fraps.exe

info
MZ
PE
resources
imports
foremost
version info
signature
hexdump
disasm
log
discuss
donate

filename	fraps.exe
size	2391736 (0x247eb8)
md5	4400c08622a1d98be090ab930e5803f2

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xf8

Rich Header

lib id	version	times used
171	40219	30
158	40219	21
170	40219	115
96	3077	1
147	30729	17
1	0	227
175	40219	28
154	40219	1
157	40219	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	5
TimeDateStamp	0x512c5c3f
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x10f
Magic	0x10b
LinkerVersion	10.0
SizeOfCode	0x2ae00
SizeOfInitializedData	0x674200
SizeOfUninitializedData	0
AddressOfEntryPoint	0x7c4000
BaseOfCode	0x1000
BaseOfData	0x2c000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	5.1
ImageVersion	3.5
SubsystemVersion	5.1
Reserved1	0
SizeOfImage	0x7c5000
SizeOfHeaders	0x400
CheckSum	0x253a4e
Subsystem	2
DllCharacteristics	0x8040
SizeOfStackReserve	0x1000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x1000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
	0x1000	0x38000	0x15c00	RWX IDATA
.rsrc	0x39000	0x66443c	0x10ba00	RW- IDATA
.idata	0x69e000	0x1000	0x200	RW- IDATA
hnjrqidb	0x69f000	0x125000	0x124600	RWX IDATA
wrrkhomm	0x7c4000	0x1000	0x200	RWX IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x69e068	0x7c
RESOURCE	0x39000	0x66443c
EXCEPTION	0	0
SECURITY	0x247000	0xeb8
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size	cp
BITMAP	#106	612042	1252
BITMAP	#114	612042	1252
BITMAP	#116	612042	1252
BITMAP	#117	612042	1252
BITMAP	#118	4602	1252
BITMAP	#119	4602	1252
BITMAP	#120	826	1252
BITMAP	#121	826	1252
BITMAP	#122	4602	1252
BITMAP	#123	4602	1252
BITMAP	#124	3162	1252
BITMAP	#125	3162	1252
BITMAP	#126	826	1252
BITMAP	#127	826	1252
BITMAP	#131	4602	1252
BITMAP	#132	4602	1252
BITMAP	#133	29082	1252
BITMAP	#134	29082	1252
BITMAP	#135	957142	1252
BITMAP	#136	957142	1252
BITMAP	#137	957142	1252
BITMAP	#138	957142	1252
BITMAP	#139	7242	1252
BITMAP	#140	7242	1252
BITMAP	#141	1338	1252
BITMAP	#142	1338	1252
BITMAP	#143	7242	1252
BITMAP	#144	7242	1252
BITMAP	#145	4942	1252
BITMAP	#146	4942	1252
BITMAP	#147	1338	1252
BITMAP	#148	1338	1252
BITMAP	#149	45582	1252
BITMAP	#150	45582	1252
BITMAP	#151	7242	1252
BITMAP	#152	7242	1252
BITMAP	#156	4602	1252
BITMAP	#157	7242	1252
BITMAP	#158	4602	1252
BITMAP	#159	7242	1252
ICON	#1	10928	1252
ICON	#2	3752	1252
ICON	#3	2216	1252
ICON	#4	1384	1252
ICON	#5	36215	1252
ICON	#6	67624	1252
ICON	#7	9640	1252
ICON	#8	4264	1252
ICON	#9	1128	1252
ICON	#10	3240	1252
ICON	#11	3240	1252
ICON	#12	3240	1252
MENU	#109	178	1252
DIALOG	#112	804	1252
DIALOG	#128	1020	1252
DIALOG	#129	1770	1252
DIALOG	#130	908	1252
GROUP_ICON	#107	132	1252
GROUP_ICON	#115	20	1252
GROUP_ICON	#116	20	1252
GROUP_ICON	#117	20	1252
VERSION	#1	804	1252
MANIFEST	#1	618	1252

module_name	hint	ord	function_name
kernel32.dll			SetProcessAffinityMask

VS_FIXEDFILEINFO

dwSignature	0xfeef04
FileVersion	768.768.1280.25405
ProductVersion	768.768.16128.25405
StrucVersion	0x5000100
FileFlagsMask	0
FileFlags	0x4000000
FileOS	0x1000000
FileType	0
FileSubtype	0

