filenamefcusbser.sys
size119552 (0x1d300)
md519492b639a8c79e45f550e7848fd1818
typePE32+ executable (native) x86-64, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xd8

Rich Header

lib idversiontimes used
123507277
1086
125507273
109507274
1135072715
124507271
120507271

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x8664
NumberOfSections7
TimeDateStamp0x4a489def
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xf0
Characteristics0x22
Magic0x20b
LinkerVersion8.0
SizeOfCode0x1af80
SizeOfInitializedData0x2080
SizeOfUninitializedData0
AddressOfEntryPoint0x1c108
BaseOfCode0x300
ImageBase0x10000
SectionAlignment0x80
FileAlignment0x80
OperatingSystemVersion6.0
ImageVersion6.0
SubsystemVersion1.10
Reserved10
SizeOfImage0x1d300
SizeOfHeaders0x300
CheckSum0x2c8b5
Subsystem1
DllCharacteristics0x2000
SizeOfStackReserve0x40000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x3000x1a4680x1a480R-X CODE
.rdata0x1a7800xbec0xc00R-- IDATA
.data0x1b3800x4b40x500RW- IDATA
.pdata0x1b8800x8700x880R-- IDATA
INIT0x1c1000xacc0xb00RWX CODE DISCARDABLE
.rsrc0x1cc000x5b00x600R-- IDATA DISCARDABLE
.reloc0x1d2000xb40x100R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x1c1640x50
RESOURCE0x1cc000x5b0
EXCEPTION0x1b8800x870
SECURITY00
BASERELOC0x1d2000x30
DEBUG0x1aa300x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x1a7800x2b0
Delay_IAT00
CLR_Header00
typenamesizecp
VERSION#113560
module_namehintordfunction_name
ntoskrnl.exe323RtlUnicodeStringToAnsiString
ntoskrnl.exe197KeReleaseSpinLock
ntoskrnl.exe163IofCompleteRequest
ntoskrnl.exe99IoFreeIrp
ntoskrnl.exe296RtlFreeAnsiString
ntoskrnl.exe281RtlCopyUnicodeString
ntoskrnl.exe126IoReleaseCancelSpinLock
ntoskrnl.exe283RtlDeleteRegistryValue
ntoskrnl.exe3DbgPrint
ntoskrnl.exe167KeAcquireSpinLockRaiseToDpc
ntoskrnl.exe66IoAcquireRemoveLockEx
ntoskrnl.exe171KeClearEvent
ntoskrnl.exe135IoSetDeviceInterfaceState
ntoskrnl.exe207KeSetPriorityThread
ntoskrnl.exe32ExGetPreviousMode
ntoskrnl.exe128IoReleaseRemoveLockEx
ntoskrnl.exe198KeReleaseSpinLockFromDpcLevel
ntoskrnl.exe264PsCreateSystemThread
ntoskrnl.exe265PsTerminateSystemThread
ntoskrnl.exe336ZwClose
ntoskrnl.exe248ObReferenceObjectByHandle
ntoskrnl.exe213KeWaitForSingleObject
ntoskrnl.exe329RtlWriteRegistryValue
ntoskrnl.exe102IoGetAttachedDeviceReference
ntoskrnl.exe252ObfDereferenceObject
ntoskrnl.exe212KeWaitForMultipleObjects
ntoskrnl.exe166KeAcquireSpinLockAtDpcLevel
ntoskrnl.exe162IofCallDriver
ntoskrnl.exe133IoReuseIrp
ntoskrnl.exe123IoRegisterDeviceInterface
ntoskrnl.exe302RtlInitUnicodeString
ntoskrnl.exe92IoDeleteDevice
ntoskrnl.exe357ZwSetValueKey
ntoskrnl.exe94IoDetachDevice
ntoskrnl.exe258PoSetPowerState
ntoskrnl.exe87IoCreateUnprotectedSymbolicLink
ntoskrnl.exe74IoAttachDeviceToDeviceStack
ntoskrnl.exe70IoAllocateIrp
ntoskrnl.exe178KeInitializeEvent
ntoskrnl.exe121IoOpenDeviceRegistryKey
ntoskrnl.exe82IoCreateDevice
ntoskrnl.exe107IoGetDeviceProperty
ntoskrnl.exe347ZwOpenKey
ntoskrnl.exe79IoCancelIrp
ntoskrnl.exe387isprint
ntoskrnl.exe354ZwQueryValueKey
ntoskrnl.exe266RtlAnsiStringToUnicodeString
ntoskrnl.exe409strstr
ntoskrnl.exe305RtlIntegerToUnicodeString
ntoskrnl.exe300RtlInitAnsiString
ntoskrnl.exe177KeInitializeDpc
ntoskrnl.exe181KeInitializeTimer
ntoskrnl.exe297RtlFreeUnicodeString
ntoskrnl.exe267RtlAppendUnicodeStringToString
ntoskrnl.exe127IoReleaseRemoveLockAndWaitEx
ntoskrnl.exe114IoInitializeRemoveLockEx
ntoskrnl.exe65IoAcquireCancelSpinLock
ntoskrnl.exe229MmMapLockedPagesSpecifyCache
ntoskrnl.exe209KeSetTimer
ntoskrnl.exe170KeCancelTimer
ntoskrnl.exe192KeReadStateTimer
ntoskrnl.exe187KeQueryPriorityThread
ntoskrnl.exe76IoBuildDeviceIoControlRequest
ntoskrnl.exe155IoWMIRegistrationControl
ntoskrnl.exe190KeReadStateEvent
ntoskrnl.exe101IoFreeWorkItem
ntoskrnl.exe257PoRequestPowerIrp
ntoskrnl.exe72IoAllocateWorkItem
ntoskrnl.exe260PoStartNextPowerIrp
ntoskrnl.exe254PoCallDriver
ntoskrnl.exe119IoIsWdmVersionAvailable
ntoskrnl.exe122IoQueueWorkItem
ntoskrnl.exe169KeBugCheckEx
ntoskrnl.exe205KeSetEvent
ntoskrnl.exe30ExFreePoolWithTag
ntoskrnl.exe93IoDeleteSymbolicLink
ntoskrnl.exe21ExAllocatePoolWithTag
ntoskrnl.exe277RtlCompareMemory
ntoskrnl.exe401sprintf
USBD.SYS4USBD_CreateConfigurationRequestEx
USBD.SYS10USBD_ParseConfigurationDescriptorEx
WMILIB.SYS2WmiSystemControl
WMILIB.SYSWmiCompleteRequest

StringTable 000004b0

CompanyNameBM
FileDescriptionUSB Modem/Serial Device Driver
FileVersion2. 0. 5. 9
InternalNamebmusbser
LegalCopyrightCopyright © 2001-2009
OriginalFilenamebmusbser.sys
ProductNameBM USB Modem/Serial Device Driver
ProductVersion2. 0. 5. 9

StringTable 040904b0

CompanyNameBM
FileDescriptionUSB/Serial Device Driver
FileVersion2. 0. 5. 9
InternalNameBM USB Device Driver
LegalCopyrightCopyright © 2001-2009
OriginalFilenamebmusbser.sys
ProductNameBM IUSB-Serial Driver
ProductVersion2. 0. 5. 9

VS_FIXEDFILEINFO

FileVersion2.0.5.9
ProductVersion2.0.5.9
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType3
FileSubtype1
offsetsizetypecomment
15c115HTM#
15d0113968BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK