filenametrace.exe
size120320 (0x1d600)
md525c2b54a3ec48a18bdef25e8ab044d0c
typePE32+ executable (console) x86-64, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf8

Rich Header

lib idversiontimes used
239401162
257241234
259241232
2612412322
2602412312
257242133
203655012
1090
001
255242101
258242131

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x8664
NumberOfSections9
TimeDateStamp0x57d4c0f1
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xf0
Characteristics0x22
Magic0x20b
LinkerVersion14.0
SizeOfCode0x13600
SizeOfInitializedData0xa400
SizeOfUninitializedData0
AddressOfEntryPoint0x1311
BaseOfCode0x1000
ImageBase0x140000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.0
ImageVersion0.0
SubsystemVersion6.0
Reserved10
SizeOfImage0x24000
SizeOfHeaders0x400
CheckSum0
Subsystem3
DllCharacteristics0x8160
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

namevavsizeraw sizeflags
.text0x10000x1350d0x13600R-X CODE
.rdata0x150000x51720x5200R-- IDATA
.data0x1b0000xad90x400RW- IDATA
.pdata0x1c0000x1d400x1e00R-- IDATA
.idata0x1e0000x190a0x1a00R-- IDATA
.gfids0x200000x1580x200R-- IDATA
.00cfg0x210000x11b0x200R-- IDATA
.rsrc0x220000x43c0x600R-- IDATA
.reloc0x230000x2500x400R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x1e5080x78
RESOURCE0x220000x43c
EXCEPTION0x1c0000x198c
SECURITY00
BASERELOC0x230000x6c
DEBUG0x168900x38
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x168d00x94
Bound_IAT00
IAT0x1e0000x508
Delay_IAT00
CLR_Header00
typenamesizecp
MANIFEST#13810
module_namehintordfunction_name
redbg.dll73public: virtual void __cdecl redbg::EventSink::on_access_violation(class redbg::Debuggee & __ptr64, class redbg::Thread & __ptr64, void * __ptr64) __ptr64

?on_access_violation@EventSink@redbg@@UEAAXAEAVDebuggee@2@AEAVThread@2@PEAX@Z

redbg.dll79public: virtual void __cdecl redbg::EventSink::on_debug_break(class redbg::Debuggee & __ptr64, class redbg::Thread & __ptr64, void * __ptr64) __ptr64

?on_debug_break@EventSink@redbg@@UEAAXAEAVDebuggee@2@AEAVThread@2@PEAX@Z

redbg.dll22public: virtual __cdecl redbg::EventSink::~EventSink(void) __ptr64

??1EventSink@redbg@@UEAA@XZ

redbg.dll10public: __cdecl redbg::EventSink::EventSink(void) __ptr64

??0EventSink@redbg@@QEAA@XZ

redbg.dll104void __cdecl redbg::wait_event(class redbg::EventSink & __ptr64)

?wait_event@redbg@@YAXAEAVEventSink@1@@Z

redbg.dll48class std::unique_ptr<class redbg::Debuggee, struct std::default_delete<class redbg::Debuggee> > __cdecl redbg::create_process(class std::basic_string<char, struct std::char_traits<char>, class std::allocator<char> > const & __ptr64, struct redbg::CreateProcessParams const & __ptr64)

?create_process@redbg@@YA?AV?$unique_ptr@VDebuggee@redbg@@U?$default_delete@VDebuggee@redbg@@@std@@@std@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@3@AEBUCreateProcessParams@1@@Z

MSVCP140D.dll1340public: char __cdecl std::basic_ios<char, struct std::char_traits<char> >::widen(char)const __ptr64

?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z

MSVCP140D.dll1129public: class std::basic_ostream<char, struct std::char_traits<char> > & __ptr64 __cdecl std::basic_ostream<char, struct std::char_traits<char> >::put(char) __ptr64

?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z

MSVCP140D.dll880public: class std::basic_ostream<char, struct std::char_traits<char> > & __ptr64 __cdecl std::basic_ostream<char, struct std::char_traits<char> >::flush(void) __ptr64

?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ

MSVCP140D.dll700class std::basic_ostream<char, struct std::char_traits<char> > std::cout

?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A

MSVCP140D.dll274public: class std::basic_ostream<char, struct std::char_traits<char> > & __ptr64 __cdecl std::basic_ostream<char, struct std::char_traits<char> >::operator<<(unsigned __int64) __ptr64

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z

MSVCP140D.dll261public: class std::basic_ostream<char, struct std::char_traits<char> > & __ptr64 __cdecl std::basic_ostream<char, struct std::char_traits<char> >::operator<<(int) __ptr64

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z

MSVCP140D.dll272public: class std::basic_ostream<char, struct std::char_traits<char> > & __ptr64 __cdecl std::basic_ostream<char, struct std::char_traits<char> >::operator<<(void const * __ptr64) __ptr64

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z

MSVCP140D.dll973public: bool __cdecl std::ios_base::good(void)const __ptr64

?good@ios_base@std@@QEBA_NXZ

MSVCP140D.dll1298public: class std::basic_ostream<char, struct std::char_traits<char> > * __ptr64 __cdecl std::basic_ios<char, struct std::char_traits<char> >::tie(void)const __ptr64

?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ

MSVCP140D.dll1318bool __cdecl std::uncaught_exception(void)

?uncaught_exception@std@@YA_NXZ

MSVCP140D.dll588public: void __cdecl std::basic_ostream<char, struct std::char_traits<char> >::_Osfx(void) __ptr64

?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ

MSVCP140D.dll659void __cdecl std::_Xbad_alloc(void)

?_Xbad_alloc@std@@YAXXZ

MSVCP140D.dll109public: __cdecl std::_Lockit::_Lockit(int) __ptr64

??0_Lockit@std@@QEAA@H@Z

MSVCP140D.dll165public: __cdecl std::_Lockit::~_Lockit(void) __ptr64

??1_Lockit@std@@QEAA@XZ

MSVCP140D.dll1229public: void __cdecl std::basic_ios<char, struct std::char_traits<char> >::setstate(int, bool) __ptr64

?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z

MSVCP140D.dll421void __cdecl std::_Debug_message(wchar_t const * __ptr64, wchar_t const * __ptr64, unsigned int)

?_Debug_message@std@@YAXPEB_W0I@Z

MSVCP140D.dll663void __cdecl std::_Xout_of_range(char const * __ptr64)

?_Xout_of_range@std@@YAXPEBD@Z

MSVCP140D.dll682class std::basic_ostream<char, struct std::char_traits<char> > std::cerr

?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A

MSVCP140D.dll268public: class std::basic_ostream<char, struct std::char_traits<char> > & __ptr64 __cdecl std::basic_ostream<char, struct std::char_traits<char> >::operator<<(class std::basic_ostream<char, struct std::char_traits<char> > & __ptr64 (__cdecl*)(class std::basic_ostream<char, struct std::char_traits<char> > & __ptr64)) __ptr64

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z

MSVCP140D.dll1350public: __int64 __cdecl std::ios_base::width(void)const __ptr64

?width@ios_base@std@@QEBA_JXZ

MSVCP140D.dll879public: int __cdecl std::ios_base::flags(void)const __ptr64

?flags@ios_base@std@@QEBAHXZ

MSVCP140D.dll662void __cdecl std::_Xlength_error(char const * __ptr64)

?_Xlength_error@std@@YAXPEBD@Z

MSVCP140D.dll1167public: class std::basic_streambuf<char, struct std::char_traits<char> > * __ptr64 __cdecl std::basic_ios<char, struct std::char_traits<char> >::rdbuf(void)const __ptr64

?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ

MSVCP140D.dll873public: char __cdecl std::basic_ios<char, struct std::char_traits<char> >::fill(void)const __ptr64

?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ

MSVCP140D.dll1254public: int __cdecl std::basic_streambuf<char, struct std::char_traits<char> >::sputc(char) __ptr64

?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z

MSVCP140D.dll1257public: __int64 __cdecl std::basic_streambuf<char, struct std::char_traits<char> >::sputn(char const * __ptr64, __int64) __ptr64

?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z

MSVCP140D.dll1349public: __int64 __cdecl std::ios_base::width(__int64) __ptr64

?width@ios_base@std@@QEAA_J_J@Z

VCRUNTIME140D.dll37__std_type_info_destroy_list
VCRUNTIME140D.dll14__CxxFrameHandler3
VCRUNTIME140D.dll34__std_exception_destroy
VCRUNTIME140D.dll33__std_exception_copy
VCRUNTIME140D.dll8__C_specific_handler
VCRUNTIME140D.dll61memmove
VCRUNTIME140D.dll1_CxxThrowException
VCRUNTIME140D.dll35__std_terminate
VCRUNTIME140D.dll60memcpy
ucrtbased.dll73__p___argc
ucrtbased.dll74__p___argv
ucrtbased.dll164_cexit
ucrtbased.dll159_c_exit
ucrtbased.dll693_register_thread_local_exe_atexit_callback
ucrtbased.dll181_configthreadlocale
ucrtbased.dll717_set_new_mode
ucrtbased.dll77__p__commode
ucrtbased.dll705_seh_filter_dll
ucrtbased.dll370_initialize_onexit_table
ucrtbased.dll692_register_onexit_function
ucrtbased.dll229_execute_onexit_table
ucrtbased.dll194_crt_atexit
ucrtbased.dll193_crt_at_quick_exit
ucrtbased.dll1354terminate
ucrtbased.dll714_set_fmode
ucrtbased.dll234_exit
ucrtbased.dll1103exit
ucrtbased.dll373_initterm_e
ucrtbased.dll372_initterm
ucrtbased.dll317_get_initial_narrow_environment
ucrtbased.dll369_initialize_narrow_environment
ucrtbased.dll182_configure_narrow_argv
ucrtbased.dll91__setusermatherr
ucrtbased.dll709_set_app_type
ucrtbased.dll706_seh_filter_exe
ucrtbased.dll1239malloc
ucrtbased.dll161_callnewh
ucrtbased.dll285_free_dbg
ucrtbased.dll374_invalid_parameter
ucrtbased.dll5_CrtDbgReportW
ucrtbased.dll1328strlen
KERNEL32.dll1205RtlLookupFunctionEntry
KERNEL32.dll1212RtlVirtualUnwind
KERNEL32.dll1426UnhandledExceptionFilter
KERNEL32.dll1362SetUnhandledExceptionFilter
KERNEL32.dll527GetCurrentProcess
KERNEL32.dll1392TerminateProcess
KERNEL32.dll880IsProcessorFeaturePresent
KERNEL32.dll1072QueryPerformanceCounter
KERNEL32.dll528GetCurrentProcessId
KERNEL32.dll532GetCurrentThreadId
KERNEL32.dll733GetSystemTimeAsFileTime
KERNEL32.dll852InitializeSListHead
KERNEL32.dll874IsDebuggerPresent
KERNEL32.dll709GetStartupInfoW
KERNEL32.dll621GetModuleHandleW
KERNEL32.dll1198RtlCaptureContext
KERNEL32.dll618GetModuleHandleA
offsetsizetypecomment
15c115HTM#
15d0114736BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK