filenameCAUWMIv2.dll
size230912 (0x38600)
md51482d7f18dd9aced199bf674c811a066
typePE32+ executable (DLL) (GUI) x86-64, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf8

Rich Header

lib idversiontimes used
2066550113
205655012
10131
2036550125
207655019
202655011
2106550123
201655011
204655011

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x8664
NumberOfSections6
TimeDateStamp0x5215e98f
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xf0
Characteristics0x2022
Magic0x20b
LinkerVersion11.0
SizeOfCode0x33400
SizeOfInitializedData0x5800
SizeOfUninitializedData0
AddressOfEntryPoint0x2fb70
BaseOfCode0x1000
ImageBase0x180000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.3
ImageVersion6.3
SubsystemVersion6.3
Reserved10
SizeOfImage0x3c000
SizeOfHeaders0x400
CheckSum0x3e8e7
Subsystem2
DllCharacteristics0x160
SizeOfStackReserve0x40000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x332060x33400R-X CODE
.data0x350000xd080x400RW- IDATA
.pdata0x360000xcd80xe00R-- IDATA
.idata0x370000x13de0x1400R-- IDATA
.rsrc0x390000x1a500x1c00R-- IDATA
.reloc0x3b0000xb320xc00R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x341200xe6
IMPORT0x374780x104
RESOURCE0x390000x1a50
EXCEPTION0x360000xcd8
SECURITY00
BASERELOC0x3b0000x89c
DEBUG0x10500x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x1a7500x94
Bound_IAT00
IAT0x370000x478
Delay_IAT00
CLR_Header00
typenamesizecp
MUI#12400
WEVT_TEMPLATE#152500
VERSION#19680
module_namehintordfunction_name
msvcrt.dll1246swscanf
msvcrt.dll13public: __cdecl exception::exception(void) __ptr64

??0exception@@QEAA@XZ

msvcrt.dll1286wcscpy_s
msvcrt.dll671_purecall
msvcrt.dll1172memcpy_s
msvcrt.dll12public: __cdecl exception::exception(class exception const & __ptr64) __ptr64

??0exception@@QEAA@AEBV0@@Z

msvcrt.dll92__CxxFrameHandler3
msvcrt.dll17public: virtual __cdecl exception::~exception(void) __ptr64

??1exception@@UEAA@XZ

msvcrt.dll1301wcsstr
msvcrt.dll874_vsnwprintf
msvcrt.dll1174memmove_s
msvcrt.dll1159malloc
msvcrt.dll917_wcsnicmp
msvcrt.dll11public: __cdecl exception::exception(char const * __ptr64 const & __ptr64, int) __ptr64

??0exception@@QEAA@AEBQEBDH@Z

msvcrt.dll192_callnewh
msvcrt.dll86_XcptFilter
msvcrt.dll175_amsg_exit
msvcrt.dll382_initterm
msvcrt.dll50public: virtual char const * __ptr64 __cdecl exception::what(void)const __ptr64

?what@exception@@UEBAPEBDXZ

msvcrt.dll1247swscanf_s
msvcrt.dll88__C_specific_handler
msvcrt.dll487_lock
msvcrt.dll834_unlock
msvcrt.dll124__dllonexit
msvcrt.dll657_onexit
msvcrt.dll18public: virtual __cdecl type_info::~type_info(void) __ptr64

??1type_info@@UEAA@XZ

msvcrt.dll1101free
msvcrt.dll76_CxxThrowException
msvcrt.dll10public: __cdecl exception::exception(char const * __ptr64 const & __ptr64) __ptr64

??0exception@@QEAA@AEBQEBD@Z

msvcrt.dll1245swprintf_s
msvcrt.dll1175memset
KERNEL32.dll219CreateProcessW
KERNEL32.dll761GetTickCount
KERNEL32.dll528GetCurrentProcessId
KERNEL32.dll1072QueryPerformanceCounter
KERNEL32.dll1020OutputDebugStringA
KERNEL32.dll420FreeLibrary
KERNEL32.dll938LoadLibraryExW
KERNEL32.dll724GetSystemDirectoryW
KERNEL32.dll598GetLastError
KERNEL32.dll676GetProcAddress
KERNEL32.dll279DisableThreadLibraryCalls
KERNEL32.dll538GetDateFormatW
KERNEL32.dll377FindFirstFileW
KERNEL32.dll143CompareFileTime
KERNEL32.dll1291SetFilePointerEx
KERNEL32.dll178CreateDirectoryW
KERNEL32.dll1021OutputDebugStringW
KERNEL32.dll733GetSystemTimeAsFileTime
KERNEL32.dll1519WriteFile
KERNEL32.dll848InitializeCriticalSection
KERNEL32.dll1499WideCharToMultiByte
KERNEL32.dll933LeaveCriticalSection
KERNEL32.dll766GetTimeFormatW
KERNEL32.dll194CreateFileW
KERNEL32.dll1288SetFileInformationByHandle
KERNEL32.dll297EnterCriticalSection
KERNEL32.dll366FindClose
KERNEL32.dll599GetLocalTime
KERNEL32.dll389FindNextFileW
KERNEL32.dll262DeleteCriticalSection
KERNEL32.dll532GetCurrentThreadId
KERNEL32.dll127CloseHandle
KERNEL32.dll267DeleteFileW
KERNEL32.dll347ExpandEnvironmentStringsW
KERNEL32.dll1465WaitForSingleObject
KERNEL32.dll1278SetEvent
KERNEL32.dll416FormatMessageW
KERNEL32.dll182CreateEventW
KERNEL32.dll973MoveFileExW
KERNEL32.dll1107ReadFile
KERNEL32.dll569GetFileAttributesExW
KERNEL32.dll980MultiByteToWideChar
KERNEL32.dll621GetModuleHandleW
KERNEL32.dll1375Sleep
KERNEL32.dll731GetSystemTime
KERNEL32.dll1390TerminateProcess
KERNEL32.dll146CompareStringOrdinal
KERNEL32.dll563GetExitCodeProcess
KERNEL32.dll470GetComputerNameExW
KERNEL32.dll1463WaitForMultipleObjects
KERNEL32.dll400FindStringOrdinal
KERNEL32.dll1197RtlCaptureContext
KERNEL32.dll1204RtlLookupFunctionEntry
KERNEL32.dll1211RtlVirtualUnwind
KERNEL32.dll1424UnhandledExceptionFilter
KERNEL32.dll1360SetUnhandledExceptionFilter
KERNEL32.dll527GetCurrentProcess
ADVAPI32.dll674RegSetValueExW
ADVAPI32.dll291EventWrite
ADVAPI32.dll290EventUnregister
ADVAPI32.dll288EventRegister
ADVAPI32.dll285EventActivityIdControl
ADVAPI32.dll605RegCreateKeyExW
ADVAPI32.dll658RegQueryValueExW
ADVAPI32.dll618RegDeleteTreeW
ADVAPI32.dll634RegGetValueW
ADVAPI32.dll630RegEnumValueW
ADVAPI32.dll645RegOpenKeyExW
ADVAPI32.dll596RegCloseKey
ADVAPI32.dll296EventWriteTransfer
CLUSAPI.dll81ClusterRegQueryValue
CLUSAPI.dll62ClusterRegCloseKey
CLUSAPI.dll163OpenCluster
CLUSAPI.dll20CloseClusterResource
CLUSAPI.dll145GetClusterResourceKey
CLUSAPI.dll174OpenClusterResource
CLUSAPI.dll14CloseCluster
CRYPT32.dll124CryptBinaryToStringW
CRYPT32.dll222CryptStringToBinaryW
ole32.dll131CoUninitialize
ole32.dll84CoInitializeEx
ole32.dll30CoCreateInstance
ole32.dll127CoTaskMemFree
ole32.dll16CLSIDFromString
ole32.dll509StringFromCLSID
ole32.dll116CoRevertToSelf
OLEAUT32.dll8
OLEAUT32.dll345
OLEAUT32.dll6
OLEAUT32.dll2
OLEAUT32.dll7
SHLWAPI.dll309StrFormatByteSizeW
RPCRT4.dll536UuidFromStringW
RPCRT4.dll534UuidEqual
USER32.dll564LoadStringW
ntdll.dll430NtQueryInformationFile
RESUTILS.dll37OpenClusterCryptProvider
RESUTILS.dll36FreeClusterCrypt
RESUTILS.dll6ClusterDecrypt
RESUTILS.dllCloseClusterCryptProvider
ordentry_vafunction_name
10x1ab44DllCanUnloadNow
20x1ab74DllGetClassObject
30x1a8c8DllMain
40x1aabcDllRegisterServer
50x1ab04DllUnregisterServer
60x1a914GetProviderClassID
70x1ace0MI_Main
module_nameCauWmiV2.DLL
flags0
timestamp2013-08-22 08:04:45
version0.0
ordinal_base1
nFunctions7
nNames7
Names(7)0x34164
Functions(7)0x34148
NameOrdinals(7)0x34180

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionWMIv2 Provider for Cluster Aware Patching
FileVersion6.3.9600.16384 (winblue_rtm.130821-1623)
InternalNameCAUWMIV2.DLL
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenameCAUWMIV2.DLL
ProductNameMicrosoft® Windows® Operating System
ProductVersion6.3.9600.16384

VS_FIXEDFILEINFO

FileVersion6.3.9600.16384
ProductVersion6.3.9600.16384
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType2
FileSubtype0
offsetsizetypecomment
15c115HTM#
15d0225328BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK