filenameEXPERT.EXE
size2969891 (0x2d5123)
md5161fb53e5820f210859a5685629b8917
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf0

Rich Header

lib idversiontimes used
2592106
1045
2594663
2994661
6494661
28946612
6994661
6194661

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0x3f73b447
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x10f
Magic0x10b
LinkerVersion7.0
SizeOfCode0xc00
SizeOfInitializedData0x5200
SizeOfUninitializedData0
AddressOfEntryPoint0x189e
BaseOfCode0x1000
BaseOfData0x2000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0xa000
SizeOfHeaders0x400
CheckSum0
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v7.x >> *SigBy Ahmed18

Sections

namevavsizeraw sizeflags
.text0x10000xbca0xc00R-X CODE
.rdata0x20000x4d40x600R-- IDATA
.data0x30000x4fc0x200RW- IDATA
.rsrc0x40000x45280x4600R-- IDATA
.xdata0x90000x31e0x400RWX IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x21040x64
RESOURCE0x40000x1294
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x20000xc4
Delay_IAT00
CLR_Header00
typenamesizecp
ICON#122161252
ICON#22961252
ICON#37441252
STRING#13961252
GROUP_ICON#15000481252
MANIFEST#16551252
idlangstring
01033VFP8.EXE
11033VFP8R.DLL
21033VFP8T.DLL
31033Microsoft Visual FoxPro
41033Cannot locate the Microsoft Visual FoxPro support library.
51033The %s file is invalid or damaged.
61033Cannot run the file %s. Error code 0xlX.
module_namehintordfunction_name
MSVCR70.dll138__p__fmode
MSVCR70.dll159__set_app_type
MSVCR70.dll133__p__commode
MSVCR70.dll443_onexit
MSVCR70.dll222_controlfp
MSVCR70.dll245_except_handler3
MSVCR70.dll190_adjust_fdiv
MSVCR70.dll162__setusermatherr
MSVCR70.dll322_initterm
MSVCR70.dll113__getmainargs
MSVCR70.dll197_amsg_exit
MSVCR70.dll176_acmdln
MSVCR70.dll665exit
MSVCR70.dll208_cexit
MSVCR70.dll79_XcptFilter
MSVCR70.dll254_exit
MSVCR70.dll205_c_exit
MSVCR70.dll396_mbschr
MSVCR70.dll403_mbsicmp
MSVCR70.dll175_access
MSVCR70.dll427_mbsrchr
MSVCR70.dll713isspace
MSVCR70.dll503_splitpath
MSVCR70.dll110__dllonexit
MSVCR70.dll380_makepath
KERNEL32.dll359GetModuleHandleA
KERNEL32.dll357GetModuleFileNameA
KERNEL32.dll229FreeLibrary
KERNEL32.dll393GetProcAddress
KERNEL32.dll422GetSystemDirectoryA
KERNEL32.dll911lstrcatA
KERNEL32.dll301GetCurrentDirectoryA
KERNEL32.dll558LoadLibraryA
KERNEL32.dll920lstrcpyA
KERNEL32.dll907_lopen
KERNEL32.dll904_lclose
KERNEL32.dll906_llseek
KERNEL32.dll908_lread
KERNEL32.dll412GetStartupInfoA
USER32.dll476MessageBoxA
USER32.dll456LoadStringA
USER32.dll728wsprintfA
ADVAPI32.dll490RegQueryValueA
ADVAPI32.dll480RegOpenKeyA
ADVAPI32.dll456RegCloseKey
offsetsizetypecomment
025088EXE09/26/2003 03:36:39#
15c115HTM#
62002944803BINoverlay data past EOF#
Scanning the drive for archives:
1 file, 2969891 bytes (2901 KiB)



Errors: 1
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK