filenamemsxml3.dll
size1875456 (0x1c9e00)
md50b32a76e0d5034a3020bbf32a5ec0e63
typePE32+ executable (DLL) (GUI) x86-64, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf0

Rich Header

lib idversiontimes used
125507272
10270
1235072711
1105072716
1095072778
122507271
11850727250
126507271
124507271
120507271

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x8664
NumberOfSections6
TimeDateStamp0x4c125f9d
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xf0
Characteristics0x2022
Magic0x20b
LinkerVersion8.0
SizeOfCode0x108e00
SizeOfInitializedData0xc9400
SizeOfUninitializedData0
AddressOfEntryPoint0x35cf0
BaseOfCode0x1000
ImageBase0x7ff7c400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.0
ImageVersion6.0
SubsystemVersion5.2
Reserved10
SizeOfImage0x1d6000
SizeOfHeaders0x400
CheckSum0x1d2f00
Subsystem2
DllCharacteristics0x40
SizeOfStackReserve0x40000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x108deb0x108e00R-X CODE
.rdata0x10a0000x3a2340x3a400R-- IDATA
.data0x1450000x1c8880x14200RW- IDATA
.pdata0x1620000x192d80x19400R-- IDATA
.rsrc0x17c0000x52ca00x52e00R-- IDATA
.reloc0x1cf0000x62180x6400R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x10a4a00xb5
IMPORT0x12f1280x78
RESOURCE0x17c0000x52ca0
EXCEPTION0x1620000x192d8
SECURITY00
BASERELOC0x1cf0000x6218
DEBUG0x109d8c0x38
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x10a0000x4a0
Delay_IAT0x12ea700xc0
CLR_Header00
typenamesizecp
PRELOADXHTML1FRAMESET.DTD206620
PRELOADXHTML1STRICT.DTD151510
PRELOADXHTML1TRANSITIONAL.DTD200250
PRELOADXHTMLLAT1.ENT26730
PRELOADXHTMLSPECIAL.ENT9570
PRELOADXHTMLSYMBOL.ENT37170
REGISTRYREGISTRY616100
TYPELIB#11010800
XMLDEFAULTSS.XSL68190
ICON#116400
ICON#27440
ICON#32960
ICON#437520
ICON#522160
ICON#613840
ICON#7171580
ICON#896400
ICON#942640
ICON#1011280
ICON#1116400
ICON#127440
ICON#132960
ICON#1437520
ICON#1522160
ICON#1613840
ICON#17358750
ICON#1896400
ICON#1942640
ICON#2011280
GROUP_ICON#1281460
GROUP_ICON#1291460
VERSION#18720
module_namehintordfunction_name
msvcrt.dll1040bsearch
msvcrt.dll1151memcmp
msvcrt.dll1069floor
msvcrt.dll1044ceil
msvcrt.dll639_onexit
msvcrt.dll469_lock
msvcrt.dll109__dllonexit
msvcrt.dll816_unlock
msvcrt.dll1156memset
msvcrt.dll1152memcpy
msvcrt.dll83__C_specific_handler
msvcrt.dll160_amsg_exit
msvcrt.dll1082free
msvcrt.dll364_initterm
msvcrt.dll1140malloc
msvcrt.dll82_XcptFilter
msvcrt.dll1263wcschr
msvcrt.dll1273wcsncmp
msvcrt.dll653_purecall
msvcrt.dll1278wcsrchr
msvcrt.dll663_resetstkoflw
msvcrt.dll1154memmove
msvcrt.dll1071fmod
ole32.dll111CoUninitialize
ole32.dll65CoInitialize
ole32.dll10CLSIDFromProgID
ole32.dll18CoCreateFreeThreadedMarshaler
ole32.dll374StringFromCLSID
ole32.dll106CoTaskMemAlloc
ole32.dll137CreateStreamOnHGlobal
ole32.dll124CreateBindCtx
ole32.dll107CoTaskMemFree
ole32.dll20CoCreateInstance
SHLWAPI.dll71PathFindExtensionW
SHLWAPI.dll73PathFindFileNameW
SHLWAPI.dll67PathCreateFromUrlW
SHLWAPI.dll349UrlGetLocationW
SHLWAPI.dll344UrlCreateFromPathW
SHLWAPI.dll143PathSearchAndQualifyW
SHLWAPI.dll361UrlUnescapeW
SHLWAPI.dll115PathIsURLW
SHLWAPI.dll338UrlCanonicalizeW
SHLWAPI.dll359UrlIsW
SHLWAPI.dll332StrToIntW
SHLWAPI.dll287StrCmpNIW
SHLWAPI.dll289StrCmpW
KERNEL32.dll851QueryPerformanceCounter
KERNEL32.dll1060SetUnhandledExceptionFilter
KERNEL32.dll1101UnhandledExceptionFilter
KERNEL32.dll1084TerminateProcess
KERNEL32.dll913RtlCaptureContext
KERNEL32.dll920RtlLookupFunctionEntry
KERNEL32.dll927RtlVirtualUnwind
KERNEL32.dll1161WideCharToMultiByte
KERNEL32.dll164CreateThread
KERNEL32.dll1050SetThreadPriority
KERNEL32.dll607GetTempPathW
KERNEL32.dll650GlobalAlloc
KERNEL32.dll626GetUserDefaultLCID
KERNEL32.dll622GetTimeFormatW
KERNEL32.dll434GetDateFormatW
KERNEL32.dll611GetThreadLocale
KERNEL32.dll86CompareStringW
KERNEL32.dll618GetTickCount
KERNEL32.dll1180WriteFile
KERNEL32.dll872ReadFile
KERNEL32.dll1004SetFilePointer
KERNEL32.dll428GetCurrentProcessId
KERNEL32.dll129CreateFileW
KERNEL32.dll323FlushFileBuffers
KERNEL32.dll986SetEndOfFile
KERNEL32.dll752LoadLibraryA
KERNEL32.dll274FileTimeToSystemTime
KERNEL32.dll1081SystemTimeToFileTime
KERNEL32.dll1071SizeofResource
KERNEL32.dll774LockResource
KERNEL32.dll757LoadResource
KERNEL32.dll315FindResourceW
KERNEL32.dll755LoadLibraryW
KERNEL32.dll330FormatMessageW
KERNEL32.dll334FreeLibrary
KERNEL32.dll754LoadLibraryExW
KERNEL32.dll793MultiByteToWideChar
KERNEL32.dll858RaiseException
KERNEL32.dll676HeapCreate
KERNEL32.dll546GetProcAddress
KERNEL32.dll506GetModuleHandleW
KERNEL32.dll1016SetLastError
KERNEL32.dll677HeapDestroy
KERNEL32.dll589GetSystemInfo
KERNEL32.dll1126VirtualFree
KERNEL32.dll1123VirtualAlloc
KERNEL32.dll891ReleaseSemaphore
KERNEL32.dll158CreateSemaphoreW
KERNEL32.dll697InitializeCriticalSection
KERNEL32.dll119CreateEventW
KERNEL32.dll992SetEvent
KERNEL32.dll349GetCPInfo
KERNEL32.dll760LocalAlloc
KERNEL32.dll764LocalFree
KERNEL32.dll908ResetEvent
KERNEL32.dll595GetSystemTimeAsFileTime
KERNEL32.dll473GetFileType
KERNEL32.dll1139WaitForSingleObject
KERNEL32.dll1131VirtualQuery
KERNEL32.dll608GetThreadContext
KERNEL32.dll911ResumeThread
KERNEL32.dll1078SuspendThread
KERNEL32.dll1096TryEnterCriticalSection
KERNEL32.dll68CloseHandle
KERNEL32.dll431GetCurrentThreadId
KERNEL32.dll430GetCurrentThread
KERNEL32.dll427GetCurrentProcess
KERNEL32.dll214DuplicateHandle
KERNEL32.dll1092TlsSetValue
KERNEL32.dll1090TlsFree
KERNEL32.dll635GetVersionExW
KERNEL32.dll1091TlsGetValue
KERNEL32.dll266ExpandEnvironmentStringsW
KERNEL32.dll487GetLastError
KERNEL32.dll502GetModuleFileNameW
KERNEL32.dll826OutputDebugStringW
KERNEL32.dll1072Sleep
KERNEL32.dll550GetProcessHeap
KERNEL32.dll192DeleteCriticalSection
KERNEL32.dll674HeapAlloc
KERNEL32.dll1089TlsAlloc
KERNEL32.dll219EnterCriticalSection
KERNEL32.dll678HeapFree
KERNEL32.dll750LeaveCriticalSection
ADVAPI32.dll502OpenThreadToken
ADVAPI32.dll610RegQueryInfoKeyW
ADVAPI32.dll585RegEnumKeyExW
ADVAPI32.dll632RegSetValueExW
ADVAPI32.dll616RegQueryValueExW
ADVAPI32.dll603RegOpenKeyExW
ADVAPI32.dll563RegCreateKeyExW
ADVAPI32.dll554RegCloseKey
ADVAPI32.dll574RegDeleteKeyW
ADVAPI32.dll588RegEnumValueW
ADVAPI32.dll578RegDeleteValueW
ADVAPI32.dll699SetThreadToken
ADVAPI32.dll650RevertToSelf
ordentry_vafunction_name
10x364c0DllCanUnloadNow
20x10080DllGetClassObject
30x35e50DllMain
40xdcf20DllRegisterServer
50xdcec0DllUnregisterServer
module_nameMSXML3.dll
flags0
timestamp2010-06-11 14:56:46
version0.0
ordinal_base1
nFunctions5
nNames5
Names(5)0x10a4dc
Functions(5)0x10a4c8
NameOrdinals(5)0x10a4f0

StringTable 000004B0

CompanyNameMicrosoft Corporation
FileDescriptionMSXML 3.0 SP10
FileVersion8.100.4002.0
InternalNameMSXML3.dll
LegalCopyrightCopyright (C) Microsoft Corporation. 1981-2007
OriginalFilenameMSXML3.dll
ProductNameMicrosoft(R) MSXML 3.0 SP10
ProductVersion8.100.4002.0
OleSelfRegister

VS_FIXEDFILEINFO

FileVersion8.100.4002.0
ProductVersion8.100.4002.0
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType2
FileSubtype0
offsetsizetypecomment
1acba017158PNG(256 x 256)#
1b712835875PNG(256 x 256)#
1bfd4b41141BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable
[?] ignoring invalid PEdump::BITMAPINFOHEADER