filenameoutput1.dll
size116736 (0x1c800)
md522c7a9a15a372640a42f736deb18f029
typePE32+ executable (DLL) (GUI) x86-64, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf0

Rich Header

lib idversiontimes used
22420806108
2232080611
2252080643
1473072913
10116
229311013
220311011
222311011

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x8664
NumberOfSections5
TimeDateStamp0x56097253
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xf0
Characteristics0x2022
Magic0x20b
LinkerVersion12.0
SizeOfCode0xf800
SizeOfInitializedData0xf200
SizeOfUninitializedData0
AddressOfEntryPoint0x40cc
BaseOfCode0x1000
ImageBase0x180000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.2
ImageVersion0.0
SubsystemVersion5.2
Reserved10
SizeOfImage0x21000
SizeOfHeaders0x400
CheckSum0
Subsystem2
DllCharacteristics0x160
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000xf64f0xf800R-X CODE
.rdata0x110000x98960x9a00R-- IDATA
.data0x1b0000x3e580x1a00RW- IDATA
.pdata0x1f0000xe100x1000R-- IDATA
.reloc0x200000x7ec0x800R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x19d200x45
IMPORT0x19d680x8c
RESOURCE00
EXCEPTION0x1f0000xe10
SECURITY00
BASERELOC0x200000x7ec
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x186a00x70
Bound_IAT00
IAT0x110000x348
Delay_IAT00
CLR_Header00
module_namehintordfunction_name
KERNEL32.dll521GetLocalTime
KERNEL32.dll894OpenMutexA
KERNEL32.dll82CloseHandle
KERNEL32.dll666GetTickCount
KERNEL32.dll143CreateFileW
KERNEL32.dll1367lstrcmpiA
KERNEL32.dll497GetFileAttributesW
KERNEL32.dll168CreateProcessW
KERNEL32.dll155CreateMutexA
KERNEL32.dll1288WaitForSingleObject
KERNEL32.dll1373lstrcpynA
KERNEL32.dll1376lstrlenA
KERNEL32.dll842LocalFree
KERNEL32.dll1216Sleep
KERNEL32.dll1332WriteFile
KERNEL32.dll838LocalAlloc
KERNEL32.dll1141SetFilePointerEx
KERNEL32.dll1172SetStdHandle
KERNEL32.dll434GetConsoleMode
KERNEL32.dll416GetConsoleCP
KERNEL32.dll349FlushFileBuffers
KERNEL32.dll908OutputDebugStringW
KERNEL32.dll624GetStringTypeW
KERNEL32.dll815LCMapStringW
KERNEL32.dll730HeapReAlloc
KERNEL32.dll538GetModuleFileNameW
KERNEL32.dll827LeaveCriticalSection
KERNEL32.dll242EnterCriticalSection
KERNEL32.dll238EncodePointer
KERNEL32.dll203DecodePointer
KERNEL32.dll770IsDebuggerPresent
KERNEL32.dll774IsProcessorFeaturePresent
KERNEL32.dll520GetLastError
KERNEL32.dll180CreateThread
KERNEL32.dll459GetCurrentThreadId
KERNEL32.dll288ExitThread
KERNEL32.dll588GetProcAddress
KERNEL32.dll832LoadLibraryExW
KERNEL32.dll396GetCommandLineA
KERNEL32.dll1057RtlPcToFileHeader
KERNEL32.dll948RaiseException
KERNEL32.dll1055RtlLookupFunctionEntry
KERNEL32.dll1061RtlUnwindEx
KERNEL32.dll287ExitProcess
KERNEL32.dll541GetModuleHandleExW
KERNEL32.dll873MultiByteToWideChar
KERNEL32.dll1312WideCharToMultiByte
KERNEL32.dll732HeapSize
KERNEL32.dll727HeapFree
KERNEL32.dll723HeapAlloc
KERNEL32.dll780IsValidCodePage
KERNEL32.dll366GetACP
KERNEL32.dll574GetOEMCP
KERNEL32.dll376GetCPInfo
KERNEL32.dll1152SetLastError
KERNEL32.dll1048RtlCaptureContext
KERNEL32.dll1062RtlVirtualUnwind
KERNEL32.dll1250UnhandledExceptionFilter
KERNEL32.dll1203SetUnhandledExceptionFilter
KERNEL32.dll747InitializeCriticalSectionAndSpinCount
KERNEL32.dll454GetCurrentProcess
KERNEL32.dll1230TerminateProcess
KERNEL32.dll1235TlsAlloc
KERNEL32.dll1237TlsGetValue
KERNEL32.dll1238TlsSetValue
KERNEL32.dll1236TlsFree
KERNEL32.dll618GetStartupInfoW
KERNEL32.dll542GetModuleHandleW
KERNEL32.dll593GetProcessHeap
KERNEL32.dll619GetStdHandle
KERNEL32.dll506GetFileType
KERNEL32.dll210DeleteCriticalSection
KERNEL32.dll537GetModuleFileNameA
KERNEL32.dll937QueryPerformanceCounter
KERNEL32.dll455GetCurrentProcessId
KERNEL32.dll640GetSystemTimeAsFileTime
KERNEL32.dll481GetEnvironmentStringsW
KERNEL32.dll359FreeEnvironmentStringsW
KERNEL32.dll1331WriteConsoleW
ADVAPI32.dll637RegSetValueExA
ADVAPI32.dll605RegNotifyChangeKeyValue
ADVAPI32.dll608RegOpenKeyExA
ADVAPI32.dll593RegEnumValueA
ADVAPI32.dll560RegCloseKey
SHELL32.dll195SHGetFolderPathW
RPCRT4.dll519UuidFromStringA
SHLWAPI.dll324StrStrIA
SHLWAPI.dll52PathAppendW
SHLWAPI.dll294StrDupA
WININET.dll151InternetOpenA
WININET.dll113InternetConnectA
WININET.dll107InternetCloseHandle
WININET.dll87HttpOpenRequestA
WININET.dll157InternetQueryOptionA
WININET.dll172InternetSetOptionA
WININET.dll82HttpAddRequestHeadersA
WININET.dll91HttpSendRequestA
WININET.dll89HttpQueryInfoA
WININET.dll159InternetReadFile
ordentry_vafunction_name
10x2980VoidFunc
module_namedll64.dll
flags0
timestamp2015-09-28 17:01:07
version0.0
ordinal_base1
nFunctions1
nNames1
Names(1)0x19d4c
Functions(1)0x19d48
NameOrdinals(1)0x19d50
offsetsizetypecomment
15c115HTM#
15d0111152BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK