filenametstsoldati.exe
size1767016 (0x1af668)
md5795144836cccdcfcae1a4e2900c27494
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xb8

Rich Header

lib idversiontimes used
0065
617351

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x391ad6e2
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x10f
Magic0x10b
LinkerVersion5.12
SizeOfCode0xa00
SizeOfInitializedData0x1400
SizeOfUninitializedData0
AddressOfEntryPoint0x1740
BaseOfCode0x1000
BaseOfData0x2000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x5000
SizeOfHeaders0x400
CheckSum0
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++

Sections

namevavsizeraw sizeflags
.text0x10000x94c0xa00R-X CODE
.rdata0x20000x4580x600R-- IDATA
.data0x30000x4f80x200RW- IDATA
.rsrc0x40000xae80xc00R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x20c40x64
RESOURCE0x40000x6e8
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x20000xb4
Delay_IAT00
CLR_Header00
typenamesizecp
ICON#12960
ICON#27440
STRING#13960
GROUP_ICON#15000340
VERSION#18880
idlangstring
01033VFP6.EXE
11033VFP6R.DLL
21033VFP6T.DLL
31033Microsoft Visual FoxPro
41033Cannot locate the Microsoft Visual FoxPro support library.
51033The %s file is invalid or damaged.
61033Cannot run the file %s. Error code 0xlX.
module_namehintordfunction_name
MSVCRT.dll127__set_app_type
MSVCRT.dll110__p__fmode
MSVCRT.dll154_adjust_fdiv
MSVCRT.dll179_controlfp
MSVCRT.dll139_access
MSVCRT.dll105__p__commode
MSVCRT.dll129__setusermatherr
MSVCRT.dll267_initterm
MSVCRT.dll88__getmainargs
MSVCRT.dll103__p__acmdln
MSVCRT.dll580exit
MSVCRT.dll72_XcptFilter
MSVCRT.dll207_exit
MSVCRT.dll339_mbschr
MSVCRT.dll706strtok
MSVCRT.dll346_mbsicmp
MSVCRT.dll370_mbsrchr
MSVCRT.dll363_mbsncpy
MSVCRT.dll393_pctype
MSVCRT.dll273_isctype
MSVCRT.dll96__mb_cur_max
MSVCRT.dll198_except_handler3
KERNEL32.dll296GetStartupInfoA
KERNEL32.dll254GetModuleHandleA
KERNEL32.dll653_llseek
KERNEL32.dll655_lread
KERNEL32.dll654_lopen
KERNEL32.dll651_lclose
KERNEL32.dll252GetModuleFileNameA
KERNEL32.dll400LoadLibraryA
KERNEL32.dll278GetProcAddress
KERNEL32.dll209GetCurrentDirectoryA
KERNEL32.dll305GetSystemDirectoryA
KERNEL32.dll658lstrcatA
KERNEL32.dll667lstrcpyA
USER32.dll612wsprintfA
USER32.dll405MessageBoxA
USER32.dll387LoadStringA
ADVAPI32.dll309RegQueryValueA
ADVAPI32.dll301RegOpenKeyA
ADVAPI32.dll279RegCloseKey

StringTable 041004E4

FileVersion1.0.10
ProductVersion1.0.10
InternalNametstsoldati
OriginalFilenametstsoldati.exe
CompanyNameTST Soldati
FileDescriptionTST Quiz
CommentsTST Soldati - Quiz di preparazione alla patente nautica
LegalCopyright® TST Soldati
LegalTrademarks® TST Soldati
ProductNameTST Quiz ®

VS_FIXEDFILEINFO

FileVersion1.0.10.0
ProductVersion1.0.10.0
StrucVersion0x10000
FileFlagsMask0
FileFlags0
FileOS4
FileType1
FileSubtype0
offsetsizetypecomment
08704EXE05/11/2000 15:50:58#
15c115HTM#
22001758312BINoverlay data past EOF#
Scanning the drive for archives:
1 file, 1767016 bytes (1726 KiB)



Errors: 1
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK