DLL load source and address

Previous Top Next

Thinstall will list all DLL/OCX files loaded by applications loaded under it's control. Some DLLs are loaded by Windows, and some will be loaded by Thinstall. It is useful to check this list to make sure DLLs are being loaded by Thinstall where needed and the source location matches where you want the DLL to be loaded from.

DLLs will be listed as:

PRELOADED_BY_SYSTEM - Loaded by Windows before Thinstall was loaded or loaded by Windows outside of Thinstall's control.
PRELOADED_MAP - Part of your base EXE
SYSTEM_LOADED - Loaded by Windows after Thinstall started running.
MEMORY_MAPPED_ANON - Loaded by Thinstall, DLL is isolated & invisible to Windows and Windows loaded DLLs

--- Modules loaded ---
PRELOADED_BY_SYSTEM 00400000-00506000, c:\Program Files\Thinstall\thinstall.exe
PRELOADED_BY_SYSTEM 00f80000-00f9f000, c:\tmp\installo.dll
PRELOADED_BY_SYSTEM 00f70000-00f75000, c:\tmp\splashd.dll
PRELOADED_BY_SYSTEM 00f20000-00f5a000, c:\tmp\vregistryd.dll
PRELOADED_BY_SYSTEM 77dd0000-77e6b000, C:\WINDOWS\system32\ADVAPI32.dll
PRELOADED_BY_SYSTEM 763b0000-763f9000, C:\WINDOWS\system32\comdlg32.dll
PRELOADED_BY_SYSTEM 77f10000-77f56000, C:\WINDOWS\system32\GDI32.dll
PRELOADED_BY_SYSTEM 7c800000-7c8f4000, C:\WINDOWS\system32\kernel32.dll
PRELOADED_BY_SYSTEM 76080000-760e5000, C:\WINDOWS\system32\MSVCP60.dll
PRELOADED_BY_SYSTEM 77c10000-77c68000, C:\WINDOWS\system32\msvcrt.dll
PRELOADED_BY_SYSTEM 5b860000-5b8b4000, C:\WINDOWS\system32\NETAPI32.dll
PRELOADED_BY_SYSTEM 7c900000-7c9b0000, C:\WINDOWS\system32\ntdll.dll
PRELOADED_BY_SYSTEM 774e0000-7761d000, C:\WINDOWS\system32\ole32.dll
PRELOADED_BY_SYSTEM 77120000-771ac000, C:\WINDOWS\system32\OLEAUT32.dll
PRELOADED_BY_SYSTEM 74e30000-74e9c000, C:\WINDOWS\system32\RICHED20.dll
PRELOADED_BY_SYSTEM 732e0000-732e5000, C:\WINDOWS\system32\riched32.dll
PRELOADED_BY_SYSTEM 77e70000-77f01000, C:\WINDOWS\system32\RPCRT4.dll
PRELOADED_BY_SYSTEM 7c9c0000-7d1d5000, C:\WINDOWS\system32\SHELL32.dll
PRELOADED_BY_SYSTEM 77f60000-77fd6000, C:\WINDOWS\system32\SHLWAPI.dll
PRELOADED_BY_SYSTEM 77d40000-77dd0000, C:\WINDOWS\system32\USER32.dll
PRELOADED_BY_SYSTEM 77c00000-77c08000, C:\WINDOWS\system32\VERSION.dll
PRELOADED_BY_SYSTEM 76360000-76370000, C:\WINDOWS\system32\WINSTA.dll
PRELOADED_BY_SYSTEM 71ab0000-71ac7000, C:\WINDOWS\system32\WS2_32.dll
PRELOADED_BY_SYSTEM 71aa0000-71aa8000, C:\WINDOWS\system32\WS2HELP.dll
PRELOADED_BY_SYSTEM 71ad0000-71ad9000, C:\WINDOWS\system32\WSOCK32.dll
PRELOADED_BY_SYSTEM 76f50000-76f58000, C:\WINDOWS\system32\wtsapi32.dll
PRELOADED_BY_SYSTEM 773d0000-774d2000, C:\WINDOWS\WinSxS\X86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\COMCTL32.dll
PRELOADED_MAP 00400000-00506000, c:\Program Files\Thinstall\thinstall.exe
SYSTEM_LOADED 00400000-00506000, c:\Program Files\Thinstall\thinstall.exe
SYSTEM_LOADED 77dd0000-77e6b000, C:\WINDOWS\system32\ADVAPI32.dll
SYSTEM_LOADED 763b0000-763f9000, C:\WINDOWS\system32\comdlg32.dll
SYSTEM_LOADED 77f10000-77f56000, C:\WINDOWS\system32\GDI32.dll
SYSTEM_LOADED 7c800000-7c8f4000, C:\WINDOWS\system32\kernel32.dll
SYSTEM_LOADED 76080000-760e5000, C:\WINDOWS\system32\MSVCP60.dll
SYSTEM_LOADED 77c10000-77c68000, C:\WINDOWS\system32\msvcrt.dll
SYSTEM_LOADED 7c900000-7c9b0000, C:\WINDOWS\system32\ntdll.dll
SYSTEM_LOADED 774e0000-7761d000, C:\WINDOWS\system32\ole32.dll
SYSTEM_LOADED 77120000-771ac000, C:\WINDOWS\system32\OLEAUT32.dll
SYSTEM_LOADED 01340000-01349000, C:\WINDOWS\system32\PGPhk.dll
SYSTEM_LOADED 76bf0000-76bfb000, C:\WINDOWS\system32\psapi.dll
SYSTEM_LOADED 74e30000-74e9c000, C:\WINDOWS\system32\RICHED20.dll
SYSTEM_LOADED 732e0000-732e5000, C:\WINDOWS\system32\riched32.dll
SYSTEM_LOADED 77e70000-77f01000, C:\WINDOWS\system32\RPCRT4.dll
SYSTEM_LOADED 7c9c0000-7d1d5000, C:\WINDOWS\system32\SHELL32.dll
SYSTEM_LOADED 77f60000-77fd6000, C:\WINDOWS\system32\SHLWAPI.dll
SYSTEM_LOADED 77d40000-77dd0000, C:\WINDOWS\system32\USER32.dll
SYSTEM_LOADED 5ad70000-5ada8000, C:\WINDOWS\system32\uxtheme.dll
SYSTEM_LOADED 77c00000-77c08000, C:\WINDOWS\system32\VERSION.dll
SYSTEM_LOADED 73000000-73026000, C:\WINDOWS\system32\WINSPOOL.DRV
SYSTEM_LOADED 71ab0000-71ac7000, C:\WINDOWS\system32\WS2_32.dll
SYSTEM_LOADED 71aa0000-71aa8000, C:\WINDOWS\system32\WS2HELP.dll
SYSTEM_LOADED 71ad0000-71ad9000, C:\WINDOWS\system32\WSOCK32.dll
SYSTEM_LOADED 773d0000-774d2000, C:\WINDOWS\WinSxS\X86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\COMCTL32.dll
MEMORY_MAPPED_ANON 76780000-76789000, c:\Program Files\Thinstall\shfolder.dll
MEMORY_MAPPED_ANON 00fb0000-00fc2000, c:\Program Files\Thinstall\statusbard.dll
MEMORY_MAPPED_ANON 010e0000-011e6000, c:\Program Files\Thinstall\thinstall.exe.th_raw
MEMORY_MAPPED_ANON 59a60000-59b01000, c:\tmp\DBGHELP.DLL