filenamec.dat
size33792 (0x8400)
md51236f3ffb068e190a9f43dea28fb2a35
typePE32 executable (console) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x108

Rich Header

lib idversiontimes used
221210052
223210052
2242100519
225210052
221406295
203655012
1064
224406291
219210051
15101
222406291

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0x5cb79445
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion12.0
SizeOfCode0x1000
SizeOfInitializedData0x7200
SizeOfUninitializedData0
AddressOfEntryPoint0x1781
BaseOfCode0x1000
BaseOfData0x2000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.0
ImageVersion0.0
SubsystemVersion6.0
Reserved10
SizeOfImage0xb000
SizeOfHeaders0x400
CheckSum0
Subsystem3
DllCharacteristics0x8140
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0 2005

Sections

namevavsizeraw sizeflags
.text0x10000xfa40x1000R-X CODE
.rdata0x20000x9aa0xa00R-- IDATA
.data0x30000x37c0x200RW- IDATA
.rsrc0x40000x5e780x6000R-- IDATA
.reloc0xa0000x2680x400R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x23340x64
RESOURCE0x40000x5e78
EXCEPTION00
SECURITY00
BASERELOC0xa0000x268
DEBUG0x21300x38
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x22000x40
Bound_IAT00
IAT0x20000x110
Delay_IAT00
CLR_Header00
typenamesizecp
ICON#1169360
ICON#242640
ICON#311280
GROUP_ICONIDR_MAGICKICON480
VERSION#19880
MANIFEST#13810
module_namehintordfunction_name
CORE_RL_MagickCore_.dll4AcquireExceptionInfo
CORE_RL_MagickCore_.dll175DestroyExceptionInfo
CORE_RL_MagickCore_.dll600LocaleCompare
CORE_RL_MagickCore_.dll603LocaleNCompare
CORE_RL_MagickCore_.dll199DestroyString
CORE_RL_MagickCore_.dll571IsStringTrue
CORE_RL_MagickCore_.dll7AcquireImageInfo
CORE_RL_MagickCore_.dll178DestroyImageInfo
CORE_RL_MagickCore_.dll612MagickCoreGenesis
CORE_RL_MagickCore_.dll613MagickCoreTerminus
CORE_RL_MagickCore_.dll729RelinquishMagickMemory
CORE_RL_MagickCore_.dll342GetImageOption
CORE_RL_MagickCore_.dll458GetPathComponent
CORE_RL_MagickCore_.dll635NTArgvToUTF8
CORE_RL_MagickWand_.dll4AnimateImageCommand
CORE_RL_MagickWand_.dll19CompareImagesCommand
CORE_RL_MagickWand_.dll20CompositeImageCommand
CORE_RL_MagickWand_.dll21ConjureImageCommand
CORE_RL_MagickWand_.dll22ConvertImageCommand
CORE_RL_MagickWand_.dll32DisplayImageCommand
CORE_RL_MagickWand_.dll171IdentifyImageCommand
CORE_RL_MagickWand_.dll172ImportImageCommand
CORE_RL_MagickWand_.dll354MagickImageCommand
CORE_RL_MagickWand_.dll212MagickCommandGenesis
CORE_RL_MagickWand_.dll534MogrifyImageCommand
CORE_RL_MagickWand_.dll538MontageImageCommand
CORE_RL_MagickWand_.dll621StreamImageCommand
MSVCR120.dll576_configthreadlocale
MSVCR120.dll500__setusermatherr
MSVCR120.dll781_initterm_e
MSVCR120.dll780_initterm
MSVCR120.dll521__winitenv
MSVCR120.dll674_fmode
MSVCR120.dll575_commode
MSVCR120.dll592_crt_debugger_hook
MSVCR120.dll428__crtUnhandledException
MSVCR120.dll427__crtTerminateProcess
MSVCR120.dll309void __cdecl terminate(void)

?terminate@@YAXXZ

MSVCR120.dll425__crtSetUnhandledExceptionFilter
MSVCR120.dll916_lock
MSVCR120.dll1284_unlock
MSVCR120.dll558_calloc_crt
MSVCR120.dll430__dllonexit
MSVCR120.dll1082_onexit
MSVCR120.dll788_invoke_watson
MSVCR120.dll579_controlfp_s
MSVCR120.dll634_except_handler4_common
MSVCR120.dll559_cexit
MSVCR120.dll643_exit
MSVCR120.dll1614exit
MSVCR120.dll520__wgetmainargs
MSVCR120.dll535_amsg_exit
MSVCR120.dll363_XcptFilter
MSVCR120.dll1662fputs
MSVCR120.dll440__iob_func
MSVCR120.dll498__set_app_type
KERNEL32.dll254DecodePointer
KERNEL32.dll726GetSystemTimeAsFileTime
KERNEL32.dll526GetCurrentThreadId
KERNEL32.dll522GetCurrentProcessId
KERNEL32.dll1069QueryPerformanceCounter
KERNEL32.dll877IsProcessorFeaturePresent
KERNEL32.dll871IsDebuggerPresent
KERNEL32.dll289EncodePointer

StringTable 040904b0

ProductNameImageMagick
FileDescriptionImageMagick Studio library and utility programs
OriginalFilenameImageMagick
InternalNameImageMagick
FileVersion7.0.8
ProductVersion7.0.8
CompanyNameImageMagick Studio
LegalCopyrightCopyright (C) 1999-2018 ImageMagick Studio LLC
CommentsImageMagick 7.0.8-41 Q16 x86 2019-04-17 http://www.imagemagick.org

VS_FIXEDFILEINFO

FileVersion7.0.8.41
ProductVersion7.0.8.41
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
033792EXE04/17/2019 21:01:57#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK