filenameDumped01~Rip.dll
size5850360 (0x5944f8)
md50d7f58f848a189d5f912d8583a15e450
typePE32 executable (DLL) (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavscan pending
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x120

Rich Header

lib idversiontimes used
2592939525
26129395179
2603193520
2593193524
257293959
10140
95403513
1540356
964035123
2613193535
2602939528
265322171
255322171
258322171

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0x6450c3f5
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x2102
Magic0x10b
LinkerVersion14.35
SizeOfCode0x47800
SizeOfInitializedData0x33800
SizeOfUninitializedData0
AddressOfEntryPoint0x34a4e
BaseOfCode0x1000
BaseOfData0x49000
ImageBase0x10000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.0
ImageVersion0.0
SubsystemVersion6.0
Reserved10
SizeOfImage0x7e000
SizeOfHeaders0x400
CheckSum0
Subsystem2
DllCharacteristics0x140
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ 6.0 - 8.0

Sections

namevavsizeraw sizeflags
.text0x10000x477f90x47800R-X CODE
.rdata0x490000x20ae20x20c00R-- IDATA
.data0x6a0000xef500xc000RW- IDATA
.rsrc0x790000x1b00x200R-- IDATA
.reloc0x7a0000x390c0x3a00R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x691780x64
RESOURCE0x790000x1b0
EXCEPTION00
SECURITY00
BASERELOC0x7a0000x390c
DEBUG0x683680x70
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x682a80x40
Bound_IAT00
IAT0x490000x1a4
Delay_IAT00
CLR_Header00
typenamesizecp
MANIFEST#23340
module_namehintordfunction_name
GDI32.dll55CreateDIBSection
GDI32.dll389DeleteDC
GDI32.dll392DeleteObject
GDI32.dll875SelectObject
GDI32.dll627GetCharacterPlacementA
GDI32.dll628GetCharacterPlacementW
GDI32.dll922SetTextColor
GDI32.dll882SetBkColor
GDI32.dll883SetBkMode
GDI32.dll666GetGlyphOutlineA
GDI32.dll659GetFontLanguageInfo
GDI32.dll64CreateFontIndirectA
GDI32.dll67CreateFontIndirectW
GDI32.dll920SetTextAlign
GDI32.dll904SetMapMode
GDI32.dll49CreateCompatibleDC
GDI32.dll474ExtTextOutA
GDI32.dll772MoveToEx
GDI32.dll475ExtTextOutW
GDI32.dll733GetTextMetricsA
GDI32.dll692GetObjectW
GDI32.dll734GetTextMetricsW
GDI32.dll690GetObjectA
ADVAPI32.dll616RegCloseKey
ADVAPI32.dll663RegOpenKeyA
ADVAPI32.dll677RegQueryValueExA
USER32.dll289GetAsyncKeyState
KERNEL32.dll1579WriteConsoleW
KERNEL32.dll1510VirtualProtect
KERNEL32.dll643GetModuleHandleA
KERNEL32.dll815GetVersionExA
KERNEL32.dll1029MultiByteToWideChar
KERNEL32.dll1560WideCharToMultiByte
KERNEL32.dll983LoadLibraryA
KERNEL32.dll701GetProcAddress
KERNEL32.dll1507VirtualFree
KERNEL32.dll1504VirtualAlloc
KERNEL32.dll1068OutputDebugStringA
KERNEL32.dll756GetSystemInfo
KERNEL32.dll923IsProcessorFeaturePresent
KERNEL32.dll1580WriteFile
KERNEL32.dll622GetLastError
KERNEL32.dll211CreateFileW
KERNEL32.dll142CloseHandle
KERNEL32.dll317EnterCriticalSection
KERNEL32.dll282DeleteCriticalSection
KERNEL32.dll979LeaveCriticalSection
KERNEL32.dll858HeapAlloc
KERNEL32.dll708GetProcessHeap
KERNEL32.dll862HeapFree
KERNEL32.dll1479UnhandledExceptionFilter
KERNEL32.dll1415SetUnhandledExceptionFilter
KERNEL32.dll548GetCurrentProcess
KERNEL32.dll1446TerminateProcess
KERNEL32.dll1121QueryPerformanceCounter
KERNEL32.dll549GetCurrentProcessId
KERNEL32.dll553GetCurrentThreadId
KERNEL32.dll762GetSystemTimeAsFileTime
KERNEL32.dll888InitializeSListHead
KERNEL32.dll916IsDebuggerPresent
KERNEL32.dll737GetStartupInfoW
KERNEL32.dll646GetModuleHandleW
KERNEL32.dll865HeapReAlloc
KERNEL32.dll1257RtlUnwind
KERNEL32.dll1143RaiseException
KERNEL32.dll897InterlockedFlushSList
KERNEL32.dll1352SetLastError
KERNEL32.dll313EncodePointer
KERNEL32.dll884InitializeCriticalSectionAndSpinCount
KERNEL32.dll1464TlsAlloc
KERNEL32.dll1466TlsGetValue
KERNEL32.dll1467TlsSetValue
KERNEL32.dll1465TlsFree
KERNEL32.dll439FreeLibrary
KERNEL32.dll985LoadLibraryExW
KERNEL32.dll1122QueryPerformanceFrequency
KERNEL32.dll362ExitProcess
KERNEL32.dll645GetModuleHandleExW
KERNEL32.dll642GetModuleFileNameW
KERNEL32.dll739GetStdHandle
KERNEL32.dll603GetFileType
KERNEL32.dll967LCMapStringW
KERNEL32.dll524GetConsoleOutputCP
KERNEL32.dll520GetConsoleMode
KERNEL32.dll1337SetFilePointerEx
KERNEL32.dll275DecodePointer
KERNEL32.dll385FindClose
KERNEL32.dll391FindFirstFileExW
KERNEL32.dll408FindNextFileW
KERNEL32.dll929IsValidCodePage
KERNEL32.dll446GetACP
KERNEL32.dll678GetOEMCP
KERNEL32.dll461GetCPInfo
KERNEL32.dll482GetCommandLineA
KERNEL32.dll483GetCommandLineW
KERNEL32.dll580GetEnvironmentStringsW
KERNEL32.dll438FreeEnvironmentStringsW
KERNEL32.dll744GetStringTypeW
KERNEL32.dll1379SetStdHandle
KERNEL32.dll427FlushFileBuffers
KERNEL32.dll867HeapSize
offsetsizetypecomment
0492544DLL05/02/2023 08:04:05#
15c115HTM#
784005357816BINoverlay data past EOF#
Scanning the drive for archives:
1 file, 5850360 bytes (5714 KiB)



Errors: 1
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK