!This program cannot be run in DOS mode.
`.rdata
@.data
.pdata
@.rsrc
@.reloc
L$ SVWH
@8+tiH
UVWATAUAVAWH
t"D8)H
tmD8.thL
A_A^A]A\_^]
u#!D$(E3
UAUAVH
L!t$0H
L!t$ E3
uF!D$(E3
UVWAVAWH
A_A^_^]
USVWATAUAVAWH
HA_A^A]A\_^[]
\$ VWAWH
<EuBH;
u-!|$(E3
!|$(E3
!|$(E3
|$ AWH
u8!D$(E3
x UATAUAVAWH
u-A9]|
tYA8 tT3
A_A^A]A\]
u?!D$(E3
u7!D$(E3
UATAUAVAWH
A_A^A]A\]
u !D$(E3
WATAUAVAWH
A_A^A]A\_
UVWATAUAVAWH
pA_A^A]A\_^]
@USVWATAVAWH
A_A^A\_^[]
u*!D$(E3
u.!D$(E3
x AUAVAWH
@A_A^A]
x UAVAWH
9D$Pu/
!\$(E3
u !D$(E3
u=!D$(E3
u3!D$(E3
` UAVAWH
uO!D$(E3
x UATAUAVAWH
A_A^A]A\]
|$ UATAUAVAWH
<"u.A8F
<AtG<Dt:<It-<Nt <Pt
<Et <Gt
A_A^A]A\]
8\u*H;
u*9Q<|%
LcA<E3
u HcA<H
H3E H3E
advapi32.dll
CheckTokenMembership
Reboot
AdvancedINF
Version
setupx.dll
setupapi.dll
SeShutdownPrivilege
advpack.dll
DelNodeRunDLL32
wininit.ini
Software\Microsoft\Windows\CurrentVersion\App Paths
HeapSetInformation
EXTRACTOPT
INSTANCECHECK
VERCHECK
DecryptFileA
LICENSE
<None>
REBOOT
SHOWWINDOW
ADMQCMD
USRQCMD
RUNPROGRAM
POSTRUNPROGRAM
FINISHMSG
LoadString() Error. Could not load string resource.
CABINET
FILESIZES
PACKINSTSPACE
UPROMPT
IXP%03d.TMP
msdownld.tmp
TMP4351$.TMP
RegServer
UPDFILE%lu
Control Panel\Desktop\ResourceLocale
wextract.pdb
.text$mn
.text$mn$00
.text$x
.rdata$brc
.idata$5
.00cfg
.CRT$XCA
.CRT$XCAA
.CRT$XCZ
.CRT$XIA
.CRT$XIAA
.CRT$XIY
.CRT$XIZ
.gfids
.rdata
.rdata$zzzdbg
.xdata
.idata$2
.idata$3
.idata$4
.idata$6
.pdata
.rsrc$01
.rsrc$02
GetTokenInformation
RegDeleteValueA
RegOpenKeyExA
RegQueryInfoKeyA
FreeSid
OpenProcessToken
RegSetValueExA
RegCreateKeyExA
LookupPrivilegeValueA
AllocateAndInitializeSid
RegQueryValueExA
EqualSid
RegCloseKey
AdjustTokenPrivileges
ADVAPI32.dll
GetShortPathNameA
GetModuleFileNameA
FindFirstFileA
GetCurrentProcess
FindNextFileA
ExpandEnvironmentStringsA
FindClose
LocalAlloc
lstrcmpA
_lopen
_llseek
CompareStringA
GetLastError
GetFileAttributesA
GetSystemDirectoryA
LoadLibraryA
DeleteFileA
GlobalAlloc
GlobalFree
CloseHandle
WritePrivateProfileStringA
IsDBCSLeadByte
GetWindowsDirectoryA
SetFileAttributesA
GetProcAddress
GlobalLock
LocalFree
RemoveDirectoryA
FreeLibrary
_lclose
CreateDirectoryA
GetPrivateProfileIntA
GetPrivateProfileStringA
GlobalUnlock
ReadFile
SizeofResource
WriteFile
GetDriveTypeA
LoadLibraryExA
SetFileTime
SetFilePointer
FindResourceA
CreateMutexA
GetVolumeInformationA
WaitForSingleObject
GetCurrentDirectoryA
FreeResource
GetVersion
SetCurrentDirectoryA
GetTempPathA
LocalFileTimeToFileTime
CreateFileA
SetEvent
TerminateThread
GetVersionExA
LockResource
GetSystemInfo
CreateThread
ResetEvent
LoadResource
ExitProcess
GetModuleHandleW
CreateProcessA
FormatMessageA
GetTempFileNameA
DosDateTimeToFileTime
CreateEventA
GetExitCodeProcess
KERNEL32.dll
GetDeviceCaps
GDI32.dll
GetDesktopWindow
CharUpperA
SetDlgItemTextA
ExitWindowsEx
MessageBeep
EndDialog
CharPrevA
LoadStringA
CharNextA
EnableWindow
ReleaseDC
SetForegroundWindow
SetWindowLongPtrA
GetWindowLongPtrA
PeekMessageA
GetDlgItem
SendMessageA
SendDlgItemMessageA
MessageBoxA
SetWindowTextA
CallWindowProcA
GetDlgItemTextA
DialogBoxIndirectParamA
ShowWindow
MsgWaitForMultipleObjects
SetWindowPos
GetWindowRect
DispatchMessageA
USER32.dll
_vsnprintf
memcpy_s
_XcptFilter
_amsg_exit
__getmainargs
__set_app_type
_cexit
_ismbblead
__setusermatherr
_initterm
__C_specific_handler
_acmdln
_fmode
_commode
msvcrt.dll
?terminate@@YAXXZ
COMCTL32.dll
Cabinet.dll
GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoA
VERSION.dll
GetStartupInfoW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
EnumResourceLanguagesA
GetDiskFreeSpaceA
MulDiv
GetSystemMetrics
memcpy
memset
System\CurrentControlSet\Control\Session Manager
rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"
Software\Microsoft\Windows\CurrentVersion\RunOnce
wextract_cleanup%d
rundll32.exe %s,InstallHinfSection %s 128 %s
PendingFileRenameOperations
DefaultInstall
Command.com /c %s
%s /D:%s
System\CurrentControlSet\Control\Session Manager\FileRenameOperations
SHELL32.DLL
DoInfInstall
SHBrowseForFolder
SHGetPathFromIDList
*MEMCAB
AVI LIST
hdrlavih8
strlstrh8
vidsRLE
LISTv$
movi00dc(
wgwwxx
wwwwwwp
wwwwwwp
\)((Bc
tZXXXj!
kXZt&'pp
\Xt'Qp
IhhI>In
IG>G>h
:>G>G>h
ICGIGn
:>>>H>r
eeRC>:y
RCIeeee
kII=GCR
>~32"*_h
nhII:h
h40.+Il
{{aFIdqx
WPMMMPPUW
WWWUWW
W***lf
****kf
PM/1NJ\
~dD>>CEwC9
8w>68~
~xxwwEwu~
ExxwwEEx
X)$DJF
}:75235:p~
"&&4(A?=
(@KM<"
Q999999999Q
GGGGGGGGGGG
wh:Mzn
{BPMS}
h0`0p@o6kll4
,m$I"=
[H)Yk6x
gF@m1%
(C!xg0
?Ed`n0
6_z0#;
Gx:=,F1
]h]e()I
ij8::f{{
iw;t:=
B/#5/s
xl}QO.
Gg}W_n
(Nh sp
$&Bu^C
VaL_d1PY
n`nT";
78><bp
RCYH($
Bj,*3E
t\gWh$
F'u@&:
GdYNRV
<g0>&o
ZpNbx!
nE&Lh/
PH7TJ)
Mx!]x1
9NZ|QA9
!#hG*I
VLon8:
4mp-LeQ
[|Y 2
|Zg}UUK
Z-Y,fX
b3eSAy
R!Spss
dCJ5@K
GGGXky
aaV<^-
|bdA*0jq
@^@i-"
D,evd2
6X'e7U
@75MU:
cVUI)#j]
M{Zk}Hr-@
f?:88x#
W%y%)JMU
pINJJ<KP[Efk
Y%HRIZH
x4z]*EU
G`Zw-B)p
4K9=9e
T1R;D2]
j[3PC"$
2y T(t
A6@XAY
mma[W[
uUQ45MS#
L&V)eNNN
Y.s0)Q4a
'FtHc1
n@WXl3
TX@'IR
_>99y5I
)%u]Q
8I&DQF
QIDAT{
UUqttt
I\D <,
#)QQD"#
W6Z]#P\
LaFN"M
la:EOu#
c:gazz
? <tyt
gA`0)%UJ
9=D2'O
yyHaOO
P@@sRCC RCC
O??qYIIYVEECRBB
L==^\KKpYHHeUDD2SDD
J<<Q[IIaZIIfXGGKVFF1WII
J<<BYHHSYHHVXHHCXHH8SDD#RCC
H::2UEE:UDD9TEE)SCC"SED
SCC%RBB"QBB
]LLNQBB
aOOx[JJgSCC%QBB
\JJX[IIdZJJQUEE&QBB
ZII?XGGKXGG?TDD0SDD
SCC%QBB
ab`L4K*
ZZ[:443
WFFYO??
eee8AB@
[IIZYHHRVFF;RCC
jjj;FFD
[HH/RBB RBB
ggg=EED
FFF?@>?
[\\?>>=
]^^@JAC
^__AQFJ
cccCIHH
YYYEHGG
TTTI444
WWWILLL
PA<None>
payload.exe
el-7'N
xzSt|i
t#{&ZV
D^aZet
6-_A=H
$8S[_q
3UH;QO
r8)6d@)A4
-iW5C;k
5|B [M
r#h#RJzhq
uM'BA
i~hVw7
?-a$o^
X&@^WCiS
3a*^*/
qO4qSj
qj$UI-G
`HBxC*q
z.uaGqFq^
67gU9&
F]]jEe\i
=Xd`Cpy
txjr;fw;
7 bh\B
@sxC%Nw
DnXg#7=3$7
LnbfNn
r`ier m
FuQg@9[
/k#$"Vnb
5thZ<*
FS,&k-
$R`>\8%
H10_U3
K`@@Yh
T>gj^WMs[
$}9F90k
UgGqsU
="9/ Ky
9f>n1S
WLyn-K
"%G8)_
P`D/O1
Pq@,gm
orr.@;
[~A=]r
%]<Js}u>
*D{qlmBO0
uLEX4EsC2U
AtTo7Q
OIRR*-
.kQv.7
V{KW5[6hS,
f9zp-7
`s/IJs}F
YWL- Q
>ss"V[9
S&g?k2>
CW]\aj(R
3!>fa7
N6T{77
&QRuT60wp
Q5'Ys/XwirO
-Yf&4^%#
-iK#5*-
)K=tX
&((mD!!N
\V[h#7
#T!Q_8e
gb5xcL
ySzV6p
Yl.a[$
Rmud3*
(~qe*s
$ T^/.
58>?z !
>I*kj)
Z%Q06S
oYj#&&/
nt0vXi
%0:7EH
-DrDi%
..-(d7@
fE4)!ip
\8Vn3/]
,-b0&)
AaH,b8
B+FNWZ
SH86.Dy
RZUU"@HIvr
jJWEHnQ
k.ApD(:
^/>0M-v
J5,F6sD!_
W[-~o.
(Pl[jc
y]"i\?
-$KDQJ
vd]D+k
mdk-zm
T'ps8#
$'%97bg
olH|\NA
K4^G8A
$KxDd:8
9 <iJZ
Kiw!oqtZD
uC:l#`
d4](Yj
};1(x?1
a'OyFG
F,P#pV3iVm/
UEopx~
FknyZ0
QpKaY6
@`o^`p
pi#1$qS
Ew%Z"1E
6-xb4#q
Vb={zn
q3iPhh
'%0~#iK
0lSBHR
%byPy/g
t#Q7U@}
H^%Q];w_X
kOJCT{
Z*vHsK
/AJ1`g
K5XY%\
= ;*3(s
f%,-"nc!
;!ut{4
%748h|
rRM5/Kj~
/j{l1'Sp
(:BAB}-r
VO5L8|
W~M_m!
)"9@@^
*)BTm;!
|:{@u<FzS
E2+MX[MB
YH$FYh-
GK774D
Xc. w'
DQDz#$
;AWXu%
4Vb>V-X
[S!uO|
)Q!/"F
WKDssb
[&if@`kFns
T0&68~jI
pZ,:v)
%b,u@$
pF^;ve!
cLi0D`F
`6^}(}Yu
P'\vx^v
Va/Sg'f
!NK`zn+
tWw6i>
yK-Pp@
}^>C(t
yC)VKP
.o*nN`B
R<+V{Y
/zZv*Q
~8>'xf
yaw0s'9
7X?E2K
~}2;_|
yh:`Rg
N?I,xa
D*unw~
S(nA}wF1-Q
6e%[0xz
WFOJTk
051tx6&
NZ|ncsoJ1
I.p}c;A
$JepR[
FKum%e
C5.kWE+
p\ &Gv
e2PK@d
(pFQ9Y@
rinz0X
lo[b5x
W%KXeF
_mNGX)
oDk v3S
u/{K%gRg
w#s]%U
$6<pP*
;_.>uTo
Jeag9o
)`{m|@
n+!V)sX
#koXau
,$go2LE
vb|6s|
u38,Ia
exgjra
EzYLNj;
S%m+MMyn
"M3&{C
d@"O3I
MR[kT_9
"`P8s'
b7]>oA
C#(59
wqu6<*
0x!;t25e
vVY()n
_l5Oc
Vx]X`n
W-JFl]
ZT195!
oFyzL
*22kv&
S:0K:E
+2^E:z>
Gf&V6
]"+H]K
GHDg/?
=#"4P9v
X&VkJ-
QD4*[W
9WjIg-
ivR 1=
dEq|M'
,QG=y5
jK"Q$C f|
+o1T=K
[1w*])
g>vTq=
v0*~! -k';V
;GF~!46
z#.=>U
tcEkn&}
[dsmyo
[\ )KX1
Abnjy +
,f{XVw
:\#]ak
r["Q;[
;(7c}l0'
'Il]C'
BIgM&2
+Tf<hM
od:%Vm0
)o<WH|
W}tBFG
_*jDKh
h&3{pf
377tvSs77x
8vwcs88xy
L1A$%f
F3{D38d6
K0y#&39
TV"%#B
"G]sCM
W`IE)l
6SaCR6Y
g$pcrw
f'sZnYZ
X?[SRX
hh7k?Fe(
3<-zY_
%9y}dy
AK[:)1
/!-sczM
s#7&3;Xw
KF#phT
&~)z<a
vu=Z5{
)e_nXo
3bY7s
+namv[
Ik^=\\
jw{+c?Z
<None>
P<None>
<None>
cmd /c payload.exe
P<None>
P<None>
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<!-- Copyright (c) Microsoft Corporation -->
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity version="5.1.0.0"
processorArchitecture="amd64"
name="wextract"
type="win32"/>
<description>IExpress extraction tool</description>
<dependency>
<dependentAssembly>
<assemblyIdentity
type="win32"
name="Microsoft.Windows.Common-Controls"
version="6.0.0.0"
processorArchitecture="amd64"
publicKeyToken="6595b64144ccf1df"
language="*"
/>
</dependentAssembly>
</dependency>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel
level="asInvoker"
uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
<compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">
<application>
<!--This Id value indicates the application supports Windows Vista/Server 2008 functionality -->
<supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>
<!--This Id value indicates the application supports Windows 7/Server 2008 R2 functionality-->
<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>
<!--This Id value indicates the application supports Windows 8/Server 2012 functionality-->
<supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>
<!-- This Id value indicates the application supports Windows Blue/Server 2012 R2 functionality-->
<supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/>
<!-- This Id value indicates the application supports Windows Threshold functionality-->
<supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/>
</application>
</compatibility>
</assembly>
PAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADD
Kernel32.dll
ADMQCMD
CABINET
EXTRACTOPT
FILESIZES
FINISHMSG
LICENSE
PACKINSTSPACE
POSTRUNPROGRAM
REBOOT
RUNPROGRAM
SHOWWINDOW
UPROMPT
USRQCMD
License
MS Shell Dlg
Please read the following license agreement. Press the PAGE DOWN key to see the rest of the agreement.
Do you accept all of the terms of the preceding License Agreement? If you choose No, Install will close. To install you must accept this agreement.
Temporary folder
MS Shell Dlg
Please type the location where you want to place the extracted files.
&Browse...
Cancel
Overwrite file
MS Shell Dlg
Do you want to overwrite the file:
Yes To &All
Extract
MS Shell Dlg
&Cancel
Extracting
Initializing... Please wait...
msctls_progress32
Generic1
SysAnimate32
Extract
MS Shell Dlg
&Cancel
Extracting
Initializing... Please wait...
Warning
MS Shell Dlg
&Continue
Do you want to continue?
4Please select a folder to store the extracted files.
CFailed to get disk space information from: %s.
System Message: %s.&A required resource cannot be located. Are you sure you want to cancel?
8Unable to retrieve operating system version information.!Memory allocation request failed.
#Unable to create extraction thread.
Cabinet is not valid.
Filetable full.%Can not change to destination folder.
Setup could not find a drive with %s KB free disk space to install the program. Please free up some space first and press RETRY or press CANCEL to exit setup.KThat folder is invalid. Please make sure the folder exists and is writable.IYou must specify a folder with fully qualified pathname or choose Cancel.!Could not update folder edit box.5Could not load functions required for browser dialog.7Could not load Shell32.dll required for browser dialog.
(Error creating process <%s>. Reason: %s1The cluster size in this system is not supported.,A required resource appears to be corrupted.QWindows 95 or Windows NT 4.0 Beta 2 or greater is required for this installation.
Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install
Could not create folder '%s'
To install this program, you need %s KB disk space on drive %s. It is recommended that you free up the required disk space before you continue.
Do you still want to continue?
Error retrieving Windows folder
$NT Shutdown: OpenProcessToken error.)NT Shutdown: AdjustTokenPrivileges error.!NT Shutdown: ExitWindowsEx error.}Extracting file failed. It is most likely caused by low memory (low disk space for swapping file) or corrupted Cabinet file.aThe setup program could not retrieve the volume information for drive (%s) .
System message: %s.xSetup could not find a drive with %s KB free disk space to install the program. Please free up some space and try again.eThe installation program appears to be damaged or corrupted. Contact the vendor of this application.
;Command line option syntax error. Type Command /? for Help.
Command line options:
/Q -- Quiet modes for package,
/T:<full path> -- Specifies temporary working folder,
/C -- Extract files only to the folder when used also with /T.
/C:<Cmd> -- Override Install Command defined by author.
sYou must restart your computer before the new settings will take effect.
Do you want to restart your computer now?
eAnother copy of the '%s' package is already running on your system. Do you want to run another copy?
Could not find the file: %s.
You do not have administrator privileges on this machine. Some installations cannot be completed correctly unless they are run by an administrator.
:The folder '%s' does not exist. Do you want to create it?hAnother copy of the '%s' package is already running on your system. You can only run one copy at a time.OThe '%s' package is not compatible with the version of Windows you are running.SThe '%s' package is not compatible with the version of the file: %s on your system.
VS_VERSION_INFO
StringFileInfo
040904B0
CompanyName
Microsoft Corporation
FileDescription
Win32 Cabinet Self-Extractor
FileVersion
11.00.17763.1 (WinBuild.160101.0800)
InternalName
Wextract
LegalCopyright
Microsoft Corporation. All rights reserved.
OriginalFilename
WEXTRACT.EXE .MUI
ProductName
Internet Explorer
ProductVersion
11.00.17763.1
VarFileInfo
Translation