OpenSSL (terse)
ASN.1 (verbose)

Signers (1)

issuer: /C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of use at https://www.verisign.com/rpa (c)10/CN=VeriSign Class 3 Code Signing 2010 CA

serial: 04DE5873E7090AE2F5ACEFB167A53573

Certificates (2)

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:de:58:73:e7:09:0a:e2:f5:ac:ef:b1:67:a5:35:73
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA
        Validity
            Not Before: Aug 21 00:00:00 2012 GMT
            Not After : Sep  4 23:59:59 2015 GMT
        Subject: C=AU, ST=Victoria, L=Albert Park, O=Beepa Pty Ltd, OU=Digital ID Class 3 - Microsoft Software Validation v2, OU=Development, CN=Beepa Pty Ltd
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:d9:43:e8:5b:1e:41:c4:83:ad:de:1f:30:dd:1d:
                    65:3b:92:78:a5:02:a0:7b:a9:20:9b:b8:43:db:1f:
                    21:61:cd:b6:72:91:47:fa:64:b7:67:0e:0e:64:20:
                    01:87:5c:26:5a:0f:0a:6a:cf:4c:b6:b9:e3:4e:26:
                    f2:1e:0b:51:3d:56:10:08:87:ab:23:51:14:32:6b:
                    b6:c1:71:09:1a:1f:22:0a:54:5e:4c:13:17:d1:ef:
                    7b:af:e4:40:d2:6c:2d:c2:ee:bd:a8:c9:27:64:31:
                    a0:60:7e:f0:2b:9b:fc:d7:0d:48:cc:33:76:96:15:
                    26:93:a7:82:71:de:9a:70:b2:17:05:40:a0:d4:f9:
                    61:c0:e2:04:64:6b:89:2e:ef:9c:22:f8:bb:e1:85:
                    39:5d:9a:6d:9e:c5:7b:68:e1:62:c6:fb:15:2b:05:
                    c1:55:72:26:e8:d8:9c:ef:d4:e3:3e:0a:3d:99:7a:
                    ed:9f:4c:ee:03:41:2d:f1:d7:43:4c:bd:fb:e9:a2:
                    1b:1b:1e:90:74:07:b6:8c:c1:c7:88:c0:4f:ae:10:
                    2c:8b:5e:fe:14:52:0b:61:65:fc:0a:55:21:d2:e5:
                    91:25:f0:06:bc:f3:34:f7:dc:bd:0a:c8:27:91:f2:
                    c4:cd:e1:0f:fd:89:9d:df:4f:8a:fc:87:c0:73:e5:
                    40:7f
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: 
                CA:FALSE
            X509v3 Key Usage: critical
                Digital Signature
            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://csc3-2010-crl.verisign.com/CSC3-2010.crl

            X509v3 Certificate Policies: 
                Policy: 2.16.840.1.113733.1.7.23.3
                  CPS: https://www.verisign.com/rpa

            X509v3 Extended Key Usage: 
                Code Signing
            Authority Information Access: 
                OCSP - URI:http://ocsp.verisign.com
                CA Issuers - URI:http://csc3-2010-aia.verisign.com/CSC3-2010.cer

            X509v3 Authority Key Identifier: 
                keyid:CF:99:A9:EA:7B:26:F4:4B:C9:8E:8F:D7:F0:05:26:EF:E3:D2:A7:9D

            Netscape Cert Type: 
                Object Signing
            1.3.6.1.4.1.311.2.1.27: 
                0.......
    Signature Algorithm: sha1WithRSAEncryption
         39:b5:83:82:02:a2:70:91:72:06:8a:36:e1:36:c4:13:c6:f5:
         45:6c:c3:2c:26:f9:7a:d1:ed:4c:11:19:5e:cc:8b:92:7b:b2:
         b0:bd:2d:b2:6b:f4:e2:14:97:e6:fe:44:59:8b:ec:a3:a4:a9:
         40:5a:d8:ad:89:68:83:5d:dd:61:1e:1e:ad:d9:c6:ef:cf:70:
         5d:1f:49:a1:75:0d:c5:e0:87:72:d6:c2:c3:78:63:6f:eb:10:
         b9:3a:e9:ef:a5:1f:5d:00:94:79:61:c1:6c:f1:b8:ec:56:3b:
         56:d3:7b:92:f0:92:f5:dc:cb:c7:9c:5d:d5:74:b2:58:92:0a:
         77:0c:7a:80:2c:4c:ab:62:fe:48:e3:2e:8e:32:b2:06:89:9b:
         f3:75:ba:78:18:ca:f1:b2:6d:8e:36:8e:a4:18:fe:c1:0d:92:
         65:4a:e0:07:e2:4a:c3:c8:61:4a:e0:30:6c:9b:43:7d:1e:6f:
         79:c8:28:f3:23:fa:35:9b:8a:a8:99:7b:31:4d:a8:cc:07:39:
         8d:ba:64:82:1f:d3:f2:1f:f2:a4:c1:bd:6e:49:cf:b4:13:12:
         6c:09:32:50:d1:1a:ca:f9:13:99:64:70:12:84:b9:c8:17:45:
         a0:3b:35:19:0e:5f:a2:15:e5:11:7e:ae:54:75:4b:80:f4:f5:
         91:95:46:87

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. - For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority - G5
        Validity
            Not Before: Feb  8 00:00:00 2010 GMT
            Not After : Feb  7 23:59:59 2020 GMT
        Subject: C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:f5:23:4b:5e:a5:d7:8a:bb:32:e9:d4:57:f7:ef:
                    e4:c7:26:7e:ad:19:98:fe:a8:9d:7d:94:f6:36:6b:
                    10:d7:75:81:30:7f:04:68:7f:cb:2b:75:1e:cd:1d:
                    08:8c:df:69:94:a7:37:a3:9c:7b:80:e0:99:e1:ee:
                    37:4d:5f:ce:3b:14:ee:86:d4:d0:f5:27:35:bc:25:
                    0b:38:a7:8c:63:9d:17:a3:08:a5:ab:b0:fb:cd:6a:
                    62:82:4c:d5:21:da:1b:d9:f1:e3:84:3b:8a:2a:4f:
                    85:5b:90:01:4f:c9:a7:76:10:7f:27:03:7c:be:ae:
                    7e:7d:c1:dd:f9:05:bc:1b:48:9c:69:e7:c0:a4:3c:
                    3c:41:00:3e:df:96:e5:c5:e4:94:71:d6:55:01:c7:
                    00:26:4a:40:3c:b5:a1:26:a9:0c:a7:6d:80:8e:90:
                    25:7b:cf:bf:3f:1c:eb:2f:96:fa:e5:87:77:c6:b5:
                    56:b2:7a:3b:54:30:53:1b:df:62:34:ff:1e:d1:f4:
                    5a:93:28:85:e5:4c:17:4e:7e:5b:fd:a4:93:99:7f:
                    df:cd:ef:a4:75:ef:ef:15:f6:47:e7:f8:19:72:d8:
                    2e:34:1a:a6:b4:a7:4c:7e:bd:bb:4f:0c:3d:57:f1:
                    30:d6:a6:36:8e:d6:80:76:d7:19:2e:a5:cd:7e:34:
                    2d:89
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Certificate Policies: 
                Policy: 2.16.840.1.113733.1.7.23.3
                  CPS: https://www.verisign.com/cps
                  User Notice:
                    Explicit Text: https://www.verisign.com/rpa

            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            1.3.6.1.5.5.7.1.12: 
                0_.].[0Y0W0U..image/gif0!0.0...+..............k...j.H.,{..0%.#http://logo.verisign.com/vslogo.gif
            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://crl.verisign.com/pca3-g5.crl

            Authority Information Access: 
                OCSP - URI:http://ocsp.verisign.com

            X509v3 Extended Key Usage: 
                TLS Web Client Authentication, Code Signing
            X509v3 Subject Alternative Name: 
                DirName:/CN=VeriSignMPKI-2-8
            X509v3 Subject Key Identifier: 
                CF:99:A9:EA:7B:26:F4:4B:C9:8E:8F:D7:F0:05:26:EF:E3:D2:A7:9D
            X509v3 Authority Key Identifier: 
                keyid:7F:D3:65:A7:C2:DD:EC:BB:F0:30:09:F3:43:39:FA:02:AF:33:31:33

    Signature Algorithm: sha1WithRSAEncryption
         56:22:e6:34:a4:c4:61:cb:48:b9:01:ad:56:a8:64:0f:d9:8c:
         91:c4:bb:cc:0c:e5:ad:7a:a0:22:7f:df:47:38:4a:2d:6c:d1:
         7f:71:1a:7c:ec:70:a9:b1:f0:4f:e4:0f:0c:53:fa:15:5e:fe:
         74:98:49:24:85:81:26:1c:91:14:47:b0:4c:63:8c:bb:a1:34:
         d4:c6:45:e8:0d:85:26:73:03:d0:a9:8c:64:6d:dc:71:92:e6:
         45:05:60:15:59:51:39:fc:58:14:6b:fe:d4:a4:ed:79:6b:08:
         0c:41:72:e7:37:22:06:09:be:23:e9:3f:44:9a:1e:e9:61:9d:
         cc:b1:90:5c:fc:3d:d2:8d:ac:42:3d:65:36:d4:b4:3d:40:28:
         8f:9b:10:cf:23:26:cc:4b:20:cb:90:1f:5d:8c:4c:34:ca:3c:
         d8:e5:37:d6:6f:a5:20:bd:34:eb:26:d9:ae:0d:e7:c5:9a:f7:
         a1:b4:21:91:33:6f:86:e8:58:bb:25:7c:74:0e:58:fe:75:1b:
         63:3f:ce:31:7c:9b:8f:1b:96:9e:c5:53:76:84:5b:9c:ad:91:
         fa:ac:ed:93:ba:5d:c8:21:53:c2:82:53:63:af:12:0d:50:87:
         11:1b:3d:54:52:96:8a:2c:9c:3d:92:1a:08:9a:05:2e:c7:93:
         a5:48:91:d3

pkcs7-signedData

SHA1: nil

1.3.6.1.4.1.311.2.1.4

1.3.6.1.4.1.311.2.1.15

00 3c 00 3c 00 3c 00 4f  00 62 00 73 00 6f 00 6c  |.<.<.<.O.b.s.o.l|
00 65 00 74 00 65 00 3e  00 3e 00 3e              |.e.t.e.>.>.>    |

SHA1

f4 54 fe 69 aa 3c 3d d9 c4 79 ec 30 37 36 00 ff |.T.i.<=..y.076..| ac e1 cf 77 |...w |

Certificates
- Certificate #0
  - 2
    - 04:DE:58:73:E7:09:0A:E2:F5:AC:EF:B1:67:A5:35:73
    - RSA-SHA1: nil
    - Issuer
      - C: US
      - O: VeriSign, Inc.
      - OU: VeriSign Trust Network
      - OU: Terms of use at https://www.verisign.com/rpa (c)10
      - CN: VeriSign Class 3 Code Signing 2010 CA
    - 2012-08-21 00:00:00 UTC: 2015-09-04 23:59:59 UTC
    - Subject
      - C: AU
      - ST: Victoria
      - L: Albert Park
      - O: Beepa Pty Ltd
      - OU: Digital ID Class 3 - Microsoft Software Validation v2
      - OU: Development
      - CN: Beepa Pty Ltd
    - #5
      - rsaEncryption: nil
      - D9:43:E8:5B:1E:41:C4:83:AD:DE:1F:30:DD:1D:65:3B:
        92:78:A5:02:A0:7B:A9:20:9B:B8:43:DB:1F:21:61:CD:
        B6:72:91:47:FA:64:B7:67:0E:0E:64:20:01:87:5C:26:
        5A:0F:0A:6A:CF:4C:B6:B9:E3:4E:26:F2:1E:0B:51:3D:
        56:10:08:87:AB:23:51:14:32:6B:B6:C1:71:09:1A:1F:
        22:0A:54:5E:4C:13:17:D1:EF:7B:AF:E4:40:D2:6C:2D:
        C2:EE:BD:A8:C9:27:64:31:A0:60:7E:F0:2B:9B:FC:D7:
        0D:48:CC:33:76:96:15:26:93:A7:82:71:DE:9A:70:B2:
        17:05:40:A0:D4:F9:61:C0:E2:04:64:6B:89:2E:EF:9C:
        22:F8:BB:E1:85:39:5D:9A:6D:9E:C5:7B:68:E1:62:C6:
        FB:15:2B:05:C1:55:72:26:E8:D8:9C:EF:D4:E3:3E:0A:
        3D:99:7A:ED:9F:4C:EE:03:41:2D:F1:D7:43:4C:BD:FB:
        E9:A2:1B:1B:1E:90:74:07:B6:8C:C1:C7:88:C0:4F:AE:
        10:2C:8B:5E:FE:14:52:0B:61:65:FC:0A:55:21:D2:E5:
        91:25:F0:06:BC:F3:34:F7:DC:BD:0A:C8:27:91:F2:C4:
        CD:E1:0F:FD:89:9D:DF:4F:8A:FC:87:C0:73:E5:40:7F: 0x010001
    - X509v3 extensions
      - basicConstraints
        nil
      - keyUsage: true, 0x80
      - crlDistributionPoints: http://csc3-2010-crl.verisign.com/CSC3-2010.crl
      - certificatePolicies
        2.16.840.1.113733.1.7.23.3
        id-qt-cps: https://www.verisign.com/rpa
      - extendedKeyUsage: codeSigning
      - authorityInfoAccess
        #0
        OCSP: http://ocsp.verisign.com
        caIssuers: http://csc3-2010-aia.verisign.com/CSC3-2010.cer
      - authorityKeyIdentifier:
        cf 99 a9 ea 7b 26 f4 4b c9 8e 8f d7 f0 05 26 ef |....{&.K......&.| e3 d2 a7 9d |.... |
      - nsCertType: 0x10
      - 1.3.6.1.4.1.311.2.1.27
        false: true
  - RSA-SHA1:
```
39 b5 83 82 02 a2 70 91  72 06 8a 36 e1 36 c4 13  |9.....p.r..6.6..|
c6 f5 45 6c c3 2c 26 f9  7a d1 ed 4c 11 19 5e cc  |..El.,&.z..L..^.|
8b 92 7b b2 b0 bd 2d b2  6b f4 e2 14 97 e6 fe 44  |..{...-.k......D|
59 8b ec a3 a4 a9 40 5a  d8 ad 89 68 83 5d dd 61  |Y.....@Z...h.].a|
1e 1e ad d9 c6 ef cf 70  5d 1f 49 a1 75 0d c5 e0  |.......p].I.u...|
87 72 d6 c2 c3 78 63 6f  eb 10 b9 3a e9 ef a5 1f  |.r...xco...:....|
5d 00 94 79 61 c1 6c f1  b8 ec 56 3b 56 d3 7b 92  |]..ya.l...V;V.{.|
f0 92 f5 dc cb c7 9c 5d  d5 74 b2 58 92 0a 77 0c  |.......].t.X..w.|
7a 80 2c 4c ab 62 fe 48  e3 2e 8e 32 b2 06 89 9b  |z.,L.b.H...2....|
f3 75 ba 78 18 ca f1 b2  6d 8e 36 8e a4 18 fe c1  |.u.x....m.6.....|
0d 92 65 4a e0 07 e2 4a  c3 c8 61 4a e0 30 6c 9b  |..eJ...J..aJ.0l.|
43 7d 1e 6f 79 c8 28 f3  23 fa 35 9b 8a a8 99 7b  |C}.oy.(.#.5....{|
31 4d a8 cc 07 39 8d ba  64 82 1f d3 f2 1f f2 a4  |1M...9..d.......|
c1 bd 6e 49 cf b4 13 12  6c 09 32 50 d1 1a ca f9  |..nI....l.2P....|
13 99 64 70 12 84 b9 c8  17 45 a0 3b 35 19 0e 5f  |..dp.....E.;5.._|
a2 15 e5 11 7e ae 54 75  4b 80 f4 f5 91 95 46 87  |....~.TuK.....F.|
```
- Certificate #1
  - 2
    - 52:00:E5:AA:25:56:FC:1A:86:ED:96:C9:D4:4B:33:C7
    - RSA-SHA1: nil
    - Issuer
      - C: US
      - O: VeriSign, Inc.
      - OU: VeriSign Trust Network
      - OU: (c) 2006 VeriSign, Inc. - For authorized use only
      - CN: VeriSign Class 3 Public Primary Certification Authority - G5
    - 2010-02-08 00:00:00 UTC: 2020-02-07 23:59:59 UTC
    - Subject
      - C: US
      - O: VeriSign, Inc.
      - OU: VeriSign Trust Network
      - OU: Terms of use at https://www.verisign.com/rpa (c)10
      - CN: VeriSign Class 3 Code Signing 2010 CA
    - #5
      - rsaEncryption: nil
      - F5:23:4B:5E:A5:D7:8A:BB:32:E9:D4:57:F7:EF:E4:C7:
        26:7E:AD:19:98:FE:A8:9D:7D:94:F6:36:6B:10:D7:75:
        81:30:7F:04:68:7F:CB:2B:75:1E:CD:1D:08:8C:DF:69:
        94:A7:37:A3:9C:7B:80:E0:99:E1:EE:37:4D:5F:CE:3B:
        14:EE:86:D4:D0:F5:27:35:BC:25:0B:38:A7:8C:63:9D:
        17:A3:08:A5:AB:B0:FB:CD:6A:62:82:4C:D5:21:DA:1B:
        D9:F1:E3:84:3B:8A:2A:4F:85:5B:90:01:4F:C9:A7:76:
        10:7F:27:03:7C:BE:AE:7E:7D:C1:DD:F9:05:BC:1B:48:
        9C:69:E7:C0:A4:3C:3C:41:00:3E:DF:96:E5:C5:E4:94:
        71:D6:55:01:C7:00:26:4A:40:3C:B5:A1:26:A9:0C:A7:
        6D:80:8E:90:25:7B:CF:BF:3F:1C:EB:2F:96:FA:E5:87:
        77:C6:B5:56:B2:7A:3B:54:30:53:1B:DF:62:34:FF:1E:
        D1:F4:5A:93:28:85:E5:4C:17:4E:7E:5B:FD:A4:93:99:
        7F:DF:CD:EF:A4:75:EF:EF:15:F6:47:E7:F8:19:72:D8:
        2E:34:1A:A6:B4:A7:4C:7E:BD:BB:4F:0C:3D:57:F1:30:
        D6:A6:36:8E:D6:80:76:D7:19:2E:A5:CD:7E:34:2D:89: 0x010001
    - X509v3 extensions
      - basicConstraints
        true
        true: 0
      - certificatePolicies
        2.16.840.1.113733.1.7.23.3
        #0
        id-qt-cps: https://www.verisign.com/cps
        id-qt-unotice: https://www.verisign.com/rpa
      - keyUsage: true, 6
      - 1.3.6.1.5.5.7.1.12
        image/gif
        SHA1:
        8f e5 d3 1a 86 ac 8d 8e 6b c3 cf 80 6a d4 48 18 |........k...j.H.| 2c 7b 19 2e |,{.. |
        http://logo.verisign.com/vslogo.gif
      - crlDistributionPoints: http://crl.verisign.com/pca3-g5.crl
      - authorityInfoAccess
        OCSP: http://ocsp.verisign.com
      - extendedKeyUsage
        clientAuth: codeSigning
      - subjectAltName
        CN: VeriSignMPKI-2-8
      - subjectKeyIdentifier:
        cf 99 a9 ea 7b 26 f4 4b c9 8e 8f d7 f0 05 26 ef |....{&.K......&.| e3 d2 a7 9d |.... |
      - authorityKeyIdentifier:
        7f d3 65 a7 c2 dd ec bb f0 30 09 f3 43 39 fa 02 |..e......0..C9..| af 33 31 33 |.313 |
  - RSA-SHA1:
```
56 22 e6 34 a4 c4 61 cb  48 b9 01 ad 56 a8 64 0f  |V".4..a.H...V.d.|
d9 8c 91 c4 bb cc 0c e5  ad 7a a0 22 7f df 47 38  |.........z."..G8|
4a 2d 6c d1 7f 71 1a 7c  ec 70 a9 b1 f0 4f e4 0f  |J-l..q.|.p...O..|
0c 53 fa 15 5e fe 74 98  49 24 85 81 26 1c 91 14  |.S..^.t.I$..&...|
47 b0 4c 63 8c bb a1 34  d4 c6 45 e8 0d 85 26 73  |G.Lc...4..E...&s|
03 d0 a9 8c 64 6d dc 71  92 e6 45 05 60 15 59 51  |....dm.q..E.`.YQ|
39 fc 58 14 6b fe d4 a4  ed 79 6b 08 0c 41 72 e7  |9.X.k....yk..Ar.|
37 22 06 09 be 23 e9 3f  44 9a 1e e9 61 9d cc b1  |7"...#.?D...a...|
90 5c fc 3d d2 8d ac 42  3d 65 36 d4 b4 3d 40 28  |.\.=...B=e6..=@(|
8f 9b 10 cf 23 26 cc 4b  20 cb 90 1f 5d 8c 4c 34  |....#&.K ...].L4|
ca 3c d8 e5 37 d6 6f a5  20 bd 34 eb 26 d9 ae 0d  |.<..7.o. .4.&...|
e7 c5 9a f7 a1 b4 21 91  33 6f 86 e8 58 bb 25 7c  |......!.3o..X.%||
74 0e 58 fe 75 1b 63 3f  ce 31 7c 9b 8f 1b 96 9e  |t.X.u.c?.1|.....|
c5 53 76 84 5b 9c ad 91  fa ac ed 93 ba 5d c8 21  |.Sv.[........].!|
53 c2 82 53 63 af 12 0d  50 87 11 1b 3d 54 52 96  |S..Sc...P...=TR.|
8a 2c 9c 3d 92 1a 08 9a  05 2e c7 93 a5 48 91 d3  |.,.=.........H..|
```

Signer

1
unnamed
- #0
  - C: US
  - O: VeriSign, Inc.
  - OU: VeriSign Trust Network
  - OU: Terms of use at https://www.verisign.com/rpa (c)10
  - CN: VeriSign Class 3 Code Signing 2010 CA
- 04:DE:58:73:E7:09:0A:E2:F5:AC:EF:B1:67:A5:35:73
SHA1: nil

contentType: 1.3.6.1.4.1.311.2.1.4
1.3.6.1.4.1.311.2.1.11: msCodeInd

messageDigest:

34 05 5e 93 2b 37 2c 46  75 22 5f 93 b5 1b eb a1  |4.^.+7,Fu"_.....|
f2 f8 62 46                                       |..bF            |

1.3.6.1.4.1.311.2.1.12

00 46 00 52 00 41 00 50 00 53 |.F.R.A.P.S |
: http://www.fraps.com

rsaEncryption:

78 f4 ff be 54 b1 d9 30  3f 1a c9 0e ce 89 82 1f  |x...T..0?.......|
21 87 46 7c 39 f3 25 b1  89 e9 78 12 d2 64 54 b0  |!.F|9.%...x..dT.|
85 1b 54 28 49 3e 57 8a  2b eb ac 63 51 53 7b da  |..T(I>W.+..cQS{.|
94 02 17 19 59 4f 0a 91  49 49 94 f9 e7 2b 5a 5b  |....YO..II...+Z[|
14 43 20 4f fd d6 d4 31  3a f8 db 00 42 38 42 60  |.C O...1:...B8B`|
a8 69 a2 83 4f eb 58 f9  e4 73 eb 71 8e b5 bd b1  |.i..O.X..s.q....|
7e 63 4a 28 67 a7 8b 84  49 26 b0 91 db 49 d6 ff  |~cJ(g...I&...I..|
02 ce 2c 41 b5 98 6c 90  25 94 47 38 15 0f b2 d5  |..,A..l.%.G8....|
78 4d 90 6c e1 e7 a6 d4  07 a7 f7 b6 51 c8 a8 ff  |xM.l........Q...|
30 85 db bf c0 26 f4 10  53 ff e9 4e 39 ea a4 94  |0....&..S..N9...|
1a ad 8f 9a 9d b7 b5 e0  66 e9 2c 3c 22 29 5a 28  |........f.,<")Z(|
38 42 d6 b3 88 7d 78 8c  9e a9 11 22 10 f9 66 d4  |8B...}x...."..f.|
24 5d 1f 35 74 ed 19 b0  98 49 c3 c9 70 c1 1a 93  |$].5t....I..p...|
bd 39 85 f2 03 31 30 76  9c f5 6b 1d 6a c9 8e a8  |.9...10v..k.j...|
7a 83 c7 4a 6a 3e 53 87  68 d2 1c be e0 68 ef 67  |z..Jj>S.h....h.g|
7c e6 d5 e2 b2 19 6c 0a  93 8e 74 5f c4 91 64 e2  ||.....l...t_..d.|

show previews

offset	size	type	comment
0	2387968	EXE	02/26/2013 06:54:55	#
15c1	15	HTM		#
222838	10928	PNG	(256 x 256)	#
226fa0	36215	PNG	(256 x 256)	#
247000	3768	PKCS7	Authenticode Signature	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0x164a20

[?] can't find file_offset of VA 0x1fa0ec

[?] can't find file_offset of VA 0x28f7b8

[?] can't find file_offset of VA 0x2909b4

[?] can't find file_offset of VA 0x291bb0

[?] can't find file_offset of VA 0x291eec

[?] can't find file_offset of VA 0x292228

[?] can't find file_offset of VA 0x293424

[?] can't find file_offset of VA 0x294620

[?] can't find file_offset of VA 0x29527c

[?] can't find file_offset of VA 0x295ed8

[?] can't find file_offset of VA 0x296214

[?] can't find file_offset of VA 0x296550

[?] can't find file_offset of VA 0x29774c

[?] can't find file_offset of VA 0x298948

[?] can't find file_offset of VA 0x29fae4

[?] can't find file_offset of VA 0x2a6c80

[?] can't find file_offset of VA 0x390758

[?] can't find file_offset of VA 0x47a230

[?] can't find file_offset of VA 0x563d08

[?] can't find file_offset of VA 0x64d7e0

[?] can't find file_offset of VA 0x64f42c

[?] can't find file_offset of VA 0x651078

[?] can't find file_offset of VA 0x6515b4

[?] can't find file_offset of VA 0x651af0

[?] can't find file_offset of VA 0x65373c

[?] can't find file_offset of VA 0x655388

[?] can't find file_offset of VA 0x6566d8

[?] can't find file_offset of VA 0x657a28

[?] can't find file_offset of VA 0x657f64

[?] can't find file_offset of VA 0x6584a0

[?] can't find file_offset of VA 0x6636b0

[?] can't find file_offset of VA 0x66e8c0

[?] can't find file_offset of VA 0x67050c

[?] can't find file_offset of VA 0x672158

[?] can't find file_offset of VA 0x673354

[?] can't find file_offset of VA 0x674fa0

[?] can't find file_offset of VA 0x67619c

[?] ignoring invalid PEdump::BITMAPINFOHEADER

[?] can't find file_offset of VA 0x69bba0

[?] can't find file_offset of VA 0x69bc54

[?] can't find file_offset of VA 0x69bf78

[?] can't find file_offset of VA 0x69c374

[?] can't find file_offset of VA 0x69ca60

[?] invalid VS_VERSIONINFO child type "\x00t\x00r\x00i"