filenameSearchFolder.dll
size646144 (0x9dc00)
md56581b52e133cc6d00661c58968c7e212
typePE32 executable (DLL) (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe8

Rich Header

lib idversiontimes used
10725
1473072921
149307297
146307291
13230729149
1313072933
148307291
145307291

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x4ce7b9c8
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x2102
Magic0x10b
LinkerVersion9.0
SizeOfCode0x91600
SizeOfInitializedData0xc200
SizeOfUninitializedData0
AddressOfEntryPoint0x18c6
BaseOfCode0x1000
BaseOfData0x98000
ImageBase0x17750000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.1
ImageVersion6.1
SubsystemVersion6.1
Reserved10
SizeOfImage0xa0000
SizeOfHeaders0x400
CheckSum0xa332f
Subsystem2
DllCharacteristics0x140
SizeOfStackReserve0x40000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v7.0 DLL

Sections

namevavsizeraw sizeflags
.text0x10000x914e50x91600R-X CODE
.data0x930000xfa80x1000RW- IDATA
.rsrc0x940000x48480x4a00R-- IDATA
.reloc0x990000x66900x6800R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x29080xa9
IMPORT0x90a680xc8
RESOURCE0x940000x4848
EXCEPTION00
SECURITY00
BASERELOC0x990000x6690
DEBUG0x924800x38
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x4a6300x40
Bound_IAT0x2800x104
IAT0x10000x5f8
Delay_IAT0x8fd040x160
CLR_Header00
typenamesizecp
MUI#12240
XML#327902480
XML#327922480
ICON#196400
ICON#242640
ICON#311280
GROUP_ICON#323480
VERSION#19200
MANIFEST#12311750
module_namehintordfunction_name
msvcrt.dll1259memcpy_s
msvcrt.dll968_vsnprintf
msvcrt.dll1224iswalnum
msvcrt.dll1227iswcntrl
msvcrt.dll1234iswspace
msvcrt.dll1232iswprint
msvcrt.dll774_resetstkoflw
msvcrt.dll1383wcstok_s
msvcrt.dll1127_wtof
msvcrt.dll1260memmove
msvcrt.dll1129_wtoi
msvcrt.dll1361wcschr
msvcrt.dll1225iswalpha
msvcrt.dll974_vsnwprintf
msvcrt.dll1258memcpy
msvcrt.dll1326swprintf_s
msvcrt.dll345_except_handler4_common
msvcrt.dll578_lock
msvcrt.dll141__dllonexit
msvcrt.dll934_unlock
msvcrt.dll257_amsg_exit
msvcrt.dll469_initterm
msvcrt.dll1190free
msvcrt.dll1246malloc
msvcrt.dll106_XcptFilter
msvcrt.dll405_ftol2_sse
msvcrt.dll747_onexit
msvcrt.dll1262memset
ntdll.dll56EtwEventUnregister
ntdll.dll57EtwEventWrite
ntdll.dll53EtwEventEnabled
ntdll.dll55EtwEventRegister
API-MS-WIN-Service-Management-L1-1-0.dll5OpenServiceW
API-MS-WIN-Service-Management-L1-1-0.dll6StartServiceW
API-MS-WIN-Service-Management-L1-1-0.dll4OpenSCManagerW
API-MS-WIN-Service-Management-L1-1-0.dllCloseServiceHandle
API-MS-WIN-Service-Management-L2-1-0.dll1ChangeServiceConfigW
API-MS-WIN-Service-Management-L2-1-0.dll6QueryServiceStatusEx
USER32.dll441InsertMenuItemW
USER32.dllActivateKeyboardLayout
USER32.dll106CreateMenu
USER32.dll344GetMenuStringW
USER32.dll442InsertMenuW
USER32.dll288GetCursorPos
USER32.dll412GetWindowRect
USER32.dll338GetMenuItemID
USER32.dll337GetMenuItemCount
USER32.dll340GetMenuItemInfoW
USER32.dll317GetKeyState
USER32.dll505LoadStringA
USER32.dll318GetKeyboardLayout
USER32.dll45CharLowerBuffW
USER32.dll636SendMessageW
USER32.dll506LoadStringW
USER32.dll158DeleteMenu
USER32.dll46CharLowerW
USER32.dll592RegisterClipboardFormatW
USER32.dll503LoadMenuW
USER32.dll378GetSubMenu
USER32.dll615RemoveMenu
USER32.dll164DestroyMenu
SHELL32.dll740
SHELL32.dll182SHGetDesktopFolder
SHELL32.dll223SHGetSpecialFolderLocation
SHELL32.dll117SHBindToFolderIDListParent
SHELL32.dll118SHBindToFolderIDListParentEx
SHELL32.dll24
SHELL32.dll681
SHELL32.dll154
SHELL32.dll64
SHELL32.dll153
SHELL32.dll815
SHELL32.dll704
SHELL32.dll155
SHELL32.dll147SHCreateItemWithParent
SHELL32.dll25
SHELL32.dll143SHCreateItemFromIDList
SHELL32.dll196SHGetIDListFromObject
SHELL32.dll818
SHELL32.dll17
SHELL32.dll16
SHELL32.dll246SHParseDisplayName
SHELL32.dll264SHSetLocalizedName
SHELL32.dll194SHGetFolderPathEx
SHELL32.dll157SHCreateShellItemArrayFromIDLists
SHELL32.dll880
SHELL32.dll146SHCreateItemInKnownFolder
SHELL32.dll158SHCreateShellItemArrayFromShellItem
SHELL32.dll874
SHELL32.dll876
SHELL32.dll120SHBindToParent
SHELL32.dll18
SHELL32.dll825
SHELL32.dll74
SHELL32.dll135SHCreateDataObject
SHELL32.dll171
SHELL32.dll19
SHELL32.dll264
SHELL32.dll241
SHELL32.dll203SHGetKnownFolderIDList
SHELL32.dll119SHBindToObject
SHELL32.dll102
SHELL32.dll830
SHELL32.dll814
SHELL32.dll849
SHELL32.dll296Shell_GetCachedImageIndexW
SHELL32.dll823
SHELL32.dll127SHChangeNotify
SHELL32.dll898
SHELL32.dll205SHGetKnownFolderPath
SHELL32.dll767
SHELL32.dll137SHCreateDefaultExtractIcon
SHELL32.dll136SHCreateDefaultContextMenu
SHELL32.dll1AssocCreateForClasses
SHELL32.dll851
SHELL32.dll781
SHELL32.dll68
SHELL32.dll256
SHELL32.dll866
SHELL32.dll791
SHELL32.dll144SHCreateItemFromParsingName
SHELL32.dll819
SHELL32.dll6
SHELL32.dll204SHGetKnownFolderItem
SHELL32.dll168SHEvaluateSystemCommandTemplate
SHELL32.dll51
SHELL32.dll895
SHELL32.dll824
SHELL32.dll847
SHELL32.dll147
SHELL32.dll817
SHELL32.dll100
SHELL32.dll90
SHELL32.dll289ShellExecuteExW
SHELL32.dll214SHGetPathFromIDListEx
SHELL32.dll27
SHELL32.dll846
SHELL32.dll21
SHELL32.dll850
SHELL32.dll844
SHELL32.dll816
SHELL32.dll208SHGetNameFromIDList
SHELL32.dll23
SHELL32.dll95
SHELL32.dll152
SHELL32.dll702
SHELL32.dll788
SHELL32.dll2AssocGetDetailsOfPropKey
SHELL32.dll789
SHELL32.dll873
SHELL32.dll75
SHLWAPI.dll199
SHLWAPI.dll219
SHLWAPI.dll212
SHLWAPI.dll184
SHLWAPI.dll255SHStrDupW
SHLWAPI.dll460
SHLWAPI.dll596
SHLWAPI.dll597
SHLWAPI.dll295StrDupW
SHLWAPI.dll170SHCreateStreamOnFileEx
SHLWAPI.dll52PathAppendW
SHLWAPI.dll158
SHLWAPI.dll487
SHLWAPI.dll213
SHLWAPI.dll520
SHLWAPI.dll276StrChrW
SHLWAPI.dll156
SHLWAPI.dll73PathFindFileNameW
SHLWAPI.dll139PathRemoveFileSpecW
SHLWAPI.dll66PathCreateFromUrlAlloc
SHLWAPI.dll361UrlIsW
SHLWAPI.dll63PathCompactPathExW
SHLWAPI.dll217
SHLWAPI.dll154
SHLWAPI.dll334StrToIntW
SHLWAPI.dll629
SHLWAPI.dll363UrlUnescapeW
SHLWAPI.dll176
SHLWAPI.dll125PathParseIconLocationW
SHLWAPI.dll388
SHLWAPI.dll636
SHLWAPI.dll24
SHLWAPI.dll137PathRemoveExtensionW
SHLWAPI.dll325StrStrIW
SHLWAPI.dllAssocCreate
SHLWAPI.dll291StrCmpW
