filenamemscoree.dll
size378368 (0x5c600)
md58ffaa80338156fd443d34f4ce9bd8431
typePE32+ executable (DLL) (console) x86-64, for MS Windows
mimetypeapplication/x-dosexec
clamavscan pending
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe8

Rich Header

lib idversiontimes used
2612671557
26026715140
147307293
10189
2592671511
256267151
2652671551
255267151
258267151

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x8664
NumberOfSections7
TimeDateStamp0xa5f86a8b
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xf0
Characteristics0x2022
Magic0x20b
LinkerVersion14.15
SizeOfCode0x3e800
SizeOfInitializedData0x20c00
SizeOfUninitializedData0
AddressOfEntryPoint0x2a840
BaseOfCode0x1000
ImageBase0x180000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion10.0
ImageVersion10.0
SubsystemVersion10.0
Reserved10
SizeOfImage0x64000
SizeOfHeaders0x400
CheckSum0x6486c
Subsystem3
DllCharacteristics0x4160
SizeOfStackReserve0x40000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x3e7940x3e800R-X CODE
.rdata0x400000x176e00x17800R-- IDATA
.data0x580000x51840x2000RW- IDATA
.pdata0x5e0000x28500x2a00R-- IDATA
.didat0x610000xe80x200RW- IDATA
.rsrc0x620000x7480x800R-- IDATA
.reloc0x630000xd940xe00R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x55b500xe80
IMPORT0x569d00x28
RESOURCE0x620000x748
EXCEPTION0x5e0000x2850
SECURITY00
BASERELOC0x630000xd94
DEBUG0x50e700x54
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x401d00x108
Bound_IAT00
IAT0x45c500x3f0
Delay_IAT0x557040xe0
CLR_Header00
typenamesizecp
MESSAGETABLE#17440
VERSION#19560
module_namehintordfunction_name
KERNEL32.dll203EnterCriticalSection
KERNEL32.dll781LeaveCriticalSection
KERNEL32.dll699InitializeCriticalSection
KERNEL32.dll640GetVersionExW
KERNEL32.dll535GetProcAddress
KERNEL32.dll175DeleteCriticalSection
KERNEL32.dll317FreeLibrary
KERNEL32.dll822MultiByteToWideChar
KERNEL32.dll1217WideCharToMultiByte
KERNEL32.dll462GetFullPathNameW
KERNEL32.dll469GetLastError
KERNEL32.dll433GetEnvironmentVariableW
KERNEL32.dll487GetModuleFileNameW
KERNEL32.dll444GetFileAttributesW
KERNEL32.dll1027SetErrorMode
KERNEL32.dll491GetModuleHandleW
KERNEL32.dll115CreateFileW
KERNEL32.dll1050SetLastError
KERNEL32.dll449GetFileSize
KERNEL32.dll112CreateFileMappingW
KERNEL32.dll807MapViewOfFile
KERNEL32.dll788LoadLibraryW
KERNEL32.dll651GetWindowsDirectoryW
KERNEL32.dll585GetSystemInfo
KERNEL32.dll787LoadLibraryExW
KERNEL32.dll191DisableThreadLibraryCalls
KERNEL32.dll247ExitProcess
KERNEL32.dll1170VirtualProtect
KERNEL32.dll1181WaitForSingleObject
KERNEL32.dll944ReleaseMutex
KERNEL32.dll57CloseHandle
KERNEL32.dll128CreateMutexW
KERNEL32.dll1150UnmapViewOfFile
KERNEL32.dll405GetCurrentProcess
KERNEL32.dll156CreateToolhelp32Snapshot
KERNEL32.dll582GetSystemDirectoryW
KERNEL32.dll924ReadProcessMemory
KERNEL32.dll921ReadFile
KERNEL32.dll1231WriteFile
KERNEL32.dll679HeapCreate
KERNEL32.dll680HeapDestroy
KERNEL32.dll470GetLocalTime
KERNEL32.dll625GetTimeFormatW
KERNEL32.dll415GetDateFormatW
KERNEL32.dll275FindFirstFileW
KERNEL32.dll266FindClose
KERNEL32.dll441GetFileAttributesExW
KERNEL32.dll720IsDBCSLeadByteEx
KERNEL32.dll574GetStringTypeW
KERNEL32.dll1136TlsGetValue
KERNEL32.dll907RaiseException
KERNEL32.dll1130TerminateProcess
KERNEL32.dll850OutputDebugStringW
KERNEL32.dll313FormatMessageW
KERNEL32.dll1267lstrlenW
KERNEL32.dll795LocalFree
KERNEL32.dll324GetACP
KERNEL32.dll338GetCPInfo
KERNEL32.dll719IsDBCSLeadByte
KERNEL32.dll166DebugBreak
KERNEL32.dll431GetEnvironmentStringsW
KERNEL32.dll316FreeEnvironmentStringsW
KERNEL32.dll885QueryActCtxW
KERNEL32.dll103CreateEventW
KERNEL32.dll1028SetEvent
KERNEL32.dll960ResetEvent
KERNEL32.dll142CreateSemaphoreW
KERNEL32.dll948ReleaseSemaphore
KERNEL32.dll1137TlsSetValue
KERNEL32.dll1134TlsAlloc
KERNEL32.dll1135TlsFree
KERNEL32.dll677HeapAlloc
KERNEL32.dll540GetProcessHeap
KERNEL32.dll681HeapFree
KERNEL32.dll1182WaitForSingleObjectEx
KERNEL32.dll1120SleepEx
KERNEL32.dll1164VirtualAlloc
KERNEL32.dll1167VirtualFree
KERNEL32.dll1172VirtualQuery
KERNEL32.dll688HeapValidate
KERNEL32.dll406GetCurrentProcessId
KERNEL32.dll577GetSystemDefaultLCID
KERNEL32.dll769LCMapStringW
KERNEL32.dll200EncodePointer
KERNEL32.dll168DecodePointer
KERNEL32.dll946ReleaseSRWLockExclusive
KERNEL32.dll352GetCommandLineA
KERNEL32.dll303FlsSetValue
KERNEL32.dll973RtlLookupFunctionEntry
KERNEL32.dll978RtlUnwindEx
KERNEL32.dll969RtlCaptureContext
KERNEL32.dll979RtlVirtualUnwind
KERNEL32.dll1147UnhandledExceptionFilter
KERNEL32.dll1104SetUnhandledExceptionFilter
KERNEL32.dll300FlsAlloc
KERNEL32.dll302FlsGetValue
KERNEL32.dll301FlsFree
KERNEL32.dll410GetCurrentThreadId
KERNEL32.dll490GetModuleHandleExW
KERNEL32.dll685HeapSetInformation
KERNEL32.dll569GetStdHandle
KERNEL32.dll452GetFileType
KERNEL32.dll700InitializeCriticalSectionAndSpinCount
KERNEL32.dll568GetStartupInfoW
KERNEL32.dll486GetModuleFileNameA
KERNEL32.dll896QueryPerformanceCounter
KERNEL32.dll591GetSystemTimeAsFileTime
KERNEL32.dll621GetTickCount
KERNEL32.dll849OutputDebugStringA
KERNEL32.dll731IsValidCodePage
KERNEL32.dll514GetOEMCP
KERNEL32.dll684HeapReAlloc
KERNEL32.dll686HeapSize
KERNEL32.dll1117Sleep
KERNEL32.dll786LoadLibraryExA
KERNEL32.dll974RtlPcToFileHeader
KERNEL32.dll371GetConsoleCP
KERNEL32.dll380GetConsoleMode
KERNEL32.dll1038SetFilePointer
KERNEL32.dll1093SetThreadStackGuarantee
KERNEL32.dll1070SetStdHandle
KERNEL32.dll1230WriteConsoleW
KERNEL32.dll918ReadConsoleW
KERNEL32.dll305FlushFileBuffers
KERNEL32.dllAcquireSRWLockExclusive
ordentry_vafunction_name
170x7850InitErrors
180xa400PostError
190x7980InitSSAutoEnterThread
200x7aa0UpdateError
210x8850CloseCtrs
220x4ce0LoadStringRC
230x8fa0ReOpenMetaDataWithMemory
240xa850
250x8730CollectCtrs
260x7740CorDllMainWorker
270x98e0EEDllGetClassObjectFromClass
280x53d0GetPrivateContextsPerfCounters
290x7520GetProcessExecutableHeap
300x4790GetStartupFlags
310x1a10GetTargetForVTableEntry
320x1770GetTokenForVTableEntry
330x7bb0LogHelp_LogAssert
340x7cf0LogHelp_NoGuiOnAssert
350x7e10LogHelp_TerminateOnAssert
360x8640OpenCtrs
370x18c0SetTargetForVTableEntry
380xa980CLRCreateInstance
390x6970CallFunctionShim
400x51d0ClrCreateManagedInstance
410x50c0CoEEShutDownCOM
420x4ab0CoInitializeCor
430x4870CoInitializeEE
440x4bd0CoUninitializeCor
450x4990CoUninitializeEE
460x63a0CorBindToCurrentRuntime
470x5ed0CorBindToRuntime
480x5d60CorBindToRuntimeByCfg
490x8030CorBindToRuntimeByPath
500x8130CorBindToRuntimeByPathEx
510x6040CorBindToRuntimeEx
520x61d0CorBindToRuntimeHost
530x7070CorExitProcess
540x8370CorGetSvc
550x8460CorIsLatestSvc
560x5310CorMarkThreadInThreadPool
570x8560CorTickleSvc
580x6f70CreateConfigStream
590x6730CreateDebuggingInterfaceFromVersion
600xa8e0CreateInterface
610x1e00DllCanUnloadNow
620x1cf0DllGetClassObject
630x1f20DllRegisterServer
640x2080DllUnregisterServer
650x9560EEDllRegisterServer
660x9680EEDllUnregisterServer
670x97a0GetAssemblyMDImport
680xa7c0GetCLRMetaHost
690x5710GetCORRequiredVersion
700x7f20GetCORRootDirectory
710x54f0GetCORSystemDirectory
720x5600GetCORVersion
730x4fa0GetCompileInfo
740x1bc0GetFileVersion
750x2310GetHashFromAssemblyFile
760x24a0GetHashFromAssemblyFileW
770x2630GetHashFromBlob
780x27a0GetHashFromFile
790x2930GetHashFromFileW
800x2ac0GetHashFromHandle
810x7600GetHostConfigurationFile
820x8e30GetMetaDataInternalInterface
830x8cf0GetMetaDataInternalInterfaceFromPublic
840x8bb0GetMetaDataPublicInterfaceFromInternal
850x93c0GetPermissionRequests
860x6b30GetRealProcAddress
870x58a0GetRequestedRuntimeInfo
880x5ae0GetRequestedRuntimeVersion
890x5c10GetRequestedRuntimeVersionForCLSID
900x6840GetVersionFromProcess
910x6c70GetXMLElement
920x6d60GetXMLElementAttribute
930x6e80GetXMLObject
940x8950IEE
950x6600LoadLibraryShim
960x8240LoadLibraryWithPolicyShim
970x4e30LoadStringRCEx
980xc880LockClrVersion
990x8a70MetaDataGetDispenser
1000xa2e0ND_CopyObjDst
1010xa1c0ND_CopyObjSrc
1020x9af0ND_RI2
1030x9be0ND_RI4
1040x9cd0ND_RI8
1050x9a00ND_RU1
1060x9ec0ND_WI2
1070x9fc0ND_WI4
1080xa0c0ND_WI8
1090x9dc0ND_WU1
1100x90e0ReOpenMetaDataWithMemoryEx
1110x64d0RunDll32ShimW
1120x73f0RuntimeOSHandle
1130x71a0RuntimeOpenImage
1140x72d0RuntimeReleaseHandle
1150x2c50StrongNameCompareAssemblies
1160x21e0StrongNameErrorInfo
1170x2db0StrongNameFreeBuffer
1180x2f10StrongNameGetBlob
1190x3070StrongNameGetBlobFromImage
1200x31f0StrongNameGetPublicKey
1210x33a0StrongNameHashSize
1220x34f0StrongNameKeyDelete
1230x3630StrongNameKeyGen
1240x37b0StrongNameKeyGenEx
1250x3950StrongNameKeyInstall
1260x3ab0StrongNameSignatureGeneration
1270x3c20StrongNameSignatureGenerationEx
1280x3dc0StrongNameSignatureSize
1290x3f20StrongNameSignatureVerification
1300x4080StrongNameSignatureVerificationEx
1310x41e0StrongNameSignatureVerificationFromImage
1320x4360StrongNameTokenFromAssembly
1330x44c0StrongNameTokenFromAssemblyEx
1340x4670StrongNameTokenFromPublicKey
1350x9240TranslateSecurityAttributes
1360x1b60_CorDllMain
1370xa500_CorExeMain
1380xa640_CorExeMain2
1390x12f20_CorImageUnloading
1400x12d50_CorValidateImage
1420x1660
module_namemscoree.dll
flags0
timestamp2058-03-28 06:00:43
version0.0
ordinal_base17
nFunctions126
nNames123
Names(123)0x55d70
Functions(126)0x55b78
NameOrdinals(123)0x55f5c

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionMicrosoft .NET Runtime Execution Engine
FileVersion10.0.18362.1 (WinBuild.160101.0800)
InternalNamemscoree.dll
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenamemscoree.dll
ProductNameMicrosoft® Windows® Operating System
ProductVersion10.0.18362.1

VS_FIXEDFILEINFO

FileVersion10.0.18362.1
ProductVersion10.0.18362.1
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType2
FileSubtype0
offsetsizetypecomment
15c115HTM#
15d0372784BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK