filenameToolbox.dll
size8704 (0x2200)
md5f70e43e2220ece2fd0a08f34dce46b1b
typePE32 executable (DLL) (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x108

Rich Header

lib idversiontimes used
147307294
257230133
259230131
2612301315
2602301311
203655012
1033
265230261
256230261
255230261
258230261

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0x57b33c9f
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x2102
Magic0x10b
LinkerVersion14.0
SizeOfCode0xe00
SizeOfInitializedData0x1200
SizeOfUninitializedData0
AddressOfEntryPoint0x13c5
BaseOfCode0x1000
BaseOfData0x2000
ImageBase0x10000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.0
ImageVersion0.0
SubsystemVersion6.0
Reserved10
SizeOfImage0x6000
SizeOfHeaders0x400
CheckSum0
Subsystem2
DllCharacteristics0x140
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000xd480xe00R-X CODE
.rdata0x20000x8ba0xa00R-- IDATA
.data0x30000x3900x200RW- IDATA
.rsrc0x40000x1e00x200R-- IDATA
.reloc0x50000x13c0x200R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x24300xb3
IMPORT0x24e40x64
RESOURCE0x40000x1e0
EXCEPTION00
SECURITY00
BASERELOC0x50000x13c
DEBUG0x20d00x38
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x21080x40
Bound_IAT00
IAT0x20000x80
Delay_IAT00
CLR_Header00
typenamesizecp
MANIFEST#23810
module_namehintordfunction_name
VCRUNTIME140.dll37__std_type_info_destroy_list
VCRUNTIME140.dll53_except_handler4_common
VCRUNTIME140.dll41__telemetry_main_return_trigger
VCRUNTIME140.dll40__telemetry_main_invoke_trigger
VCRUNTIME140.dll72memset
api-ms-win-crt-runtime-l1-1-0.dll23_cexit
api-ms-win-crt-runtime-l1-1-0.dll31_crt_atexit
api-ms-win-crt-runtime-l1-1-0.dll36_execute_onexit_table
api-ms-win-crt-runtime-l1-1-0.dll62_register_onexit_function
api-ms-win-crt-runtime-l1-1-0.dll53_initialize_narrow_environment
api-ms-win-crt-runtime-l1-1-0.dll65_seh_filter_dll
api-ms-win-crt-runtime-l1-1-0.dll57_initterm_e
api-ms-win-crt-runtime-l1-1-0.dll56_initterm
api-ms-win-crt-runtime-l1-1-0.dll54_initialize_onexit_table
api-ms-win-crt-runtime-l1-1-0.dll59_invalid_parameter_noinfo_noreturn
api-ms-win-crt-heap-l1-1-0.dll24free
KERNEL32.dll1347SetUnhandledExceptionFilter
KERNEL32.dll521GetCurrentProcess
KERNEL32.dll1377TerminateProcess
KERNEL32.dll877IsProcessorFeaturePresent
KERNEL32.dll1069QueryPerformanceCounter
KERNEL32.dll522GetCurrentProcessId
KERNEL32.dll871IsDebuggerPresent
KERNEL32.dll843InitializeSListHead
KERNEL32.dll275DisableThreadLibraryCalls
KERNEL32.dll726GetSystemTimeAsFileTime
KERNEL32.dll526GetCurrentThreadId
KERNEL32.dll1410UnhandledExceptionFilter
ordentry_vafunction_name
10x1020?Calculate@Calculator@Math@@QAENV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
20x1000Calculate
module_nameToolbox.dll
flags0
timestamp2016-08-16 16:17:35
version0.0
ordinal_base1
nFunctions2
nNames2
Names(2)0x2460
Functions(2)0x2458
NameOrdinals(2)0x2468
offsetsizetypecomment
08704DLL08/16/2016 16:17:35#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK