filenameForceLibrary.dll
size12800 (0x3200)
md5c6ef0a1eb063707ea93a664e8e05e485
typePE32 executable (DLL) (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe8

Rich Header

lib idversiontimes used
1272911
1472991
1045
1980349
1884441
1081686
617201
481683

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections3
TimeDateStamp0x3abdd833
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x210e
Magic0x10b
LinkerVersion6.0
SizeOfCode0x2400
SizeOfInitializedData0xa00
SizeOfUninitializedData0
AddressOfEntryPoint0x25e1
BaseOfCode0x1000
BaseOfData0x4000
ImageBase0xf000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x6000
SizeOfHeaders0x400
CheckSum0
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ 6.0 DLL

Sections

namevavsizeraw sizeflags
.text0x10000x23260x2400RWX CODE
.rsrc0x40000x4680x600R-- IDATA
.reloc0x50000x2400x400R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x32600xc6
IMPORT0x2dd80x78
RESOURCE0x40000x468
EXCEPTION00
SECURITY00
BASERELOC0x50000x1c8
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x10000xc0
Delay_IAT00
CLR_Header00
typenamesizecp
VERSION#110280
module_namehintordfunction_name
KERNEL32.dll711VirtualQueryEx
KERNEL32.dll495OpenProcess
KERNEL32.dll27CloseHandle
KERNEL32.dll699VirtualAlloc
KERNEL32.dll540ReadProcessMemory
KERNEL32.dll703VirtualFree
KERNEL32.dll643SetThreadContext
KERNEL32.dll664SuspendThread
KERNEL32.dll359GetThreadContext
KERNEL32.dll662Sleep
KERNEL32.dll556ResumeThread
KERNEL32.dll708VirtualProtectEx
KERNEL32.dll426InitializeCriticalSection
KERNEL32.dll372GetVersion
KERNEL32.dll248GetCurrentProcessId
KERNEL32.dll437IsBadReadPtr
KERNEL32.dll770lstrcpyA
KERNEL32.dll247GetCurrentProcess
KERNEL32.dll449LeaveCriticalSection
KERNEL32.dll85DeleteCriticalSection
KERNEL32.dll268GetExitCodeThread
KERNEL32.dll718WaitForSingleObject
KERNEL32.dll70CreateRemoteThread
KERNEL32.dll392GlobalFree
KERNEL32.dll385GlobalAlloc
KERNEL32.dll450LoadLibraryA
KERNEL32.dll93DisableThreadLibraryCalls
KERNEL32.dll294GetModuleHandleA
KERNEL32.dll318GetProcAddress
KERNEL32.dll745WriteProcessMemory
KERNEL32.dll776lstrlenA
KERNEL32.dll102EnterCriticalSection
USER32.dll481PostThreadMessageA
ADVAPI32.dll322OpenProcessToken
ADVAPI32.dll245LookupPrivilegeValueA
ADVAPI32.dll23AdjustTokenPrivileges
IMAGEHLP.dll21ImageNtHeader
MSVCRT.dll271_initterm
MSVCRT.dll157_adjust_fdiv
MSVCRT.dll606free
MSVCRT.dll657malloc
MSVCRT.dll202_except_handler3
MSVCRT.dll449_stricmp
ordentry_vafunction_name
10x18f0ForceLibrary
20x2280ForceLibraryDBG
30x1d40ForceLibraryNow
40x23c0PerformCleanup
50x21a0RemoteExec
60x2200TrapEntry
module_nameForceLibrary.dll
flags0
timestamp2001-03-25 11:36:19
version0.0
ordinal_base1
nFunctions6
nNames6
Names(6)0x32a0
Functions(6)0x3288
NameOrdinals(6)0x32b8

StringTable 000004b0

CommentsThis dll works on win 9x/ME/NT/2k
CompanyNameFReAK2FReaK
FileDescriptionMaking processes load your dlls >:-)
FileVersion[ ForceLibrary 1.4 BETA ] by yoda
InternalNameForceLibrary
LegalCopyrightCopyright © 2000
LegalTrademarks
OriginalFilenameForceLibrary.dll
PrivateBuild
ProductNameForceLibrary by yoda
ProductVersion1.4 BETA
SpecialBuild

VS_FIXEDFILEINFO

FileVersion1.0.0.1
ProductVersion1.0.0.1
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType2
FileSubtype0
offsetsizetypecomment
012800DLL03/25/2001 11:36:19#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK