filenameAurora-A11.exe_1136393_90112.dll
size90112 (0x16000)
md5999a5bdb8be4f4bbf90f52c6cbacd70e
typePE32 executable (DLL) (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf0

Rich Header

lib idversiontimes used
1272911
10816868
14729924
9340357
1071
1181682
617201
481681

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0x496abd96
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x210e
Magic0x10b
LinkerVersion6.0
SizeOfCode0xf000
SizeOfInitializedData0x7000
SizeOfUninitializedData0
AddressOfEntryPoint0x8abc
BaseOfCode0x1000
BaseOfData0x10000
ImageBase0x10000000
SectionAlignment0x1000
FileAlignment0x1000
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x17000
SizeOfHeaders0x1000
CheckSum0
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ 6.0 DLL (Debug)

Sections

namevavsizeraw sizeflags
.text0x10000xe65d0xf000R-X CODE
.rdata0x100000x11b70x2000R-- IDATA
.data0x120000x28580x2000RW- IDATA
.rsrc0x150000x3d00x1000R-- IDATA
.reloc0x160000xf180x1000R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x10d600x457
IMPORT0x1073c0x50
RESOURCE0x150000x3d0
EXCEPTION00
SECURITY00
BASERELOC0x160000xd88
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x100000x120
Delay_IAT00
CLR_Header00
typenamesizecp
VERSION#18800
module_namehintordfunction_name
KERNEL32.dll381GetModuleFileNameA
KERNEL32.dll383GetModuleHandleA
KERNEL32.dll957lstrcatA
KERNEL32.dll679RaiseException
KERNEL32.dll96CreateMutexA
KERNEL32.dll83CreateFileA
KERNEL32.dll52CloseHandle
KERNEL32.dll369GetLastError
KERNEL32.dll693ReadFile
KERNEL32.dll912WaitForSingleObject
KERNEL32.dll706ReleaseMutex
KERNEL32.dll972lstrlenA
KERNEL32.dll419GetProcessHeap
KERNEL32.dll528HeapAlloc
KERNEL32.dll966lstrcpyA
KERNEL32.dll534HeapFree
KERNEL32.dll138DeviceIoControl
KERNEL32.dll489GetVersionExA
KERNEL32.dll854Sleep
KERNEL32.dll272GetCommandLineA
KERNEL32.dll488GetVersion
KERNEL32.dll185ExitProcess
KERNEL32.dll862TerminateProcess
KERNEL32.dll322GetCurrentProcess
KERNEL32.dll416GetProcAddress
KERNEL32.dll532HeapDestroy
KERNEL32.dll530HeapCreate
KERNEL32.dll899VirtualFree
KERNEL32.dll897VirtualAlloc
KERNEL32.dll538HeapReAlloc
KERNEL32.dll804SetHandleCount
KERNEL32.dll441GetStdHandle
KERNEL32.dll358GetFileType
KERNEL32.dll439GetStartupInfoA
KERNEL32.dll246FreeEnvironmentStringsA
KERNEL32.dll247FreeEnvironmentStringsW
KERNEL32.dll916WideCharToMultiByte
KERNEL32.dll341GetEnvironmentStrings
KERNEL32.dll343GetEnvironmentStringsW
KERNEL32.dll139DisableThreadLibraryCalls
KERNEL32.dll932WriteFile
KERNEL32.dll629MultiByteToWideChar
KERNEL32.dll580LCMapStringA
KERNEL32.dll581LCMapStringW
KERNEL32.dll442GetStringTypeA
KERNEL32.dll445GetStringTypeW
KERNEL32.dll795SetFilePointer
KERNEL32.dll260GetCPInfo
KERNEL32.dll253GetACP
KERNEL32.dll403GetOEMCP
KERNEL32.dll594LoadLibraryA
KERNEL32.dll727RtlUnwind
KERNEL32.dll823SetStdHandle
KERNEL32.dll238FlushFileBuffers
USER32.dll727wsprintfA
ADVAPI32.dll503RegQueryValueExA
ADVAPI32.dll175DeleteService
ADVAPI32.dll66ControlService
ADVAPI32.dll431OpenServiceA
ADVAPI32.dll585StartServiceA
ADVAPI32.dll100CreateServiceA
ADVAPI32.dll429OpenSCManagerA
ADVAPI32.dll62CloseServiceHandle
ADVAPI32.dll491RegOpenKeyA
ADVAPI32.dll497RegQueryInfoKeyA
ADVAPI32.dll478RegEnumKeyExA
ADVAPI32.dll481RegEnumValueA
ADVAPI32.dll459RegCloseKey
ADVAPI32.dll465RegCreateKeyExA
ordentry_vafunction_name
10x5fd0AGP_nX
20x1cc7ApEnableATIISA
30x5b7eBIOSVendor
40x7bc2BootSequency
50x7d6aC000_icafeStr
60x78f8ChangeSupervisorPassword
70x7450ChangeUserPassword
80x245dChassisClear
90x24b2ChassisIntrusion
100x5ad0CheckMP
110x62b9_CheckSum@8
120x485dDetectLM75
130x1e8aDetectLM78
140x1d4cEnableSMSCHWMonitor
150x5d43EnabledSMBusBase
160x7cf0F000_icafeStr
170x63baFDDDISABLE
180x62deFDDENABLE
190x5627FanControl
200x5e2cGetCmosAddressByte
210x5f0eGetCmosByte
220x5a89GetDMIData
230x5a31GetDMILength
240x111aGetDid
250x1011GetMemoryCheckSum
260x1069GetVid
270x1da2Get_EFERs
280x587dLoadNTGLM7X
290x6fb0PARALLELPORTDISABLE
300x6dc0PARALLELPORTENABLE
310x11bfPowerManVID
320x252dRWPCI
330x25daReadPCI
340x5c99ReadPort
350x66efSERIALPORT1DISABLE
360x6494SERIALPORT1ENABLE
370x6b83SERIALPORT2DISABLE
380x68c8SERIALPORT2ENABLE
390x5d93SearchMemory
400x55c3SuspendOnHalt
410x59f5UnloadNTGLM7X
420x2669ValueRAM
430x5ea0WriteCmosAddressByte
440x5f71WriteCmosByte
450x5cf3WritePort
module_nameGLM7X.dll
flags0
timestamp2009-01-12 03:48:38
version0.0
ordinal_base1
nFunctions45
nNames45
Names(45)0x10e3c
Functions(45)0x10d88
NameOrdinals(45)0x10ef0

StringTable 040904b0

Comments
CompanyNameMICRO-STAR INT'L CO., LTD.
FileDescriptionGLM7X.dll
FileVersion0, 8, 7, 3
InternalNameGLM7X.dll
LegalCopyrightCopyright(C) MICRO-STAR
LegalTrademarks
OriginalFilenameGLM7X.dll
PrivateBuild
ProductNameMSI DualCoreCenter
ProductVersion0, 8, 7, 3
SpecialBuild

VS_FIXEDFILEINFO

FileVersion0.8.7.3
ProductVersion0.8.7.3
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS4
FileType2
FileSubtype0
offsetsizetypecomment
090112DLL01/12/2009 03:48:38#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK