filenameUAC.dll
size18432 (0x4800)
md5d8f07db28bb87694d7d5756e6dfab5ae
typePE32 executable (DLL) (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe0

Rich Header

lib idversiontimes used
147307292
131307293
1235072711
1089
138307293
146307291
148210221
145307291

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x52f4579c
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x2102
Magic0x10b
LinkerVersion9.0
SizeOfCode0x3600
SizeOfInitializedData0xe00
SizeOfUninitializedData0
AddressOfEntryPoint0x38e0
BaseOfCode0x1000
BaseOfData0x5000
ImageBase0x10000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.0
ImageVersion0.0
SubsystemVersion5.0
Reserved10
SizeOfImage0x8000
SizeOfHeaders0x400
CheckSum0x5915
Subsystem2
DllCharacteristics0x540
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x34cc0x3600R-X CODE
.data0x50000x3900x200RW- IDATA
.rsrc0x60000x47c0x600R-- IDATA
.reloc0x70000x4ce0x600R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x44900x3c
IMPORT0x3bf40x8c
RESOURCE0x60000x47c
EXCEPTION00
SECURITY00
BASERELOC0x70000x3bc
DEBUG0x11800x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x10000x17c
Delay_IAT00
CLR_Header00
typenamesizecp
DIALOG#1013861252
MANIFEST#25981252
module_namehintordfunction_name
KERNEL32.dll67CloseHandle
KERNEL32.dll765LocalFree
KERNEL32.dll368GetCommandLineW
KERNEL32.dll778MapViewOfFile
KERNEL32.dll1089UnmapViewOfFile
KERNEL32.dll1124WaitForSingleObject
KERNEL32.dll979SetEvent
KERNEL32.dll505GetModuleHandleW
KERNEL32.dll819OpenProcess
KERNEL32.dll1057Sleep
KERNEL32.dll630GetVersionExW
KERNEL32.dll453GetExitCodeProcess
KERNEL32.dll1004SetLastError
KERNEL32.dll544GetProcAddress
KERNEL32.dll1191lstrcatW
KERNEL32.dll454GetExitCodeThread
KERNEL32.dll117CreateEventW
KERNEL32.dll967SetCurrentDirectoryW
KERNEL32.dll1197lstrcmpiW
KERNEL32.dll429GetCurrentThreadId
KERNEL32.dll212DuplicateHandle
KERNEL32.dll426GetCurrentProcessId
KERNEL32.dll163CreateThread
KERNEL32.dll425GetCurrentProcess
KERNEL32.dll721IsDebuggerPresent
KERNEL32.dll1045SetUnhandledExceptionFilter
KERNEL32.dll1086UnhandledExceptionFilter
KERNEL32.dll1069TerminateProcess
KERNEL32.dll753LoadLibraryA
KERNEL32.dll652GlobalFree
KERNEL32.dll486GetLastError
KERNEL32.dll535GetPrivateProfileIntW
KERNEL32.dll1206lstrlenW
KERNEL32.dll501GetModuleFileNameW
KERNEL32.dll328FormatMessageW
KERNEL32.dll645GlobalAlloc
KERNEL32.dll541GetPrivateProfileStringW
KERNEL32.dll124CreateFileMappingW
KERNEL32.dll151CreateProcessW
USER32.dll104CreateWindowExW
USER32.dll242FindWindowExW
USER32.dll93CreateDialogParamW
USER32.dll679SetWindowPos
USER32.dll267GetClassNameW
USER32.dll540PeekMessageW
USER32.dll471LoadIconW
USER32.dll441IsDialogMessageW
USER32.dll725TranslateMessage
USER32.dll269GetClientRect
USER32.dll27CallNextHookEx
USER32.dll634SetForegroundWindow
USER32.dll518MsgWaitForMultipleObjects
USER32.dll688SetWindowsHookExW
USER32.dll47CharNextW
USER32.dll392GetWindowRect
USER32.dll458IsWindowVisible
USER32.dll29CallWindowProcW
USER32.dll150DefWindowProcW
USER32.dll400GetWindowThreadProcessId
USER32.dll169DispatchMessageW
USER32.dll160DestroyWindow
USER32.dll166DialogBoxParamW
USER32.dll776wsprintfW
USER32.dll386GetWindowLongW
USER32.dll287GetDlgItem
USER32.dll677SetWindowLongW
USER32.dll543PostMessageW
USER32.dll729UnhookWindowsHookEx
USER32.dll209EnableWindow
USER32.dll611SendMessageW
USER32.dll211EndDialog
USER32.dll484LoadStringW
USER32.dll696ShowWindow
USER32.dll511MessageBoxW
USER32.dll473LoadImageW
ADVAPI32.dll351GetUserNameW
ADVAPI32.dll340GetTokenInformation
ADVAPI32.dll499OpenSCManagerW
ADVAPI32.dll258EqualSid
ADVAPI32.dll546QueryServiceStatus
ADVAPI32.dll401LookupPrivilegeValueW
ADVAPI32.dll30AdjustTokenPrivileges
ADVAPI32.dll497OpenProcessToken
ADVAPI32.dll83CloseServiceHandle
ADVAPI32.dll501OpenServiceW
SHELL32.dll279ShellExecuteExW
ole32.dll61CoInitialize
MSVCR90.dll331_crt_debugger_hook
MSVCR90.dll1322memset
ordentry_vafunction_name
10x2f50_
module_nameUAC.dll
flags0
timestamp2014-02-07 03:48:44
version0.0
ordinal_base1
nFunctions1
nNames1
Names(1)0x44bc
Functions(1)0x44b8
NameOrdinals(1)0x44c0
offsetsizetypecomment
018432DLL02/07/2014 03:48:44#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK