filenamezlib1.dll
size77824 (0x13000)
md5c55a4d3a9d2cdcd1456c3a0d9236fa02
typePE32+ executable (DLL) (GUI) x86-64, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf8

Rich Header

lib idversiontimes used
147307292
156303193
1046
152201155
171303192
158303193
1703031926
155303191
154303191
157303191

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x8664
NumberOfSections6
TimeDateStamp0x547c1c5b
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xf0
Characteristics0x2022
Magic0x20b
LinkerVersion10.0
SizeOfCode0xbc00
SizeOfInitializedData0x7600
SizeOfUninitializedData0
AddressOfEntryPoint0xc5c4
BaseOfCode0x1000
ImageBase0x5a4c0000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.2
ImageVersion0.0
SubsystemVersion5.2
Reserved10
SizeOfImage0x17000
SizeOfHeaders0x400
CheckSum0
Subsystem2
DllCharacteristics0x140
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000xbb220xbc00R-X CODE
.rdata0xd0000x5c470x5e00R-- IDATA
.data0x130000x6380x200RW- IDATA
.pdata0x140000x9a80xa00R-- IDATA
.rsrc0x150000x3900x400R-- IDATA
.reloc0x160000x10a0x200R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x125800x6c7
IMPORT0x120b40x3c
RESOURCE0x150000x390
EXCEPTION0x140000x9a8
SECURITY00
BASERELOC0x160000x5c
DEBUG0xd1b00x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0xd0000x180
Delay_IAT00
CLR_Header00
typenamesizecp
VERSION#18120
module_namehintordfunction_name
MSVCR100.dll287__CppXcptFilter
MSVCR100.dll326__crt_debugger_hook
MSVCR100.dll286__C_specific_handler
MSVCR100.dll1115_unlock
MSVCR100.dll328__dllonexit
MSVCR100.dll758_lock
MSVCR100.dll925_onexit
MSVCR100.dll414_amsg_exit
MSVCR100.dll498_encoded_null
MSVCR100.dll647_initterm_e
MSVCR100.dll646_initterm
MSVCR100.dll775_malloc_crt
MSVCR100.dll1151_vsnprintf
MSVCR100.dll1447memchr
MSVCR100.dll503_errno
MSVCR100.dll1501strerror
MSVCR100.dll1578wcstombs
MSVCR100.dll1265_wopen
MSVCR100.dll1379free
MSVCR100.dll1438malloc
MSVCR100.dll991_snprintf
MSVCR100.dll768_lseeki64
MSVCR100.dll1453memset
MSVCR100.dll320__clean_type_info_names_internal
MSVCR100.dll1449memcpy
MSVCR100.dll926_open
MSVCR100.dll947_read
MSVCR100.dll450_close
MSVCR100.dll1277_write
KERNEL32.dll455GetCurrentProcessId
KERNEL32.dll459GetCurrentThreadId
KERNEL32.dll666GetTickCount
KERNEL32.dll937QueryPerformanceCounter
KERNEL32.dll226DisableThreadLibraryCalls
KERNEL32.dll1048RtlCaptureContext
KERNEL32.dll1055RtlLookupFunctionEntry
KERNEL32.dll1062RtlVirtualUnwind
KERNEL32.dll770IsDebuggerPresent
KERNEL32.dll1203SetUnhandledExceptionFilter
KERNEL32.dll1250UnhandledExceptionFilter
KERNEL32.dll454GetCurrentProcess
KERNEL32.dll1230TerminateProcess
KERNEL32.dll1216Sleep
KERNEL32.dll203DecodePointer
KERNEL32.dll238EncodePointer
KERNEL32.dll640GetSystemTimeAsFileTime
ordentry_vafunction_name
10x1000adler32
20x13e0adler32_combine
30x13f0adler32_combine64
40x14b0compress
50x1400compress2
60x14d0compressBound
70x1a00crc32
80x19e0crc32_combine
90x19f0crc32_combine64
100x39b0deflate
110x1c70deflateBound
120x1ee0deflateCopy
130x1e00deflateEnd
140x42f0deflateInit2_
150x46a0deflateInit_
160x4580deflateParams
170x1b10deflatePending
180x1b50deflatePrime
190x3980deflateReset
200x1a10deflateResetKeep
210x3750deflateSetDictionary
220x1ae0deflateSetHeader
230x1c30deflateTune
240x14f0get_crc_table
250x4700gzbuffer
260x5050gzclearerr
270x46e0gzclose
280x5c80gzclose_r
290x6660gzclose_w
300x5c40gzdirect
310x4dc0gzdopen
320x48a0gzeof
330x48d0gzerror
340x6510gzflush
350x5960gzgetc
360x59d0gzgetc_
370x5af0gzgets
380x4830gzoffset
390x47d0gzoffset64
400x4db0gzopen
410x4db0gzopen64
420x4e50gzopen_w
430x64e0gzprintf
440x62d0gzputc
450x6390gzputs
460x57b0gzread
470x4e60gzrewind
480x5020gzseek
490x4ec0gzseek64
500x6590gzsetparams
510x4770gztell
520x4730gztell64
530x59e0gzungetc
540x63d0gzvprintf
550x6180gzwrite
560x7b90inflate
570x6840inflateBack
580x7760inflateBackEnd
590x6730inflateBackInit_
600x9670inflateCopy
610x9280inflateEnd
620x92e0inflateGetDictionary
630x9420inflateGetHeader
640x7930inflateInit2_
650x7a20inflateInit_
660x9830inflateMark
670x7a30inflatePrime
680x7830inflateReset
690x7860inflateReset2
700x77b0inflateResetKeep
710x9370inflateSetDictionary
720x94c0inflateSync
730x9640inflateSyncPoint
740x9800inflateUndermine
750xb830uncompress
760xb920zError
770xb910zlibCompileFlags
780xb900zlibVersion
module_namezlib1.dll
flags0
timestamp2014-12-01 07:44:27
version0.0
ordinal_base1
nFunctions78
nNames78
Names(78)0x126e0
Functions(78)0x125a8
NameOrdinals(78)0x12818

StringTable 040904E4

FileDescriptionzlib data compression library
FileVersion1.2.8
InternalNamezlib1.dll
LegalCopyright(C) 1995-2013 Jean-loup Gailly & Mark Adler
OriginalFilenamezlib1.dll
ProductNamezlib
ProductVersion1.2.8
CommentsFor more information visit http://www.zlib.net/

VS_FIXEDFILEINFO

FileVersion1.2.8.0
ProductVersion1.2.8.0
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS4
FileType2
FileSubtype0
offsetsizetypecomment
15c115HTM#
15d072240BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK