filenameed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.bin
size3514368 (0x35a000)
md584c82835a5d21bbcf75a61706d8ab549
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf8

Rich Header

lib idversiontimes used
1272912
1180471
1472994
10804711
480474
93403513
10163
1197827
617351

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x4ce78f41
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x10f
Magic0x10b
LinkerVersion6.0
SizeOfCode0x7000
SizeOfInitializedData0x352000
SizeOfUninitializedData0
AddressOfEntryPoint0x77ba
BaseOfCode0x1000
BaseOfData0x8000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x1000
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x35a000
SizeOfHeaders0x1000
CheckSum0
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v6.0

Sections

namevavsizeraw sizeflags
.text0x10000x69b00x7000R-X CODE
.rdata0x80000x5f700x6000R-- IDATA
.data0xe0000x19580x2000RW- IDATA
.rsrc0x100000x349fa00x34a000R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0xd5a80x64
RESOURCE0x100000x349fa0
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x80000x1d8
Delay_IAT00
CLR_Header00
typenamesizecp
XIA#205834463251252
VERSION#19041252
MANIFEST#112631252
module_namehintordfunction_name
KERNEL32.dll353GetFileAttributesW
KERNEL32.dll356GetFileSizeEx
KERNEL32.dll83CreateFileA
KERNEL32.dll547InitializeCriticalSection
KERNEL32.dll129DeleteCriticalSection
KERNEL32.dll693ReadFile
KERNEL32.dll355GetFileSize
KERNEL32.dll932WriteFile
KERNEL32.dll593LeaveCriticalSection
KERNEL32.dll152EnterCriticalSection
KERNEL32.dll794SetFileAttributesW
KERNEL32.dll779SetCurrentDirectoryW
KERNEL32.dll78CreateDirectoryW
KERNEL32.dll470GetTempPathW
KERNEL32.dll500GetWindowsDirectoryW
KERNEL32.dll350GetFileAttributesA
KERNEL32.dll853SizeofResource
KERNEL32.dll613LockResource
KERNEL32.dll599LoadResource
KERNEL32.dll629MultiByteToWideChar
KERNEL32.dll854Sleep
KERNEL32.dll644OpenMutexA
KERNEL32.dll361GetFullPathNameA
KERNEL32.dll67CopyFileA
KERNEL32.dll381GetModuleFileNameA
KERNEL32.dll897VirtualAlloc
KERNEL32.dll899VirtualFree
KERNEL32.dll248FreeLibrary
KERNEL32.dll528HeapAlloc
KERNEL32.dll419GetProcessHeap
KERNEL32.dll383GetModuleHandleA
KERNEL32.dll808SetLastError
KERNEL32.dll902VirtualProtect
KERNEL32.dll563IsBadReadPtr
KERNEL32.dll534HeapFree
KERNEL32.dll859SystemTimeToFileTime
KERNEL32.dll602LocalFileTimeToFileTime
KERNEL32.dll75CreateDirectoryA
KERNEL32.dll439GetStartupInfoA
KERNEL32.dll795SetFilePointer
KERNEL32.dll799SetFileTime
KERNEL32.dll279GetComputerNameW
KERNEL32.dll320GetCurrentDirectoryA
KERNEL32.dll778SetCurrentDirectoryA
KERNEL32.dll504GlobalAlloc
KERNEL32.dll594LoadLibraryA
KERNEL32.dll416GetProcAddress
KERNEL32.dll511GlobalFree
KERNEL32.dll102CreateProcessA
KERNEL32.dll52CloseHandle
KERNEL32.dll912WaitForSingleObject
KERNEL32.dll862TerminateProcess
KERNEL32.dll346GetExitCodeProcess
KERNEL32.dll227FindResourceA
USER32.dll727wsprintfA
ADVAPI32.dll100CreateServiceA
ADVAPI32.dll431OpenServiceA
ADVAPI32.dll585StartServiceA
ADVAPI32.dll62CloseServiceHandle
ADVAPI32.dll160CryptReleaseContext
ADVAPI32.dll467RegCreateKeyW
ADVAPI32.dll516RegSetValueExA
ADVAPI32.dll503RegQueryValueExA
ADVAPI32.dll459RegCloseKey
ADVAPI32.dll429OpenSCManagerA
MSVCRT.dll679realloc
MSVCRT.dll588fclose
MSVCRT.dll614fwrite
MSVCRT.dll605fread
MSVCRT.dll599fopen
MSVCRT.dll690sprintf
MSVCRT.dll678rand
MSVCRT.dll692srand
MSVCRT.dll698strcpy
MSVCRT.dll665memset
MSVCRT.dll702strlen
MSVCRT.dll735wcscat
MSVCRT.dll742wcslen
MSVCRT.dll73__CxxFrameHandler
MSVCRT.dll16void __cdecl operator delete(void *)

??3@YAXPAX@Z

MSVCRT.dll662memcmp
MSVCRT.dll202_except_handler3
MSVCRT.dll316_local_unwind2
MSVCRT.dll747wcsrchr
MSVCRT.dll715swprintf
MSVCRT.dll15void * __cdecl operator new(unsigned int)

??2@YAPAXI@Z

MSVCRT.dll663memcpy
MSVCRT.dll696strcmp
MSVCRT.dll707strrchr
MSVCRT.dll99__p___argv
MSVCRT.dll98__p___argc
MSVCRT.dll449_stricmp
MSVCRT.dll606free
MSVCRT.dll657malloc
MSVCRT.dll8public: __thiscall exception::exception(class exception const &)

??0exception@@QAE@ABV0@@Z

MSVCRT.dll13public: virtual __thiscall exception::~exception(void)

??1exception@@UAE@XZ

MSVCRT.dll7public: __thiscall exception::exception(char const * const &)

??0exception@@QAE@ABQBD@Z

MSVCRT.dll65_CxxThrowException
MSVCRT.dll576calloc
MSVCRT.dll694strcat
MSVCRT.dll380_mbsstr
MSVCRT.dll14public: virtual __thiscall type_info::~type_info(void)

??1type_info@@UAE@XZ

MSVCRT.dll211_exit
MSVCRT.dll72_XcptFilter
MSVCRT.dll585exit
MSVCRT.dll143_acmdln
MSVCRT.dll88__getmainargs
MSVCRT.dll271_initterm
MSVCRT.dll131__setusermatherr
MSVCRT.dll157_adjust_fdiv
MSVCRT.dll106__p__commode
MSVCRT.dll111__p__fmode
MSVCRT.dll129__set_app_type
MSVCRT.dll183_controlfp

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionDiskPart
FileVersion6.1.7601.17514 (win7sp1_rtm.101119-1850)
InternalNamediskpart.exe
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenamediskpart.exe
ProductNameMicrosoft® Windows® Operating System
ProductVersion6.1.7601.17514

VS_FIXEDFILEINFO

FileVersion6.1.7601.17514
ProductVersion6.1.7601.17514
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType2
FileSubtype0
offsetsizetypecomment
03514368EXE11/20/2010 09:05:05#
15c115HTM#
100f03446325ZIP#
Scanning the drive for archives:
1 file, 3514368 bytes (3432 KiB)


--
Type = PE
Physical Size = 3514368
CPU = x86
Characteristics = Executable 32-bit NoRelocs NoLineNums NoLocalSyms
Created = 2010-11-20 09:05:05
Headers Size = 4096
Checksum = 0
Name = diskpart.exe
Image Size = 3514368
Section Alignment = 4096
File Alignment = 4096
Code Size = 28672
Initialized Data Size = 3481600
Uninitialized Data Size = 0
Linker Version = 6.0
OS Version = 4.0
Image Version = 0.0
Subsystem Version = 4.0
Subsystem = Windows GUI
Stack Reserve = 1048576
Stack Commit = 4096
Heap Reserve = 1048576
Heap Commit = 4096
Image Base = 4194304
Comment = FileVersion: 6.1.7601.17514
FileVersion: 6.1.7601.17514 (win7sp1_rtm.101119-1850)
ProductVersion: 6.1.7601.17514
CompanyName: Microsoft Corporation
FileDescription: DiskPart
InternalName: diskpart.exe
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFilename: diskpart.exe
ProductName: Microsoft® Windows® Operating System
----
Path = .rsrc/XIA/2058
Size = 3446325
Packed Size = 3446325
--
Path = .rsrc/XIA/2058
Type = zip
Physical Size = 3446325

   Date      Time    Attr         Size   Compressed  Name
------------------- ----- ------------ ------------  ------------------------
2017-05-11 11:13:18 ....A      1440054        14164  b.wnry
2017-05-11 11:11:57 ....A          780          177  c.wnry
2010-11-19 19:16:58 ....A        47879         9404  msg/m_bulgarian.wnry
2010-11-19 19:16:58 ....A        54359        11044  msg/m_chinese (simplified).wnry
2010-11-19 19:16:58 ....A        79346        11633  msg/m_chinese (traditional).wnry
2010-11-19 19:16:58 ....A        39070         8905  msg/m_croatian.wnry
2010-11-19 19:16:58 ....A        40512         9079  msg/m_czech.wnry
2010-11-19 19:16:58 ....A        37045         8688  msg/m_danish.wnry
2010-11-19 19:16:58 ....A        36987         8694  msg/m_dutch.wnry
2010-11-19 19:16:58 ....A        36973         8700  msg/m_english.wnry
2010-11-19 19:16:58 ....A        37580         8795  msg/m_filipino.wnry
2010-11-19 19:16:58 ....A        38377         8786  msg/m_finnish.wnry
2010-11-19 19:16:58 ....A        38437         8841  msg/m_french.wnry
2010-11-19 19:16:58 ....A        37181         8787  msg/m_german.wnry
2010-11-19 19:16:58 ....A        49044         9554  msg/m_greek.wnry
2010-11-19 19:16:58 ....A        37196         8691  msg/m_indonesian.wnry
2010-11-19 19:16:58 ....A        36883         8735  msg/m_italian.wnry
2010-11-19 19:16:58 ....A        81844        11242  msg/m_japanese.wnry
2010-11-19 19:16:58 ....A        91501        11209  msg/m_korean.wnry
2010-11-19 19:16:58 ....A        41169         9023  msg/m_latvian.wnry
2010-11-19 19:16:58 ....A        37577         8707  msg/m_norwegian.wnry
2010-11-19 19:16:58 ....A        39896         8950  msg/m_polish.wnry
2010-11-19 19:16:58 ....A        37917         8752  msg/m_portuguese.wnry
2010-11-19 19:16:58 ....A        52161         9499  msg/m_romanian.wnry
2010-11-19 19:16:58 ....A        47108         9419  msg/m_russian.wnry
2010-11-19 19:16:58 ....A        41391         9124  msg/m_slovak.wnry
2010-11-19 19:16:58 ....A        37381         8727  msg/m_spanish.wnry
2010-11-19 19:16:58 ....A        38483         8771  msg/m_swedish.wnry
2010-11-19 19:16:58 ....A        42582         9084  msg/m_turkish.wnry
2010-11-19 19:16:58 ....A        93778        11224  msg/m_vietnamese.wnry
2017-05-11 06:59:13 ....A          864          484  r.wnry
2017-05-09 07:58:43 ....A      3038286      3009375  s.wnry
2017-05-11 17:22:55 .....        65816        65828  t.wnry
2017-05-11 17:22:55 ....A        20480         3457  taskdl.exe
2017-05-11 17:22:55 ....A        20480         2555  taskse.exe
2017-05-11 17:22:55 ....A       245760        82980  u.wnry
------------------- ----- ------------ ------------  ------------------------
2017-05-11 17:22:55            6162177      3441087  36 files
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable







everything is OK