filenamedeviceaccess.dll
size147968 (0x24200)
md54491e85c62a83cb3be7b82da974f73c4
typePE32 executable (DLL) (console) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf0

Rich Header

lib idversiontimes used
1473072968
205655015
207655011
10283
203655019
202655011
2166550158
2066550120
201655011
204655011

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections7
TimeDateStamp0x52df5c17
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x2102
Magic0x10b
LinkerVersion11.0
SizeOfCode0x1ce00
SizeOfInitializedData0x7600
SizeOfUninitializedData0
AddressOfEntryPoint0x7879
BaseOfCode0x1000
BaseOfData0x1f000
ImageBase0x10000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.3
ImageVersion6.3
SubsystemVersion6.3
Reserved10
SizeOfImage0x29000
SizeOfHeaders0x400
CheckSum0x2df3c
Subsystem3
DllCharacteristics0x140
SizeOfStackReserve0x40000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v7.0 DLL

Sections

namevavsizeraw sizeflags
.text0x10000x1c9860x1ca00R-X CODE
.orpc0x1e0000x2cc0x400R-X CODE
.data0x1f0000x90c0x400RW- IDATA
.idata0x200000x21160x2200R-- IDATA
minATL0x230000x180x200R-- IDATA
.rsrc0x240000x1df00x1e00R-- IDATA
.reloc0x260000x29a60x2a00R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x1d8d00xb6
IMPORT0x204000x2e4
RESOURCE0x240000x1df0
EXCEPTION00
SECURITY00
BASERELOC0x260000x1ac8
DEBUG0x10200x38
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x2dd00x5c
Bound_IAT00
IAT0x200000x400
Delay_IAT0x1d4340x160
CLR_Header00
typenamesizecp
MUI#12400
WEVT_TEMPLATE#154260
VERSION#19640
MANIFEST#26660
module_namehintordfunction_name
msvcrt.dll779_onexit
msvcrt.dll159__dllonexit
msvcrt.dll966_unlock
msvcrt.dll123__CxxFrameHandler3
msvcrt.dll490_initterm
msvcrt.dll1279malloc
msvcrt.dll1223free
msvcrt.dll275_amsg_exit
msvcrt.dll113_XcptFilter
msvcrt.dll1006_vsnwprintf
msvcrt.dll364_except_handler4_common
msvcrt.dll1291memcpy
msvcrt.dll1290memcmp
msvcrt.dll1409wcsrchr
msvcrt.dll1394wcschr
msvcrt.dll610_lock
msvcrt.dll796_purecall
msvcrt.dll1295memset
ntdll.dll1511WinSqmAddToStream
ntdll.dll924RtlGUIDFromString
ntdll.dll1529WinSqmIsOptedInEx
ntdll.dll1135RtlNtStatusToDosErrorNoTeb
ntdll.dll723RtlCompareUnicodeString
ntdll.dll437NtQueryInformationToken
ntdll.dll804RtlDeleteCriticalSection
ntdll.dll917RtlFreeHeap
ntdll.dll1198RtlReAllocateHeap
ntdll.dll671RtlAllocateHeap
ntdll.dll1155RtlPublishWnfStateData
ntdll.dll301NtDeleteWnfStateName
ntdll.dll286NtCreateWnfStateName
ntdll.dll641RtlAddAccessAllowedAce
ntdll.dll630RtlAbsoluteToSelfRelativeSD
ntdll.dll1095RtlLengthSecurityDescriptor
ntdll.dll1267RtlSetOwnerSecurityDescriptor
ntdll.dll1254RtlSetDaclSecurityDescriptor
ntdll.dll642RtlAddAccessAllowedAceEx
ntdll.dll754RtlCreateAcl
ntdll.dll772RtlCreateSecurityDescriptor
ntdll.dll668RtlAllocateAndInitializeSid
ntdll.dll434NtQueryInformationProcess
ntdll.dll720RtlCompareMemory
ntdll.dll537NtSetInformationProcess
ntdll.dll1007RtlInitUnicodeString
ntdll.dll1134RtlNtStatusToDosError
ntdll.dll252NtCreateFile
api-ms-win-eventing-classicprovider-l1-1-0.dll5TraceMessage
api-ms-win-eventing-classicprovider-l1-1-0.dll7UnregisterTraceGuids
api-ms-win-eventing-classicprovider-l1-1-0.dll1GetTraceEnableLevel
api-ms-win-eventing-classicprovider-l1-1-0.dll3RegisterTraceGuidsW
api-ms-win-eventing-classicprovider-l1-1-0.dll2GetTraceLoggerHandle
api-ms-win-eventing-classicprovider-l1-1-0.dllGetTraceEnableFlags
api-ms-win-core-file-l1-2-1.dll5CreateFileW
api-ms-win-core-errorhandling-l1-1-1.dll11UnhandledExceptionFilter
api-ms-win-core-errorhandling-l1-1-1.dll3GetLastError
api-ms-win-core-errorhandling-l1-1-1.dll10SetUnhandledExceptionFilter
api-ms-win-core-errorhandling-l1-1-1.dll4RaiseException
api-ms-win-core-registry-l1-1-0.dll28RegOpenKeyExW
api-ms-win-core-registry-l1-1-0.dll7RegDeleteTreeW
api-ms-win-core-registry-l1-1-0.dllRegCloseKey
api-ms-win-core-registry-l1-1-0.dll12RegEnumKeyExW
api-ms-win-core-registry-l1-1-0.dll31RegQueryInfoKeyW
api-ms-win-core-registry-l1-1-0.dll40RegSetValueExW
api-ms-win-core-registry-l1-1-0.dll9RegDeleteValueW
api-ms-win-core-registry-l1-1-0.dll3RegCreateKeyExW
api-ms-win-core-registry-l1-1-0.dll5RegDeleteKeyExW
api-ms-win-core-registry-l1-1-0.dll33RegQueryValueExW
api-ms-win-core-registry-l1-1-0.dll18RegGetValueW
api-ms-win-core-registry-l1-1-0.dll26RegOpenCurrentUser
api-ms-win-core-processthreads-l1-1-2.dll63TerminateProcess
api-ms-win-core-processthreads-l1-1-2.dll44OpenThreadToken
api-ms-win-core-processthreads-l1-1-2.dll18GetExitCodeProcess
api-ms-win-core-processthreads-l1-1-2.dll5CreateThread
api-ms-win-core-processthreads-l1-1-2.dll15GetCurrentThread
api-ms-win-core-processthreads-l1-1-2.dll16GetCurrentThreadId
api-ms-win-core-processthreads-l1-1-2.dll43OpenThread
api-ms-win-core-processthreads-l1-1-2.dll41OpenProcess
api-ms-win-core-processthreads-l1-1-2.dll12GetCurrentProcessId
api-ms-win-core-processthreads-l1-1-2.dll11GetCurrentProcess
api-ms-win-core-processthreads-l1-1-2.dll42OpenProcessToken
api-ms-win-security-base-l1-2-0.dll44FreeSid
api-ms-win-security-base-l1-2-0.dll63GetSidSubAuthorityCount
api-ms-win-security-base-l1-2-0.dll64GetTokenInformation
api-ms-win-security-base-l1-2-0.dll42EqualSid
api-ms-win-security-base-l1-2-0.dll38DuplicateToken
api-ms-win-security-base-l1-2-0.dll62GetSidSubAuthority
api-ms-win-security-base-l1-2-0.dll51GetLengthSid
api-ms-win-security-base-l1-2-0.dll30CopySid
api-ms-win-security-base-l1-2-0.dll26CheckTokenCapability
api-ms-win-security-base-l1-2-0.dll22AllocateAndInitializeSid
api-ms-win-core-heap-l1-2-0.dll6HeapFree
api-ms-win-core-heap-l1-2-0.dll2HeapAlloc
api-ms-win-core-heap-l1-2-0.dllGetProcessHeap
api-ms-win-core-com-l1-1-1.dll63CoTaskMemFree
api-ms-win-core-com-l1-1-1.dll5CoCopyProxy
api-ms-win-core-com-l1-1-1.dll59CoSetProxyBlanket
api-ms-win-core-com-l1-1-1.dll71CreateStreamOnHGlobal
api-ms-win-core-com-l1-1-1.dll45CoMarshalInterface
api-ms-win-core-com-l1-1-1.dll53CoReleaseMarshalData
api-ms-win-core-com-l1-1-1.dll69CoWaitForMultipleHandles
api-ms-win-core-com-l1-1-1.dll78RoGetAgileReference
api-ms-win-core-com-l1-1-1.dll56CoRevertToSelf
api-ms-win-core-com-l1-1-1.dll36CoImpersonateClient
api-ms-win-core-com-l1-1-1.dll6CoCreateFreeThreadedMarshaler
api-ms-win-core-com-l1-1-1.dll8CoCreateInstance
api-ms-win-core-com-l1-1-1.dll38CoInitializeEx
api-ms-win-core-com-l1-1-1.dll62CoTaskMemAlloc
api-ms-win-core-com-l1-1-1.dll66CoUninitialize
api-ms-win-core-com-l1-1-1.dll80StringFromGUID2
api-ms-win-core-handle-l1-1-0.dll1DuplicateHandle
api-ms-win-core-handle-l1-1-0.dllCloseHandle
api-ms-win-core-libraryloader-l1-2-0.dll24LoadStringW
api-ms-win-core-libraryloader-l1-2-0.dll19GetProcAddress
api-ms-win-core-libraryloader-l1-2-0.dll17GetModuleHandleExW
api-ms-win-core-libraryloader-l1-2-0.dll1DisableThreadLibraryCalls
api-ms-win-core-libraryloader-l1-2-0.dll10FreeLibrary
api-ms-win-core-synch-l1-2-0.dll6CreateEventW
api-ms-win-core-synch-l1-2-0.dll27LeaveCriticalSection
api-ms-win-core-synch-l1-2-0.dll15EnterCriticalSection
api-ms-win-core-synch-l1-2-0.dll35ReleaseSRWLockShared
api-ms-win-core-synch-l1-2-0.dll19InitOnceExecuteOnce
api-ms-win-core-synch-l1-2-0.dll51WaitForSingleObject
api-ms-win-core-synch-l1-2-0.dll39SetEvent
api-ms-win-core-synch-l1-2-0.dll5CreateEventExW
api-ms-win-core-synch-l1-2-0.dll1AcquireSRWLockShared
api-ms-win-core-synch-l1-2-0.dll22InitializeCriticalSection
api-ms-win-core-synch-l1-2-0.dllAcquireSRWLockExclusive
api-ms-win-core-synch-l1-2-0.dll34ReleaseSRWLockExclusive
api-ms-win-core-synch-l1-2-0.dll37ResetEvent
api-ms-win-core-synch-l1-2-0.dll13DeleteCriticalSection
api-ms-win-core-synch-l1-2-0.dll43Sleep
api-ms-win-core-winrt-error-l1-1-1.dll10RoOriginateErrorW
api-ms-win-core-winrt-error-l1-1-1.dll18SetRestrictedErrorInfo
api-ms-win-core-winrt-error-l1-1-1.dllGetRestrictedErrorInfo
api-ms-win-core-winrt-error-l1-1-1.dll6RoGetMatchingRestrictedErrorInfo
api-ms-win-core-winrt-error-l1-1-1.dll16RoTransformError
api-ms-win-core-winrt-error-l1-1-1.dll9RoOriginateError
api-ms-win-core-winrt-error-l1-1-1.dll1IsErrorPropagationEnabled
api-ms-win-core-winrt-error-l1-1-1.dll12RoReportFailedDelegate
api-ms-win-core-util-l1-1-0.dll1DecodePointer
api-ms-win-core-util-l1-1-0.dll3EncodePointer
api-ms-win-core-winrt-string-l1-1-0.dll18WindowsStringHasEmbeddedNull
api-ms-win-core-winrt-string-l1-1-0.dll7WindowsCreateStringReference
api-ms-win-core-winrt-string-l1-1-0.dll12WindowsGetStringRawBuffer
api-ms-win-core-winrt-string-l1-1-0.dll14WindowsIsStringEmpty
api-ms-win-core-winrt-string-l1-1-0.dll6WindowsCreateString
api-ms-win-core-io-l1-1-1.dll1CancelIoEx
api-ms-win-core-io-l1-1-1.dll4DeviceIoControl
api-ms-win-core-io-l1-1-1.dll6GetOverlappedResultEx
api-ms-win-core-io-l1-1-1.dll2CancelSynchronousIo
api-ms-win-core-threadpool-l1-2-0.dll30StartThreadpoolIo
api-ms-win-core-threadpool-l1-2-0.dll1CancelThreadpoolIo
api-ms-win-core-threadpool-l1-2-0.dll5CloseThreadpoolIo
api-ms-win-core-threadpool-l1-2-0.dll32TrySubmitThreadpoolCallback
api-ms-win-core-threadpool-l1-2-0.dll8CloseThreadpoolWork
api-ms-win-core-threadpool-l1-2-0.dll36WaitForThreadpoolWorkCallbacks
api-ms-win-core-threadpool-l1-2-0.dll16FreeLibraryWhenCallbackReturns
api-ms-win-core-threadpool-l1-2-0.dll11CreateThreadpoolIo
api-ms-win-core-threadpool-l1-2-0.dll14CreateThreadpoolWork
api-ms-win-core-threadpool-l1-2-0.dll31SubmitThreadpoolWork
api-ms-win-core-threadpool-l1-2-0.dll33WaitForThreadpoolIoCallbacks
api-ms-win-security-sddl-l1-1-0.dll3ConvertStringSidToSidW
api-ms-win-security-sddl-l1-1-0.dll1ConvertSidToStringSidW
api-ms-win-core-winrt-l1-1-0.dll1RoGetActivationFactory
api-ms-win-core-sysinfo-l1-2-1.dll17GetSystemTimeAsFileTime
api-ms-win-core-sysinfo-l1-2-1.dll22GetTickCount64
api-ms-win-core-sysinfo-l1-2-1.dll21GetTickCount
api-ms-win-core-debug-l1-1-1.dll5IsDebuggerPresent
api-ms-win-eventing-provider-l1-1-0.dll3EventRegister
api-ms-win-eventing-provider-l1-1-0.dll5EventUnregister
api-ms-win-eventing-provider-l1-1-0.dll6EventWrite
api-ms-win-core-string-l1-1-0.dll1CompareStringOrdinal
api-ms-win-core-profile-l1-1-0.dllQueryPerformanceCounter
RPCRT4.dll311NdrStubForwardingFunction
RPCRT4.dll310NdrStubCall2
RPCRT4.dll17IUnknown_Release_Proxy
RPCRT4.dll264NdrOleFree
RPCRT4.dll15IUnknown_AddRef_Proxy
RPCRT4.dllCStdStubBuffer_AddRef
RPCRT4.dll2CStdStubBuffer_CountRefs
RPCRT4.dll3CStdStubBuffer_DebugServerQueryInterface
RPCRT4.dll8CStdStubBuffer_QueryInterface
RPCRT4.dll4CStdStubBuffer_DebugServerRelease
RPCRT4.dll5CStdStubBuffer_Disconnect
RPCRT4.dll16IUnknown_QueryInterface_Proxy
RPCRT4.dll7CStdStubBuffer_IsIIDSupported
RPCRT4.dll206NdrDllGetClassObject
RPCRT4.dll1CStdStubBuffer_Connect
RPCRT4.dll6CStdStubBuffer_Invoke
RPCRT4.dll78I_RpcOpenClientProcess
RPCRT4.dll446RpcServerInqCallAttributesW
RPCRT4.dll153NdrCStdStubBuffer_Release
RPCRT4.dll152NdrCStdStubBuffer2_Release
RPCRT4.dll205NdrDllCanUnloadNow
RPCRT4.dll263NdrOleAllocate
api-ms-win-core-string-obsolete-l1-1-0.dll4lstrcmpiW
api-ms-win-core-heap-obsolete-l1-1-0.dll10LocalFree
api-ms-win-core-kernel32-legacy-l1-1-1.dll68WaitForMultipleObjects
api-ms-win-core-kernel32-legacy-l1-1-1.dll37GetSystemPowerStatus
api-ms-win-devices-query-l1-1-1.dll9DevFreeObjects
api-ms-win-devices-query-l1-1-1.dll10DevGetObjectProperties
api-ms-win-devices-query-l1-1-1.dll8DevFreeObjectProperties
api-ms-win-devices-query-l1-1-1.dll12DevGetObjects
api-ms-win-core-wow64-l1-1-0.dllIsWow64Process
api-ms-win-core-apiquery-l1-1-0.dllApiSetQueryApiSetPresence
combase.dll8
combase.dll4
combase.dll9
combase.dll3
combase.dll34
combase.dll5
combase.dll32
combase.dll6
combase.dll7
combase.dll33
combase.dll2
api-ms-win-core-localization-l1-2-1.dll48LCMapStringW
api-ms-win-core-atoms-l1-1-0.dll15GlobalGetAtomNameW
api-ms-win-core-delayload-l1-1-1.dll1ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-1.dllDelayLoadFailureHook
ordentry_vafunction_name
10xdcf7CreateDeviceAccessInstance
20x73a0DllCanUnloadNow
30xcbd8DllGetActivationFactory
40x6d90DllGetClassObject
module_namedeviceaccess.dll
flags0
timestamp2014-01-22 01:29:26
version0.0
ordinal_base1
nFunctions4
nNames4
Names(4)0x1d908
Functions(4)0x1d8f8
NameOrdinals(4)0x1d918

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionDevice Broker And Policy COM Server
FileVersion6.3.9600.16519 (winblue_gdr.140121-1609)
InternalNameDeviceAccess
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenameDeviceAccess.dll
ProductNameMicrosoft® Windows® Operating System
ProductVersion6.3.9600.16519

VS_FIXEDFILEINFO

FileVersion6.3.9600.16519
ProductVersion6.3.9600.16519
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
0147968DLL01/22/2014 05:50:15#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK