filenamedm.unpacked.dll 1063592 9216.dll
size9216 (0x2400)
md598583e02daa03a16d692168d7f89ab7a
typePE32 executable (native) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xd8

Rich Header

lib idversiontimes used
1030
147307295
149307293
131307299
148307291
145307291

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections6
TimeDateStamp0x50164b33
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion9.0
SizeOfCode0x1600
SizeOfInitializedData0x4a00
SizeOfUninitializedData0
AddressOfEntryPoint0x8892
BaseOfCode0x1000
BaseOfData0x2000
ImageBase0x10000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.1
ImageVersion6.1
SubsystemVersion6.1
Reserved10
SizeOfImage0xb000
SizeOfHeaders0x400
CheckSum0x4553
Subsystem1
DllCharacteristics0
SizeOfStackReserve0x40000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x9660xa00R-X CODE
.rdata0x20000x1480x200R-- IDATA
.data0x30000x40600x200RW- IDATA
INIT0x80000xb660xc00RWX CODE DISCARDABLE
.rsrc0x90000x3000x400R-- IDATA DISCARDABLE
.reloc0xa0000x1940x200R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x88d40x3c
RESOURCE0x90000x300
EXCEPTION00
SECURITY00
BASERELOC0xa0000xf4
DEBUG0x20700x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x20900x40
Bound_IAT00
IAT0x20000x68
Delay_IAT00
CLR_Header00
typenamesizecp
VERSION#16680
module_namehintordfunction_name
ntoskrnl.exe1390RtlCompareUnicodeString
ntoskrnl.exe139ExFreePoolWithTag
ntoskrnl.exe1981ZwQuerySystemInformation
ntoskrnl.exe115ExAllocatePoolWithTag
ntoskrnl.exe1302PsGetVersion
ntoskrnl.exe1518RtlInitUnicodeString
ntoskrnl.exe1261PsGetCurrentProcessId
ntoskrnl.exe998MmGetSystemRoutineAddress
ntoskrnl.exe1985ZwReadFile
ntoskrnl.exe1869ZwClose
ntoskrnl.exe1964ZwQueryInformationFile
ntoskrnl.exe1483RtlFreeUnicodeString
ntoskrnl.exe1367RtlAnsiStringToUnicodeString
ntoskrnl.exe1513RtlInitAnsiString
ntoskrnl.exe2148strrchr
ntoskrnl.exe894KeServiceDescriptorTable
ntoskrnl.exe2152swprintf
ntoskrnl.exe2123memcpy
ntoskrnl.exe733KeBugCheckEx
ntoskrnl.exe1680RtlUnwind
ntoskrnl.exe1927ZwOpenFile
ntoskrnl.exe924KeTickCount
HAL.dll99KfReleaseSpinLock
HAL.dll96KfAcquireSpinLock

StringTable 000004b0

CompanyNameMicrosoft Corporation
FileVersion5.1.2200.3385
LegalCopyright(C) Microsoft Corporation. All rights reserved.
ProductNameMicrosoft(R) Windows(R) Operating System
ProductVersion5.1.2200.3385

VS_FIXEDFILEINFO

FileVersion5.1.2200.3385
ProductVersion5.1.2200.3385
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40000
FileType3
FileSubtype7
offsetsizetypecomment
09216EXE07/30/2012 08:52:03#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK