filenamefraps.exe
size71680 (0x11800)
md55050a30474ae64cd02dedfd698ee2608
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x110

Rich Header

lib idversiontimes used
199411182
205506282
2065062819
203506284
207506286
123507272
147210222
10109
1853071613
2115072715
201507271
204507271

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0x52d2a0c9
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion11.0
SizeOfCode0xd600
SizeOfInitializedData0x67c00
SizeOfUninitializedData0
AddressOfEntryPoint0xd6a9
BaseOfCode0x1000
BaseOfData0xf000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.0
ImageVersion0.0
SubsystemVersion6.0
Reserved10
SizeOfImage0x78000
SizeOfHeaders0x400
CheckSum0
Subsystem2
DllCharacteristics0x8140
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0 2005

Sections

namevavsizeraw sizeflags
.text0x10000xd4d70xd600R-X CODE
.rdata0xf0000x1a2c0x1c00R-- IDATA
.data0x110000x63fd80x200RW- IDATA
.rsrc0x750000x1e00x200R-- IDATA
.reloc0x760000x1d340x1e00R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0xff540xdc
RESOURCE0x750000x1e0
EXCEPTION00
SECURITY00
BASERELOC0x760000x14c4
DEBUG0xf2a00x38
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0xfb800x40
Bound_IAT00
IAT0xf0000x1dc
Delay_IAT00
CLR_Header00
typenamesizecp
MANIFEST#13810
module_namehintordfunction_name
KERNEL32.dll1407Thread32First
KERNEL32.dll1408Thread32Next
KERNEL32.dll991Module32First
KERNEL32.dll1065Process32Next
KERNEL32.dll1032OpenProcess
KERNEL32.dll993Module32Next
KERNEL32.dll142CloseHandle
KERNEL32.dll257CreateThread
KERNEL32.dll804GetVolumeInformationA
KERNEL32.dll1063Process32First
KERNEL32.dll547GetCurrentProcess
KERNEL32.dll1530WriteProcessMemory
KERNEL32.dll1115ReadProcessMemory
KERNEL32.dll266CreateToolhelp32Snapshot
KERNEL32.dll1375Sleep
KERNEL32.dll316EncodePointer
KERNEL32.dll279DecodePointer
KERNEL32.dll899IsDebuggerPresent
KERNEL32.dll904IsProcessorFeaturePresent
KERNEL32.dll1084QueryPerformanceCounter
KERNEL32.dll785GetTickCount64
KERNEL32.dll756GetSystemTimeAsFileTime
KERNEL32.dll552GetCurrentThreadId
USER32.dll692SendMessageA
USER32.dll339GetKeyState
USER32.dll593MoveWindow
USER32.dll541LoadCursorA
USER32.dll263FindWindowA
USER32.dll181DispatchMessageA
USER32.dll796ShowWindow
USER32.dll728SetLayeredWindowAttributes
USER32.dll883keybd_event
USER32.dll279GetAsyncKeyState
USER32.dll458GetWindowRect
USER32.dll645RegisterClassExA
USER32.dll622PostQuitMessage
USER32.dll545LoadIconA
USER32.dll827TranslateMessage
USER32.dll112CreateWindowExA
USER32.dll617PeekMessageA
USER32.dll160DefWindowProcA
GDI32.dll86CreateSolidBrush
ADVAPI32.dll530OpenProcessToken
ADVAPI32.dll428LookupPrivilegeValueA
ADVAPI32.dll31AdjustTokenPrivileges
d3dx9_40.dll64D3DXCreateFontA
d3dx9_40.dll71D3DXCreateLine
d3d9.dll10Direct3DCreate9Ex
dwmapi.dll6DwmExtendFrameIntoClientArea
MSVCP110.dll731void __cdecl std::_Xout_of_range(char const *)

?_Xout_of_range@std@@YAXPBD@Z

MSVCP110.dll727void __cdecl std::_Xbad_alloc(void)

?_Xbad_alloc@std@@YAXXZ

MSVCP110.dll702char const * __cdecl std::_Syserror_map(int)

?_Syserror_map@std@@YAPBDH@Z

MSVCP110.dll723char const * __cdecl std::_Winerror_map(int)

?_Winerror_map@std@@YAPBDH@Z

MSVCP110.dll730void __cdecl std::_Xlength_error(char const *)

?_Xlength_error@std@@YAXPBD@Z

MSVCR110.dll861_libm_sse2_cos_precise
MSVCR110.dll865_libm_sse2_pow_precise
MSVCR110.dll866_libm_sse2_sin_precise
MSVCR110.dll867_libm_sse2_sqrt_precise
MSVCR110.dll1560memcpy
MSVCR110.dll860_libm_sse2_atan_precise
MSVCR110.dll758_invoke_watson
MSVCR110.dll408__crtSetUnhandledExceptionFilter
MSVCR110.dll608_except_handler4_common
MSVCR110.dll409__crtTerminateProcess
MSVCR110.dll410__crtUnhandledException
MSVCR110.dll858_libm_sse2_acos_precise
MSVCR110.dll376__CxxFrameHandler3
MSVCR110.dll349_CxxThrowException
MSVCR110.dll333_CIatan2
MSVCR110.dll559_controlfp_s
MSVCR110.dll714_getcwd
MSVCR110.dll1592sprintf
MSVCR110.dll1562memmove
MSVCR110.dll1464clock
MSVCR110.dll1057_purecall
MSVCR110.dll115void __cdecl operator delete(void *)

??3@YAXPAX@Z

MSVCR110.dll113void * __cdecl operator new(unsigned int)

??2@YAPAXI@Z

MSVCR110.dll1468exit
MSVCR110.dll1619strstr
MSVCR110.dll1629system
MSVCR110.dll1578rand
MSVCR110.dll1595srand
MSVCR110.dll1210_time64
MSVCR110.dll876_lock
MSVCR110.dll1238_unlock
MSVCR110.dll539_calloc_crt
MSVCR110.dll412__dllonexit
MSVCR110.dll1042_onexit
MSVCR110.dll112public: virtual __thiscall type_info::~type_info(void)

??1type_info@@UAE@XZ

MSVCR110.dll315void __cdecl terminate(void)

?terminate@@YAXXZ

MSVCR110.dll1162_stricmp
MSVCR110.dll367_XcptFilter
MSVCR110.dll404__crtGetShowWindowMode
MSVCR110.dll517_amsg_exit
MSVCR110.dll420__getmainargs
MSVCR110.dll480__set_app_type
MSVCR110.dll617_exit
MSVCR110.dll540_cexit
MSVCR110.dll784_ismbblead
MSVCR110.dll556_configthreadlocale
MSVCR110.dll482__setusermatherr
MSVCR110.dll751_initterm_e
MSVCR110.dll750_initterm
MSVCR110.dll508_acmdln
MSVCR110.dll644_fmode
MSVCR110.dll555_commode
MSVCR110.dll571_crt_debugger_hook
MSVCR110.dll1564memset
WINMM.dll8PlaySoundA
offsetsizetypecomment
071680EXE01/12/2014 14:03:53#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK