filenamerecosmss.dll
size81920 (0x14000)
md5d5606e169dfa0308224741020d5f5518
typePE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf0

Rich Header

lib idversiontimes used
16186083
103
85119192
21798813
19552551
835212
22748682
9040354

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x440c6691
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x2306
Magic0x10b
LinkerVersion7.10
SizeOfCode0x10000
SizeOfInitializedData0x3a00
SizeOfUninitializedData0
AddressOfEntryPoint0x16e7
BaseOfCode0x1000
BaseOfData0x11000
ImageBase0x10000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.1
ImageVersion8.20
SubsystemVersion4.0
Reserved10
SizeOfImage0x17000
SizeOfHeaders0x400
CheckSum0x2345f
Subsystem2
DllCharacteristics0x8000
SizeOfStackReserve0x200000
SizeOfStackCommit0x4000
SizeOfHeapReserve0x20000
SizeOfHeapCommit0x8000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x100000x10000R-X CODE
.data0x110000x378f0x3800RW- IDATA
.rsrc0x150000x10000x200R-- IDATA
.reloc0x160000x10000x200R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x10a580x299
IMPORT0x108800x3c
RESOURCE0x150000x10
EXCEPTION00
SECURITY00
BASERELOC0x160000x44
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x10d000x48
Delay_IAT00
CLR_Header00
module_namehintordfunction_name
KERNEL32.dll413GetPrivateProfileSectionNamesA
KERNEL32.dll861SleepEx
KERNEL32.dll223FindNextChangeNotification
KERNEL32.dll60CompareStringA
KERNEL32.dll712RemoveDirectoryA
KERNEL32.dll837SetThreadAffinityMask
KERNEL32.dll54CloseHandle
KERNEL32.dll361GetFileTime
KERNEL32.dll86CreateFileA
KERNEL32.dll903VirtualAlloc
KERNEL32.dll508GlobalAlloc
KERNEL32.dll657OutputDebugStringA
NTDLL.dll370NtSetInformationProcess
NTDLL.dll1009ZwCreateMutant
NTDLL.dll1139ZwQueryPerformanceCounter
NTDLL.dll307NtQuerySection
ordentry_vafunction_name
10x1776CreatePlocessNotify
20x7091Seek
30x4e81GetTableIndexInfo
40x5765SetTableSequential
50x8d08GotoPosition
60x44d1GotoBookmark
70x8ebcGetColumnInfo
80x252aGetLock
90x342fAttachDatabaseWithStreaming
100x7c44AttachDatabase2
110x3382CreateDatabase
120x61daOpenTempTable2
130x17e2DetachDatabase2
140x1d2fDupCursor
150x5a53BeginExternalBackupInstance
160x23f6RetrieveColumns
170x77acEscrowUpdate
180x806fCommitTransaction
190x27e3GetSystemParameter
200x62d4GetDatabaseInfo
210x1a8bOSSnapshotFreeze
220x61f3CloseFileInstance
230x5c9bFreeBuffer
240x2f1cRestore
module_nameclient.dll
flags0
timestamp2012-11-26 10:04:12
version0.0
ordinal_base1
nFunctions24
nNames24
Names(24)0x10b10
Functions(24)0x10a80
NameOrdinals(24)0x10ae0
offsetsizetypecomment
081920DLL03/06/2006 16:42:57#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK