filenamecore32_80.dll
size1483776 (0x16a400)
md536efb7bcca1ecd3f9aefe17f62576e92
typePE32 executable (DLL) (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x118

Rich Header

lib idversiontimes used
150204131
132210224
110507271
1493072933
13130729204
109507278
1235072735
10707
13121022330
149210222
13230729201
146307291
145307291

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections6
TimeDateStamp0x5229a053
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x2102
Magic0x10b
LinkerVersion9.0
SizeOfCode0x10d400
SizeOfInitializedData0xb1600
SizeOfUninitializedData0
AddressOfEntryPoint0xabcc9
BaseOfCode0x1000
BaseOfData0x10f000
ImageBase0x10000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.0
ImageVersion0.0
SubsystemVersion5.0
Reserved10
SizeOfImage0x1c3000
SizeOfHeaders0x400
CheckSum0
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v7.0 DLL

Sections

namevavsizeraw sizeflags
.text0x10000x10d2840x10d400R-X CODE
.rdata0x10f0000x39ad30x39c00R-- IDATA
.data0x1490000x62e280xe600RW- IDATA
.IdleSys0x1ac0000x100x200RW- IDATA SHARED
.shared0x1ad00040x200RW- IDATA
.reloc0x1ae0000x144740x14600R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x148a800x53
IMPORT0x1463140x154
RESOURCE00
EXCEPTION00
SECURITY00
BASERELOC0x1ae0000xd488
DEBUG0x10f8600x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x10f0000x778
Delay_IAT00
CLR_Header00
module_namehintordfunction_name
KERNEL32.dll108CreateDirectoryA
KERNEL32.dll861ReadConsoleInputA
KERNEL32.dll951SetConsoleMode
KERNEL32.dll571GetStdHandle
KERNEL32.dll471GetFileType
KERNEL32.dll628GetVersion
KERNEL32.dll476GetFullPathNameA
KERNEL32.dll96CopyFileA
KERNEL32.dll893RemoveDirectoryA
KERNEL32.dll271FileTimeToLocalFileTime
KERNEL32.dll272FileTimeToSystemTime
KERNEL32.dll619GetTimeZoneInformation
KERNEL32.dll756LoadLibraryW
KERNEL32.dll321FlushFileBuffers
KERNEL32.dll101CopyFileW
KERNEL32.dll328FormatMessageW
KERNEL32.dll1004SetLastError
KERNEL32.dll260ExitProcess
KERNEL32.dll1116VirtualQuery
KERNEL32.dll823OpenThread
KERNEL32.dll604GetThreadContext
KERNEL32.dll1030SetThreadContext
KERNEL32.dll1108VirtualAlloc
KERNEL32.dll1114VirtualProtect
KERNEL32.dll1111VirtualFree
KERNEL32.dll490GetLocaleInfoW
KERNEL32.dll568GetShortPathNameW
KERNEL32.dll190DeleteCriticalSection
KERNEL32.dll692InitializeCriticalSection
KERNEL32.dll630GetVersionExW
KERNEL32.dll753LoadLibraryA
KERNEL32.dll332FreeLibrary
KERNEL32.dll429GetCurrentThreadId
KERNEL32.dll139CreateMutexA
KERNEL32.dll1017SetProcessShutdownParameters
KERNEL32.dll1089UnmapViewOfFile
KERNEL32.dll121CreateFileMappingA
KERNEL32.dll486GetLastError
KERNEL32.dll778MapViewOfFile
KERNEL32.dll1203lstrcpynW
KERNEL32.dll704InterlockedIncrement
KERNEL32.dll1196lstrcmpiA
KERNEL32.dll1146WideCharToMultiByte
KERNEL32.dll631GetVolumeInformationA
KERNEL32.dll1199lstrcpyA
KERNEL32.dll1205lstrlenA
KERNEL32.dll285FindFirstFileA
KERNEL32.dll302FindNextFileA
KERNEL32.dll451GetEnvironmentVariableW
KERNEL32.dll502GetModuleHandleA
KERNEL32.dll581GetSystemDirectoryA
KERNEL32.dll505GetModuleHandleW
KERNEL32.dll544GetProcAddress
KERNEL32.dll585GetSystemInfo
KERNEL32.dll629GetVersionExA
KERNEL32.dll500GetModuleFileNameA
KERNEL32.dll567GetShortPathNameA
KERNEL32.dll450GetEnvironmentVariableA
KERNEL32.dll1014SetPriorityClass
KERNEL32.dll425GetCurrentProcess
KERNEL32.dll602GetTempPathA
KERNEL32.dll373GetComputerNameA
KERNEL32.dll376GetComputerNameW
KERNEL32.dll1066SystemTimeToFileTime
KERNEL32.dll1194lstrcmpW
KERNEL32.dll896RemoveDirectoryW
KERNEL32.dll292FindFirstFileW
KERNEL32.dll304FindNextFileW
KERNEL32.dll281FindClose
KERNEL32.dll603GetTempPathW
KERNEL32.dll1191lstrcatW
KERNEL32.dll787MoveFileExW
KERNEL32.dll582GetSystemDirectoryW
KERNEL32.dll113CreateDirectoryW
KERNEL32.dll1070TerminateThread
KERNEL32.dll217EnterCriticalSection
KERNEL32.dll751LeaveCriticalSection
KERNEL32.dll906ResetEvent
KERNEL32.dll176CreateWaitableTimerW
KERNEL32.dll1052SetWaitableTimer
KERNEL32.dll794MultiByteToWideChar
KERNEL32.dll428GetCurrentThread
KERNEL32.dll609GetThreadPriority
KERNEL32.dll1035SetThreadPriority
KERNEL32.dll148CreateProcessA
KERNEL32.dll151CreateProcessW
KERNEL32.dll872ReadFile
KERNEL32.dll457GetFileAttributesA
KERNEL32.dll983SetFileAttributesA
KERNEL32.dll142CreateMutexW
KERNEL32.dll991SetFilePointer
KERNEL32.dll973SetEndOfFile
KERNEL32.dll887ReleaseMutex
KERNEL32.dll986SetFileAttributesW
KERNEL32.dll1206lstrlenW
KERNEL32.dll979SetEvent
KERNEL32.dll1200lstrcpyW
KERNEL32.dll1072Thread32First
KERNEL32.dll426GetCurrentProcessId
KERNEL32.dll1073Thread32Next
KERNEL32.dll172CreateToolhelp32Snapshot
KERNEL32.dll836Process32FirstW
KERNEL32.dll838Process32NextW
KERNEL32.dll700InterlockedDecrement
KERNEL32.dll468GetFileSize
KERNEL32.dll462GetFileAttributesW
KERNEL32.dll758LoadResource
KERNEL32.dll775LockResource
KERNEL32.dll1056SizeofResource
KERNEL32.dll313FindResourceW
KERNEL32.dll487GetLocalTime
KERNEL32.dll765LocalFree
KERNEL32.dll1165WriteFile
KERNEL32.dll195DeleteFileW
KERNEL32.dll203DisableThreadLibraryCalls
KERNEL32.dll501GetModuleFileNameW
KERNEL32.dll1197lstrcmpiW
KERNEL32.dll1057Sleep
KERNEL32.dll614GetTickCount
KERNEL32.dll909ResumeThread
KERNEL32.dll1063SuspendThread
KERNEL32.dll127CreateFileW
KERNEL32.dll1124WaitForSingleObject
KERNEL32.dll117CreateEventW
KERNEL32.dll1122WaitForMultipleObjects
KERNEL32.dll163CreateThread
KERNEL32.dll120CreateFileA
KERNEL32.dll67CloseHandle
KERNEL32.dll320FlushConsoleInputBuffer
KERNEL32.dll657GlobalMemoryStatus
KERNEL32.dll976SetEnvironmentVariableA
KERNEL32.dll547GetProcessHeap
KERNEL32.dll1164WriteConsoleW
KERNEL32.dll409GetConsoleOutputCP
KERNEL32.dll1154WriteConsoleA
KERNEL32.dll488GetLocaleInfoA
KERNEL32.dll576GetStringTypeW
KERNEL32.dll573GetStringTypeA
KERNEL32.dll693InitializeCriticalSectionAndSpinCount
KERNEL32.dll935SetConsoleCtrlHandler
KERNEL32.dll852QueryPerformanceCounter
KERNEL32.dll449GetEnvironmentStringsW
KERNEL32.dll331FreeEnvironmentStringsW
KERNEL32.dll447GetEnvironmentStrings
KERNEL32.dll330FreeEnvironmentStringsA
KERNEL32.dll1020SetStdHandle
KERNEL32.dll423GetCurrentDirectoryA
KERNEL32.dll430GetDateFormatA
KERNEL32.dll616GetTimeFormatA
KERNEL32.dll739LCMapStringW
KERNEL32.dll737LCMapStringA
KERNEL32.dll405GetConsoleMode
KERNEL32.dll387GetConsoleCP
KERNEL32.dll672HeapDestroy
KERNEL32.dll671HeapCreate
KERNEL32.dll731IsValidCodePage
KERNEL32.dll531GetOEMCP
KERNEL32.dll338GetACP
KERNEL32.dll347GetCPInfo
KERNEL32.dll569GetStartupInfoA
KERNEL32.dll1000SetHandleCount
KERNEL32.dll678HeapSize
KERNEL32.dll676HeapReAlloc
KERNEL32.dll367GetCommandLineA
KERNEL32.dll442GetDriveTypeA
KERNEL32.dll673HeapFree
KERNEL32.dll669HeapAlloc
KERNEL32.dll721IsDebuggerPresent
KERNEL32.dll1045SetUnhandledExceptionFilter
KERNEL32.dll1086UnhandledExceptionFilter
KERNEL32.dll1069TerminateProcess
KERNEL32.dll858RaiseException
KERNEL32.dll591GetSystemTimeAsFileTime
KERNEL32.dll914RtlUnwind
KERNEL32.dll82CompareStringA
KERNEL32.dll651GlobalFlags
KERNEL32.dll663GlobalUnlock
KERNEL32.dll656GlobalLock
KERNEL32.dll645GlobalAlloc
KERNEL32.dll652GlobalFree
KERNEL32.dll1193lstrcmpA
KERNEL32.dll459GetFileAttributesExW
KERNEL32.dll763LocalFileTimeToFileTime
KERNEL32.dll995SetFileTime
KERNEL32.dll85CompareStringW
KERNEL32.dll761LocalAlloc
KERNEL32.dll1076TlsGetValue
KERNEL32.dll659GlobalReAlloc
KERNEL32.dll655GlobalHandle
KERNEL32.dll1074TlsAlloc
KERNEL32.dll1077TlsSetValue
KERNEL32.dll768LocalReAlloc
KERNEL32.dll1075TlsFree
KERNEL32.dll633GetVolumeInformationW
KERNEL32.dll479GetFullPathNameW
KERNEL32.dll647GlobalDeleteAtom
KERNEL32.dll649GlobalFindAtomW
KERNEL32.dll644GlobalAddAtomW
USER32.dll69ClientToScreen
USER32.dll754ValidateRect
USER32.dll391GetWindowPlacement
USER32.dll445IsIconic
USER32.dll708SystemParametersInfoA
USER32.dll679SetWindowPos
USER32.dll316GetMenu
USER32.dll553PtInRect
USER32.dll79CopyRect
USER32.dll286GetDlgCtrlID
USER32.dll3AdjustWindowRectEx
USER32.dll566RegisterClassW
USER32.dll263GetClassInfoW
USER32.dll262GetClassInfoExW
USER32.dll104CreateWindowExW
USER32.dll269GetClientRect
USER32.dll634SetForegroundWindow
USER32.dll639SetMenu
USER32.dll323GetMenuItemID
USER32.dll499MapWindowPoints
USER32.dll332GetMessagePos
USER32.dll333GetMessageTime
USER32.dll160DestroyWindow
USER32.dll287GetDlgItem
USER32.dll292GetFocus
USER32.dll592RemovePropW
USER32.dll267GetClassNameW
USER32.dll265GetClassLongW
USER32.dll257GetCapture
USER32.dll768WinHelpW
USER32.dll471LoadIconW
USER32.dll404GrayStringW
USER32.dll61CheckMenuItem
USER32.dll207EnableMenuItem
USER32.dll513ModifyMenuW
USER32.dll465LoadBitmapW
USER32.dll318GetMenuCheckMarkDimensions
USER32.dll643SetMenuItemBitmaps
USER32.dll684SetWindowTextW
USER32.dll158DestroyMenu
USER32.dll381GetWindow
USER32.dll716ToUnicode
USER32.dll310GetKeyboardState
USER32.dll399GetWindowTextW
USER32.dll453IsWindow
USER32.dll293GetForegroundWindow
USER32.dll305GetKeyState
USER32.dll776wsprintfW
USER32.dll169DispatchMessageW
USER32.dll199DrawTextExW
USER32.dll200DrawTextW
USER32.dll711TabbedTextOutW
USER32.dll58CharUpperW
USER32.dll611SendMessageW
USER32.dll312GetLastActivePopup
USER32.dll454IsWindowEnabled
USER32.dll469LoadCursorW
USER32.dll364GetSysColor
USER32.dll365GetSysColorBrush
USER32.dll209EnableWindow
USER32.dll327GetMenuState
USER32.dll586RegisterWindowMessageW
USER32.dll322GetMenuItemCount
USER32.dll363GetSubMenu
USER32.dll373GetTopWindow
USER32.dll400GetWindowThreadProcessId
USER32.dll341GetParent
USER32.dll725TranslateMessage
USER32.dll540PeekMessageW
USER32.dll518MsgWaitForMultipleObjects
USER32.dll588ReleaseDC
USER32.dll367GetSystemMetrics
USER32.dll392GetWindowRect
USER32.dll504MessageBoxA
USER32.dll27CallNextHookEx
USER32.dll688SetWindowsHookExW
USER32.dll729UnhookWindowsHookEx
USER32.dll543PostMessageW
USER32.dll284GetDesktopWindow
USER32.dll345GetProcessWindowStation
USER32.dll378GetUserObjectInformationW
USER32.dll441IsDialogMessageW
USER32.dll511MessageBoxW
USER32.dll563RegisterClassA
USER32.dll103CreateWindowExA
USER32.dll696ShowWindow
USER32.dll334GetMessageW
USER32.dll734UnregisterClassA
USER32.dll670SetTimer
USER32.dll544PostQuitMessage
USER32.dll609SendMessageTimeoutA
USER32.dll242FindWindowExW
USER32.dll232EnumThreadWindows
USER32.dll241FindWindowExA
USER32.dll266GetClassNameA
USER32.dll386GetWindowLongW
USER32.dll656SetPropW
USER32.dll677SetWindowLongW
USER32.dll348GetPropW
USER32.dll396GetWindowTextA
USER32.dll29CallWindowProcW
USER32.dll150DefWindowProcW
USER32.dll775wsprintfA
USER32.dll282GetDC
USER32.dll383GetWindowDC
GDI32.dll659SetWindowExtEx
GDI32.dll656SetViewportOrgEx
GDI32.dll281Escape
GDI32.dll291ExtTextOutW
GDI32.dll672TextOutW
GDI32.dll581RectVisible
GDI32.dll577PtVisible
GDI32.dll426GetClipBox
GDI32.dll635SetMapMode
GDI32.dll653SetTextColor
GDI32.dll484GetObjectW
GDI32.dll46CreateCompatibleDC
GDI32.dll45CreateCompatibleBitmap
GDI32.dll600ScaleViewportExtEx
GDI32.dll649SetStretchBltMode
GDI32.dll666StretchBlt
GDI32.dll205DeleteDC
GDI32.dll208DeleteObject
GDI32.dll601ScaleWindowExtEx
GDI32.dll40CreateBitmap
GDI32.dll500GetStockObject
GDI32.dll655SetViewportExtEx
GDI32.dll606SelectObject
GDI32.dll613SetBkColor
GDI32.dll592RestoreDC
GDI32.dll599SaveDC
GDI32.dll437GetDeviceCaps
GDI32.dll549OffsetViewportOrgEx
ADVAPI32.dll554RegCloseKey
ADVAPI32.dll616RegQueryValueExW
ADVAPI32.dll563RegCreateKeyExW
ADVAPI32.dll627RegSetKeySecurity
ADVAPI32.dll589RegFlushKey
ADVAPI32.dll632RegSetValueExW
ADVAPI32.dll351GetUserNameW
ADVAPI32.dll615RegQueryValueExA
ADVAPI32.dll109ConvertStringSecurityDescriptorToSecurityDescriptorA
ADVAPI32.dll693SetSecurityInfo
ADVAPI32.dll327GetSecurityDescriptorSacl
ADVAPI32.dll110ConvertStringSecurityDescriptorToSecurityDescriptorW
ADVAPI32.dll688SetSecurityDescriptorDacl
ADVAPI32.dll369InitializeSecurityDescriptor
ADVAPI32.dll672SetEntriesInAclW
ADVAPI32.dll699SetThreadToken
ADVAPI32.dll700SetTokenInformation
ADVAPI32.dll304GetLengthSid
ADVAPI32.dll219DuplicateTokenEx
ADVAPI32.dll497OpenProcessToken
ADVAPI32.dll340GetTokenInformation
ADVAPI32.dll173CryptAcquireContextW
