filename0995.dll
size289025 (0x46901)
md5a185f263faf488e75ebceef450574819
typePE32 executable (DLL) (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe0

Rich Header

lib idversiontimes used
125507273
1095072725
1235072719
10128
1105072710
124507271
120507271

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections7
TimeDateStamp0x4420c84b
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x2102
Magic0x10b
LinkerVersion11.0
SizeOfCode0x11000
SizeOfInitializedData0x56000
SizeOfUninitializedData0
AddressOfEntryPoint0x1005
BaseOfCode0x1000
BaseOfData0x12000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x1000
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x68000
SizeOfHeaders0x1000
CheckSum0x3fb6b
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

namevavsizeraw sizeflags
.text0x10000x105d00x11000R-X CODE
.idata0x120000xc760x1000RW- IDATA
bss0x130000x39b0x1000RW- IDATA
.rdata0x140000x601b0x7000R-- IDATA
.data0x1b0000x370700x6000RW- IDATA
.rsrc0x530000x1363c0x14000R-- IDATA
.reloc0x670000x65f0x1000R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x19d500x166
IMPORT0x120000xa0
RESOURCE0x530000x1363c
EXCEPTION00
SECURITY00
BASERELOC0x670000x250
DEBUG0x140000x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x123280x288
Delay_IAT00
CLR_Header00
typenamesizecp
BITMAP#20282321252
BITMAP#203328081252
BITMAP#20731121252
BITMAP#21910641252
ICON#17441252
ICON#24881252
ICON#32961252
ICON#422161252
ICON#517361252
ICON#613841252
ICON#742641252
ICON#824401252
ICON#911281252
ICON#107441252
ICON#114881252
ICON#122961252
ICON#1322161252
ICON#1417361252
ICON#1513841252
ICON#1642641252
ICON#1724401252
ICON#1811281252
GROUP_ICON#2051321252
GROUP_ICON#2181321252
VERSION#110041252
#5000#102641252
#5000#1061681252
#5000#107641252
#5000#1101041252
#5000#111641252
#5000#113481252
#5000#1151041252
#5000#117481252
#5000#118481252
#5000#120961252
#5000#210161252
#5000#211481252
#5000#213481252
#5000#215401252
#5000#2171201252
#5000#218401252
#5000#219241252
#5000#220321252
#5000#221481252
#5000#222241252
module_namehintordfunction_name
KERNEL32.dll576LeaveCriticalSection
KERNEL32.dll534InitializeCriticalSectionAndSpinCount
KERNEL32.dll587LocalFree
KERNEL32.dll376GetModuleHandleW
KERNEL32.dll787SetLastError
KERNEL32.dll49CloseHandle
KERNEL32.dll337GetEnvironmentVariableW
KERNEL32.dll362GetLocalTime
KERNEL32.dll830Sleep
KERNEL32.dll907WriteFile
KERNEL32.dll56CompareStringW
KERNEL32.dll948lstrlenW
KERNEL32.dll657QueryPerformanceCounter
KERNEL32.dll514HeapAlloc
KERNEL32.dll520HeapFree
KERNEL32.dll137DisableThreadLibraryCalls
KERNEL32.dll440GetSystemInfo
KERNEL32.dll874VirtualAlloc
KERNEL32.dll360GetLastError
KERNEL32.dll127DeleteCriticalSection
KERNEL32.dll185ExpandEnvironmentStringsA
KERNEL32.dll525HeapSetInformation
KERNEL32.dll508GlobalUnlock
KERNEL32.dll240FreeLibrary
KERNEL32.dll146EncodePointer
KERNEL32.dll430GetStdHandle
KERNEL32.dll350GetFileType
KERNEL32.dll300GetConsoleMode
KERNEL32.dll82CreateFileW
KERNEL32.dll906WriteConsoleW
USER32.dll414IsCharUpperA
USER32.dll229FindWindowA
USER32.dll380GetWindowTextW
USER32.dll379GetWindowTextLengthW
USER32.dll459LoadStringW
USER32.dll421IsDlgButtonChecked
USER32.dll28CallWindowProcW
USER32.dll369GetWindowLongW
USER32.dll601SetForegroundWindow
USER32.dll600SetFocus
USER32.dll227ExitWindowsEx
USER32.dll541RegisterClipboardFormatW
USER32.dll643SetWindowLongW
USER32.dll198EnableWindow
USER32.dll56CheckDlgButton
USER32.dll196EnableMenuItem
USER32.dll645SetWindowPos
ADVAPI32.dll458RegCloseKey
ADVAPI32.dll310InitiateSystemShutdownExW
ADVAPI32.dll463RegCreateKeyExW
ADVAPI32.dll523ReportEventW
ADVAPI32.dll483RegOpenKeyExA
ADVAPI32.dll493RegQueryValueExA
ADVAPI32.dll484RegOpenKeyExW
ADVAPI32.dll494RegQueryValueExW
ADVAPI32.dll472RegEnumKeyExW
ADVAPI32.dll507RegSetValueExW
ADVAPI32.dll468RegDeleteValueW
ADVAPI32.dll176DeregisterEventSource
ADVAPI32.dll512RegisterEventSourceW
ole32.dll106CoUninitialize
ole32.dll342ReleaseStgMedium
msvcrt.dll1267printf
msvcrt.dll1256memchr
msvcrt.dll1260memmove
msvcrt.dll1323strtoul
msvcrt.dll1216isdigit
msvcrt.dll1387wcstoul
msvcrt.dll1246malloc
msvcrt.dll1190free
msvcrt.dll1371wcsncmp
Secur32.dll25GetUserNameExW
SHLWAPI.dll35PathCombineW
ordentry_vafunction_name
10x1019MeansOrTheJavaEndorsed
module_nameclasses.dll
flags0
timestamp2006-03-22 03:45:15
version0.0
ordinal_base1
nFunctions1
nNames1
Names(1)0x19d7c
Functions(1)0x19d78
NameOrdinals(1)0x19d80

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionSoftware Installation Snapin Extenstion
FileVersion6.0.6001.18000 (longhorn_rtm.080118-1840)
InternalNameSoftware Installation Editor Snapin
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenameappmgr.dll
ProductNameMicrosoft® Windows® Operating System
ProductVersion6.0.6001.18000

VS_FIXEDFILEINFO

FileVersion6.0.6001.18000
ProductVersion6.0.6001.18000
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType2
FileSubtype0
offsetsizetypecomment
0221184DLL03/22/2006 03:45:15#
15c115HTM#
3600067841BINoverlay data past EOF#
Scanning the drive for archives:
1 file, 289025 bytes (283 KiB)



Errors: 1
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK