ntplugin - Copy.dll - NTPlugin.dll - NTPlugin Event Library

info
MZ
PE
resources
imports
exports
foremost
version info
hexdump
disasm
log
discuss
donate

filename	ntplugin - Copy.dll
size	33280 (0x8200)
md5	b71dbdb6a9cb4639508e4e121fb52f8b

type	PE32+ executable (DLL) (console) x86-64, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x100

Rich Header

lib id	version	times used
187	30716	1
1	0	79
185	30716	5
189	30716	17
188	30716	59
184	30716	1
193	30716	1
126	50727	1
183	30716	1
186	30716	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x8664
NumberOfSections	6
TimeDateStamp	0x5010a94a
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xf0
Characteristics	0x2022
Magic	0x20b
LinkerVersion	10.10
SizeOfCode	0x5c00
SizeOfInitializedData	0x2800
SizeOfUninitializedData	0
AddressOfEntryPoint	0x4548
BaseOfCode	0x1000
ImageBase	0x180000000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	6.2
ImageVersion	6.2
SubsystemVersion	5.2
Reserved1	0
SizeOfImage	0xd000
SizeOfHeaders	0x400
CheckSum	0x15f87
Subsystem	3
DllCharacteristics	0x140
SizeOfStackReserve	0x40000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x5b9b	0x5c00	R-X CODE
.data	0x7000	0x1260	0xe00	RW- IDATA
.pdata	0x9000	0x294	0x400	R-- IDATA
.idata	0xa000	0x63c	0x800	R-- IDATA
.rsrc	0xb000	0x400	0x400	R-- IDATA
.reloc	0xc000	0x2b8	0x400	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0x6b50	0x4b
IMPORT	0xa000	0x3c
RESOURCE	0xb000	0x400
EXCEPTION	0x9000	0x294
SECURITY	0	0
BASERELOC	0xc000	0x1a8
DEBUG	0x1180	0x1c
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0x2650	0x70
Bound_IAT	0	0
IAT	0xa1b8	0x178
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size	cp
VERSION	#1	924	0

module_name	hint	function_name
msvcrt.dll	76	_CxxThrowException
msvcrt.dll	82	_XcptFilter
msvcrt.dll	160	_amsg_exit
msvcrt.dll	367	_initterm
msvcrt.dll	83	__C_specific_handler
msvcrt.dll	472	_lock
msvcrt.dll	819	_unlock
msvcrt.dll	109	__dllonexit
msvcrt.dll	642	_onexit
msvcrt.dll	1156	memcpy
msvcrt.dll	1160	memset
msvcrt.dll	18	public: virtual __cdecl type_info::~type_info(void) __ptr64 ??1type_info@@UEAA@XZ
msvcrt.dll	177	_callnewh
msvcrt.dll	1114	isleadbyte
msvcrt.dll	269	_fileno
msvcrt.dll	370	_iob
msvcrt.dll	701	_snprintf
msvcrt.dll	457	_itoa
msvcrt.dll	1296	wctomb
msvcrt.dll	101	__badioinfo
msvcrt.dll	125	__pioinfo
msvcrt.dll	373	_isatty
msvcrt.dll	982	_write
msvcrt.dll	481	_lseeki64
msvcrt.dll	50	public: virtual char const * __ptr64 __cdecl exception::what(void)const __ptr64 ?what@exception@@UEBAPEBDXZ
msvcrt.dll	17	public: virtual __cdecl exception::~exception(void) __ptr64 ??1exception@@UEAA@XZ
msvcrt.dll	12	public: __cdecl exception::exception(class exception const & __ptr64) __ptr64 ??0exception@@QEAA@AEBV0@@Z
msvcrt.dll	11	public: __cdecl exception::exception(char const * __ptr64 const & __ptr64, int) __ptr64 ??0exception@@QEAA@AEBQEBDH@Z
msvcrt.dll	1144	malloc
msvcrt.dll	1086	free
msvcrt.dll	247	_errno
KERNEL32.dll	763	GetSystemTimeAsFileTime
KERNEL32.dll	558	GetCurrentThreadId
KERNEL32.dll	554	GetCurrentProcessId
KERNEL32.dll	1087	QueryPerformanceCounter
KERNEL32.dll	1047	OutputDebugStringA
KERNEL32.dll	1406	TerminateProcess
KERNEL32.dll	553	GetCurrentProcess
KERNEL32.dll	1375	SetUnhandledExceptionFilter
KERNEL32.dll	1440	UnhandledExceptionFilter
KERNEL32.dll	1225	RtlVirtualUnwind
KERNEL32.dll	1218	RtlLookupFunctionEntry
KERNEL32.dll	1211	RtlCaptureContext
KERNEL32.dll	1390	Sleep
KERNEL32.dll	791	GetTickCount

ord	entry_va	function_name
1	0x3f38	Plugin_Main

module_name	NTPlugin.dll
flags	0
timestamp	2012-07-25 22:30:21
version	0.0
ordinal_base	1
nFunctions	1
nNames	1
Names(1)	0x6b7c
Functions(1)	0x6b78
NameOrdinals(1)	0x6b80

StringTable 040904B0

CompanyName	Microsoft Corporation
FileDescription	NTPlugin Event Library
FileVersion	6.2.9200.16384 (win8_rtm.120725-1247)
InternalName	NTPlugin.dll
LegalCopyright	© Microsoft Corporation. All rights reserved.
OriginalFilename	NTPlugin.dll
ProductName	Microsoft® Windows® Operating System
ProductVersion	6.2.9200.16384

VS_FIXEDFILEINFO

FileVersion	6.2.9200.16384
ProductVersion	6.2.9200.16384
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	0x40004
FileType	3
FileSubtype	7

show previews

offset	size	type	comment
15c1	15	HTM		#
15d0	27696	BIN	overlay data past EOF	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK

ntplugin - Copy.dll-

MZ Header

Rich Header

DOS stub

PE Header

Sections

Data Directory

StringTable 040904B0

VS_FIXEDFILEINFO

ntplugin - Copy.dll
-