filenameOSVolOSVol--Windows--SysWOW64--cryptnet.dll.fullextract
size106496 (0x1a000)
md509a47d3608661cb1ddff9fa2ea5b60aa
typePE32 executable (DLL) (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe8

Rich Header

lib idversiontimes used
149307295
10266
1473072921
146307291
1323072933
1313072914
148307291
145307291

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x51db9643
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x2102
Magic0x10b
LinkerVersion9.0
SizeOfCode0x17a00
SizeOfInitializedData0x1800
SizeOfUninitializedData0
AddressOfEntryPoint0x145e
BaseOfCode0x1000
BaseOfData0x18000
ImageBase0x40f30000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.1
ImageVersion6.1
SubsystemVersion6.1
Reserved10
SizeOfImage0x1c000
SizeOfHeaders0x400
CheckSum0x1ad71
Subsystem2
DllCharacteristics0x140
SizeOfStackReserve0x40000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v7.0 DLL

Sections

namevavsizeraw sizeflags
.text0x10000x179910x17a00R-X CODE
.data0x190000x5cc0x600RW- IDATA
.rsrc0x1a0000x4380x600R-- IDATA
.reloc0x1b0000xbe80xc00R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x175c0x301
IMPORT0x174000xb4
RESOURCE0x1a0000x438
EXCEPTION00
SECURITY00
BASERELOC0x1b0000xbe8
DEBUG0x189300x38
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0xf4180x40
Bound_IAT00
IAT0x10000x394
Delay_IAT0x16fa00xc0
CLR_Header00
typenamesizecp
VERSION#19800
module_namehintordfunction_name
msvcrt.dll1258memcpy
msvcrt.dll1262memset
msvcrt.dll1380wcsstr
msvcrt.dll345_except_handler4_common
msvcrt.dll257_amsg_exit
msvcrt.dll469_initterm
msvcrt.dll1190free
msvcrt.dll1246malloc
msvcrt.dll106_XcptFilter
msvcrt.dll1376wcsrchr
msvcrt.dll926_ultow
msvcrt.dll1387wcstoul
msvcrt.dll1234iswspace
msvcrt.dll974_vsnwprintf
msvcrt.dll1267printf
msvcrt.dll1133_wtol
msvcrt.dll588_ltoa
msvcrt.dll1382wcstok
msvcrt.dll1224iswalnum
msvcrt.dll1371wcsncmp
msvcrt.dll1316strrchr
msvcrt.dll968_vsnprintf
msvcrt.dll1361wcschr
msvcrt.dll1153atol
API-MS-Win-Core-LocalRegistry-L1-1-0.dll24RegOpenKeyExA
API-MS-Win-Core-LocalRegistry-L1-1-0.dllRegCloseKey
API-MS-Win-Core-LocalRegistry-L1-1-0.dll30RegQueryValueExW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll25RegOpenKeyExW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll29RegQueryValueExA
API-MS-Win-Core-ProcessThreads-L1-1-0.dll11GetCurrentProcessId
API-MS-Win-Core-ProcessThreads-L1-1-0.dll13GetCurrentThreadId
API-MS-Win-Core-ProcessThreads-L1-1-0.dll5CreateThread
API-MS-Win-Core-ProcessThreads-L1-1-0.dll12GetCurrentThread
API-MS-Win-Core-ProcessThreads-L1-1-0.dll28OpenThreadToken
API-MS-Win-Core-ProcessThreads-L1-1-0.dll39SetThreadToken
API-MS-Win-Core-ProcessThreads-L1-1-0.dll32ResumeThread
API-MS-Win-Core-ProcessThreads-L1-1-0.dll8ExitThread
API-MS-Win-Core-ProcessThreads-L1-1-0.dll10GetCurrentProcess
API-MS-Win-Core-ProcessThreads-L1-1-0.dll42TerminateProcess
API-MS-Win-Security-Base-L1-1-0.dll41GetAce
API-MS-Win-Security-Base-L1-1-0.dll20AllocateAndInitializeSid
API-MS-Win-Security-Base-L1-1-0.dll38EqualSid
API-MS-Win-Security-Base-L1-1-0.dll40FreeSid
API-MS-Win-Security-Base-L1-1-0.dll58GetTokenInformation
API-MS-Win-Security-Base-L1-1-0.dll45GetLengthSid
API-MS-Win-Security-Base-L1-1-0.dll85SetFileSecurityW
API-MS-Win-Security-Base-L1-1-0.dll53GetSecurityDescriptorSacl
API-MS-Win-Security-Base-L1-1-0.dll83RevertToSelf
API-MS-Win-Security-Base-L1-1-0.dll62ImpersonateSelf
API-MS-Win-Security-Base-L1-1-0.dll43GetFileSecurityW
API-MS-Win-Security-Base-L1-1-0.dll26CopySid
ADVAPI32.dll753SystemFunction036
CRYPT32.dll210CryptSignAndEncodeCertificate
CRYPT32.dll44CertEnumCertificatesInStore
CRYPT32.dll217CryptStringToBinaryW
CRYPT32.dll40CertEnumCRLsInStore
CRYPT32.dll31CertDeleteCRLFromStore
CRYPT32.dll191CryptQueryObject
CRYPT32.dll66CertGetCRLContextProperty
CRYPT32.dll68CertGetCTLContextProperty
CRYPT32.dll182CryptMsgGetParam
CRYPT32.dll176CryptMsgControl
CRYPT32.dll42CertEnumCTLsInStore
CRYPT32.dll67CertGetCRLFromStore
CRYPT32.dll53CertFindCertificateInStore
CRYPT32.dll32CertDeleteCTLFromStore
CRYPT32.dll157CryptGetOIDFunctionValue
CRYPT32.dll24CertCreateCRLContext
CRYPT32.dll125CryptBinaryToStringW
CRYPT32.dll8CertAddEncodedCertificateToStore
CRYPT32.dll173CryptMemRealloc
CRYPT32.dll33CertDeleteCertificateFromStore
CRYPT32.dll18CertCloseStore
CRYPT32.dll87CertOpenStore
CRYPT32.dll181CryptMsgGetAndVerifySigner
CRYPT32.dll60CertFreeCTLContext
CRYPT32.dll2CertAddCTLContextToStore
CRYPT32.dll64CertFreeCertificateContext
CRYPT32.dll37CertDuplicateCertificateContext
CRYPT32.dll57CertFindSubjectInCTL
CRYPT32.dll35CertDuplicateCTLContext
CRYPT32.dll51CertFindCTLInStore
CRYPT32.dll130CryptDecodeObject
CRYPT32.dll55CertFindExtension
CRYPT32.dll73CertGetIssuerCertificateFromStore
CRYPT32.dll20CertCompareCertificateName
CRYPT32.dll234I_CertDiagControl
CRYPT32.dll59CertFreeCRLContext
CRYPT32.dll70CertGetCertificateContextProperty
CRYPT32.dll50CertFindCRLInStore
CRYPT32.dll34CertDuplicateCRLContext
CRYPT32.dll82CertIsValidCRLForCertificate
CRYPT32.dll131CryptDecodeObjectEx
CRYPT32.dll52CertFindCertificateInCRL
CRYPT32.dll238I_CertUpdateStore
CRYPT32.dll171CryptMemAlloc
CRYPT32.dll172CryptMemFree
CRYPT32.dll262I_CryptGetTls
CRYPT32.dll149CryptFreeOIDFunctionAddress
CRYPT32.dll156CryptGetOIDFunctionAddress
CRYPT32.dll252I_CryptFreeLruCache
CRYPT32.dll263I_CryptInsertLruEntry
CRYPT32.dll269I_CryptRemoveLruEntry
CRYPT32.dll271I_CryptTouchLruEntry
CRYPT32.dll268I_CryptReleaseLruEntry
CRYPT32.dll247I_CryptEnumMatchingLruEntries
CRYPT32.dll259I_CryptGetLruEntryData
CRYPT32.dll248I_CryptFindLruEntry
CRYPT32.dll251I_CryptFlushLruCache
CRYPT32.dll106CertSetCertificateContextProperty
CRYPT32.dll243I_CryptCreateLruEntry
CRYPT32.dll242I_CryptCreateLruCache
CRYPT32.dll270I_CryptSetTls
CRYPT32.dll253I_CryptFreeTls
CRYPT32.dll241I_CryptAllocTls
CRYPT32.dll169CryptInstallOIDFunctionAddress
CRYPT32.dll167CryptInitOIDFunctionSet
CRYPT32.dll244I_CryptDetachTls
CRYPT32.dll193CryptRegisterOIDFunction
CRYPT32.dll192CryptRegisterDefaultOIDFunction
CRYPT32.dll222CryptUnregisterOIDFunction
CRYPT32.dll221CryptUnregisterDefaultOIDFunction
CRYPT32.dll84CertNameToStrW
CRYPT32.dll135CryptEncodeObjectEx
CRYPT32.dll158CryptHashCertificate
CRYPT32.dll71CertGetEnhancedKeyUsage
CRYPT32.dll119CertVerifyTimeValidity
CRYPT32.dll226CryptVerifyCertificateSignatureEx
CRYPT32.dll61CertFreeCertificateChain
CRYPT32.dll116CertVerifyCertificateChainPolicy
CRYPT32.dll69CertGetCertificateChain
CRYPT32.dll38CertDuplicateStore
CRYPT32.dll15CertAddStoreToCollection
WLDAP32.dll210
WLDAP32.dll208
WLDAP32.dll41
WLDAP32.dll145
WLDAP32.dll211
WLDAP32.dll88
WLDAP32.dll73
WLDAP32.dll136
WLDAP32.dll146
WLDAP32.dll18
WLDAP32.dll26
WLDAP32.dll126
WLDAP32.dll141
WLDAP32.dll79
WLDAP32.dll166
WLDAP32.dll27
WLDAP32.dll46
WLDAP32.dll12
WLDAP32.dll147
WLDAP32.dll157
KERNEL32.dll932QueryPerformanceCounter
KERNEL32.dll658GetTickCount
KERNEL32.dll1236UnhandledExceptionFilter
KERNEL32.dll1187SetUnhandledExceptionFilter
KERNEL32.dll214DeleteFileW
KERNEL32.dll494GetFileSize
KERNEL32.dll1106SetEndOfFile
KERNEL32.dll302FindClose
KERNEL32.dll325FindNextFileW
KERNEL32.dll313FindFirstFileW
KERNEL32.dll715HeapAlloc
KERNEL32.dll584GetProcessHeap
KERNEL32.dll722HeapReAlloc
KERNEL32.dll719HeapFree
KERNEL32.dll488GetFileAttributesW
KERNEL32.dll285ExpandEnvironmentStringsW
KERNEL32.dll1119SetFileAttributesW
KERNEL32.dll130CreateDirectoryW
KERNEL32.dll748InterlockedExchange
KERNEL32.dll739InitializeCriticalSection
KERNEL32.dll98CompareStringA
KERNEL32.dll101CompareStringW
KERNEL32.dll729IdnToAscii
KERNEL32.dll731IdnToUnicode
KERNEL32.dll1318WriteFile
KERNEL32.dll843LocalReAlloc
KERNEL32.dll836LocalAlloc
KERNEL32.dll293FileTimeToSystemTime
KERNEL32.dll698GlobalFree
KERNEL32.dll350FormatMessageW
KERNEL32.dll840LocalFree
KERNEL32.dll957ReadFile
KERNEL32.dll485GetFileAttributesExW
KERNEL32.dll144CreateFileW
KERNEL32.dll1201Sleep
KERNEL32.dll138CreateFileMappingA
KERNEL32.dll854MapViewOfFile
KERNEL32.dll1239UnmapViewOfFile
KERNEL32.dll1298WideCharToMultiByte
KERNEL32.dll747InterlockedDecrement
KERNEL32.dll751InterlockedIncrement
KERNEL32.dll1124SetFilePointer
KERNEL32.dll475GetEnvironmentVariableA
KERNEL32.dll206DelayLoadFailureHook
KERNEL32.dll579GetProcAddress
KERNEL32.dll512GetLastError
KERNEL32.dll354FreeLibrary
KERNEL32.dll745InterlockedCompareExchange
KERNEL32.dll829LoadLibraryExA
KERNEL32.dll97CompareFileTime
KERNEL32.dll825LeaveCriticalSection
KERNEL32.dll238EnterCriticalSection
KERNEL32.dll1137SetLastError
KERNEL32.dll1212SystemTimeToFileTime
KERNEL32.dll630GetSystemTime
KERNEL32.dll632GetSystemTimeAsFileTime
KERNEL32.dll209DeleteCriticalSection
KERNEL32.dll828LoadLibraryA
KERNEL32.dll830LoadLibraryExW
KERNEL32.dll530GetModuleFileNameW
KERNEL32.dll902OutputDebugStringA
KERNEL32.dll355FreeLibraryAndExitThread
KERNEL32.dll1112SetEvent
KERNEL32.dll1275WaitForSingleObjectEx
KERNEL32.dll83CloseHandle
KERNEL32.dll131CreateEventA
KERNEL32.dll870MultiByteToWideChar
KERNEL32.dll529GetModuleFileNameA
ordentry_vafunction_name
10xf7a9CertDllVerifyCTLUsage
20x2b7eCertDllVerifyRevocation
30xfc8fI_CryptConvertIriToAsciiOrUnicode
40x10ad4LdapProvOpenStore
50x10c08CryptCancelAsyncRetrieval
60x10e2bCryptFlushTimeValidObject
70x49beCryptGetObjectUrl
80x284dCryptGetTimeValidObject
90x11421CryptInstallCancelRetrieval
100x10d8eCryptRetrieveObjectByUrlA
110x3258CryptRetrieveObjectByUrlW
120x113f4CryptUninstallCancelRetrieval
130xf469DllRegisterServer
140xf48fDllUnregisterServer
150xa096I_CryptNetEnumUrlCacheEntry
160x6cbbI_CryptNetGetConnectivity
170xfc2fI_CryptNetGetHostNameFromUrl
180x10623I_CryptNetGetUserDsStoreUrl
190x11c65I_CryptNetSetUrlCacheFlushInfo
200x8d89I_CryptNetSetUrlCachePreFetchInfo
module_nameCRYPTNET.dll
flags0
timestamp2013-07-09 03:07:18
version0.0
ordinal_base1
nFunctions20
nNames20
Names(20)0x17d4
Functions(20)0x1784
NameOrdinals(20)0x1824

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionCrypto Network Related API
FileVersion6.1.7601.18205 (win7sp1_gdr.130708-1532)
InternalNameCRYPTNET.DLL
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenameCRYPTNET.DLL
ProductNameMicrosoft® Windows® Operating System
ProductVersion6.1.7601.18205
OleSelfRegister

VS_FIXEDFILEINFO

FileVersion6.1.7601.18205
ProductVersion6.1.7601.18205
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType2
FileSubtype0
offsetsizetypecomment
0103936DLL07/09/2013 04:49:07#
15c115HTM#
196002560BINoverlay data past EOF#
Scanning the drive for archives:
1 file, 106496 bytes (104 KiB)



Errors: 1
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK