializeCriticalSection
KERNEL32.dll210DeleteCriticalSection
KERNEL32.dll82CloseHandle
KERNEL32.dll1253UnmapViewOfFile
KERNEL32.dll857MapViewOfFile
KERNEL32.dll137CreateFileMappingA
KERNEL32.dll503GetFileSize
KERNEL32.dll136CreateFileA
KERNEL32.dll537GetModuleFileNameA
KERNEL32.dll1376lstrlenA
KERNEL32.dll459GetCurrentThreadId
KERNEL32.dll130CreateEventA
KERNEL32.dll1288WaitForSingleObject
KERNEL32.dll1127SetEvent
KERNEL32.dll455GetCurrentProcessId
KERNEL32.dll1046ResumeThread
KERNEL32.dll1216Sleep
KERNEL32.dll683GetVersionExA
KERNEL32.dll101ConnectNamedPipe
KERNEL32.dll229DisconnectNamedPipe
KERNEL32.dll349FlushFileBuffers
KERNEL32.dll1149SetHandleInformation
KERNEL32.dll517GetHandleInformation
KERNEL32.dll1332WriteFile
KERNEL32.dll963ReadFile
KERNEL32.dll159CreateNamedPipeA
KERNEL32.dll1294WaitNamedPipeA
KERNEL32.dll1286WaitForMultipleObjects
KERNEL32.dll1042ResetEvent
KERNEL32.dll886OpenEventA
KERNEL32.dll890OpenFileMappingA
KERNEL32.dll685GetVolumeInformationA
KERNEL32.dll467GetDiskFreeSpaceA
KERNEL32.dll694GetWindowsDirectoryA
KERNEL32.dll711GlobalMemoryStatus
KERNEL32.dll937QueryPerformanceCounter
KERNEL32.dll666GetTickCount
KERNEL32.dll630GetSystemDirectoryA
KERNEL32.dll342FindVolumeClose
KERNEL32.dll333FindNextVolumeA
KERNEL32.dll322FindFirstVolumeA
KERNEL32.dll721Heap32ListNext
KERNEL32.dll720Heap32ListFirst
KERNEL32.dll1234Thread32Next
KERNEL32.dll1233Thread32First
KERNEL32.dll862Module32Next
KERNEL32.dll860Module32First
KERNEL32.dll921Process32Next
KERNEL32.dll919Process32First
KERNEL32.dll189CreateToolhelp32Snapshot
KERNEL32.dll634GetSystemInfo
KERNEL32.dll468GetDiskFreeSpaceExA
KERNEL32.dll642GetSystemWindowsDirectoryA
KERNEL32.dll712GlobalMemoryStatusEx
KERNEL32.dll1235TlsAlloc
KERNEL32.dll1238TlsSetValue
KERNEL32.dll1237TlsGetValue
KERNEL32.dll1236TlsFree
KERNEL32.dll242EnterCriticalSection
KERNEL32.dll827LeaveCriticalSection
KERNEL32.dll355FormatMessageA
KERNEL32.dll873MultiByteToWideChar
KERNEL32.dll1312WideCharToMultiByte
KERNEL32.dll842LocalFree
KERNEL32.dll838LocalAlloc
KERNEL32.dll640GetSystemTimeAsFileTime
KERNEL32.dll830LoadLibraryA
KERNEL32.dll588GetProcAddress
KERNEL32.dll360FreeLibrary
KERNEL32.dll238EncodePointer
KERNEL32.dll203DecodePointer
KERNEL32.dll1230TerminateProcess
KERNEL32.dll454GetCurrentProcess
KERNEL32.dll1250UnhandledExceptionFilter
KERNEL32.dll1203SetUnhandledExceptionFilter
KERNEL32.dll770IsDebuggerPresent
KERNEL32.dll1062RtlVirtualUnwind
KERNEL32.dll1055RtlLookupFunctionEntry
KERNEL32.dll1048RtlCaptureContext
KERNEL32.dll575GetOverlappedResult
USER32.dll290GetCursorPos
USER32.dll289GetCursorInfo
USER32.dll309GetIconInfo
USER32.dll755SystemParametersInfoA
USER32.dll6AllowSetForegroundWindow
USER32.dll388GetThreadDesktop
ADVAPI32.dll203CryptReleaseContext
ADVAPI32.dll573RegDeleteKeyA
ADVAPI32.dll615RegQueryInfoKeyA
ADVAPI32.dll621RegQueryValueExA
ADVAPI32.dll583RegDeleteValueA
ADVAPI32.dll568RegCreateKeyExA
ADVAPI32.dll637RegSetValueExA
ADVAPI32.dll608RegOpenKeyExA
ADVAPI32.dll656RevertToSelf
ADVAPI32.dll372ImpersonateNamedPipeClient
ADVAPI32.dll180CryptDecrypt
ADVAPI32.dll196CryptGetHashParam
ADVAPI32.dll186CryptEncrypt
ADVAPI32.dll560RegCloseKey
ADVAPI32.dll208CryptSetProviderExA
ADVAPI32.dll606RegOpenCurrentUser
ADVAPI32.dll193CryptGenRandom
ADVAPI32.dll176CryptAcquireContextA
ADVAPI32.dll182CryptDestroyHash
ADVAPI32.dll181CryptDeriveKey
ADVAPI32.dll200CryptHashData
ADVAPI32.dll179CryptCreateHash
ADVAPI32.dll183CryptDestroyKey
ADVAPI32.dll194CryptGetDefaultProviderA
MSVCR100.dll1115_unlock
MSVCR100.dll328__dllonexit
MSVCR100.dll758_lock
MSVCR100.dll925_onexit
MSVCR100.dll775_malloc_crt
MSVCR100.dll646_initterm
MSVCR100.dll647_initterm_e
MSVCR100.dll498_encoded_null
MSVCR100.dll414_amsg_exit
MSVCR100.dll287__CppXcptFilter
MSVCR100.dll256void __cdecl terminate(void)

?terminate@@YAXXZ

MSVCR100.dll238public: void __cdecl type_info::_type_info_dtor_internal_method(void) __ptr64

?_type_info_dtor_internal_method@type_info@@QEAAXXZ

MSVCR100.dll326__crt_debugger_hook
MSVCR100.dll320__clean_type_info_names_internal
MSVCR100.dll296__CxxFrameHandler3
MSVCR100.dll1449memcpy
MSVCR100.dll101void __cdecl operator delete(void * __ptr64)

??3@YAXPEAX@Z

MSVCR100.dll99void * __ptr64 __cdecl operator new(unsigned __int64)

??2@YAPEAX_K@Z

MSVCR100.dll937_purecall
MSVCR100.dll1453memset
MSVCR100.dll1499strcpy_s
MSVCR100.dll1561wcslen
MSVCR100.dll1504strlen
MSVCR100.dll1495strchr
MSVCR100.dll1512strrchr
MSVCR100.dll1514strstr
MSVCR100.dll743_itoa_s
MSVCR100.dll1496strcmp
MSVCR100.dll1451memmove
MSVCR100.dll1411isspace
MSVCR100.dll1509strncpy_s
MSVCR100.dll1494strcat_s
MSVCR100.dll1506strncat_s
MSVCR100.dll1448memcmp
MSVCR100.dll286__C_specific_handler
MSVCR100.dll1049_strnicmp
MSVCR100.dll819_mbsicmp
MSVCR100.dll823_mbsinc
MSVCR100.dll1487sprintf_s
MSVCR100.dll1342ceil
MSVCR100.dll429_beginthreadex
MSVCR100.dll1346clock
MSVCR100.dll1438malloc
MSVCR100.dll1379free
MSVCR100.dll1341calloc
MSVCR100.dll1471realloc
MSVCR100.dll1371fprintf
MSVCR100.dll340__iob_func
MSVCR100.dll1469rand
MSVCR100.dll1488sqrt
MSVCR100.dll1087_time64
MSVCR100.dll1030_stat64i32
MSVCR100.dll1498strcpy
MSVCR100.dll1493strcat
MSVCR100.dll1019_splitpath
MSVCR100.dll764_lrotr
MSVCR100.dll1507strncmp
MSVCR100.dll450_close
MSVCR100.dll451_commit
MSVCR100.dll1277_write
MSVCR100.dll229int __cdecl _open(char const * __ptr64, int, int)

?_open@@YAHPEBDHH@Z

MSVCR100.dll1085_tempnam
MSVCR100.dll1113_unlink
MSVCR100.dll1433log
MSVCR100.dll1519strtoul
MSVCR100.dll947_read
MSVCR100.dll270_CxxThrowException
MSVCR100.dll825_mbslen
MSVCR100.dll677_ismbblead
ordentry_vafunction_name
10x13d74CPAcquireContext
20x13ef4CPCreateHash
30x1402cCPDecrypt
40x14130CPDeriveKey
50x14268CPDestroyHash
60x14328CPDestroyKey
70x143e8CPEncrypt
80x144f8CPExportKey
90x14644CPGenKey
100x14774CPGenRandom
110x156c0CPGenerateSecretKey
120x14844CPGetHashParam
130x14984CPGetKeyParam
140x14ac4CPGetProvParam
150x14c2cCPGetUserKey
160x14d48CPHashData
170x14e38CPHashSessionKey
180x14f20CPImportKey
190x1501cCPReleaseContext
200x150c8CPSetHashParam
210x15200CPSetKeyParam
220x15338CPSetProvParam
230x15468CPSignHash
240x155b8CPVerifySignature
250x15f0cDllRegisterServer
260x15f24DllUnregisterServer
module_nameeeenhcsp.dll
flags0
timestamp2012-05-08 16:18:44
version0.0
ordinal_base1
nFunctions26
nNames26
Names(26)0xe8140
Functions(26)0xe80d8
NameOrdinals(26)0xe81a8

StringTable 100904B0

CompanyNameEntrust(R)
FileDescriptionEntrust Entelligence Enhanced Cryptographic Provider
FileVersion9.2.10.3192
InternalNameEEENHCSP
LegalCopyrightCopyright 1994-2012 Entrust. All rights reserved.
LegalTrademarksEntrust is a trademark or registered trademark of Entrust, Inc.
OriginalFilenameEEENHCSP.DLL
ProductNameEntrust Entelligence Security Provider
ProductVersion9.2
Build Number3192
Company URLhttp://www.entrust.com/

VS_FIXEDFILEINFO

FileVersion9.2.10.3192
ProductVersion9.2.10.3192
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS4
FileType1
FileSubtype0
offsetsizetypecomment
15c115HTM#
15d01005616BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK