filenamemsxml3.dll
size1236992 (0x12e000)
md521d3a18769ec2c4e56756d04e989a221
typePE32 executable (DLL) (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe8

Rich Header

lib idversiontimes used
126507272
149307295
10210
1473072913
146307291
13230729253
1313072937
148307291
145307291

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x5091ff27
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x2102
Magic0x10b
LinkerVersion9.0
SizeOfCode0xc6400
SizeOfInitializedData0x69800
SizeOfUninitializedData0
AddressOfEntryPoint0x145e
BaseOfCode0x1000
BaseOfData0xc2000
ImageBase0x72800000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.1
ImageVersion6.1
SubsystemVersion6.1
Reserved10
SizeOfImage0x133000
SizeOfHeaders0x400
CheckSum0x137f77
Subsystem2
DllCharacteristics0x140
SizeOfStackReserve0x40000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0 DLL

Sections

namevavsizeraw sizeflags
.text0x10000xc635b0xc6400R-X CODE
.data0xc80000xb3940x9400RW- IDATA
.rsrc0xd40000x52cb00x52e00R-- IDATA
.reloc0x1270000xb5040xb600R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x13a40xb5
IMPORT0xc63f00x8c
RESOURCE0xd40000x52cb0
EXCEPTION00
SECURITY00
BASERELOC0x1270000xb504
DEBUG0xc72fc0x38
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x326900x40
Bound_IAT00
IAT0x10000x338
Delay_IAT0xc62f80x40
CLR_Header00
typenamesizecp
PRELOADXHTML1FRAMESET.DTD206620
PRELOADXHTML1STRICT.DTD151510
PRELOADXHTML1TRANSITIONAL.DTD200250
PRELOADXHTMLLAT1.ENT26730
PRELOADXHTMLSPECIAL.ENT9570
PRELOADXHTMLSYMBOL.ENT37170
REGISTRYREGISTRY616100
TYPELIB#11010800
XMLDEFAULTSS.XSL68190
ICON#116400
ICON#27440
ICON#32960
ICON#437520
ICON#522160
ICON#613840
ICON#7171580
ICON#896400
ICON#942640
ICON#1011280
ICON#1116400
ICON#127440
ICON#132960
ICON#1437520
ICON#1522160
ICON#1613840
ICON#17358750
ICON#1896400
ICON#1942640
ICON#2011280
GROUP_ICON#1281460
GROUP_ICON#1291460
VERSION#18880
module_namehintordfunction_name
msvcrt.dll106_XcptFilter
msvcrt.dll1258memcpy
msvcrt.dll1260memmove
msvcrt.dll774_resetstkoflw
msvcrt.dll1154bsearch
msvcrt.dll1376wcsrchr
msvcrt.dll404_ftol2
msvcrt.dll764_purecall
msvcrt.dll295_controlfp
msvcrt.dll290_clearfp
msvcrt.dll747_onexit
msvcrt.dll578_lock
msvcrt.dll141__dllonexit
msvcrt.dll934_unlock
msvcrt.dll257_amsg_exit
msvcrt.dll469_initterm
msvcrt.dll1190free
msvcrt.dll1246malloc
msvcrt.dll1262memset
msvcrt.dll345_except_handler4_common
msvcrt.dll1361wcschr
msvcrt.dll1158ceil
msvcrt.dll1179floor
msvcrt.dll65_CIfmod
msvcrt.dll405_ftol2_sse
msvcrt.dll1371wcsncmp
KERNEL32.dll182CreateThread
KERNEL32.dll371GetCPInfo
KERNEL32.dll837LocalAlloc
KERNEL32.dll841LocalFree
KERNEL32.dll355FreeLibraryAndExitThread
KERNEL32.dll633GetSystemTimeAsFileTime
KERNEL32.dll450GetCurrentProcessId
KERNEL32.dll935QueryPerformanceCounter
KERNEL32.dll1191SetUnhandledExceptionFilter
KERNEL32.dll1240UnhandledExceptionFilter
KERNEL32.dll1220TerminateProcess
KERNEL32.dll1302WideCharToMultiByte
KERNEL32.dll1179SetThreadPriority
KERNEL32.dll645GetTempPathW
KERNEL32.dll692GlobalAlloc
KERNEL32.dll667GetUserDefaultLCID
KERNEL32.dll457GetDateFormatW
KERNEL32.dll663GetTimeFormatW
KERNEL32.dll659GetTickCount
KERNEL32.dll652GetThreadLocale
KERNEL32.dll101CompareStringW
KERNEL32.dll1109SetEndOfFile
KERNEL32.dll1322WriteFile
KERNEL32.dll960ReadFile
KERNEL32.dll344FlushFileBuffers
KERNEL32.dll1227TlsGetValue
KERNEL32.dll513GetLastError
KERNEL32.dll906OutputDebugStringW
KERNEL32.dll752InterlockedIncrement
KERNEL32.dll748InterlockedDecrement
KERNEL32.dll531GetModuleFileNameW
KERNEL32.dll207DelayLoadFailureHook
KERNEL32.dll580GetProcAddress
KERNEL32.dll355FreeLibrary
KERNEL32.dll746InterlockedCompareExchange
KERNEL32.dll830LoadLibraryExA
KERNEL32.dll210DeleteCriticalSection
KERNEL32.dll826LeaveCriticalSection
KERNEL32.dll239EnterCriticalSection
KERNEL32.dll716HeapAlloc
KERNEL32.dll720HeapFree
KERNEL32.dll585GetProcessHeap
KERNEL32.dll83CloseHandle
KERNEL32.dll1228TlsSetValue
KERNEL32.dll454GetCurrentThreadId
KERNEL32.dll233DuplicateHandle
KERNEL32.dll453GetCurrentThread
KERNEL32.dll449GetCurrentProcess
KERNEL32.dll676GetVersionExW
KERNEL32.dll1225TlsAlloc
KERNEL32.dll1226TlsFree
KERNEL32.dll740InitializeCriticalSection
KERNEL32.dll1278WaitForSingleObject
KERNEL32.dll1022ReleaseSemaphore
KERNEL32.dll749InterlockedExchange
KERNEL32.dll175CreateSemaphoreW
KERNEL32.dll134CreateEventW
KERNEL32.dll750InterlockedExchangeAdd
KERNEL32.dll1234TryEnterCriticalSection
KERNEL32.dll1215SwitchToThread
KERNEL32.dll1205Sleep
KERNEL32.dll1270VirtualQuery
KERNEL32.dll646GetThreadContext
KERNEL32.dll1044ResumeThread
KERNEL32.dll1213SuspendThread
KERNEL32.dll1115SetEvent
KERNEL32.dll1040ResetEvent
KERNEL32.dll1262VirtualAlloc
KERNEL32.dll1265VirtualFree
KERNEL32.dll719HeapDestroy
KERNEL32.dll718HeapCreate
KERNEL32.dll535GetModuleHandleW
KERNEL32.dll1140SetLastError
KERNEL32.dll627GetSystemInfo
KERNEL32.dll945RaiseException
KERNEL32.dll871MultiByteToWideChar
KERNEL32.dll351FormatMessageW
KERNEL32.dll831LoadLibraryExW
KERNEL32.dll832LoadLibraryW
KERNEL32.dll834LoadResource
KERNEL32.dll335FindResourceW
KERNEL32.dll1204SizeofResource
KERNEL32.dll852LockResource
KERNEL32.dll294FileTimeToSystemTime
KERNEL32.dll1216SystemTimeToFileTime
KERNEL32.dll829LoadLibraryA
KERNEL32.dll1127SetFilePointer
KERNEL32.dll498GetFileType
KERNEL32.dll144CreateFileW
ole32.dll16CoCreateInstance
ole32.dll104CoTaskMemFree
ole32.dll134CreateStreamOnHGlobal
ole32.dll103CoTaskMemAlloc
ole32.dll121CreateBindCtx
ole32.dll376StringFromCLSID
ole32.dll6CLSIDFromProgID
ole32.dll108CoUninitialize
ole32.dll62CoInitialize
ole32.dll15CoCreateGuid
ole32.dll14CoCreateFreeThreadedMarshaler
SHLWAPI.dll143PathSearchAndQualifyW
SHLWAPI.dll363UrlUnescapeW
SHLWAPI.dll115PathIsURLW
SHLWAPI.dll73PathFindFileNameW
SHLWAPI.dll71PathFindExtensionW
SHLWAPI.dll291StrCmpW
SHLWAPI.dll289StrCmpNIW
SHLWAPI.dll334StrToIntW
SHLWAPI.dll361UrlIsW
SHLWAPI.dll340UrlCanonicalizeW
SHLWAPI.dll351UrlGetLocationW
SHLWAPI.dll67PathCreateFromUrlW
SHLWAPI.dll346UrlCreateFromPathW
USER32.dll378GetSubMenu
USER32.dll342GetMenuState
USER32.dll337GetMenuItemCount
USER32.dll164DestroyMenu
USER32.dll563PeekMessageW
USER32.dll338GetMenuItemID
USER32.dll592RegisterClipboardFormatW
USER32.dll175DispatchMessageW
USER32.dll540MsgWaitForMultipleObjects
USER32.dll636SendMessageW
USER32.dll156DefWindowProcW
USER32.dll110CreateWindowExW
USER32.dll774UnregisterClassW
USER32.dll590RegisterClassW
USER32.dll566PostMessageW
USER32.dll214EnableMenuItem
USER32.dll256GetActiveWindow
USER32.dll301GetForegroundWindow
USER32.dll59CharUpperBuffW
USER32.dll456IsCharUpperW
USER32.dll60CharUpperW
USER32.dll46CharLowerW
USER32.dll452IsCharAlphaW
USER32.dll758TrackPopupMenu
OLEAUT32.dll147
OLEAUT32.dll19
OLEAUT32.dll20
OLEAUT32.dll7
OLEAUT32.dll2
OLEAUT32.dll10
OLEAUT32.dll27
OLEAUT32.dll96
OLEAUT32.dll124
OLEAUT32.dll82
OLEAUT32.dll93
OLEAUT32.dll113
OLEAUT32.dll102
OLEAUT32.dll202
OLEAUT32.dll92
OLEAUT32.dll112
OLEAUT32.dll123
OLEAUT32.dll103
OLEAUT32.dll83
OLEAUT32.dll87
OLEAUT32.dll17
OLEAUT32.dll330
OLEAUT32.dll331
OLEAUT32.dll46
OLEAUT32.dll47
OLEAUT32.dll411
OLEAUT32.dll23
OLEAUT32.dll16
OLEAUT32.dll24
OLEAUT32.dll4
OLEAUT32.dll200
OLEAUT32.dll201
OLEAUT32.dll8
OLEAUT32.dll9
OLEAUT32.dll12
OLEAUT32.dll161
OLEAUT32.dll6
ordentry_vafunction_name
10x437bbDllCanUnloadNow
20xd439DllGetClassObject
30x14b1DllMain
40x45a9dDllRegisterServer
50x45a9dDllUnregisterServer
module_nameMSXML3.dll
flags0
timestamp2012-11-01 03:57:56
version0.0
ordinal_base1
nFunctions5
nNames5
Names(5)0x13e0
Functions(5)0x13cc
NameOrdinals(5)0x13f4

StringTable 000004B0

CompanyNameMicrosoft Corporation
FileDescriptionMSXML 3.0 SP11
FileVersion8.110.7601.17988
InternalNameMSXML3.dll
LegalCopyrightCopyright (C) Microsoft Corporation. 1981-2008
OriginalFilenameMSXML3.dll
ProductNameMicrosoft(R) MSXML 3.0 SP11
ProductVersion8.110.7601.17988
OleSelfRegister

VS_FIXEDFILEINFO

FileVersion8.110.7601.17988
ProductVersion8.110.7601.17988
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType2
FileSubtype0
offsetsizetypecomment
01236992DLL11/01/2012 04:48:39#
15c115HTM#
10bbb017158PNG(256 x 256)#
11613835875PNG(256 x 256)#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] ignoring invalid PEdump::BITMAPINFOHEADER