SHLWAPI.dll113PathIsUNCW
SHLWAPI.dll544
SHLWAPI.dll175
SHLWAPI.dll16
SHLWAPI.dll133PathRemoveBackslashW
SHLWAPI.dll323StrStrA
SHLWAPI.dll355UrlHashW
SHLWAPI.dll29
SHLWAPI.dll344UrlCompareW
SHLWAPI.dll69PathFileExistsW
SHLWAPI.dll331
SHLWAPI.dll348UrlEscapeW
SHLWAPI.dll67PathCreateFromUrlW
SHLWAPI.dll290StrCmpNW
SHLWAPI.dll333StrToIntExW
SHLWAPI.dll122PathMatchSpecExW
SHLWAPI.dll214
SHLWAPI.dll54PathBuildRootW
SHLWAPI.dll534
SHLWAPI.dll331StrToIntA
SHLWAPI.dll326StrStrNIW
SHLWAPI.dll318StrRetToBufW
SHLWAPI.dll282StrCmpLogicalW
SHLWAPI.dll456
SHLWAPI.dll147PathSkipRootW
SHLWAPI.dll216
SHLWAPI.dll236
SHLWAPI.dll344
SHLWAPI.dll615
SHLWAPI.dll151PathStripToRootW
SHLWAPI.dll193
SHLWAPI.dll157
SHLWAPI.dll515
SHLWAPI.dll494
SHLWAPI.dll336StrTrimW
SHLWAPI.dll85PathGetDriveNumberW
SHLWAPI.dll309StrPBrkW
SHLWAPI.dll611
SHLWAPI.dll317
SHLWAPI.dll507
SHLWAPI.dll508
SHLWAPI.dll152
SHLWAPI.dll254SHStrDupA
SHLWAPI.dll215
SHLWAPI.dll476
SHLWAPI.dll316StrRetToBSTR
SHLWAPI.dll320StrRetToStrW
SHLWAPI.dll632
SHLWAPI.dll232SHRegGetValueW
SHLWAPI.dll103PathIsRootW
SHLWAPI.dll15
SHLWAPI.dll172
SHLWAPI.dll313StrRChrW
SHLWAPI.dll123PathMatchSpecW
SHLWAPI.dll131PathRemoveArgsW
SHLWAPI.dll135PathRemoveBlanksW
SHLWAPI.dll630
SHLWAPI.dll618
SHLWAPI.dll211SHQueryValueExW
SHLWAPI.dll81PathGetArgsW
SHLWAPI.dll71PathFindExtensionW
SHLWAPI.dll115PathIsURLW
SHLWAPI.dll266StrCSpnW
SHLWAPI.dll2
SHLWAPI.dll174
SHLWAPI.dll637
SHLWAPI.dll477
SHLWAPI.dll164
SHLWAPI.dll12
SHLWAPI.dll281StrCmpIW
SHLWAPI.dll97PathIsNetworkPathW
SHLWAPI.dll289StrCmpNIW
SHLWAPI.dll168
SHLWAPI.dll328StrStrW
KERNEL32.dll359GetACP
KERNEL32.dll846LocaleNameToLCID
KERNEL32.dll1037ResolveLocaleName
KERNEL32.dll627GetSystemPreferredUILanguages
KERNEL32.dll850LockResource
KERNEL32.dll704GlobalReAlloc
KERNEL32.dll662GetTimeZoneInformation
KERNEL32.dll766IsDBCSLeadByteEx
KERNEL32.dll1344lstrcmpiA
KERNEL32.dll765IsDBCSLeadByte
KERNEL32.dll613GetStringTypeExA
KERNEL32.dll104ConvertCalDateTimeToSystemTime
KERNEL32.dll108ConvertSystemTimeToCalDateTime
KERNEL32.dll1210SystemTimeToTzSpecificLocalTime
KERNEL32.dll1228TzSpecificLocalTimeToSystemTime
KERNEL32.dll292FileTimeToSystemTime
KERNEL32.dll451GetCurrentThread
KERNEL32.dll812LCMapStringW
KERNEL32.dll978RegGetValueW
KERNEL32.dll617GetSystemDefaultLCID
KERNEL32.dll1345lstrcmpiW
KERNEL32.dll615GetStringTypeW
KERNEL32.dll466GetDriveTypeW
KERNEL32.dll1108SetErrorMode
KERNEL32.dll869MultiByteToWideChar
KERNEL32.dll1035ResetEvent
KERNEL32.dll231DuplicateHandle
KERNEL32.dll842LocalReAlloc
KERNEL32.dll1219TlsGetValue
KERNEL32.dll1220TlsSetValue
KERNEL32.dll532GetModuleHandleExW
KERNEL32.dll1341lstrcmpA
KERNEL32.dll512GetLocalTime
KERNEL32.dll349FormatMessageW
KERNEL32.dll332FindResourceExW
KERNEL32.dll333FindResourceW
KERNEL32.dll1197SizeofResource
KERNEL32.dll832LoadResource
KERNEL32.dll830LoadLibraryW
KERNEL32.dll529GetModuleFileNameW
KERNEL32.dll195DeactivateActCtx
KERNEL32.dll2ActivateActCtx
KERNEL32.dll1013ReleaseActCtx
KERNEL32.dll120CreateActCtxW
KERNEL32.dll533GetModuleHandleW
KERNEL32.dll1293WideCharToMultiByte
KERNEL32.dll1353lstrlenA
KERNEL32.dll674GetVersionExW
KERNEL32.dll1184SetUnhandledExceptionFilter
KERNEL32.dll1231UnhandledExceptionFilter
KERNEL32.dll447GetCurrentProcess
KERNEL32.dll1212TerminateProcess
KERNEL32.dll448GetCurrentProcessId
KERNEL32.dll452GetCurrentThreadId
KERNEL32.dll657GetTickCount
KERNEL32.dll931QueryPerformanceCounter
KERNEL32.dll1198Sleep
KERNEL32.dll828LoadLibraryExA
KERNEL32.dll353FreeLibrary
KERNEL32.dll578GetProcAddress
KERNEL32.dll205DelayLoadFailureHook
KERNEL32.dll514GetLocaleInfoEx
KERNEL32.dll631GetSystemTimeAsFileTime
KERNEL32.dll1240UpdateCalendarDayOfWeek
KERNEL32.dll95CompareCalendarDates
KERNEL32.dll380GetCalendarSupportedDateRange
KERNEL32.dll15AdjustCalendarDate
KERNEL32.dll319FindNLSString
KERNEL32.dll747InterlockedExchange
KERNEL32.dll665GetUserDefaultLCID
KERNEL32.dll96CompareFileTime
KERNEL32.dll1109SetEvent
KERNEL32.dll1267WaitForMultipleObjects
KERNEL32.dll1269WaitForSingleObject
KERNEL32.dll133CreateEventW
KERNEL32.dll744InterlockedCompareExchange
KERNEL32.dll705GlobalSize
KERNEL32.dll701GlobalLock
KERNEL32.dll708GlobalUnlock
KERNEL32.dll1342lstrcmpW
KERNEL32.dll1234UnmapViewOfFile
KERNEL32.dll82CloseHandle
KERNEL32.dll100CompareStringW
KERNEL32.dll99CompareStringOrdinal
KERNEL32.dll658GetTickCount64
KERNEL32.dll1017ReleaseSRWLockShared
KERNEL32.dll1AcquireSRWLockShared
KERNEL32.dll1016ReleaseSRWLockExclusive
KERNEL32.dllAcquireSRWLockExclusive
KERNEL32.dll743InitializeSRWLock
KERNEL32.dll643GetTempPathW
KERNEL32.dll511GetLastError
KERNEL32.dll839LocalFree
KERNEL32.dll690GlobalAlloc
KERNEL32.dll697GlobalFree
KERNEL32.dll629GetSystemTime
KERNEL32.dll1209SystemTimeToFileTime
KERNEL32.dll237EnterCriticalSection
KERNEL32.dll824LeaveCriticalSection
KERNEL32.dll835LocalAlloc
KERNEL32.dll1354lstrlenW
KERNEL32.dll221DisableThreadLibraryCalls
KERNEL32.dll208DeleteCriticalSection
KERNEL32.dll738InitializeCriticalSection
KERNEL32.dll1217TlsAlloc
KERNEL32.dll1218TlsFree
KERNEL32.dll746InterlockedDecrement
KERNEL32.dll750InterlockedIncrement
KERNEL32.dll718HeapFree
KERNEL32.dll583GetProcessHeap
KERNEL32.dll714HeapAlloc
GDI32.dll230DeleteObject
ordentry_vafunction_name
10x29b6DllCanUnloadNow
20x3e5eDllGetClassObject
30x4a698DllRegisterServer
40x4a698DllUnregisterServer
module_nameSearchFolder.dll
flags0
timestamp2010-11-20 09:44:42
version0.0
ordinal_base1
nFunctions4
nNames4
Names(4)0x2940
Functions(4)0x2930
NameOrdinals(4)0x2950

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionSearchFolder
FileVersion6.1.7601.17514 (win7sp1_rtm.101119-1850)
InternalNameSearchFolder
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenameSearchFolder.dll
ProductNameMicrosoft® Windows® Operating System
ProductVersion6.1.7601.17514

VS_FIXEDFILEINFO

FileVersion6.1.7601.17514
ProductVersion6.1.7601.17514
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
0646144DLL11/20/2010 12:06:32#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x280