ADVAPI32.dll199CryptReleaseContext
ADVAPI32.dll192CryptGetHashParam
ADVAPI32.dll178CryptDestroyHash
ADVAPI32.dll196CryptHashData
ADVAPI32.dll175CryptCreateHash
ADVAPI32.dll215DeregisterEventSource
ADVAPI32.dll648ReportEventA
ADVAPI32.dll636RegisterEventSourceA
SHELL32.dll278ShellExecuteExA
SHELL32.dll124SHChangeNotify
SHELL32.dll217SHGetSpecialFolderPathA
SHELL32.dll138SHCreateDirectoryExW
SHELL32.dll280ShellExecuteW
SHELL32.dll165
ole32.dll61CoInitialize
ole32.dll107CoUninitialize
ole32.dll16CoCreateInstance
ole32.dll259OleRun
ole32.dll62CoInitializeEx
OLEAUT32.dll149
OLEAUT32.dll150
OLEAUT32.dll6
OLEAUT32.dll9
OLEAUT32.dll7
OLEAUT32.dll2
OLEAUT32.dll200
OLEAUT32.dll8
OLEAUT32.dll12
SHLWAPI.dll149PathStripPathW
SHLWAPI.dll363wnsprintfW
SHLWAPI.dll322StrStrIW
SHLWAPI.dll71PathFindExtensionW
SHLWAPI.dll69PathFileExistsW
SHLWAPI.dll330StrToIntExW
SHLWAPI.dll321StrStrIA
SHLWAPI.dll320StrStrA
SHLWAPI.dll269StrChrA
SHLWAPI.dll329StrToIntExA
SHLWAPI.dll271StrChrIW
SHLWAPI.dll48PathAddBackslashW
SHLWAPI.dll139PathRemoveFileSpecW
SHLWAPI.dll151PathStripToRootW
SHLWAPI.dll113PathIsUNCW
SHLWAPI.dll331StrToIntW
WSOCK32.dll4
WSOCK32.dll19
WSOCK32.dll16
WSOCK32.dll111
WSOCK32.dll151
WSOCK32.dll18
WSOCK32.dll15
WSOCK32.dll23
WSOCK32.dll116
WSOCK32.dll9
WSOCK32.dll10
WSOCK32.dll2
WSOCK32.dll3
WSOCK32.dll13
WSOCK32.dll1
WSOCK32.dll115
WSOCK32.dll22
WSOCK32.dll12
WSOCK32.dll7
WSOCK32.dll21
WSOCK32.dll57
WSOCK32.dll112
WSOCK32.dll17
WSOCK32.dll20
WSOCK32.dll5
WSOCK32.dll6
WSOCK32.dll52
WSOCK32.dll51
WSOCK32.dll8
WSOCK32.dll11
NETAPI32.dll254NetUserEnum
NETAPI32.dll111NetApiBufferFree
gdiplus.dll77GdipCreateBitmapFromHBITMAP
gdiplus.dll629GdiplusStartup
gdiplus.dll286GdipGetImageEncoders
gdiplus.dll287GdipGetImageEncodersSize
gdiplus.dll80GdipCreateBitmapFromScan0
gdiplus.dll33GdipAlloc
gdiplus.dll54GdipCloneImage
gdiplus.dll237GdipFree
gdiplus.dll152GdipDisposeImage
gdiplus.dll496GdipSaveImageToFile
gdiplus.dll628GdiplusShutdown
WININET.dll112InternetConnectA
WININET.dll153InternetOpenW
WININET.dll113InternetConnectW
WININET.dll87HttpOpenRequestW
WININET.dll150InternetOpenA
WININET.dll86HttpOpenRequestA
WININET.dll93HttpSendRequestW
WININET.dll106InternetCloseHandle
WININET.dll158InternetReadFile
WININET.dll154InternetQueryDataAvailable
RPCRT4.dll508UuidToStringW
RPCRT4.dll490RpcStringFreeW
RPCRT4.dll499UuidCreate
WS2_32.dll42WSAEventSelect
WS2_32.dll39WSAEnumNetworkEvents
WS2_32.dll27WSACloseEvent
WS2_32.dll32WSACreateEvent
OLEACC.dll4CreateStdAccessibleObject
OLEACC.dll20LresultFromObject
WINSPOOL.DRV29ClosePrinter
WINSPOOL.DRV143OpenPrinterW
WINSPOOL.DRV78DocumentPropertiesW
ordentry_vafunction_name
10x31a0testftp
20x3110z
module_nameHookTest.dll
flags0
timestamp2013-09-06 09:28:49
version0.0
ordinal_base1
nFunctions2
nNames2
Names(2)0x148ab0
Functions(2)0x148aa8
NameOrdinals(2)0x148ab8
offsetsizetypecomment
01483776DLL09/06/2013 09:28:51#
15c115HTM#
1126f345HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK