filenamesteamclient.dll
size392192 (0x5fc00)
md5c28318cd314ad0ce76ad76a0ea4eadef
typePE32 executable (DLL) (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe8

Rich Header

lib idversiontimes used
1493072926
13130729143
1323072952
123507279
10123
1383072994
146307291
145307291

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0x4ab8ef8c
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x2102
Magic0x10b
LinkerVersion9.0
SizeOfCode0x39c00
SizeOfInitializedData0x25c00
SizeOfUninitializedData0
AddressOfEntryPoint0x284a9
BaseOfCode0x1000
BaseOfData0x3b000
ImageBase0x10000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.0
ImageVersion0.0
SubsystemVersion5.0
Reserved10
SizeOfImage0x66000
SizeOfHeaders0x400
CheckSum0x6af8a
Subsystem2
DllCharacteristics0x140
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v7.0 DLL

Sections

namevavsizeraw sizeflags
.text0x10000x39aaf0x39c00R-X CODE
.rdata0x3b0000x119620x11a00R-- IDATA
.data0x4d0000xfcdc0xc800RW- IDATA
.rsrc0x5d0000x1b40x200R-- IDATA
.reloc0x5e0000x776e0x7800R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x4c2800x6e2
IMPORT0x4b94c0x64
RESOURCE0x5d0000x1b4
EXCEPTION00
SECURITY00
BASERELOC0x5e0000x6314
DEBUG0x3b6e00x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x484b00x40
Bound_IAT00
IAT0x3b0000x1c0
Delay_IAT00
CLR_Header00
typenamesizecp
MANIFEST#23461252
module_namehintordfunction_name
ADVAPI32.dll615RegQueryValueExA
ADVAPI32.dll562RegCreateKeyExA
ADVAPI32.dll602RegOpenKeyExA
ADVAPI32.dll554RegCloseKey
WS2_32.dll115
WS2_32.dll11
WS2_32.dll17
WS2_32.dll111
WS2_32.dll9
WS2_32.dll20
WS2_32.dll16
WS2_32.dll2
WS2_32.dll23
WS2_32.dll3
WS2_32.dll19
WS2_32.dll8
WS2_32.dll21
USER32.dll511MessageBoxW
USER32.dll504MessageBoxA
KERNEL32.dll550GetProcessHeap
KERNEL32.dll981SetEndOfFile
KERNEL32.dll1174WriteConsoleW
KERNEL32.dll410GetConsoleOutputCP
KERNEL32.dll1164WriteConsoleA
KERNEL32.dll698InitializeCriticalSectionAndSpinCount
KERNEL32.dll489GetLocaleInfoA
KERNEL32.dll429GetCurrentThread
KERNEL32.dll368GetCommandLineA
KERNEL32.dll697InitializeCriticalSection
KERNEL32.dll756LeaveCriticalSection
KERNEL32.dll109CreateDirectoryA
KERNEL32.dll487GetLastError
KERNEL32.dll546GetProcAddress
KERNEL32.dll218EnterCriticalSection
KERNEL32.dll488GetLocalTime
KERNEL32.dll503GetModuleHandleA
KERNEL32.dll759LoadLibraryExA
KERNEL32.dll191DeleteCriticalSection
KERNEL32.dll261ExitProcess
KERNEL32.dll121CreateFileA
KERNEL32.dll333FreeLibrary
KERNEL32.dll636GetVolumeInformationA
KERNEL32.dll585GetSystemDirectoryA
KERNEL32.dll758LoadLibraryA
KERNEL32.dll589GetSystemInfo
KERNEL32.dll501GetModuleFileNameA
KERNEL32.dll1124VirtualProtect
KERNEL32.dll164CreateThread
KERNEL32.dll857QueryPerformanceCounter
KERNEL32.dll858QueryPerformanceFrequency
KERNEL32.dll1080TerminateThread
KERNEL32.dll1067Sleep
KERNEL32.dll430GetCurrentThreadId
KERNEL32.dll542GetPrivateProfileStringA
KERNEL32.dll991SetFileAttributesA
KERNEL32.dll678HeapFree
KERNEL32.dll674HeapAlloc
KERNEL32.dll1079TerminateProcess
KERNEL32.dll426GetCurrentProcess
KERNEL32.dll1096UnhandledExceptionFilter
KERNEL32.dll1055SetUnhandledExceptionFilter
KERNEL32.dll726IsDebuggerPresent
KERNEL32.dll681HeapReAlloc
KERNEL32.dll595GetSystemTimeAsFileTime
KERNEL32.dll193DeleteFileA
KERNEL32.dll864RaiseException
KERNEL32.dll922RtlUnwind
KERNEL32.dll348GetCPInfo
KERNEL32.dll709InterlockedIncrement
KERNEL32.dll705InterlockedDecrement
KERNEL32.dll339GetACP
KERNEL32.dll532GetOEMCP
KERNEL32.dll736IsValidCodePage
KERNEL32.dll506GetModuleHandleW
KERNEL32.dll1086TlsGetValue
KERNEL32.dll1084TlsAlloc
KERNEL32.dll1087TlsSetValue
KERNEL32.dll1085TlsFree
KERNEL32.dll1012SetLastError
KERNEL32.dll676HeapCreate
KERNEL32.dll677HeapDestroy
KERNEL32.dll1121VirtualFree
KERNEL32.dll1118VirtualAlloc
KERNEL32.dll1175WriteFile
KERNEL32.dll574GetStdHandle
KERNEL32.dll683HeapSize
KERNEL32.dll1156WideCharToMultiByte
KERNEL32.dll388GetConsoleCP
KERNEL32.dll406GetConsoleMode
KERNEL32.dll68CloseHandle
KERNEL32.dll1030SetStdHandle
KERNEL32.dll472GetFileType
KERNEL32.dll999SetFilePointer
KERNEL32.dll1008SetHandleCount
KERNEL32.dll572GetStartupInfoA
KERNEL32.dll799MultiByteToWideChar
KERNEL32.dll878ReadFile
KERNEL32.dll322FlushFileBuffers
KERNEL32.dll742LCMapStringA
KERNEL32.dll744LCMapStringW
KERNEL32.dll331FreeEnvironmentStringsA
KERNEL32.dll448GetEnvironmentStrings
KERNEL32.dll332FreeEnvironmentStringsW
KERNEL32.dll450GetEnvironmentStringsW
KERNEL32.dll618GetTickCount
KERNEL32.dll427GetCurrentProcessId
KERNEL32.dll576GetStringTypeA
KERNEL32.dll579GetStringTypeW
offsetsizetypecomment
0392192DLL09/22/2009 15:38:52#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK