x86_BlankUMDFDriver-InsiderWDK_20226+VSPreview2019

info
MZ
PE
imports
exports
foremost
hexdump
disasm
log
discuss
donate

filename	x86_BlankUMDFDriver-InsiderWDK_20226+VSPreview2019_16.8-pre3.2.dll
size	21504 (0x5400)
md5	eca0ecd61048069e64eea503c982e78c

type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xf8

Rich Header

lib id	version	times used
261	29118	29
260	29118	13
259	29118	8
147	30729	16
257	28900	3
1	0	58
263	28900	2
260	28900	1
260	29304	3
256	29304	1
258	29304	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	4
TimeDateStamp	0x5f7538fb
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x2102
Magic	0x10b
LinkerVersion	14.28
SizeOfCode	0x2e00
SizeOfInitializedData	0x2600
SizeOfUninitializedData	0
AddressOfEntryPoint	0x1d60
BaseOfCode	0x1000
BaseOfData	0x4000
ImageBase	0x10000000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	10.0
ImageVersion	10.0
SubsystemVersion	10.0
Reserved1	0
SizeOfImage	0x8000
SizeOfHeaders	0x400
CheckSum	0x8c6d
Subsystem	2
DllCharacteristics	0x4140
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x2d63	0x2e00	R-X CODE
.rdata	0x4000	0x1998	0x1a00	R-- IDATA
.data	0x6000	0x4f8	0x200	RW- IDATA
.reloc	0x7000	0x438	0x600	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0x5400	0x88
IMPORT	0x5488	0x8c
RESOURCE	0	0
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0x7000	0x438
DEBUG	0x4ed8	0x38
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0x4f10	0xbc
Bound_IAT	0	0
IAT	0x4000	0xc4
Delay_IAT	0	0
CLR_Header	0	0

module_name	hint	function_name
ntdll.dll	1530	RtlUnwind
ntdll.dll	35	DbgPrintEx
ADVAPI32.dll	638	TraceMessage
ADVAPI32.dll	544	RegisterTraceGuidsW
ADVAPI32.dll	644	UnregisterTraceGuids
ADVAPI32.dll	268	GetTraceLoggerHandle
ADVAPI32.dll	267	GetTraceEnableLevel
ADVAPI32.dll	266	GetTraceEnableFlags
WppRecorderUM.dll	2	WppAutoLogStop
WppRecorderUM.dll	1	WppAutoLogStart
WppRecorderUM.dll	3	WppAutoLogTrace
KERNEL32.dll	696	InitializeCriticalSectionEx
KERNEL32.dll	299	FlsGetValue
KERNEL32.dll	175	DeleteCriticalSection
KERNEL32.dll	298	FlsFree
KERNEL32.dll	899	QueryPerformanceCounter
KERNEL32.dll	403	GetCurrentProcessId
KERNEL32.dll	407	GetCurrentThreadId
KERNEL32.dll	586	GetSystemTimeAsFileTime
KERNEL32.dll	699	InitializeSListHead
KERNEL32.dll	722	IsDebuggerPresent
KERNEL32.dll	1148	UnhandledExceptionFilter
KERNEL32.dll	1106	SetUnhandledExceptionFilter
KERNEL32.dll	728	IsProcessorFeaturePresent
KERNEL32.dll	402	GetCurrentProcess
KERNEL32.dll	1132	TerminateProcess
KERNEL32.dll	300	FlsSetValue
KERNEL32.dll	708	InterlockedFlushSList
KERNEL32.dll	465	GetLastError
KERNEL32.dll	1050	SetLastError
KERNEL32.dll	297	FlsAlloc
api-ms-win-crt-runtime-l1-1-0.dll	25	_configure_narrow_argv
api-ms-win-crt-runtime-l1-1-0.dll	53	_initialize_narrow_environment
api-ms-win-crt-runtime-l1-1-0.dll	54	_initialize_onexit_table
api-ms-win-crt-runtime-l1-1-0.dll	57	_initterm_e
api-ms-win-crt-runtime-l1-1-0.dll	23	_cexit
api-ms-win-crt-runtime-l1-1-0.dll	106	terminate
api-ms-win-crt-runtime-l1-1-0.dll	65	_seh_filter_dll
api-ms-win-crt-runtime-l1-1-0.dll	56	_initterm
api-ms-win-crt-runtime-l1-1-0.dll	36	_execute_onexit_table
api-ms-win-crt-runtime-l1-1-0.dll	87	abort
api-ms-win-crt-heap-l1-1-0.dll	24	free
api-ms-win-crt-heap-l1-1-0.dll	23	calloc

ord	entry_va	function_name
1	0x1750	_FxDriverEntryUm@16

module_name	BlankUMDFDriver-InsiderWDK_20226+VSPreview2019_16.8-pre3.2.dll
flags	0
timestamp	2106-02-07 06:28:15
version	0.0
ordinal_base	1
nFunctions	1
nNames	1
Names(1)	0x542c
Functions(1)	0x5428
NameOrdinals(1)	0x5430

show previews

offset	size	type	comment
0	21504	DLL	10/01/2020 02:03:39	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK

x86_BlankUMDFDriver-InsiderWDK_20226+VSPreview2019_16.8-pre3.2.dll

MZ Header

Rich Header

DOS stub

PE Header

Sections

Data Directory