filenameNCScnet4.dll
size59904 (0xea00)
md5cf1c0662cd0b798b5c8303349bce673f
typePE32 executable (DLL) (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe8

Rich Header

lib idversiontimes used
158303193
171303192
156303194
1473072911
10126
1703031916
155303191
154303191
157303191

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0x4d5174c7
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x2102
Magic0x10b
LinkerVersion10.0
SizeOfCode0x9200
SizeOfInitializedData0x10000
SizeOfUninitializedData0
AddressOfEntryPoint0x9aeb
BaseOfCode0x1000
BaseOfData0xb000
ImageBase0x10000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.1
ImageVersion0.0
SubsystemVersion5.1
Reserved10
SizeOfImage0x1d000
SizeOfHeaders0x400
CheckSum0
Subsystem2
DllCharacteristics0x100
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v7.0 DLL

Sections

namevavsizeraw sizeflags
.text0x10000x904e0x9200R-X CODE
.rdata0xb0000x41180x4200R-- IDATA
.data0x100000xacc00x200RW- IDATA
.rsrc0x1b0000x4d80x600R-- IDATA
.reloc0x1c0000x9ce0xa00R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0xeea00x278
IMPORT0xe31c0xa0
RESOURCE0x1b0000x4d8
EXCEPTION00
SECURITY00
BASERELOC0x1c0000x938
DEBUG0xb2300x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0xe1b00x40
Bound_IAT00
IAT0xb0000x214
Delay_IAT00
CLR_Header00
typenamesizecp
DIALOG#1011900
VERSION#18840
module_namehintordfunction_name
CRYPT32.dll37CertDuplicateCertificateContext
CRYPT32.dll75CertGetNameStringW
CRYPT32.dll64CertFreeCertificateContext
CRYPT32.dll89CertOpenSystemStoreW
CRYPT32.dll44CertEnumCertificatesInStore
CRYPT32.dll18CertCloseStore
WSOCK32.dll52
WSOCK32.dll8
WSOCK32.dll57
KERNEL32.dll1297WideCharToMultiByte
KERNEL32.dll531GetModuleFileNameA
KERNEL32.dll354FreeLibrary
KERNEL32.dll536GetModuleHandleW
KERNEL32.dll514GetLastError
KERNEL32.dll532GetModuleFileNameW
KERNEL32.dll581GetProcAddress
KERNEL32.dll831LoadLibraryW
KERNEL32.dll762IsBadWritePtr
KERNEL32.dll871MultiByteToWideChar
KERNEL32.dll117CopyFileW
KERNEL32.dll129CreateDirectoryW
KERNEL32.dll624GetSystemDirectoryW
KERNEL32.dll840LocalFree
KERNEL32.dll350FormatMessageW
KERNEL32.dll633GetSystemTimeAsFileTime
KERNEL32.dll449GetCurrentProcessId
KERNEL32.dll453GetCurrentThreadId
KERNEL32.dll659GetTickCount
KERNEL32.dll935QueryPerformanceCounter
KERNEL32.dll745InterlockedCompareExchange
KERNEL32.dll1202Sleep
KERNEL32.dll748InterlockedExchange
KERNEL32.dll202DecodePointer
KERNEL32.dll1216TerminateProcess
KERNEL32.dll448GetCurrentProcess
KERNEL32.dll1235UnhandledExceptionFilter
KERNEL32.dll1189SetUnhandledExceptionFilter
KERNEL32.dll214DeleteFileW
KERNEL32.dll234EncodePointer
KERNEL32.dll768IsDebuggerPresent
USER32.dll291GetDesktopWindow
USER32.dll533MessageBoxW
USER32.dll256GetActiveWindow
USER32.dll172DialogBoxParamW
USER32.dll295GetDlgItem
USER32.dll636SendMessageW
USER32.dll218EndDialog
USER32.dll658SetFocus
ADVAPI32.dll622RegQueryValueExW
ADVAPI32.dll609RegOpenKeyExW
ADVAPI32.dll357GetUserNameW
ADVAPI32.dll560RegCloseKey
NCSUtil4.dll908NCSPrefMachineUnLock
NCSUtil4.dll915NCSPrefSetMachineKeyLock
NCSUtil4.dll895NCSPrefGetBoolean
NCSUtil4.dll948NCSThreadTerminate
NCSUtil4.dll890NCSPrefCreateUserKeyLock
NCSUtil4.dll859NCSGetTempDirectory
NCSUtil4.dll901NCSPrefGetString
NCSUtil4.dll805NCSFileGetVersion
NCSUtil4.dll857NCSGetPlatform
NCSUtil4.dll955NCSVersionCompare
NCSUtil4.dll919NCSPrefSetUserBoolean
NCSUtil4.dll906NCSPrefGetUserString
NCSUtil4.dll905NCSPrefGetUserInt
NCSUtil4.dll793NCSEncodeBase64Message
NCSUtil4.dll952NCSUtf8Encode
NCSUtil4.dll936NCSStrDupT
NCSUtil4.dll882NCSMutexInit
NCSUtil4.dll797NCSEventCreate
NCSUtil4.dll946NCSThreadSpawn
NCSUtil4.dll802NCSEventWait
NCSUtil4.dll938NCSThreadIsRunning
NCSUtil4.dll934NCSSleep
NCSUtil4.dll801NCSEventSet
NCSUtil4.dll782NCSDbgGetExceptionInfoMsg
NCSUtil4.dll799NCSEventDestroy
NCSUtil4.dll881NCSMutexFini
NCSUtil4.dll935NCSStrDup
NCSUtil4.dll922NCSPrefSetUserKeyLock
NCSUtil4.dll903NCSPrefGetUserBoolean
NCSUtil4.dll925NCSPrefUserUnLock
NCSUtil4.dll893NCSPrefDeleteValueUser
NCSUtil4.dll926NCSRealloc
NCSUtil4.dll879NCSMutexBegin
NCSUtil4.dll880NCSMutexEnd
NCSUtil4.dll861NCSGetTimeStampMs
NCSUtil4.dll848NCSFree
NCSUtil4.dll877NCSMalloc
NCSUtil4.dll875NCSLogSetServer
NCSUtil4.dll870NCSIsService
NCSUtil4.dll872NCSLog
MSVCR100.dll1123_swprintf
MSVCR100.dll545_except_handler4_common
MSVCR100.dll969_onexit
MSVCR100.dll803_lock
MSVCR100.dll347__dllonexit
MSVCR100.dll1165_unlock
MSVCR100.dll339__clean_type_info_names_internal
MSVCR100.dll305__CppXcptFilter
MSVCR100.dll453_amsg_exit
MSVCR100.dll689_initterm_e
MSVCR100.dll688_initterm
MSVCR100.dll537_encoded_null
MSVCR100.dll1419free
MSVCR100.dll820_malloc_crt
MSVCR100.dll1594wcsncmp
MSVCR100.dll1250_wcsnicmp
MSVCR100.dll1487memcpy
MSVCR100.dll1244_wcslwr
MSVCR100.dll1603wcsstr
MSVCR100.dll544_except_handler3
MSVCR100.dll1519sprintf
MSVCR100.dll1489memmove
MSVCR100.dll1299_wfopen
MSVCR100.dll1399feof
MSVCR100.dll1406fgetws
MSVCR100.dll1554swscanf
MSVCR100.dll1360_wtoi
MSVCR100.dll1398fclose
MSVCR100.dll1491memset
MSVCR100.dll1595wcsncpy
MSVCR100.dll1093_strlwr
MSVCR100.dll1546strstr
MSVCR100.dll1217_vswprintf_c_l
MSVCR100.dll507_crt_debugger_hook
ordentry_vafunction_name
10x2400DllMain
20x2470NCSWinInetAddClient
30x24a0NCSWinInetRemoveClient
40x8650NCScnetCreate
50x8610NCScnetCreateEx
60x7e70NCScnetCreateProxy
70x7ac0NCScnetDestroy
80x6ac0NCScnetInit
90x1840NCScnetIsPollingConnection
100x85d0NCScnetPostURL
110x7e10NCScnetPostURLExt
120x73b0NCScnetPostURLExt2
130x6920NCScnetSendPacket
140x6a30NCScnetSetIISDLLName
150x1140NCScnetSetProxy
160x68c0NCScnetSetRecvCB
170x6a00NCScnetSetSendBlocking
180x68f0NCScnetSetSentCB
190x6af0NCScnetShutdown
200x6b30NCScnetUseWinHttp
210x5a90NCScnetVerifyURL
module_nameNCScnet4.dll
flags0
timestamp2011-02-08 16:52:23
version0.0
ordinal_base1
nFunctions21
nNames21
Names(21)0xef1c
Functions(21)0xeec8
NameOrdinals(21)0xef70

StringTable 040904b0

CompanyNameERDAS, Inc.
FileDescriptionNCScnet4
FileVersion4,2,1,128
InternalNameNCScnet4
LegalCopyrightCopyright ©1999-2010
OriginalFilenameNCScnet4.dll
PatentsCovered by one or more of U.S. Patents #6,442,298, #6,201,897 & #6,633,688
ProductNameERDAS NCScnet4
ProductVersion4,2,1,128

VS_FIXEDFILEINFO

FileVersion4.2.1.128
ProductVersion4.2.1.128
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType2
FileSubtype0
offsetsizetypecomment
059904DLL02/08/2011 16:52:23#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK