filenamenew.dll
size463360 (0x71200)
md527e46f9a37d44e5be051b5983668908e
typePE32 executable (DLL) (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe0

Rich Header

lib idversiontimes used
147210222
131210223
138210221
1235072715
1086
132210228
146210221
145210221

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x59941bde
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x2102
Magic0x10b
LinkerVersion9.0
SizeOfCode0x7600
SizeOfInitializedData0x15fa00
SizeOfUninitializedData0
AddressOfEntryPoint0x1a10
BaseOfCode0x1000
BaseOfData0x9000
ImageBase0x10000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.0
ImageVersion0.0
SubsystemVersion5.0
Reserved10
SizeOfImage0x16a000
SizeOfHeaders0x400
CheckSum0
Subsystem2
DllCharacteristics0x540
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++

Sections

namevavsizeraw sizeflags
.text0x10000x74dc0x7600R-X CODE
.rdata0x90000x607520x60800R-- IDATA
.data0x6a0000xfbb340x5a00RW- IDATA
.reloc0x1660000x35aa0x3600R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x693c00x392
IMPORT0x68b9c0x8c
RESOURCE00
EXCEPTION00
SECURITY00
BASERELOC0x1660000x26b8
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x90000x15c
Delay_IAT00
CLR_Header00
module_namehintordfunction_name
PSAPI.DLL20GetProcessImageFileNameW
VERSION.dll5GetFileVersionInfoW
VERSION.dll13VerQueryValueW
VERSION.dll4GetFileVersionInfoSizeW
KERNEL32.dll1069TerminateProcess
KERNEL32.dll1111VirtualFree
KERNEL32.dll673HeapFree
KERNEL32.dll547GetProcessHeap
KERNEL32.dll1194lstrcmpW
KERNEL32.dll669HeapAlloc
KERNEL32.dll1206lstrlenW
KERNEL32.dll1108VirtualAlloc
KERNEL32.dll1197lstrcmpiW
KERNEL32.dll751LeaveCriticalSection
KERNEL32.dll217EnterCriticalSection
KERNEL32.dll979SetEvent
KERNEL32.dll1124WaitForSingleObject
KERNEL32.dll1089UnmapViewOfFile
KERNEL32.dll67CloseHandle
KERNEL32.dll778MapViewOfFile
KERNEL32.dll812OpenFileMappingW
KERNEL32.dll808OpenEventW
KERNEL32.dll124CreateFileMappingW
KERNEL32.dll117CreateEventW
KERNEL32.dll1035SetThreadPriority
KERNEL32.dll1014SetPriorityClass
KERNEL32.dll425GetCurrentProcess
KERNEL32.dll163CreateThread
KERNEL32.dll202DeviceIoControl
KERNEL32.dll426GetCurrentProcessId
KERNEL32.dll127CreateFileW
KERNEL32.dll1070TerminateThread
KERNEL32.dll1086UnhandledExceptionFilter
KERNEL32.dll292FindFirstFileW
KERNEL32.dll872ReadFile
KERNEL32.dll468GetFileSize
KERNEL32.dll846QueryDosDeviceW
KERNEL32.dll492GetLogicalDriveStringsW
KERNEL32.dll641GetWindowsDirectoryW
KERNEL32.dll451GetEnvironmentVariableW
KERNEL32.dll195DeleteFileW
KERNEL32.dll498GetLongPathNameW
KERNEL32.dll721IsDebuggerPresent
KERNEL32.dll544GetProcAddress
KERNEL32.dll756LoadLibraryW
KERNEL32.dll693InitializeCriticalSectionAndSpinCount
KERNEL32.dll630GetVersionExW
KERNEL32.dll1057Sleep
KERNEL32.dll857QueueUserWorkItem
KERNEL32.dll479GetFullPathNameW
KERNEL32.dll190DeleteCriticalSection
KERNEL32.dll819OpenProcess
KERNEL32.dll875ReadProcessMemory
KERNEL32.dll591GetSystemTimeAsFileTime
KERNEL32.dll823OpenThread
KERNEL32.dll794MultiByteToWideChar
KERNEL32.dll1122WaitForMultipleObjects
KERNEL32.dll1205lstrlenA
KERNEL32.dll784Module32NextW
KERNEL32.dll782Module32FirstW
KERNEL32.dll172CreateToolhelp32Snapshot
KERNEL32.dll1073Thread32Next
KERNEL32.dll1072Thread32First
KERNEL32.dll838Process32NextW
KERNEL32.dll836Process32FirstW
KERNEL32.dll906ResetEvent
KERNEL32.dll1045SetUnhandledExceptionFilter
KERNEL32.dll281FindClose
KERNEL32.dll81CompareFileTime
USER32.dll776wsprintfW
ADVAPI32.dll688SetSecurityDescriptorDacl
ADVAPI32.dll369InitializeSecurityDescriptor
ADVAPI32.dll104ConvertSidToStringSidW
ADVAPI32.dll497OpenProcessToken
ADVAPI32.dll340GetTokenInformation
ADVAPI32.dll395LookupAccountSidW
MSVCR90.dll1322memset
MSVCR90.dll331_crt_debugger_hook
MSVCR90.dll1414wcscat_s
MSVCR90.dll1320memmove
MSVCR90.dll1318memcpy
ordentry_vafunction_name
10x8210GetDeviceName
20x81e0GetFileTypeName
30x81f0GetOperationName
40x81d0GetStatusData
50x8200GetTypeOpenName
60x8190InitFilesLoger
70x8180InitLoger
80x82c0InitProcessLoger
90x8330InitUserDebugThread
100x8340ManualPrThrRegInfo
110x81c0ReleseFilesLoger
120x8360ReleseLoger
130x8350ReleseProcessLoger
140x82a0ResetAllFiltrs
150x8290ResetPathsExclude
160x8270ResetPathsInclude
170x8250ResetProcessIdsExclude
180x8230ResetProcessIdsInclude
190x82b0SetMaxSizeFileModifed
200x8280SetPathsExclude
210x8260SetPathsInclude
220x8240SetProcessIdsExclude
230x8220SetProcessIdsInclude
240x8310StartDebugLoger
250x81a0StartFilesLoger
260x82d0StartProcessThreadLoger
270x82f0StartRegistryLoger
280x8320StopDebugLoger
290x81b0StopFilesLoger
300x82e0StopProcessThreadLoger
310x8300StopRegistryLoger
module_nameKernelLogerSDK.dll
flags0
timestamp2017-08-16 10:18:06
version0.0
ordinal_base1
nFunctions31
nNames31
Names(31)0x69464
Functions(31)0x693e8
NameOrdinals(31)0x694e0
offsetsizetypecomment
0463360DLL08/16/2017 10:18:06#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK