filenamepcacli.dll
size20480 (0x5000)
md50320929a497a57a243ed157ba082896d
typePE32 executable (DLL) (console) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe0

Rich Header

lib idversiontimes used
205655012
2066550112
10110
2036550125
202655011
210655018
201655011
204655011

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0x52158d93
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x2102
Magic0x10b
LinkerVersion11.0
SizeOfCode0x3400
SizeOfInitializedData0x1a00
SizeOfUninitializedData0
AddressOfEntryPoint0x3939
BaseOfCode0x1000
BaseOfData0x5000
ImageBase0x10000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.3
ImageVersion6.3
SubsystemVersion6.3
Reserved10
SizeOfImage0x9000
SizeOfHeaders0x400
CheckSum0x9e88
Subsystem3
DllCharacteristics0x140
SizeOfStackReserve0x40000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v7.0 DLL

Sections

namevavsizeraw sizeflags
.text0x10000x33d80x3400R-X CODE
.data0x50000x3e00x200RW- IDATA
.idata0x60000x8940xa00R-- IDATA
.rsrc0x70000x3f80x400R-- IDATA
.reloc0x80000x7940x800R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x42d00x108
IMPORT0x61380xdc
RESOURCE0x70000x3f8
EXCEPTION00
SECURITY00
BASERELOC0x80000x370
DEBUG0x10200x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x1bb00x5c
Bound_IAT00
IAT0x60000x138
Delay_IAT00
CLR_Header00
typenamesizecp
VERSION#19200
module_namehintordfunction_name
msvcrt.dll1413wcsstr
msvcrt.dll1043_wcslwr
msvcrt.dll1049_wcsnicmp
msvcrt.dll1393wcscat_s
msvcrt.dll1293memmove
msvcrt.dll1039_wcsicmp
msvcrt.dll1000_vsnprintf
msvcrt.dll1336strcpy_s
msvcrt.dll1409wcsrchr
msvcrt.dll1291memcpy
msvcrt.dll364_except_handler4_common
msvcrt.dll490_initterm
msvcrt.dll1279malloc
msvcrt.dll1223free
msvcrt.dll275_amsg_exit
msvcrt.dll113_XcptFilter
msvcrt.dll1398wcscpy_s
msvcrt.dll1394wcschr
msvcrt.dll1295memset
ntdll.dll58EtwEventUnregister
ntdll.dll56EtwEventRegister
ntdll.dll671RtlAllocateHeap
ntdll.dll59EtwEventWrite
ntdll.dll917RtlFreeHeap
ntdll.dll63EtwEventWriteNoRegistration
api-ms-win-service-management-l1-1-0.dll6StartServiceW
api-ms-win-service-management-l1-1-0.dll5OpenServiceW
api-ms-win-service-management-l1-1-0.dllCloseServiceHandle
api-ms-win-service-management-l1-1-0.dll4OpenSCManagerW
api-ms-win-service-management-l2-1-0.dll2NotifyServiceStatusChangeW
api-ms-win-core-registry-l1-1-0.dll18RegGetValueW
api-ms-win-security-base-l1-2-0.dll35CreateWellKnownSid
KERNEL32.dll565GetFileAttributesW
KERNEL32.dll946LocalFree
KERNEL32.dll942LocalAlloc
KERNEL32.dll525GetCurrentThread
KERNEL32.dll752GetThreadTimes
KERNEL32.dll754GetTickCount
KERNEL32.dll726GetSystemTimeAsFileTime
KERNEL32.dll526GetCurrentThreadId
KERNEL32.dll522GetCurrentProcessId
KERNEL32.dll1069QueryPerformanceCounter
KERNEL32.dll1449WaitForSingleObject
KERNEL32.dll1363SleepEx
KERNEL32.dll592GetLastError
KERNEL32.dll676GetProcessId
KERNEL32.dll994OpenEventW
KERNEL32.dll127CloseHandle
KERNEL32.dll936LoadLibraryW
KERNEL32.dll669GetProcAddress
KERNEL32.dll1360Sleep
KERNEL32.dll1408UnhandledExceptionFilter
KERNEL32.dll1345SetUnhandledExceptionFilter
KERNEL32.dll521GetCurrentProcess
KERNEL32.dll1375TerminateProcess
RPCRT4.dll48I_RpcExceptionFilter
RPCRT4.dll513RpcStringFreeW
RPCRT4.dll356RpcBindingFree
RPCRT4.dll156NdrClientCall2
RPCRT4.dll358RpcBindingFromStringBindingW
RPCRT4.dll509RpcStringBindingComposeW
RPCRT4.dll373RpcBindingSetAuthInfoExW
MPR.dll43WNetGetConnectionW
apphelp.dll2
apphelp.dll17
apphelp.dll5
apphelp.dll10ApphelpDebugPrintf
apphelp.dll1
ordentry_vafunction_name
10x28fdPcaGetFileInfoFromPath
20x1d93PcaIsPcaDisabled
30x27fbPcaLinkChildProcessToParent
40x23b1PcaMonitorProcess
50x26c8PcaNotifyMsiInstall
60x27e0PcaNotifyStatusIcon
70x25ecPcaSendToService
module_namepcacli.dll
flags0
timestamp2013-08-22 00:36:25
version0.0
ordinal_base1
nFunctions7
nNames7
Names(7)0x4314
Functions(7)0x42f8
NameOrdinals(7)0x4330

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionProgram Compatibility Assistant Client Module
FileVersion6.3.9600.16384 (winblue_rtm.130821-1623)
InternalName
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilename
ProductNameMicrosoft® Windows® Operating System
ProductVersion6.3.9600.16384

VS_FIXEDFILEINFO

FileVersion6.3.9600.16384
ProductVersion6.3.9600.16384
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType2
FileSubtype0
offsetsizetypecomment
020480DLL08/22/2013 04:03:31#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK