filename0285f020.dll
size2944992 (0x2cefe0)
md51352fd1ed25ad39f8990c4afccd9e158
typePE32 executable (DLL) (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavscan pending
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x100

Rich Header

lib idversiontimes used
156212022
123507272
152201153
1714021955
1584021938
17040219182
131307292
1473072921
10298
1754021915
154402191
157402191

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections6
TimeDateStamp0x8f000
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x2102
Magic0x10b
LinkerVersion10.0
SizeOfCode0x8ca00
SizeOfInitializedData0x268ea00
SizeOfUninitializedData0
AddressOfEntryPoint0x78300
BaseOfCode0x1000
BaseOfData0xe0000
ImageBase0x10000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.1
ImageVersion0.0
SubsystemVersion5.1
Reserved10
SizeOfImage0x2770000
SizeOfHeaders0x400
CheckSum0
Subsystem2
DllCharacteristics0x140
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v7.0 DLL

Sections

namevavsizeraw sizeflags
.text0x10000x8d4b30x8d600R-X CODE
.data0x8f0000x5022b0x50400R-X CODE
.rdata0xe00000x14e460x15000R-- IDATA
.data0xf50000x25db45c0x13da00RW- IDATA
.rsrc0x26d10000x746100x74800R-- IDATA
.reloc0x27460000x29b000x29c00R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0xf38140xdc
RESOURCE0x26d10000x74610
EXCEPTION00
SECURITY00
BASERELOC0x27460000x10c08
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0xf2c980x40
Bound_IAT00
IAT0xe00000x3e0
Delay_IAT00
CLR_Header00
typenamesizecp
PNG#10250520
PNG#10461740
PNG#10561490
PNG#10661780
PNG#10712820
PNG#1086900
PNG#10923680
PNG#1104030
PNG#1113960
PNG#1122820
PNG#11335070
PNG#11422170
PNG#11534460
PNG#11650310
PNG#11749980
PNG#11850470
PNG#11913810
PNG#12014650
PNG#12115440
PNG#12257210
PNG#12356970
PNG#12457450
PNG#1258770
PNG#129416920
PNG#13153820
PNG#132122930
PNG#13316070
PNG#13411540
PNG#1352320
PNG#1361660
PNG#1375470
PNG#13811780
PNG#13929820
PNG#14049490
PNG#14117130
PNG#14218720
PNG#14340770
PNG#14423450
PNG#14521290
PNG#14731780
PNG#14931580
PNG#15043290
PNG#15141720
PNG#159448810
PNG#16015130
PNG#16121330
PNG#16216980
PNG#16365780
PNG#16466020
PNG#16566030
PNG#16838570
PNG#16938190
PNG#17038650
PNG#17113970
PNG#17221160
PNG#17392100
PNG#17491980
PNG#17592270
PNG#176301730
PNG#177335630
PNG#178246940
PNG#179256770
PNG#180105730
PNG#18120840
PNG#18216070
PNG#1835200
PNG#18410280
PNG#185179100
PNG#190377150
module_namehintordfunction_name
KERNEL32.dll855MapViewOfFile
KERNEL32.dll137CreateFileMappingA
KERNEL32.dll1238UnmapViewOfFile
KERNEL32.dll168CreateProcessW
KERNEL32.dll646GetThreadContext
KERNEL32.dll354FreeLibrary
KERNEL32.dll531GetModuleFileNameA
KERNEL32.dll396GetComputerNameA
KERNEL32.dll921ProcessIdToSessionId
KERNEL32.dll650GetThreadId
KERNEL32.dll136CreateFileA
KERNEL32.dll624GetSystemDirectoryW
KERNEL32.dll306FindFirstFileA
KERNEL32.dll323FindNextFileA
KERNEL32.dll302FindClose
KERNEL32.dll124CreateDirectoryA
KERNEL32.dll704GlobalMemoryStatusEx
KERNEL32.dll514GetLastError
KERNEL32.dll536GetModuleHandleW
KERNEL32.dll618GetSystemDEPPolicy
KERNEL32.dll738InitializeCriticalSection
KERNEL32.dll238EnterCriticalSection
KERNEL32.dll825LeaveCriticalSection
KERNEL32.dll892OpenMutexA
KERNEL32.dll1177SetThreadPriority
KERNEL32.dll936QueryPerformanceFrequency
KERNEL32.dll935QueryPerformanceCounter
KERNEL32.dll1317WriteFile
KERNEL32.dll1110SetEnvironmentVariableA
KERNEL32.dll100CompareStringW
KERNEL32.dll724HeapSize
KERNEL32.dll888OpenFileMappingA
KERNEL32.dll1316WriteConsoleW
KERNEL32.dll586GetProcessHeap
KERNEL32.dll1107SetEndOfFile
KERNEL32.dll343FlushFileBuffers
KERNEL32.dll1159SetStdHandle
KERNEL32.dll617GetStringTypeW
KERNEL32.dll1126SetFilePointer
KERNEL32.dll659GetTickCount
KERNEL32.dll474GetEnvironmentStringsW
KERNEL32.dll353FreeEnvironmentStringsW
KERNEL32.dll485GetFileAttributesA
KERNEL32.dll143CreateFileW
KERNEL32.dll507GetFullPathNameW
KERNEL32.dll772IsProcessorFeaturePresent
KERNEL32.dll664GetTimeZoneInformation
KERNEL32.dll428GetConsoleMode
KERNEL32.dll410GetConsoleCP
KERNEL32.dll960ReadFile
KERNEL32.dll909PeekNamedPipe
KERNEL32.dll492GetFileInformationByHandle
KERNEL32.dll504GetFullPathNameA
KERNEL32.dll209DeleteCriticalSection
KERNEL32.dll611GetStartupInfoW
KERNEL32.dll499GetFileType
KERNEL32.dll1135SetHandleCount
KERNEL32.dll1048RtlUnwind
KERNEL32.dll739InitializeCriticalSectionAndSpinCount
KERNEL32.dll813LCMapStringW
KERNEL32.dll778IsValidCodePage
KERNEL32.dll567GetOEMCP
KERNEL32.dll360GetACP
KERNEL32.dll370GetCPInfo
KERNEL32.dll1139SetLastError
KERNEL32.dll686GetWindowsDirectoryA
KERNEL32.dll164CreateProcessA
KERNEL32.dll828LoadLibraryA
KERNEL32.dll1169SetThreadContext
KERNEL32.dll453GetCurrentThreadId
KERNEL32.dll1217TerminateThread
KERNEL32.dll169CreateRemoteThread
KERNEL32.dll1273WaitForSingleObject
KERNEL32.dll1297WideCharToMultiByte
KERNEL32.dll871MultiByteToWideChar
KERNEL32.dll782IsWow64Process
KERNEL32.dll896OpenProcess
KERNEL32.dll533GetModuleHandleA
KERNEL32.dll581GetProcAddress
KERNEL32.dll497GetFileSizeEx
KERNEL32.dll1338_lopen
KERNEL32.dll751InterlockedIncrement
KERNEL32.dll181CreateThread
KERNEL32.dll1263VirtualProtect
KERNEL32.dll852LockResource
KERNEL32.dll833LoadResource
KERNEL32.dll1201SizeofResource
KERNEL32.dll331FindResourceA
KERNEL32.dll14AddVectoredExceptionHandler
KERNEL32.dll746InterlockedCompareExchange64
KERNEL32.dll1202Sleep
KERNEL32.dll476GetEnvironmentVariableW
KERNEL32.dll293FileTimeToSystemTime
KERNEL32.dll292FileTimeToLocalFileTime
KERNEL32.dll831LoadLibraryW
KERNEL32.dll449GetCurrentProcessId
KERNEL32.dll1265VirtualQuery
KERNEL32.dll82CloseHandle
KERNEL32.dll448GetCurrentProcess
KERNEL32.dll1216TerminateProcess
KERNEL32.dll709GlobalUnlock
KERNEL32.dll702GlobalLock
KERNEL32.dll691GlobalAlloc
KERNEL32.dll905OutputDebugStringA
KERNEL32.dll1222TlsFree
KERNEL32.dll1224TlsSetValue
KERNEL32.dll1223TlsGetValue
KERNEL32.dll1221TlsAlloc
KERNEL32.dll234EncodePointer
KERNEL32.dll532GetModuleFileNameW
KERNEL32.dll612GetStdHandle
KERNEL32.dll281ExitProcess
KERNEL32.dll718HeapDestroy
KERNEL32.dll717HeapCreate
KERNEL32.dll768IsDebuggerPresent
KERNEL32.dll1189SetUnhandledExceptionFilter
KERNEL32.dll1235UnhandledExceptionFilter
KERNEL32.dll390GetCommandLineA
KERNEL32.dll202DecodePointer
KERNEL32.dll214DeleteFileW
KERNEL32.dll722HeapReAlloc
KERNEL32.dll308FindFirstFileExW
KERNEL32.dll467GetDriveTypeW
KERNEL32.dll490GetFileAttributesW
KERNEL32.dll211DeleteFileA
KERNEL32.dll307FindFirstFileExA
KERNEL32.dll466GetDriveTypeA
KERNEL32.dll715HeapAlloc
KERNEL32.dll719HeapFree
KERNEL32.dll515GetLocalTime
KERNEL32.dll447GetCurrentDirectoryW
KERNEL32.dll633GetSystemTimeAsFileTime
KERNEL32.dll1260VirtualFree
KERNEL32.dll1257VirtualAlloc
KERNEL32.dll747InterlockedDecrement
KERNEL32.dll945RaiseException
USER32.dll175DispatchMessageW
USER32.dll420GetWindowThreadProcessId
USER32.dll718SetWindowsHookExA
USER32.dll768UnhookWindowsHookEx
USER32.dll550OpenClipboard
USER32.dll213EmptyClipboard
USER32.dll646SetClipboardData
USER32.dll73CloseClipboard
USER32.dll526MessageBoxA
USER32.dll533MessageBoxW
USER32.dll458IsClipboardFormatAvailable
USER32.dll278GetClipboardData
USER32.dll263GetAsyncKeyState
USER32.dll288GetCursorPos
USER32.dll412GetWindowRect
USER32.dll228EnumDisplayDevicesA
USER32.dll819wsprintfW
USER32.dll28CallNextHookEx
USER32.dll631SendMessageA
USER32.dll539MoveWindow
USER32.dll735ShowWindow
USER32.dll664SetLayeredWindowAttributes
USER32.dll708SetWindowLongW
USER32.dll406GetWindowLongW
USER32.dll636SendMessageW
USER32.dll714SetWindowTextA
USER32.dll349GetMessageW
USER32.dll567PostQuitMessage
USER32.dll156DefWindowProcW
USER32.dll493LoadIconW
USER32.dll276GetClientRect
USER32.dll301GetForegroundWindow
USER32.dll730ShowCursor
USER32.dll491LoadCursorW
USER32.dll590RegisterClassW
USER32.dll110CreateWindowExW
USER32.dll785UpdateWindow
USER32.dll764TranslateMessage
USER32.dll247FindWindowA
ADVAPI32.dll503OpenProcessToken
ADVAPI32.dll31AdjustTokenPrivileges
ADVAPI32.dll346GetTokenInformation
ADVAPI32.dll32AllocateAndInitializeSid
ADVAPI32.dll263EqualSid
ADVAPI32.dll288FreeSid
ADVAPI32.dll176CryptAcquireContextA
ADVAPI32.dll713StartServiceW
ADVAPI32.dll255EnumServicesStatusA
ADVAPI32.dll505OpenSCManagerW
ADVAPI32.dll356GetUserNameA
ADVAPI32.dll710StartServiceA
ADVAPI32.dll128CreateServiceA
ADVAPI32.dll637RegSetValueExA
ADVAPI32.dll567RegCreateKeyA
ADVAPI32.dll87CloseServiceHandle
ADVAPI32.dll218DeleteService
ADVAPI32.dll92ControlService
ADVAPI32.dll506OpenServiceA
ADVAPI32.dll560RegCloseKey
ADVAPI32.dll607RegOpenKeyA
ADVAPI32.dll504OpenSCManagerA
ADVAPI32.dll621RegQueryValueExA
ADVAPI32.dll608RegOpenKeyExA
ADVAPI32.dll182CryptDestroyHash
ADVAPI32.dll196CryptGetHashParam
ADVAPI32.dll200CryptHashData
ADVAPI32.dll179CryptCreateHash
ADVAPI32.dll407LookupPrivilegeValueW
SHELL32.dll205SHGetKnownFolderPath
SHELL32.dll286ShellExecuteA
WS2_32.dll21
WS2_32.dll7
WS2_32.dll115
WS2_32.dll23
WS2_32.dll9
WS2_32.dll4
WS2_32.dll19
WS2_32.dll3
WS2_32.dll111
d3d9.dll9Direct3DCreate9
d3dx9_43.dll310D3DXVec3Normalize
d3dx9_43.dll319D3DXVec3Unproject
d3dx9_43.dll326D3DXVec4Transform
d3dx9_43.dll97D3DXCreateTextureFromFileInMemoryEx
d3dx9_43.dll204D3DXMatrixPerspectiveFovLH
d3dx9_43.dll214D3DXMatrixRotationY
d3dx9_43.dll98D3DXCreateTextureFromFileW
d3dx9_43.dll13D3DXCompileShader
CRYPT32.dll18CertCloseStore
CRYPT32.dll33CertDeleteCertificateFromStore
CRYPT32.dll87CertOpenStore
CRYPT32.dll53CertFindCertificateInStore
PSAPI.DLL21GetProcessMemoryInfo
gdiplus.dll237GdipFree
gdiplus.dll33GdipAlloc
gdiplus.dll629GdiplusStartup
gdiplus.dll286GdipGetImageEncoders
gdiplus.dll287GdipGetImageEncodersSize
gdiplus.dll81GdipCreateBitmapFromStream
gdiplus.dll497GdipSaveImageToStream
gdiplus.dll54GdipCloneImage
gdiplus.dll152GdipDisposeImage
offsetsizetypecomment
02944000DLL01/07/1970 18:42:08#
15c115HTM#
2315205052PNG(1146 x 715)#
2328e06174PNG(256 x 256)#
2341006149PNG(256 x 256)#
2359086178PNG(256 x 256)#
2371301282PNG(206 x 46)#
237638690PNG(206 x 46)#
2378f02368PNG(206 x 46)#
238230403PNG(35 x 49)#
2383c8396PNG(35 x 49)#
238558282PNG(35 x 49)#
2386783507PNG(205 x 205)#
2394302217PNG(128 x 128)#
239ce03446PNG(200 x 200)#
23aa585031PNG(256 x 256)#
23be004998PNG(256 x 256)#
23d1885047PNG(256 x 256)#
23e5401381PNG(35 x 49)#
23eaa81465PNG(35 x 49)#
23f0681544PNG(35 x 49)#
23f6705721PNG(240 x 100)#
240cd05697PNG(240 x 100)#
2423185745PNG(240 x 100)#
243990877PNG(356 x 37)#
243d0041692PNG(1300 x 1050)#
24dfe05382PNG(1146 x 150)#
24f4e812293PNG(1118 x 61)#
2524f01607PNG(75 x 40)#
252b381154PNG(75 x 40)#
252fc0232PNG(10 x 24)#
2530a8166PNG(10 x 50)#
253150547PNG(206 x 60)#
2533781178PNG(206 x 60)#
2538182982PNG(243 x 69)#
2543c04949PNG(243 x 69)#
2557181713PNG(276 x 79)#
255dd01872PNG(276 x 79)#
2565204077PNG(243 x 69)#
2575102345PNG(276 x 79)#
257e402129PNG(206 x 60)#
2586983178PNG(550 x 450)#
2593083158PNG(243 x 69)#
259f604329PNG(243 x 69)#
25b0504172PNG(243 x 69)#
25c0a044881PNG(1040 x 840)#
266ff81513PNG(276 x 79)#
2675e82133PNG(276 x 79)#
267e401698PNG(276 x 79)#
2684e86578PNG(256 x 256)#
269ea06602PNG(256 x 256)#
26b8706603PNG(256 x 256)#
26d2403857PNG(256 x 128)#
26e1583819PNG(256 x 128)#
26f0483865PNG(256 x 128)#
26ff681397PNG(40 x 23)#
2704e02116PNG(40 x 23)#
270d289210PNG(256 x 256)#
2731289198PNG(256 x 256)#
2755189227PNG(256 x 256)#
27792830173PNG(630 x 630)#
27ef0833563PNG(610 x 304)#
28722824694PNG(256 x 120)#
28d2a025677PNG(256 x 120)#
2936f010573PNG(256 x 120)#
2960402084PNG(40 x 23)#
2968681607PNG(206 x 60)#
296eb0520PNG(206 x 60)#
2970b81028PNG(206 x 60)#
2974c017910PNG(650 x 525)#
29bab837715PNG(456 x 101)#
2cec00992BINoverlay data past EOF#
Scanning the drive for archives:
1 file, 2944992 bytes (2876 KiB)



Errors: 1
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK