filename0E1BFBE5F8C63F479E8791F5E0E94161
size147456 (0x24000)
md50e1bfbe5f8c63f479e8791f5e0e94161
typePE32 executable (DLL) (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x110

Rich Header

lib idversiontimes used
483972
1083974
1184471
1472999
1980227
19904929
10603
1272911
0045
5489711
617351
10816823
11816814

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0x3aef5012
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x210e
Magic0x10b
LinkerVersion6.22
SizeOfCode0x19000
SizeOfInitializedData0xb000
SizeOfUninitializedData0
AddressOfEntryPoint0x18a0b
BaseOfCode0x1000
BaseOfData0x1a000
ImageBase0x4f900000
SectionAlignment0x1000
FileAlignment0x1000
OperatingSystemVersion4.0
ImageVersion7.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x25000
SizeOfHeaders0x1000
CheckSum0x2d210
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ 6.0 DLL

Sections

namevavsizeraw sizeflags
.text0x10000x181c90x19000R-X CODE
.rdata0x1a0000x2a000x3000R-- IDATA
.data0x1d0000x3f280x3000RW- IDATA
.rsrc0x210000x14580x2000R-- IDATA
.reloc0x230000x1e460x2000R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x1c9200xa3
IMPORT0x1be000x8c
RESOURCE0x210000x1458
EXCEPTION00
SECURITY00
BASERELOC0x230000xd44
DEBUG0x1a2000x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x1a0000x200
Delay_IAT0x1bae00x40
CLR_Header00
typenamesizecp
REGISTRY#2019540
ICON#116400
ICON#22960
ICON#37440
STRING#7440
GROUP_ICON#202480
VERSION#19720
idlangstring
1001033CEWMDM
module_namehintordfunction_name
KERNEL32.dll153FileTimeToSystemTime
KERNEL32.dll374GetSystemTimeAsFileTime
KERNEL32.dll656SetEvent
KERNEL32.dll30CloseHandle
KERNEL32.dll77CreateThread
KERNEL32.dll765WaitForSingleObject
KERNEL32.dll339GetProcAddress
KERNEL32.dll440HeapDestroy
KERNEL32.dll301GetLastError
KERNEL32.dll453InitializeCriticalSection
KERNEL32.dll90DeleteCriticalSection
KERNEL32.dll478LeaveCriticalSection
KERNEL32.dll459InterlockedIncrement
KERNEL32.dll821lstrlenA
KERNEL32.dll484LoadResource
KERNEL32.dll706SizeofResource
KERNEL32.dll111EnterCriticalSection
KERNEL32.dll195FreeLibrary
KERNEL32.dll456InterlockedDecrement
KERNEL32.dll481LoadLibraryExW
KERNEL32.dll763WaitForMultipleObjects
KERNEL32.dll99DeviceIoControl
KERNEL32.dll266GetCurrentProcessId
KERNEL32.dll356GetShortPathNameA
KERNEL32.dll275GetDiskFreeSpaceA
KERNEL32.dll467IsBadWritePtr
KERNEL32.dll668SetLastError
KERNEL32.dll816lstrcpyW
KERNEL32.dll813lstrcmpiW
KERNEL32.dll268GetCurrentThreadId
KERNEL32.dll390GetTickCount
KERNEL32.dll303GetLocalTime
KERNEL32.dll555QueryPerformanceCounter
KERNEL32.dll424GlobalMemoryStatus
KERNEL32.dll370GetSystemInfo
KERNEL32.dll560RaiseException
KERNEL32.dll457InterlockedExchange
KERNEL32.dll357GetShortPathNameW
KERNEL32.dll222GetComputerNameA
KERNEL32.dll479LoadLibraryA
KERNEL32.dll480LoadLibraryExA
KERNEL32.dll807lstrcatW
KERNEL32.dll482LoadLibraryW
KERNEL32.dll100DisableThreadLibraryCalls
KERNEL32.dll819lstrcpynW
KERNEL32.dll315GetModuleHandleW
KERNEL32.dll399GetVersionExA
KERNEL32.dll822lstrlenW
KERNEL32.dll514MultiByteToWideChar
KERNEL32.dll769WideCharToMultiByte
KERNEL32.dll812lstrcmpiA
KERNEL32.dll52CreateEventA
KERNEL32.dll53CreateEventW
KERNEL32.dll489LocalFree
KERNEL32.dll314GetModuleHandleA
KERNEL32.dll178FindResourceA
KERNEL32.dll181FindResourceW
KERNEL32.dll485LocalAlloc
KERNEL32.dll312GetModuleFileNameA
KERNEL32.dll313GetModuleFileNameW
ADVAPI32.dll418RegQueryInfoKeyA
ADVAPI32.dll243GetUserNameA
ADVAPI32.dll392RegCreateKeyExA
ADVAPI32.dll393RegCreateKeyExW
ADVAPI32.dll404RegEnumValueA
ADVAPI32.dll405RegEnumValueW
ADVAPI32.dll395RegDeleteKeyA
ADVAPI32.dll396RegDeleteKeyW
ADVAPI32.dll397RegDeleteValueA
ADVAPI32.dll398RegDeleteValueW
ADVAPI32.dll413RegOpenKeyExA
ADVAPI32.dll414RegOpenKeyExW
ADVAPI32.dll419RegQueryInfoKeyW
ADVAPI32.dll388RegCloseKey
ADVAPI32.dll402RegEnumKeyExW
ADVAPI32.dll401RegEnumKeyExA
ADVAPI32.dll423RegQueryValueExA
ADVAPI32.dll435RegSetValueExW
ADVAPI32.dll434RegSetValueExA
ole32.dll49CoInitialize
ole32.dll15CoCreateInstance
ole32.dll85CoTaskMemFree
ole32.dll86CoTaskMemRealloc
ole32.dll89CoUninitialize
ole32.dll84CoTaskMemAlloc
OLEAUT32.dll163
OLEAUT32.dll161
OLEAUT32.dll2
OLEAUT32.dll277
OLEAUT32.dll6
MSVCRT.dll606free
MSVCRT.dll733vswprintf
MSVCRT.dll157_adjust_fdiv
MSVCRT.dll271_initterm
MSVCRT.dll664memmove
MSVCRT.dll490_wcsicmp
MSVCRT.dll736wcschr
MSVCRT.dll747wcsrchr
MSVCRT.dll735wcscat
MSVCRT.dll715swprintf
MSVCRT.dll745wcsncpy
MSVCRT.dll742wcslen
MSVCRT.dll739wcscpy
MSVCRT.dll16void __cdecl operator delete(void *)

??3@YAXPAX@Z

MSVCRT.dll15void * __cdecl operator new(unsigned int)

??2@YAPAXI@Z

MSVCRT.dll402_purecall
MSVCRT.dll657malloc
MSVCRT.dll679realloc
USER32.dll463MsgWaitForMultipleObjects
USER32.dll39CharNextW
USER32.dll694wvsprintfW
USER32.dll536SendMessageA
USER32.dll301GetMessageA
USER32.dll486PostThreadMessageA
USER32.dll516RegisterWindowMessageA
USER32.dll151DispatchMessageA
USER32.dll152DispatchMessageW
USER32.dll487PostThreadMessageW
USER32.dll305GetMessageW
USER32.dll418LoadIconA
USER32.dll419LoadIconW
USER32.dll481PeekMessageA
ordentry_vafunction_name
10x1089DllCanUnloadNow
20x1095DllGetClassObject
30x10afDllRegisterServer
40x10beDllUnregisterServer
module_nameCEWMDM.DLL
flags0
timestamp2001-05-01 23:44:11
version0.0
ordinal_base1
nFunctions4
nNames4
Names(4)0x1c958
Functions(4)0x1c948
NameOrdinals(4)0x1c968

StringTable 040904E4

CompanyNameMicrosoft Corporation
FileDescriptionWindows CE WMDM Service Provider
FileVersion7.01.00.3055
InternalNameCEWMDM.DLL
LegalCopyrightCopyright (C) 1992-2000 Microsoft Corp.
OriginalFilenameCEWMDM.DLL
ProductNameWindows CE WMDM Service Provider
ProductVersion7.01.00.3055
OLESelfRegisterMicrosoft(R) Windows Media Player

VS_FIXEDFILEINFO

FileVersion7.1.0.3055
ProductVersion7.1.0.3055
StrucVersion0x10000
FileFlagsMask0x30003f
FileFlags0
FileOS4
FileType2
FileSubtype0
offsetsizetypecomment
0147456DLL05/02/2001 00:08:50#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK