filenamedm.unpacked.dll 919720 10752.dll
size10752 (0x2a00)
md57665a88d9ce5c28f7e38b24469728218
typePE32 executable (native) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xd8

Rich Header

lib idversiontimes used
1036
147307295
149307293
1313072910
148307291
145307291

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections6
TimeDateStamp0x4fec6349
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion9.0
SizeOfCode0x1c00
SizeOfInitializedData0xa00
SizeOfUninitializedData0
AddressOfEntryPoint0x4dbe
BaseOfCode0x1000
BaseOfData0x2000
ImageBase0x10000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.1
ImageVersion6.1
SubsystemVersion6.1
Reserved10
SizeOfImage0x8000
SizeOfHeaders0x400
CheckSum0x5e31
Subsystem1
DllCharacteristics0
SizeOfStackReserve0x40000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x6320x800R-X CODE
.rdata0x20000x1b40x200R-- IDATA
.data0x30000x1f80x200RW- IDATA
INIT0x40000x133c0x1400RWX CODE DISCARDABLE
.rsrc0x60000x3000x400R-- IDATA DISCARDABLE
.reloc0x70000x1dc0x200R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x4f9c0x3c
RESOURCE0x60000x300
EXCEPTION00
SECURITY00
BASERELOC0x70000x184
DEBUG0x20a00x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x20c00x40
Bound_IAT00
IAT0x20000x98
Delay_IAT00
CLR_Header00
typenamesizecp
VERSION#16680
module_namehintordfunction_name
ntoskrnl.exe1518RtlInitUnicodeString
ntoskrnl.exe2127memset
ntoskrnl.exe1302PsGetVersion
ntoskrnl.exe2152swprintf
ntoskrnl.exe1616RtlRandom
ntoskrnl.exe848KeQuerySystemTime
ntoskrnl.exe1199ObfDereferenceObject
ntoskrnl.exe748KeDetachProcess
ntoskrnl.exe497IoCreateSymbolicLink
ntoskrnl.exe487IoCreateDevice
ntoskrnl.exe731KeAttachProcess
ntoskrnl.exe1314PsLookupProcessByProcessId
ntoskrnl.exe139ExFreePoolWithTag
ntoskrnl.exe1985ZwReadFile
ntoskrnl.exe115ExAllocatePoolWithTag
ntoskrnl.exe510IoDeleteSymbolicLink
ntoskrnl.exe1964ZwQueryInformationFile
ntoskrnl.exe1927ZwOpenFile
ntoskrnl.exe2099_wcsicmp
ntoskrnl.exe1390RtlCompareUnicodeString
ntoskrnl.exe1981ZwQuerySystemInformation
ntoskrnl.exe894KeServiceDescriptorTable
ntoskrnl.exe1002MmIsAddressValid
ntoskrnl.exe723KeAddSystemServiceTable
ntoskrnl.exe2123memcpy
ntoskrnl.exe517IoDriverObjectType
ntoskrnl.exe1189ObReferenceObjectByName
ntoskrnl.exe546IoGetDeviceObjectPointer
ntoskrnl.exe924KeTickCount
ntoskrnl.exe1680RtlUnwind
ntoskrnl.exe508IoDeleteDevice
ntoskrnl.exe1869ZwClose
ntoskrnl.exe698IofCompleteRequest
ntoskrnl.exe733KeBugCheckEx
HAL.dll97KfLowerIrql
HAL.dll98KfRaiseIrql

StringTable 000004b0

CompanyNameMicrosoft Corporation
FileVersion5.1.2600.5519
LegalCopyright(C) Microsoft Corporation. All rights reserved.
ProductNameMicrosoft(R) Windows(R) Operating System
ProductVersion5.1.2600.5519

VS_FIXEDFILEINFO

FileVersion5.1.2600.5519
ProductVersion5.1.2600.5519
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40000
FileType3
FileSubtype7
offsetsizetypecomment
010752EXE06/28/2012 13:59:37#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK