filenameeeksp.dll
size1728000 (0x1a5e00)
md514d2322a061b2825dba30e76cf290814
typePE32+ executable (DLL) (GUI) x86-64, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x110

Rich Header

lib idversiontimes used
156303192
152201151
158303192
1703031911
1473072914
147210223
10297
17130319135
155303191
154303191
15101
157303191

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x8664
NumberOfSections7
TimeDateStamp0x4fa023cb
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xf0
Characteristics0x2022
Magic0x20b
LinkerVersion10.0
SizeOfCode0x11f400
SizeOfInitializedData0x95400
SizeOfUninitializedData0
AddressOfEntryPoint0xdc5d0
BaseOfCode0x1000
ImageBase0x180000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.2
ImageVersion0.0
SubsystemVersion5.2
Reserved10
SizeOfImage0x1b9000
SizeOfHeaders0x400
CheckSum0x1a6360
Subsystem2
DllCharacteristics0x140
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MASM/TASM - sig1(h)

Sections

namevavsizeraw sizeflags
.text0x10000x11f3a90x11f400R-X CODE
.rdata0x1210000x6b8f90x6ba00R-- IDATA
.data0x18d0000x16be00x7e00RW- IDATA
.pdata0x1a40000xb9700xba00R-- IDATA
.idata0x1b00000x31e60x3200RW- IDATA
.rsrc0x1b40000x90c0xa00R-- IDATA
.reloc0x1b50000x36170x3800R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x18c7500x1a9
IMPORT0x1b00000xc8
RESOURCE0x1b40000x90c
EXCEPTION0x1a40000xa788
SECURITY00
BASERELOC0x1b50000x2134
DEBUG0x1219b00x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x1b0ee80xe20
Delay_IAT00
CLR_Header00
typenamesizecp
RCDATA#60080
RCDATA#6661440
VERSION#110600
MANIFEST#24060
module_namehintordfunction_name
bcrypt.dll52BCryptUnregisterProvider
bcrypt.dll42BCryptRegisterProvider
imagehlp.dll2CheckSumMappedFile
WS2_32.dll115
WS2_32.dll57
WS2_32.dll116
WS2_32.dll112
WS2_32.dll56
WS2_32.dll15
WS2_32.dll51
WS2_32.dll9
WS2_32.dll55
WS2_32.dll8
WS2_32.dll12
WS2_32.dll52
WS2_32.dll111
WS2_32.dll11
KERNEL32.dll873MultiByteToWideChar
KERNEL32.dll355FormatMessageA
KERNEL32.dll830LoadLibraryA
KERNEL32.dll360FreeLibrary
KERNEL32.dll588GetProcAddress
KERNEL32.dll683GetVersionExA
KERNEL32.dll473GetDriveTypeA
KERNEL32.dll474GetDriveTypeW
KERNEL32.dll492GetFileAttributesA
KERNEL32.dll497GetFileAttributesW
KERNEL32.dll493GetFileAttributesExA
KERNEL32.dll308FindClose
KERNEL32.dll329FindNextFileA
KERNEL32.dll312FindFirstFileA
KERNEL32.dll520GetLastError
KERNEL32.dll124CreateDirectoryA
KERNEL32.dll129CreateDirectoryW
KERNEL32.dll1027RemoveDirectoryA
KERNEL32.dll212DeleteFileA
KERNEL32.dll1132SetFileAttributesA
KERNEL32.dll1135SetFileAttributesW
KERNEL32.dll948RaiseException
KERNEL32.dll638GetSystemTime
KERNEL32.dll299FileTimeToSystemTime
KERNEL32.dll671GetTimeZoneInformation
KERNEL32.dll298FileTimeToLocalFileTime
KERNEL32.dll1152SetLastError
KERNEL32.dll746InitializeCriticalSection
KERNEL32.dll210DeleteCriticalSection
KERNEL32.dll827LeaveCriticalSection
KERNEL32.dll242EnterCriticalSection
KERNEL32.dll200DebugBreak
KERNEL32.dll82CloseHandle
KERNEL32.dll1253UnmapViewOfFile
KERNEL32.dll857MapViewOfFile
KERNEL32.dll137CreateFileMappingA
KERNEL32.dll503GetFileSize
KERNEL32.dll136CreateFileA
KERNEL32.dll537GetModuleFileNameA
KERNEL32.dll459GetCurrentThreadId
KERNEL32.dll130CreateEventA
KERNEL32.dll1288WaitForSingleObject
KERNEL32.dll1127SetEvent
KERNEL32.dll1312WideCharToMultiByte
KERNEL32.dll1046ResumeThread
KERNEL32.dll1216Sleep
KERNEL32.dll575GetOverlappedResult
KERNEL32.dll101ConnectNamedPipe
KERNEL32.dll229DisconnectNamedPipe
KERNEL32.dll349FlushFileBuffers
KERNEL32.dll1149SetHandleInformation
KERNEL32.dll517GetHandleInformation
KERNEL32.dll1332WriteFile
KERNEL32.dll963ReadFile
KERNEL32.dll159CreateNamedPipeA
KERNEL32.dll1294WaitNamedPipeA
KERNEL32.dll1286WaitForMultipleObjects
KERNEL32.dll1042ResetEvent
KERNEL32.dll886OpenEventA
KERNEL32.dll890OpenFileMappingA
KERNEL32.dll1126SetErrorMode
KERNEL32.dll685GetVolumeInformationA
KERNEL32.dll467GetDiskFreeSpaceA
KERNEL32.dll694GetWindowsDirectoryA
KERNEL32.dll711GlobalMemoryStatus
KERNEL32.dll937QueryPerformanceCounter
KERNEL32.dll666GetTickCount
KERNEL32.dll630GetSystemDirectoryA
KERNEL32.dll342FindVolumeClose
KERNEL32.dll333FindNextVolumeA
KERNEL32.dll322FindFirstVolumeA
KERNEL32.dll721Heap32ListNext
KERNEL32.dll720Heap32ListFirst
KERNEL32.dll1234Thread32Next
KERNEL32.dll1233Thread32First
KERNEL32.dll862Module32Next
KERNEL32.dll860Module32First
KERNEL32.dll921Process32Next
KERNEL32.dll919Process32First
KERNEL32.dll189CreateToolhelp32Snapshot
KERNEL32.dll634GetSystemInfo
KERNEL32.dll468GetDiskFreeSpaceExA
KERNEL32.dll642GetSystemWindowsDirectoryA
KERNEL32.dll712GlobalMemoryStatusEx
KERNEL32.dll1235TlsAlloc
KERNEL32.dll1238TlsSetValue
KERNEL32.dll1237TlsGetValue
KERNEL32.dll1236TlsFree
KERNEL32.dll938QueryPerformanceFrequency
KERNEL32.dll842LocalFree
KERNEL32.dll838LocalAlloc
KERNEL32.dll727HeapFree
KERNEL32.dll593GetProcessHeap
KERNEL32.dll723HeapAlloc
KERNEL32.dll238EncodePointer
KERNEL32.dll203DecodePointer
KERNEL32.dll770IsDebuggerPresent
KERNEL32.dll1376lstrlenA
KERNEL32.dll833LoadLibraryW
KERNEL32.dll1230TerminateProcess
KERNEL32.dll454GetCurrentProcess
KERNEL32.dll1250UnhandledExceptionFilter
KERNEL32.dll1203SetUnhandledExceptionFilter
KERNEL32.dll1062RtlVirtualUnwind
KERNEL32.dll538GetModuleFileNameW
KERNEL32.dll1280VirtualQuery
KERNEL32.dll1055RtlLookupFunctionEntry
KERNEL32.dll1048RtlCaptureContext
KERNEL32.dll455GetCurrentProcessId
KERNEL32.dll640GetSystemTimeAsFileTime
USER32.dll309GetIconInfo
USER32.dll289GetCursorInfo
USER32.dll290GetCursorPos
USER32.dll755SystemParametersInfoA
USER32.dll6AllowSetForegroundWindow
USER32.dll530MessageBoxA
USER32.dll361GetProcessDefaultLayout
USER32.dll407GetWindowLongA
USER32.dll256GetActiveWindow
USER32.dll826wsprintfA
USER32.dll388GetThreadDesktop
ADVAPI32.dll176CryptAcquireContextA
ADVAPI32.dll637RegSetValueExA
ADVAPI32.dll203CryptReleaseContext
ADVAPI32.dll568RegCreateKeyExA
ADVAPI32.dll621RegQueryValueExA
ADVAPI32.dll560RegCloseKey
ADVAPI32.dll606RegOpenCurrentUser
ADVAPI32.dll608RegOpenKeyExA
ADVAPI32.dll573RegDeleteKeyA
ADVAPI32.dll615RegQueryInfoKeyA
ADVAPI32.dll583RegDeleteValueA
ADVAPI32.dll182CryptDestroyHash
ADVAPI32.dll181CryptDeriveKey
ADVAPI32.dll200CryptHashData
ADVAPI32.dll179CryptCreateHash
ADVAPI32.dll183CryptDestroyKey
ADVAPI32.dll186CryptEncrypt
ADVAPI32.dll196CryptGetHashParam
ADVAPI32.dll656RevertToSelf
ADVAPI32.dll180CryptDecrypt
ADVAPI32.dll372ImpersonateNamedPipeClient
ADVAPI32.dll193CryptGenRandom
SHELL32.dll191SHGetFolderPathA
SHELL32.dll195SHGetFolderPathW
ole32.dll437StringFromGUID2
ole32.dll19CoCreateGuid
MSVCR100D.dll1162_ultow_s
MSVCR100D.dll353__clean_type_info_names_internal
MSVCR100D.dll239public: void __cdecl type_info::_type_info_dtor_internal_method(void) __ptr64

?_type_info_dtor_internal_method@type_info@@QEAAXXZ

MSVCR100D.dll359__crt_debugger_hook
MSVCR100D.dll257void __cdecl terminate(void)

?terminate@@YAXXZ

MSVCR100D.dll320__CppXcptFilter
MSVCR100D.dll458_amsg_exit
MSVCR100D.dll703_initterm_e
MSVCR100D.dll702_initterm
MSVCR100D.dll291_CrtSetCheckCount
MSVCR100D.dll548_encoded_null
MSVCR100D.dll606_free_dbg
MSVCR100D.dll830_malloc_dbg
MSVCR100D.dll1565strerror
MSVCR100D.dll1508mbstowcs
MSVCR100D.dll981_onexit
MSVCR100D.dll812_lock
MSVCR100D.dll361__dllonexit
MSVCR100D.dll1173_unlock
MSVCR100D.dll1563strcpy_s
MSVCR100D.dll1568strlen
MSVCR100D.dll329__CxxFrameHandler3
MSVCR100D.dll1573strncpy_s
MSVCR100D.dll1558strcat_s
MSVCR100D.dll1126_strupr_s
MSVCR100D.dll1102_strlwr_s
MSVCR100D.dll1114_strset_s
MSVCR100D.dll1559strchr
MSVCR100D.dll1576strrchr
MSVCR100D.dll1578strstr
MSVCR100D.dll1160_ultoa_s
MSVCR100D.dll797_itoa_s
MSVCR100D.dll1582strtol
MSVCR100D.dll553_errno
MSVCR100D.dll1560strcmp
MSVCR100D.dll1096_stricmp
MSVCR100D.dll1515memmove
MSVCR100D.dll1475isspace
MSVCR100D.dll1516memmove_s
MSVCR100D.dll101void __cdecl operator delete(void * __ptr64)

??3@YAXPEAX@Z

MSVCR100D.dll1622wcscpy_s
MSVCR100D.dll1625wcslen
MSVCR100D.dll99void * __ptr64 __cdecl operator new(unsigned __int64)

??2@YAPEAX_K@Z

MSVCR100D.dll1512memcmp
MSVCR100D.dll1490isxdigit
MSVCR100D.dll1517memset
MSVCR100D.dll1076_splitpath_s
MSVCR100D.dll1358_wsplitpath_s
MSVCR100D.dll864_mbscmp
MSVCR100D.dll1618wcschr
MSVCR100D.dll1630wcsncpy_s
MSVCR100D.dll1617wcscat_s
MSVCR100D.dll898_mbsnbcpy_s
MSVCR100D.dll1401atol
MSVCR100D.dll954_mbstok_s
MSVCR100D.dll890_mbsnbcmp
MSVCR100D.dll824_ltoa_s
MSVCR100D.dll1513memcpy
MSVCR100D.dll319__C_specific_handler
MSVCR100D.dll1415div
MSVCR100D.dll1156_ui64toa_s
MSVCR100D.dll698_i64toa_s
MSVCR100D.dll964_mbsupr_s
MSVCR100D.dll884_mbslwr_s
MSVCR100D.dll944_mbsset_s
MSVCR100D.dll862_mbschr
MSVCR100D.dll938_mbsrchr
MSVCR100D.dll950_mbsstr
MSVCR100D.dll878_mbsinc
MSVCR100D.dll872_mbsdec
MSVCR100D.dll765_ismbcspace
MSVCR100D.dll874_mbsicmp
MSVCR100D.dll1551sprintf_s
MSVCR100D.dll1406ceil
MSVCR100D.dll1267_wcsset_s
MSVCR100D.dll1627wcsncat_s
MSVCR100D.dll1637wcsstr
MSVCR100D.dll1619wcscmp
MSVCR100D.dll1249_wcsicmp
MSVCR100D.dll1633wcsrchr
MSVCR100D.dll1487iswspace
MSVCR100D.dll1641wcstol
MSVCR100D.dll1471isleadbyte
MSVCR100D.dll799_itow_s
MSVCR100D.dll1279_wcsupr_s
MSVCR100D.dll1255_wcslwr_s
MSVCR100D.dll993_purecall
MSVCR100D.dll1106_strnicmp
MSVCR100D.dll1621wcscpy
MSVCR100D.dll473_beginthreadex
MSVCR100D.dll1410clock
MSVCR100D.dll1502malloc
MSVCR100D.dll1443free
MSVCR100D.dll1405calloc
MSVCR100D.dll1535realloc
MSVCR100D.dll1416exit
MSVCR100D.dll1435fprintf
MSVCR100D.dll373__iob_func
MSVCR100D.dll1533rand
MSVCR100D.dll1437fputc
MSVCR100D.dll1552sqrt
MSVCR100D.dll1145_time64
MSVCR100D.dll1554srand
MSVCR100D.dll1086_stat64i32
MSVCR100D.dll1562strcpy
MSVCR100D.dll1557strcat
MSVCR100D.dll1075_splitpath
MSVCR100D.dll818_lrotr
MSVCR100D.dll1571strncmp
MSVCR100D.dll1423fflush
MSVCR100D.dll1523printf
MSVCR100D.dll496_close
MSVCR100D.dll497_commit
MSVCR100D.dll1340_write
MSVCR100D.dll230int __cdecl _open(char const * __ptr64, int, int)

?_open@@YAHPEBDHH@Z

MSVCR100D.dll1142_tempnam
MSVCR100D.dll1171_unlink
MSVCR100D.dll1497log
MSVCR100D.dll1583strtoul
MSVCR100D.dll1003_read
MSVCR100D.dll301_CxxThrowException
MSVCR100D.dll866_mbscoll
MSVCR100D.dll880_mbslen
MSVCR100D.dll882_mbslwr
MSVCR100D.dll962_mbsupr
MSVCR100D.dll731_ismbblead
MSVCR100D.dll741_ismbcalpha
MSVCR100D.dll739_ismbcalnum
MSVCR100D.dll743_ismbcdigit
MSVCR100D.dll763_ismbcpunct
MSVCR100D.dll769_ismbcupper
MSVCR100D.dll759_ismbclower
MSVCR100D.dll269_CRT_RTC_INITW
ordentry_vafunction_name
10x190bDllRegisterServer
20x1cc6DllUnregisterServer
30x13d4GetKeyStorageInterface
module_nameeeksp.dll
flags0
timestamp2012-05-01 17:56:23
version0.0
ordinal_base1
nFunctions3
nNames3
Names(3)0x18c784
Functions(3)0x18c778
NameOrdinals(3)0x18c790

StringTable 100904B0

CompanyNameEntrust(R)
FileDescriptionEntrust Entelligence Key Storage Provider
FileVersion1.0.0.0
InternalNameEEKSP
LegalCopyrightCopyright 1994-2012 Entrust. All rights reserved.
LegalTrademarksEntrust is a trademark or registered trademark of Entrust, Inc.
OriginalFilenameEEKSP.DLL
ProductNameunset
ProductVersion1.0
Build Number0
Company URLhttp://www.entrust.com/

VS_FIXEDFILEINFO

FileVersion1.0.0.0
ProductVersion1.0.0.0
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS4
FileType1
FileSubtype0
offsetsizetypecomment
15c115HTM#
15d01722416BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK