filenameExtExport.exe
size45056 (0xb000)
md562c2634f8cce80a14bfdd0a2734d632b
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe0

Rich Header

lib idversiontimes used
259257114
2602571121
261257113
2572571117
10154
2652571122
255257111
258257111

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0x88176214
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion14.12
SizeOfCode0x8c00
SizeOfInitializedData0x2a00
SizeOfUninitializedData0
AddressOfEntryPoint0x9290
BaseOfCode0x1000
BaseOfData0xa000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion10.0
ImageVersion10.0
SubsystemVersion10.0
Reserved10
SizeOfImage0xe000
SizeOfHeaders0x400
CheckSum0x18955
Subsystem2
DllCharacteristics0xc140
SizeOfStackReserve0x40000
SizeOfStackCommit0x2000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

namevavsizeraw sizeflags
.text0x10000x8a240x8c00R-X CODE
.data0xa0000xa680x200RW- IDATA
.idata0xb0000xab20xc00R-- IDATA
.rsrc0xc0000x8100xa00R-- IDATA
.reloc0xd0000x6f00x800R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0xb1b80xb4
RESOURCE0xc0000x810
EXCEPTION00
SECURITY00
BASERELOC0xd0000x6f0
DEBUG0x2b900x54
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x10100xa0
Bound_IAT00
IAT0xb0000x1b4
Delay_IAT00
CLR_Header00
typenamesizecp
VERSION#19480
MANIFEST#19450
module_namehintordfunction_name
ADVAPI32.dll297EventWriteTransfer
ADVAPI32.dll291EventUnregister
ADVAPI32.dll290EventSetInformation
ADVAPI32.dll289EventRegister
ADVAPI32.dll603RegCloseKey
ADVAPI32.dll627RegDeleteValueW
ADVAPI32.dll652RegOpenKeyExW
KERNEL32.dll890IsDebuggerPresent
KERNEL32.dll260DebugBreak
KERNEL32.dll969LocalFree
KERNEL32.dll216CreateMutexExW
KERNEL32.dll1034OpenSemaphoreW
KERNEL32.dll790GetVersionExA
KERNEL32.dll1042OutputDebugStringW
KERNEL32.dll421FormatMessageW
KERNEL32.dll1193ReleaseMutex
KERNEL32.dll965LocalAlloc
KERNEL32.dll1487WaitForSingleObject
KERNEL32.dll627GetModuleHandleExW
KERNEL32.dll1197ReleaseSemaphore
KERNEL32.dll1322SetLastError
KERNEL32.dll233CreateSemaphoreExW
KERNEL32.dll623GetModuleFileNameA
KERNEL32.dll1470VirtualAlloc
KERNEL32.dll263DecodePointer
KERNEL32.dll688GetProcessHeap
KERNEL32.dll833HeapAlloc
KERNEL32.dll853InitOnceExecuteOnce
KERNEL32.dll1576lstrcmpW
KERNEL32.dll134CloseHandle
KERNEL32.dll202CreateFileW
KERNEL32.dll1546WriteFile
KERNEL32.dll958LoadLibraryExW
KERNEL32.dll425FreeLibrary
KERNEL32.dll682GetProcAddress
KERNEL32.dll605GetLastError
KERNEL32.dll352ExpandEnvironmentStringsW
KERNEL32.dll1488WaitForSingleObjectEx
KERNEL32.dll1397Sleep
KERNEL32.dll1381SetUnhandledExceptionFilter
KERNEL32.dll628GetModuleHandleW
KERNEL32.dll1094QueryPerformanceCounter
KERNEL32.dll534GetCurrentProcessId
KERNEL32.dll538GetCurrentThreadId
KERNEL32.dll741GetSystemTimeAsFileTime
KERNEL32.dll771GetTickCount
KERNEL32.dll1445UnhandledExceptionFilter
KERNEL32.dll533GetCurrentProcess
KERNEL32.dll1412TerminateProcess
KERNEL32.dll275DeleteFileW
KERNEL32.dll996MoveFileW
KERNEL32.dll185CreateDirectoryW
KERNEL32.dll624GetModuleFileNameW
KERNEL32.dll837HeapFree
msvcrt.dll1004_vsnwprintf
msvcrt.dll290_callnewh
msvcrt.dll1221free
msvcrt.dll1291memmove
msvcrt.dll583_itow_s
msvcrt.dll111_XcptFilter
msvcrt.dll201__p__commode
msvcrt.dll273_amsg_exit
msvcrt.dll161__getmainargs
msvcrt.dll362_except_handler4_common
msvcrt.dll311_controlfp
msvcrt.dll53void __cdecl terminate(void)

?terminate@@YAXXZ

msvcrt.dll777_onexit
msvcrt.dll157__dllonexit
msvcrt.dll964_unlock
msvcrt.dll608_lock
msvcrt.dll488_initterm
msvcrt.dll1402wcsncmp
msvcrt.dll1392wcschr
msvcrt.dll1256iswalpha
msvcrt.dll1290memcpy_s
msvcrt.dll1309rand_s
msvcrt.dll1037_wcsicmp
msvcrt.dll226__set_app_type
msvcrt.dll1198exit
msvcrt.dll371_exit
msvcrt.dll292_cexit
msvcrt.dll206__p__fmode
msvcrt.dll1277malloc
msvcrt.dll228__setusermatherr
msvcrt.dll1293memset
ole32.dll258IIDFromString
ole32.dll138CoTaskMemRealloc
ole32.dll137CoTaskMemFree
SHLWAPI.dll299StrCmpNIW
SHLWAPI.dll338StrStrW
SHLWAPI.dll215
SHLWAPI.dll335StrStrIW
SHLWAPI.dll77PathFindFileNameW
SHLWAPI.dll158
SHLWAPI.dll73PathFileExistsW
SHLWAPI.dll300StrCmpNW
USER32.dll605LoadStringW
SHELL32.dll412SHSetLocalizedName
SHELL32.dll341SHGetFolderPathAndSubDirW
iertutil.dll672
iertutil.dll675

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionInternet Explorer ImpExp FF exporter
FileVersion11.00.17134.254 (WinBuild.160101.0800)
InternalNameextexport
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenameextexport.exe
ProductNameInternet Explorer
ProductVersion11.00.17134.254
OleSelfRegister

VS_FIXEDFILEINFO

FileVersion11.0.17134.254
ProductVersion11.0.17134.254
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType2
FileSubtype0
offsetsizetypecomment
045056EXE05/09/2042 07:36:52#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK