filenameAcGenral.dll
size308736 (0x4b600)
md58cfbccdd3df24d6194fc4b6dbdfa6383
typePE32+ executable (DLL) (console) x86-64, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf0

Rich Header

lib idversiontimes used
1473072935
10293
149307299
1323072952
13130729114
146307291
1383072949
148307291
145307291

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x8664
NumberOfSections6
TimeDateStamp0x5119d6f7
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xf0
Characteristics0x2022
Magic0x20b
LinkerVersion9.0
SizeOfCode0x30c00
SizeOfInitializedData0x1b600
SizeOfUninitializedData0
AddressOfEntryPoint0x1070
BaseOfCode0x1000
ImageBase0x7ff79800000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.1
ImageVersion6.1
SubsystemVersion6.1
Reserved10
SizeOfImage0x51000
SizeOfHeaders0x400
CheckSum0x5a5ff
Subsystem3
DllCharacteristics0x140
SizeOfStackReserve0x40000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x30b9d0x30c00R-X CODE
.rdata0x320000x134dc0x13600R-- IDATA
.data0x460000x45200x3600RW- IDATA
.pdata0x4b0000x30f00x3200R-- IDATA
.rsrc0x4f0000x3d00x400R-- IDATA
.reloc0x500000x30c0x400R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x3bf040x5d
IMPORT0x3bf640x168
RESOURCE0x4f0000x3d0
EXCEPTION0x4b0000x30f0
SECURITY00
BASERELOC0x500000x30c
DEBUG0x31b3c0x38
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x320000x878
Delay_IAT00
CLR_Header00
typenamesizecp
VERSION#18800
module_namehintordfunction_name
ntdll.dll230NtCreateFile
ntdll.dll561NtWriteFile
ntdll.dll916RtlImageNtHeader
ntdll.dll1225RtlUnicodeStringToInteger
ntdll.dll618RtlAnsiStringToUnicodeString
ntdll.dll922RtlInitAnsiString
ntdll.dll711RtlCreateUnicodeStringFromAsciiz
ntdll.dll1163RtlSetLastWin32ErrorAndNtStatusFromNtStatus
ntdll.dll878RtlGetLastNtStatus
ntdll.dll848RtlFreeUnicodeString
ntdll.dll837RtlFormatCurrentUserKeyPath
ntdll.dll623RtlAppendUnicodeToString
ntdll.dll413NtQueryObject
ntdll.dll798RtlEqualSid
ntdll.dll890RtlGetOwnerSecurityDescriptor
ntdll.dll1196RtlSubAuthoritySid
ntdll.dll402NtQueryInformationToken
ntdll.dll950RtlInitializeSid
ntdll.dll1004RtlLengthRequiredSid
ntdll.dll988RtlIsDosDeviceName_U
ntdll.dll498NtSetInformationProcess
ntdll.dll850RtlGUIDFromString
ntdll.dll364NtOpenThreadToken
ntdll.dll356NtOpenProcessToken
ntdll.dll768RtlDosPathNameToNtPathName_U
ntdll.dll347NtOpenKey
ntdll.dll843RtlFreeHeap
ntdll.dll234NtCreateKey
ntdll.dll613RtlAllocateHeap
ntdll.dll431NtQueryValueKey
ntdll.dll948RtlInitializeSListHead
ntdll.dll962RtlInterlockedPopEntrySList
ntdll.dll1242RtlUnwindEx
ntdll.dll1265RtlVirtualUnwind
ntdll.dll1026RtlLookupFunctionEntry
ntdll.dll635RtlCaptureContext
ntdll.dll214NtClose
ntdll.dll523NtSetValueKey
ntdll.dll931RtlInitUnicodeString
ntdll.dll1058RtlPcToFileHeader
API-MS-Win-Core-LocalRegistry-L1-1-0.dll13RegEnumValueW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll2RegCreateKeyExW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll25RegOpenKeyExW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll37RegSetValueExW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll11RegEnumKeyExW
API-MS-Win-Core-LocalRegistry-L1-1-0.dllRegCloseKey
API-MS-Win-Core-LocalRegistry-L1-1-0.dll30RegQueryValueExW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll28RegQueryInfoKeyW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll19RegLoadKeyW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll39RegUnLoadKeyW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll17RegGetValueW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll36RegSetValueExA
API-MS-Win-Core-LocalRegistry-L1-1-0.dll15RegGetKeySecurity
API-MS-Win-Core-LocalRegistry-L1-1-0.dll24RegOpenKeyExA
API-MS-Win-Security-Base-L1-1-0.dll38EqualSid
API-MS-Win-Security-Base-L1-1-0.dll47GetSecurityDescriptorControl
API-MS-Win-Security-Base-L1-1-0.dll48GetSecurityDescriptorDacl
API-MS-Win-Security-Base-L1-1-0.dll20AllocateAndInitializeSid
API-MS-Win-Security-Base-L1-1-0.dll40FreeSid
API-MS-Win-Security-Base-L1-1-0.dll19AdjustTokenPrivileges
API-MS-Win-Security-Base-L1-1-0.dll43GetFileSecurityW
API-MS-Win-Security-Base-L1-1-0.dll42GetAclInformation
API-MS-Win-Security-Base-L1-1-0.dll41GetAce
SspiCli.dll25GetUserNameExW
SHLWAPI.dll255SHStrDupW
SHLWAPI.dll194SHGetValueW
SHLWAPI.dll73PathFindFileNameW
USER32.dll772TranslateMessage
USER32.dll567PeekMessageW
USER32.dll625ScreenToClient
USER32.dll406GetWindowInfo
USER32.dll484IsWindowVisible
USER32.dll400GetWindow
USER32.dll461IsChild
USER32.dll358GetParent
USER32.dll818WindowFromDC
USER32.dll394GetUpdateRgn
USER32.dll424GetWindowThreadProcessId
USER32.dll175DispatchMessageW
USER32.dll479IsWindow
USER32.dll6AllowSetForegroundWindow
USER32.dll397GetUserObjectInformationW
USER32.dll216EnableWindow
USER32.dll353GetMonitorInfoW
USER32.dll640SendMessageW
USER32.dll304GetGUIThreadInfo
USER32.dll362GetProcessWindowStation
USER32.dll495LoadCursorW
USER32.dll654SetCursor
USER32.dll571PostQuitMessage
USER32.dll388GetThreadDesktop
USER32.dll544MsgWaitForMultipleObjects
GDI32.dll524GetRgnBox
GDI32.dll230DeleteObject
GDI32.dll79CreateRectRgn
GDI32.dll672SetRectRgn
GDI32.dll34CombineRgn
GDI32.dll448GetClipBox
GDI32.dll80CreateRectRgnIndirect
ole32.dll20CoCreateInstance
ole32.dll108CoTaskMemFree
ole32.dll57CoGetObject
ole32.dll437StringFromGUID2
SHELL32.dll141SHCreateDirectoryExW
SHELL32.dll195SHGetFolderPathW
SHELL32.dll194SHGetFolderPathEx
SHELL32.dll225SHGetSpecialFolderPathW
SHELL32.dll127SHChangeNotify
SHELL32.dll165
sfc.dll5SfcIsKeyProtected
USERENV.dll30GetUserProfileDirectoryW
USERENV.dll17GetAllUsersProfileDirectoryW
dwmapi.dll15DwmIsCompositionEnabled
apphelp.dll163SdbResolveDatabase
apphelp.dll106SdbGetPDBFromGUID
apphelp.dll70SdbFindNextTag
apphelp.dll111SdbGetStringTagPtr
apphelp.dll63SdbFindFirstTag
apphelp.dll116SdbInitDatabase
apphelp.dll131SdbOpenLocalDatabase
KERNEL32.dll1220Sleep
KERNEL32.dll834LoadLibraryExW
KERNEL32.dll417GetConsoleCP
KERNEL32.dll435GetConsoleMode
KERNEL32.dll1278VirtualAlloc
KERNEL32.dll1195SetThreadStackGuarantee
KERNEL32.dll634GetSystemInfo
KERNEL32.dll1286VirtualQuery
KERNEL32.dll949RaiseException
KERNEL32.dll1175SetStdHandle
KERNEL32.dll624GetStringTypeW
KERNEL32.dll817LCMapStringW
KERNEL32.dll1338WriteFile
KERNEL32.dll734HeapSize
KERNEL32.dll573GetOEMCP
KERNEL32.dll367GetACP
KERNEL32.dll377GetCPInfo
KERNEL32.dll1206SetUnhandledExceptionFilter
KERNEL32.dll1256UnhandledExceptionFilter
KERNEL32.dll1235TerminateProcess
KERNEL32.dll640GetSystemTimeAsFileTime
KERNEL32.dll666GetTickCount
KERNEL32.dll938QueryPerformanceCounter
KERNEL32.dll728HeapDestroy
KERNEL32.dll727HeapCreate
KERNEL32.dll733HeapSetInformation
KERNEL32.dll482GetEnvironmentStringsW
KERNEL32.dll360FreeEnvironmentStringsW
KERNEL32.dll1337WriteConsoleW
KERNEL32.dll350FlushFileBuffers
KERNEL32.dll134CreateEventW
KERNEL32.dll750InitializeCriticalSectionAndSpinCount
KERNEL32.dll536GetModuleFileNameA
KERNEL32.dll618GetStartupInfoW
KERNEL32.dll505GetFileType
KERNEL32.dll619GetStdHandle
KERNEL32.dll1150SetHandleCount
KERNEL32.dll345FlsAlloc
KERNEL32.dll460GetCurrentThreadId
KERNEL32.dll347FlsGetValue
KERNEL32.dll346FlsFree
KERNEL32.dll204DecodePointer
KERNEL32.dll239EncodePointer
KERNEL32.dll685GetVersionExW
KERNEL32.dll397GetCommandLineA
KERNEL32.dll348FlsSetValue
KERNEL32.dll201DebugBreak
KERNEL32.dll1069SearchPathW
KERNEL32.dll292ExpandEnvironmentStringsW
KERNEL32.dll696GetWindowsDirectoryW
KERNEL32.dll616GetShortPathNameW
KERNEL32.dll532GetLongPathNameW
KERNEL32.dll631GetSystemDirectoryW
KERNEL32.dll513GetFullPathNameW
KERNEL32.dll1022ReleaseMutex
KERNEL32.dll519GetLastError
KERNEL32.dll1154SetLastError
KERNEL32.dll835LoadLibraryW
KERNEL32.dll587GetProcAddress
KERNEL32.dll288ExitProcess
KERNEL32.dll844LocalFree
KERNEL32.dll398GetCommandLineW
KERNEL32.dll456GetCurrentProcessId
KERNEL32.dll840LocalAlloc
KERNEL32.dll541GetModuleHandleW
KERNEL32.dll99CompareStringEx
KERNEL32.dll814LCIDToLocaleName
KERNEL32.dll522GetLocaleInfoEx
KERNEL32.dll725HeapAlloc
KERNEL32.dll592GetProcessHeap
KERNEL32.dll874MultiByteToWideChar
KERNEL32.dll729HeapFree
KERNEL32.dll816LCMapStringEx
KERNEL32.dll732HeapReAlloc
KERNEL32.dll1318WideCharToMultiByte
KERNEL32.dll328FindNLSStringEx
KERNEL32.dll773IsNLSDefinedString
KERNEL32.dll243EnterCriticalSection
KERNEL32.dll829LeaveCriticalSection
KERNEL32.dll144CreateFileW
KERNEL32.dll83CloseHandle
KERNEL32.dll320FindFirstFileW
KERNEL32.dll332FindNextFileW
KERNEL32.dll309FindClose
KERNEL32.dll520GetLocalTime
KERNEL32.dll211DeleteCriticalSection
KERNEL32.dll455GetCurrentProcess
KERNEL32.dll1383lstrlenW
KERNEL32.dll121CreateActCtxW
KERNEL32.dll928QueryActCtxW
KERNEL32.dll1021ReleaseActCtx
KERNEL32.dll484GetEnvironmentVariableW
KERNEL32.dll1128SetEnvironmentVariableW
KERNEL32.dll651GetTempPathA
KERNEL32.dll649GetTempFileNameA
KERNEL32.dll652GetTempPathW
KERNEL32.dll650GetTempFileNameW
KERNEL32.dll537GetModuleFileNameW
KERNEL32.dll100CompareStringOrdinal
KERNEL32.dll1284VirtualProtect
KERNEL32.dll75CheckElevationEnabled
KERNEL32.dll1294WaitForSingleObject
KERNEL32.dll487GetExitCodeProcess
KERNEL32.dll159CreateMutexW
KERNEL32.dll908OutputDebugStringA
KERNEL32.dll1142SetFilePointer
KERNEL32.dll1382lstrlenA
KERNEL32.dll496GetFileAttributesW
KERNEL32.dll454GetCurrentDirectoryW
ADVAPI32.dll87CloseServiceHandle
ADVAPI32.dll131CreateWellKnownSid
ADVAPI32.dll552QueryServiceStatus
ADVAPI32.dll713StartServiceW
ADVAPI32.dll507OpenServiceW
ADVAPI32.dll505OpenSCManagerW
ADVAPI32.dll116ConvertStringSidToSidW
ADVAPI32.dll303GetFileSecurityA
ADVAPI32.dll334GetSecurityInfo
ADVAPI32.dll407LookupPrivilegeValueW
ADVAPI32.dll503OpenProcessToken
ADVAPI32.dll114ConvertStringSecurityDescriptorToSecurityDescriptorW
ADVAPI32.dll689SetNamedSecurityInfoW
ADVAPI32.dll401LookupAccountSidW
MPR.dll36WNetGetConnectionW
RPCRT4.dll348RpcAsyncCancelCall
RPCRT4.dll359RpcBindingFromStringBindingW
RPCRT4.dll502RpcStringBindingComposeW
RPCRT4.dll374RpcBindingSetAuthInfoExW
RPCRT4.dll349RpcAsyncCompleteCall
RPCRT4.dll134Ndr64AsyncClientCall
RPCRT4.dll351RpcAsyncInitializeHandle
RPCRT4.dll43I_RpcExceptionFilter
RPCRT4.dll506RpcStringFreeW
RPCRT4.dll357RpcBindingFree
ordentry_vafunction_name
10x1ec38GetHookAPIs
20x1ebbcNotifyShims
module_nameNULL.dll
flags0
timestamp2013-02-12 03:31:53
version0.0
ordinal_base1
nFunctions2
nNames2
Names(2)0x3bf34
Functions(2)0x3bf2c
NameOrdinals(2)0x3bf3c

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionWindows Compatibility DLL
FileVersion6.1.7601.18076 (win7sp1_gdr.130211-1434)
InternalName
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilename
ProductNameMicrosoft® Windows® Operating System
ProductVersion6.1.7601.18076

VS_FIXEDFILEINFO

FileVersion6.1.7601.18076
ProductVersion6.1.7601.18076
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType2
FileSubtype0
offsetsizetypecomment
15c115HTM#
15d0303152BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK