filenameGbtWPBTService.exe
size480256 (0x75400)
md5372309fbdd120583455fd5c63c4b6386
typePE32+ executable (console) x86-64, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x110

Rich Header

lib idversiontimes used
259257115
26125711150
259261318
2612613136
2602613121
2602571114
2572571113
10116
265264339
255264331
15101
258264331

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x8664
NumberOfSections6
TimeDateStamp0x5c8b75e6
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xf0
Characteristics0x22
Magic0x20b
LinkerVersion14.14
SizeOfCode0x16600
SizeOfInitializedData0x5fc00
SizeOfUninitializedData0
AddressOfEntryPoint0x2c6c
BaseOfCode0x1000
ImageBase0x140000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.0
ImageVersion0.0
SubsystemVersion6.0
Reserved10
SizeOfImage0x7a000
SizeOfHeaders0x400
CheckSum0
Subsystem3
DllCharacteristics0x8160
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x165000x16600R-X CODE
.rdata0x180000xb7fc0xb800R-- IDATA
.data0x240000x1dc80xc00RW- IDATA
.pdata0x260000x15600x1600R-- IDATA
.rsrc0x280000x507800x50800R-- IDATA
.reloc0x790000x6800x800R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x22c140x8c
RESOURCE0x280000x50780
EXCEPTION0x260000x1560
SECURITY00
BASERELOC0x790000x680
DEBUG0x20b300x70
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x20ba00x100
Bound_IAT00
IAT0x180000x370
Delay_IAT00
CLR_Header00
typenamesizecp
ZIP#1023281510
VERSION#18240
MANIFEST#13810
module_namehintordfunction_name
SHLWAPI.dll73PathFileExistsW
SETUPAPI.dll370SetupDiGetDeviceRegistryPropertyW
SETUPAPI.dll320SetupDiEnumDeviceInfo
SETUPAPI.dll340SetupDiGetClassDevsW
KERNEL32.dll634GetModuleHandleW
KERNEL32.dll185CreateDirectoryW
KERNEL32.dll630GetModuleFileNameW
KERNEL32.dll761GetTempPathW
KERNEL32.dll410FindResourceW
KERNEL32.dll1108QueueUserWorkItem
KERNEL32.dll190CreateEventW
KERNEL32.dll1411Sleep
KERNEL32.dll1308SetEvent
KERNEL32.dll965LoadResource
KERNEL32.dll134CloseHandle
KERNEL32.dll611GetLastError
KERNEL32.dll202CreateFileW
KERNEL32.dll1561WriteFile
KERNEL32.dll1410SizeofResource
KERNEL32.dll419FlushFileBuffers
KERNEL32.dll494GetConsoleCP
KERNEL32.dll512GetConsoleMode
KERNEL32.dll851HeapSize
KERNEL32.dll849HeapReAlloc
KERNEL32.dll1321SetFilePointerEx
KERNEL32.dll1502WaitForSingleObject
KERNEL32.dll1236RtlPcToFileHeader
KERNEL32.dll695GetProcessHeap
KERNEL32.dll730GetStringTypeW
KERNEL32.dll1359SetStdHandle
KERNEL32.dll1306SetEnvironmentVariableW
KERNEL32.dll430FreeEnvironmentStringsW
KERNEL32.dll570GetEnvironmentStringsW
KERNEL32.dll1541WideCharToMultiByte
KERNEL32.dll1227RtlCaptureContext
KERNEL32.dll1234RtlLookupFunctionEntry
KERNEL32.dll1241RtlVirtualUnwind
KERNEL32.dll1460UnhandledExceptionFilter
KERNEL32.dll1395SetUnhandledExceptionFilter
KERNEL32.dll539GetCurrentProcess
KERNEL32.dll1426TerminateProcess
KERNEL32.dll900IsProcessorFeaturePresent
KERNEL32.dll1097QueryPerformanceCounter
KERNEL32.dll540GetCurrentProcessId
KERNEL32.dll544GetCurrentThreadId
KERNEL32.dll748GetSystemTimeAsFileTime
KERNEL32.dll871InitializeSListHead
KERNEL32.dll893IsDebuggerPresent
KERNEL32.dll723GetStartupInfoW
KERNEL32.dll1240RtlUnwindEx
KERNEL32.dll1560WriteConsoleW
KERNEL32.dll1119RaiseException
KERNEL32.dll1335SetLastError
KERNEL32.dll303EncodePointer
KERNEL32.dll307EnterCriticalSection
KERNEL32.dll955LeaveCriticalSection
KERNEL32.dll271DeleteCriticalSection
KERNEL32.dll867InitializeCriticalSectionAndSpinCount
KERNEL32.dll1444TlsAlloc
KERNEL32.dll1446TlsGetValue
KERNEL32.dll1447TlsSetValue
KERNEL32.dll1445TlsFree
KERNEL32.dll431FreeLibrary
KERNEL32.dll689GetProcAddress
KERNEL32.dll961LoadLibraryExW
KERNEL32.dll725GetStdHandle
KERNEL32.dll354ExitProcess
KERNEL32.dll633GetModuleHandleExW
KERNEL32.dll474GetCommandLineA
KERNEL32.dll475GetCommandLineW
KERNEL32.dll846HeapFree
KERNEL32.dll575GetExitCodeProcess
KERNEL32.dll228CreateProcessW
KERNEL32.dll581GetFileAttributesExW
KERNEL32.dll842HeapAlloc
KERNEL32.dll154CompareStringW
KERNEL32.dll943LCMapStringW
KERNEL32.dll593GetFileType
KERNEL32.dll377FindClose
KERNEL32.dll383FindFirstFileExW
KERNEL32.dll400FindNextFileW
KERNEL32.dll905IsValidCodePage
KERNEL32.dll438GetACP
KERNEL32.dll666GetOEMCP
KERNEL32.dll453GetCPInfo
KERNEL32.dll1003MultiByteToWideChar
ADVAPI32.dll145CreateServiceW
ADVAPI32.dll592QueryServiceStatus
ADVAPI32.dll101CloseServiceHandle
ADVAPI32.dll535OpenSCManagerW
ADVAPI32.dll236DeleteService
ADVAPI32.dll106ControlService
ADVAPI32.dll537OpenServiceW
ADVAPI32.dll237DeregisterEventSource
ADVAPI32.dll754SetServiceStatus
ADVAPI32.dll691RegisterServiceCtrlHandlerW
ADVAPI32.dll762StartServiceCtrlDispatcherW
ADVAPI32.dll686RegisterEventSourceW
ADVAPI32.dll704ReportEventW
ole32.dll96CoInitialize
ole32.dll144CoUninitialize
ole32.dll43CoCreateInstance
OLEAUT32.dll2
OLEAUT32.dll6

StringTable 040904b0

CompanyNameGIGA-BYTE TECHNOLOGY CO., LTD.
FileDescriptionGIGABYTE WPBT Service
FileVersion1.0.0.1
InternalNameGbtWPBTS.exe
LegalCopyrightCopyright (C) 2019 GIGA-BYTE TECHNOLOGY CO., LTD.
OriginalFilenameGbtWPBTS.exe
ProductNameGIGABYTE WPBT
ProductVersion1.0.0.1

VS_FIXEDFILEINFO

FileVersion1.0.0.1
ProductVersion1.0.0.1
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
15c115HTM#
24828328151ZIP#
749ff2561BINoverlay data past EOF#
Scanning the drive for archives:
1 file, 480256 bytes (469 KiB)


--
Type = PE
Physical Size = 480256
CPU = x64
64-bit = +
Characteristics = Executable LargeAddress
Created = 2019-03-15 09:52:38
Headers Size = 1024
Checksum = 0
Name = GbtWPBTS.exe
Image Size = 499712
Section Alignment = 4096
File Alignment = 512
Code Size = 91648
Initialized Data Size = 392192
Uninitialized Data Size = 0
Linker Version = 14.14
OS Version = 6.0
Image Version = 0.0
Subsystem Version = 6.0
Subsystem = Windows CUI
DLL Characteristics = Relocated NX-Compatible TerminalServerAware 0x20
Stack Reserve = 1048576
Stack Commit = 4096
Heap Reserve = 1048576
Heap Commit = 4096
Image Base = 5368709120
Comment = FileVersion: 1.0.0.1
ProductVersion: 1.0.0.1
CompanyName: GIGA-BYTE TECHNOLOGY CO., LTD.
FileDescription: GIGABYTE WPBT Service
InternalName: GbtWPBTS.exe
LegalCopyright: Copyright (C) 2019 GIGA-BYTE TECHNOLOGY CO., LTD.
OriginalFilename: GbtWPBTS.exe
ProductName: GIGABYTE WPBT
----
Path = .rsrc/ZIP/102
Size = 328151
Packed Size = 328151
--
Path = .rsrc/ZIP/102
Type = zip
Physical Size = 328151

   Date      Time    Attr         Size   Compressed  Name
------------------- ----- ------------ ------------  ------------------------
2019-03-14 08:29:44 D....            0            0  LanDriver
2018-11-21 17:32:22 ....A        15580         6513  LanDriver/e1d65x64.cat
2018-11-21 17:32:22 ....A         3130         1021  LanDriver/e1d65x64.din
2018-11-21 17:32:22 ....A       172604        16089  LanDriver/e1d65x64.inf
2018-11-21 17:32:22 ....A       568768       277854  LanDriver/e1d65x64.sys
2018-11-21 17:32:22 ....A        89024        25460  LanDriver/e1dmsg.dll
2019-03-14 07:33:57 ....A          146          130  LanDriver/Install.cmd
------------------- ----- ------------ ------------  ------------------------
2019-03-14 08:29:44             849252       327067  6 files, 1 folders
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK