x64_BlankUMDFDriver-InsiderWDK_20226+VSPreview2019

info
MZ
PE
imports
exports
foremost
hexdump
disasm
log
discuss
donate

filename	x64_BlankUMDFDriver-InsiderWDK_20226+VSPreview2019_16.8-pre3.2.dll
size	23552 (0x5c00)
md5	c7b1c9041982ff054ed6cd2101cf11c8

type	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x108

Rich Header

lib id	version	times used
261	29118	29
260	29118	9
259	29118	5
147	30729	16
257	28900	3
1	0	63
263	28900	2
259	28900	2
260	28900	1
260	29304	3
256	29304	1
258	29304	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x8664
NumberOfSections	6
TimeDateStamp	0x5f753984
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xf0
Characteristics	0x2022
Magic	0x20b
LinkerVersion	14.28
SizeOfCode	0x2a00
SizeOfInitializedData	0x3600
SizeOfUninitializedData	0
AddressOfEntryPoint	0x2210
BaseOfCode	0x1000
ImageBase	0x180000000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	10.0
ImageVersion	10.0
SubsystemVersion	10.0
Reserved1	0
SizeOfImage	0xb000
SizeOfHeaders	0x400
CheckSum	0x12869
Subsystem	2
DllCharacteristics	0x4160
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MASM/TASM - sig4

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x280e	0x2a00	R-X CODE
.rdata	0x4000	0x231e	0x2400	R-- IDATA
.data	0x7000	0x888	0x200	RW- IDATA
.pdata	0x8000	0x3b4	0x400	R-- IDATA
_RDATA	0x9000	0x100	0x200	R-- IDATA
.reloc	0xa000	0x128	0x200	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0x5c60	0x84
IMPORT	0x5ce4	0x8c
RESOURCE	0	0
EXCEPTION	0x8000	0x3b4
SECURITY	0	0
BASERELOC	0xa000	0x128
DEBUG	0x5458	0x38
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0x5490	0x138
Bound_IAT	0	0
IAT	0x4000	0x1a0
Delay_IAT	0	0
CLR_Header	0	0

module_name	hint	function_name
ntdll.dll	35	DbgPrintEx
ADVAPI32.dll	638	TraceMessage
ADVAPI32.dll	544	RegisterTraceGuidsW
ADVAPI32.dll	644	UnregisterTraceGuids
ADVAPI32.dll	268	GetTraceLoggerHandle
ADVAPI32.dll	267	GetTraceEnableLevel
ADVAPI32.dll	266	GetTraceEnableFlags
WppRecorderUM.dll	3	WppAutoLogTrace
WppRecorderUM.dll	2	WppAutoLogStop
WppRecorderUM.dll	1	WppAutoLogStart
KERNEL32.dll	177	DeleteCriticalSection
KERNEL32.dll	306	FlsGetValue
KERNEL32.dll	409	GetCurrentProcess
KERNEL32.dll	707	InitializeCriticalSectionEx
KERNEL32.dll	1268	__C_specific_handler
KERNEL32.dll	904	QueryPerformanceCounter
KERNEL32.dll	410	GetCurrentProcessId
KERNEL32.dll	414	GetCurrentThreadId
KERNEL32.dll	595	GetSystemTimeAsFileTime
KERNEL32.dll	710	InitializeSListHead
KERNEL32.dll	979	RtlCaptureContext
KERNEL32.dll	984	RtlLookupFunctionEntry
KERNEL32.dll	991	RtlVirtualUnwind
KERNEL32.dll	727	IsDebuggerPresent
KERNEL32.dll	1164	UnhandledExceptionFilter
KERNEL32.dll	1121	SetUnhandledExceptionFilter
KERNEL32.dll	733	IsProcessorFeaturePresent
KERNEL32.dll	305	FlsFree
KERNEL32.dll	714	InterlockedFlushSList
KERNEL32.dll	473	GetLastError
KERNEL32.dll	1064	SetLastError
KERNEL32.dll	304	FlsAlloc
KERNEL32.dll	1147	TerminateProcess
KERNEL32.dll	307	FlsSetValue
api-ms-win-crt-runtime-l1-1-0.dll	24	_configure_narrow_argv
api-ms-win-crt-runtime-l1-1-0.dll	52	_initialize_onexit_table
api-ms-win-crt-runtime-l1-1-0.dll	63	_seh_filter_dll
api-ms-win-crt-runtime-l1-1-0.dll	34	_execute_onexit_table
api-ms-win-crt-runtime-l1-1-0.dll	55	_initterm_e
api-ms-win-crt-runtime-l1-1-0.dll	103	terminate
api-ms-win-crt-runtime-l1-1-0.dll	54	_initterm
api-ms-win-crt-runtime-l1-1-0.dll	51	_initialize_narrow_environment
api-ms-win-crt-runtime-l1-1-0.dll	84	abort
api-ms-win-crt-runtime-l1-1-0.dll	22	_cexit
api-ms-win-crt-heap-l1-1-0.dll	23	calloc
api-ms-win-crt-heap-l1-1-0.dll	24	free

ord	entry_va	function_name
1	0x1b40	FxDriverEntryUm

module_name	BlankUMDFDriver-InsiderWDK_20226+VSPreview2019_16.8-pre3.2.dll
flags	0
timestamp	2106-02-07 06:28:15
version	0.0
ordinal_base	1
nFunctions	1
nNames	1
Names(1)	0x5c8c
Functions(1)	0x5c88
NameOrdinals(1)	0x5c90

show previews

offset	size	type	comment
15c1	15	HTM		#
15d0	17968	BIN	overlay data past EOF	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK

x64_BlankUMDFDriver-InsiderWDK_20226+VSPreview2019_16.8-pre3.2.dll

MZ Header

Rich Header

DOS stub

PE Header

Packer / Compiler

Sections

Data Directory