NoVirusThanks Unloaded Module Viewer

novirusthanks · Jun 5, 2018

We've released a new tool useful for malware analysis:

Unloaded Module Viewer v1.0

Unloaded Module Viewer (UMV) is a standalone GUI tool designed to enumerate and list Portable Executable (PE) modules (.DLL, .CPL, .EXE etc.) that have been dynamically unloaded throughout the life of a process. When a module is unloaded by the Windows PE loader (with APIs such as FreeLibrary/LdrUnloadDll) certain module information is cached as a snapshot by NTDLL inside the respective process address space which can be useful come investigation time. This internal and private cache consists of the last 64 modules that have been unloaded and it provides relevant information such as the module name, load address, module size, timestamp and checksum.
Click to expand...

Unloaded Module Viewer can be especially useful to developers, security researchers and reverse engineers looking to analyze run-time module unloading behavior inside a process of interest.
Click to expand...

More info & download:
http://www.novirusthanks.org/products/unloaded-module-viewer/

EASTER · Jun 5, 2018

Click

Log in or Sign up

NoVirusThanks Unloaded Module Viewer

novirusthanks Developer

EASTER Registered Member

Log in or Sign up

NoVirusThanks Unloaded Module Viewer

novirusthanks Developer

EASTER Registered Member

Useful Searches