filenamehidclass.sys
size56320 (0xdc00)
md54402b6576369c11b989861de24b24557
typePE32 executable (DLL) (native) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe8

Rich Header

lib idversiontimes used
1085
147307299
149307294
146307291
1313072927
148307291
145307291

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections8
TimeDateStamp0x5c355f1f
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x2102
Magic0x10b
LinkerVersion9.0
SizeOfCode0xbc00
SizeOfInitializedData0x1c00
SizeOfUninitializedData0
AddressOfEntryPoint0x1003e
BaseOfCode0x1000
BaseOfData0x9000
ImageBase0x10000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.1
ImageVersion6.1
SubsystemVersion6.1
Reserved10
SizeOfImage0x13000
SizeOfHeaders0x400
CheckSum0x109e8
Subsystem1
DllCharacteristics0
SizeOfStackReserve0x40000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x7d680x7e00R-X CODE
.rdata0x90000x5d40x600R-- IDATA
.data0xa0000x16c0x200RW- IDATA
PAGE0xb0000x32520x3400R-X CODE
.edata0xf0000x9d0x200R-- IDATA
INIT0x100000x9040xa00RWX CODE DISCARDABLE
.rsrc0x110000x4080x600R-- IDATA DISCARDABLE
.reloc0x120000xa540xc00R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0xf0000x9d
IMPORT0x100500x64
RESOURCE0x110000x408
EXCEPTION00
SECURITY00
BASERELOC0x120000x940
DEBUG0x91600x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x94d80x40
Bound_IAT00
IAT0x90000x160
Delay_IAT00
CLR_Header00
typenamesizecp
VERSION#19320
module_namehintordfunction_name
ntoskrnl.exe783KeInitializeDpc
ntoskrnl.exe796KeInitializeTimerEx
ntoskrnl.exe896KeSetEvent
ntoskrnl.exe115ExAllocatePoolWithQuotaTag
ntoskrnl.exe1760SeQuerySessionIdToken
ntoskrnl.exe567IoGetRequestorSessionId
ntoskrnl.exe2128memset
ntoskrnl.exe511IoDeleteDevice
ntoskrnl.exe1195ObfDereferenceObject
ntoskrnl.exe1197ObfReferenceObject
ntoskrnl.exe1481RtlFreeUnicodeString
ntoskrnl.exe1011MmMapLockedPagesSpecifyCache
ntoskrnl.exe737KeBugCheckEx
ntoskrnl.exe929KeWaitForSingleObject
ntoskrnl.exe551IoGetDeviceProperty
ntoskrnl.exe1241ProbeForWrite
ntoskrnl.exe532IoFreeIrp
ntoskrnl.exe2124memcpy
ntoskrnl.exe910KeSetTimer
ntoskrnl.exe880KeResetEvent
ntoskrnl.exe457IoAllocateIrp
ntoskrnl.exe795KeInitializeTimer
ntoskrnl.exe615IoReleaseCancelSpinLock
ntoskrnl.exe695IoWMIWriteEvent
ntoskrnl.exe994MmGetSystemRoutineAddress
ntoskrnl.exe1385RtlCompareMemory
ntoskrnl.exe116ExAllocatePoolWithTag
ntoskrnl.exe1982ZwQueryValueKey
ntoskrnl.exe1929ZwOpenKey
ntoskrnl.exe786KeInitializeEvent
ntoskrnl.exe455IoAllocateDriverObjectExtension
ntoskrnl.exe577IoInvalidateDeviceRelations
ntoskrnl.exe702IofCallDriver
ntoskrnl.exe2097_vsnwprintf
ntoskrnl.exe635IoSetDeviceInterfaceState
ntoskrnl.exe605IoRegisterDeviceInterface
ntoskrnl.exe514IoDetachDevice
ntoskrnl.exe466IoAttachDeviceToDeviceStack
ntoskrnl.exe490IoCreateDevice
ntoskrnl.exe574IoInitializeRemoveLockEx
ntoskrnl.exe738KeCancelTimer
ntoskrnl.exe1236PoStartNextPowerIrp
ntoskrnl.exe1233PoSetSystemWake
ntoskrnl.exe1217PoGetSystemWake
ntoskrnl.exe1231PoSetPowerState
ntoskrnl.exe742KeClearEvent
ntoskrnl.exe1771SeSinglePrivilegeCheck
ntoskrnl.exe911KeSetTimerEx
ntoskrnl.exe573IoInitializeIrp
ntoskrnl.exe632IoReuseIrp
ntoskrnl.exe920KeTickCount
ntoskrnl.exe1679RtlUnwind
ntoskrnl.exe449IoAcquireRemoveLockEx
ntoskrnl.exe461IoAllocateWorkItem
ntoskrnl.exe594IoQueueWorkItem
ntoskrnl.exe587IoOpenDeviceRegistryKey
ntoskrnl.exe1516RtlInitUnicodeString
ntoskrnl.exe2026ZwSetValueKey
ntoskrnl.exe474IoCancelIrp
ntoskrnl.exe1403RtlCopyUnicodeString
ntoskrnl.exe1225PoRequestPowerIrp
ntoskrnl.exe1869ZwClose
ntoskrnl.exe617IoReleaseRemoveLockEx
ntoskrnl.exe536IoFreeWorkItem
ntoskrnl.exe140ExFreePoolWithTag
ntoskrnl.exe690IoWMIRegistrationControl
ntoskrnl.exe703IofCompleteRequest
ntoskrnl.exe1612RtlQueryRegistryValues
ntoskrnl.exe63DbgPrint
ntoskrnl.exe1299PsGetVersion
ntoskrnl.exe1981ZwQuerySystemInformation
ntoskrnl.exe934KiBugCheckData
HAL.dll96KfAcquireSpinLock
HAL.dll84KeGetCurrentIrql
HAL.dll1ExReleaseFastMutex
HAL.dllExAcquireFastMutex
HAL.dll99KfReleaseSpinLock
WMILIB.SYS2WmiSystemControl
WMILIB.SYSWmiCompleteRequest
HIDPARSE.SYS2HidP_GetCaps
HIDPARSE.SYS24HidP_SysPowerEvent
HIDPARSE.SYS3HidP_GetCollectionDescription
HIDPARSE.SYS23HidP_SysPowerCaps
HIDPARSE.SYSHidP_FreeCollectionDescription
ordentry_vafunction_name
10xb2eeDllInitialize
20xb2b0DllUnload
30x41ccHidNotifyPresence
40xc11cHidRegisterMinidriver
module_nameHIDCLASS.SYS
flags0
timestamp2019-01-09 02:08:54
version0.0
ordinal_base1
nFunctions4
nNames4
Names(4)0xf038
Functions(4)0xf028
NameOrdinals(4)0xf048

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionHid Class Library
FileVersion6.1.7601.24354 (win7sp1_ldr_escrow.190108-1700)
InternalNamehidclass.sys
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenamehidclass.sys
ProductNameMicrosoft® Windows® Operating System
ProductVersion6.1.7601.24354

VS_FIXEDFILEINFO

FileVersion6.1.7601.24354
ProductVersion6.1.7601.24354
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType2
FileSubtype0
offsetsizetypecomment
056320DLL01/09/2019 02:40:31#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK