Static | ZeroBOX

PE Compile Time

1992-06-20 07:22:17

PE Imphash

9f4693fc0c511135129493f2161d1e86

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
CODE 0x00001000 0x0000722c 0x00007400 6.51167217489
DATA 0x00009000 0x00000218 0x00000400 3.15169834056
BSS 0x0000a000 0x0000a899 0x00000000 0.0
.idata 0x00015000 0x00000864 0x00000a00 4.17385976895
.tls 0x00016000 0x00000008 0x00000000 0.0
.rdata 0x00017000 0x00000018 0x00000200 0.206920017787
.reloc 0x00018000 0x000005cc 0x00000600 6.44309346589
.rsrc 0x00019000 0x00001400 0x00001400 2.76479857998

Resources

Name Offset Size Language Sub-language File type
RT_ICON 0x00019150 0x000010a8 LANG_RUSSIAN SUBLANG_RUSSIAN data
RT_RCDATA 0x0001a208 0x000000ac LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_RCDATA 0x0001a208 0x000000ac LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_GROUP_ICON 0x0001a2b4 0x00000014 LANG_RUSSIAN SUBLANG_RUSSIAN data

Imports

Library kernel32.dll:
0x4150ec VirtualFree
0x4150f0 VirtualAlloc
0x4150f4 LocalFree
0x4150f8 LocalAlloc
0x4150fc GetVersion
0x415100 GetCurrentThreadId
0x415104 GetThreadLocale
0x415108 GetStartupInfoA
0x41510c GetLocaleInfoA
0x415110 GetCommandLineA
0x415114 FreeLibrary
0x415118 ExitProcess
0x41511c WriteFile
0x415124 RtlUnwind
0x415128 RaiseException
0x41512c GetStdHandle
Library user32.dll:
0x415134 GetKeyboardType
0x415138 MessageBoxA
Library advapi32.dll:
0x415140 RegQueryValueExA
0x415144 RegOpenKeyExA
0x415148 RegCloseKey
Library oleaut32.dll:
0x415150 SysFreeString
0x415154 SysReAllocStringLen
Library kernel32.dll:
0x41515c TlsSetValue
0x415160 TlsGetValue
0x415164 LocalAlloc
0x415168 GetModuleHandleA
Library advapi32.dll:
0x415170 RegSetValueExA
0x415174 RegOpenKeyExA
0x415178 RegCloseKey
Library kernel32.dll:
0x415180 WriteFile
0x415184 WinExec
0x415188 SetFilePointer
0x41518c SetFileAttributesA
0x415190 SetEndOfFile
0x415198 ReleaseMutex
0x41519c ReadFile
0x4151a4 GetTempPathA
0x4151a8 GetShortPathNameA
0x4151ac GetModuleFileNameA
0x4151b4 GetLocalTime
0x4151b8 GetLastError
0x4151bc GetFileSize
0x4151c0 GetFileAttributesA
0x4151c4 GetDriveTypeA
0x4151c8 GetCommandLineA
0x4151cc FreeLibrary
0x4151d0 FindNextFileA
0x4151d4 FindFirstFileA
0x4151d8 FindClose
0x4151dc DeleteFileA
0x4151e0 CreateMutexA
0x4151e4 CreateFileA
0x4151e8 CreateDirectoryA
0x4151ec CloseHandle
Library gdi32.dll:
0x4151f4 StretchDIBits
0x4151f8 SetDIBits
0x4151fc SelectObject
0x415200 GetObjectA
0x415204 GetDIBits
0x415208 DeleteObject
0x41520c DeleteDC
0x415210 CreateSolidBrush
0x415214 CreateDIBSection
0x415218 CreateCompatibleDC
0x415220 BitBlt
Library user32.dll:
0x415228 ReleaseDC
0x41522c GetSysColor
0x415230 GetIconInfo
0x415234 GetDC
0x415238 FillRect
0x41523c DestroyIcon
0x415240 CopyImage
0x415244 CharLowerBuffA
Library shell32.dll:
0x41524c ShellExecuteA
0x415250 ExtractIconA

This program must be run under Win32
.idata
.rdata
P.reloc
P.rsrc
YZ]_^[
YZ]_^[
_^[YY]
YZ]_^[
~KxI[)
SOFTWARE\Borland\Delphi\RTL
FPUMaskValue
_^[YY]
HBITMAP
YXZQRPR
R;P P|
IVXLCDMT
_^[YY]
_^[YY]
XH;XH~
9PD}-RP
PH9PL~
KH+KLQ
;CHRQ~
RP;P ~
tSPRQj
_^[YY]
QQQQQS
\PROGRA~1\
QQQQQQSVW
_^[YY]
QQQQQQS3
QQQQQQ
QQQQQQSV
Runtime error at 00000000
0123456789ABCDEF
kernel32.dll
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
GetVersion
GetCurrentThreadId
GetThreadLocale
GetStartupInfoA
GetLocaleInfoA
GetCommandLineA
FreeLibrary
ExitProcess
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
user32.dll
GetKeyboardType
MessageBoxA
advapi32.dll
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
oleaut32.dll
SysFreeString
SysReAllocStringLen
kernel32.dll
TlsSetValue
TlsGetValue
LocalAlloc
GetModuleHandleA
advapi32.dll
RegSetValueExA
RegOpenKeyExA
RegCloseKey
kernel32.dll
WriteFile
WinExec
SetFilePointer
SetFileAttributesA
SetEndOfFile
SetCurrentDirectoryA
ReleaseMutex
ReadFile
GetWindowsDirectoryA
GetTempPathA
GetShortPathNameA
GetModuleFileNameA
GetLogicalDriveStringsA
GetLocalTime
GetLastError
GetFileSize
GetFileAttributesA
GetDriveTypeA
GetCommandLineA
FreeLibrary
FindNextFileA
FindFirstFileA
FindClose
DeleteFileA
CreateMutexA
CreateFileA
CreateDirectoryA
CloseHandle
gdi32.dll
StretchDIBits
SetDIBits
SelectObject
GetObjectA
GetDIBits
DeleteObject
DeleteDC
CreateSolidBrush
CreateDIBSection
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
user32.dll
ReleaseDC
GetSysColor
GetIconInfo
FillRect
DestroyIcon
CopyImage
CharLowerBuffA
shell32.dll
ShellExecuteA
ExtractIconA
0"0*020:0B0J0R0Z0b0j0r0z0
4-595T5
8&8,848F8R8a8m8u8
9/9:9[9s9
<'<0<;<D<K<Z<a<
?2?\?e?u?}?
0(0@0L0T0k0z0
0,1P1n1~1
2$2u2|2
4#4+4O4o4
8A8Q8g8
9*929H9`9n9
9+:X:a:
< =T=\=g=
>N>R>X>\>a>h>n>v>
?%?/?7?=?K?f?{?
N0W0}0
466?6:7C7
<)<2<><E<
=/=;=B=L=V=m=~=
>/>@>J>R>Z>b>j>
?&?+?0?7?>?H?_?k?x?
0:0B0J0R0Z0b0j0r0z0
1"1*121:1B1J1R1Z1b1j1r1z1
2#202B2J2R2_2k2x2
3 323?3K3X3j3w3
4$4(4,484<4@4L4P4T4`4d4h4t4x4|4
9,;:;A;H;c;o;
:(;=;c;
=*=:=Z=
9_9d9w9
:.:E:c:z:
030F0X0\0`0d0h0l0p0t0x0|0
1%191M1a1
004080
1 1$1(1
Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus.
! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
33333330
{{{{{{{3
{{{{{{{33
{{{{{{{330
{{{{{{{330
{{{{{{{330
3333333
33333333
wwwwwwwwwww
DDDDDD@
DDDDDDGpw
DDDDDDGpw
DDDDDDDDDDD
wwwwwwwwwww
PA"dxwsetup.exe" /windowsupdate
PAMSCF
dsetup.dll
dsetup32.dll
dxwsetup.exe
dxwsetup.cif
dxwsetup.inf
nFp2-r3
4j9<{Ps(
O[mzZ!u
9j]p?>%
3Q-j7;
u>E_K.
mb[5|:
;&Uk;#
c8$00e3
Xx-%@^
&@70lk
;gc-OTl
l_F9p(
m85g7c
CqV'@H
5"0924
rxS/~5w
A)(P`V
}i1bRp
/R~Awe
*p<~L^"
ja[0Bl<
ErWT:<
\!#?5W
zCGP{uF
>u)":
DUR ]J
kmEV8WV
Qm)Q48
hQl1:2
jNMf53
$M=FoRB
;m2Dg{F
DN/o{iN
3%~V9Ncj
Y9*fQw.
rRlx\>;
bj]DbEaUb
/,`+S
r{kA|W
BJ'JVj
0jU%m{
uL#gJ!F
@Y]T&|
@CZ^lg
"Ds7?fB
&)wYS*
gdg[V4
5yK`g0/
$%BfMf
!/cksvDGa
Zu5~X'
h]MD<M
U_A9A\3
'` z$~
:QA:/[
xpDGvS
)-]}o3"
RVpZz%{ly
xLc;D#(
R\O!2Q
K'o0|n
4O<oLiL
K9|Tq5
k-M~U9
p%qWBl
s>sVrj
?Q?^?m?v
[P\P]PM
CKC(C5B:
z<{P{~{
'=(=0=9=
.A[W}[
,>BLsUs=
2SHs0r1
yDG"oF
+RVSC+
)tA)tC
KN98+
]R]8MQ
DiV*~NI9
)cM=#w
rlory"
e01)U<kmbSW_
Z}s7}K
<qa.kN?
rijZ8G
<elxma3
<uK"|m8
m|b' Ch
0H5AZ{5t
O{0cX<*3zo:
"h >LB%
aj|Ya}>
uuGhmtU,
'>lH1z
g<:RY'
cYQOXc{
tWh`IMSIUp
1%pM[m
Yv9=B
&E$~S&
B2B`F4
%r[#$oKv
u{&6sP
{2vuxM
-=iuokl
Yv$RNc
Q~H JG
@_'i#q(
~QqP8Kt
<S(9a5
eC?L7C
K8d-{J
E(FOBBD
\pU[":Hx <
Fo/gC9'
\Bs&aw
d0f%~(dJ-
R[3KObG
$D7*uWk
}*>1V#
hWf?5!zXs
dPkYR>
4~aX?
^{In'1F
4$d5hN
^<?l>8
CX\I#
0!eN|K
j<c3'g
Z'"_.Y<
H"cB*jRB
'%$)_E
ag +-+
badMD)
Ebazx>
&IhZ;L
&uxdF^
/:_2%^d
.-l=)1
+V2VD[>
,ng+[=
SKc0o:M
~*Jg|fA
ZhJAi{
6Rb7LN
_)LOM-
^77*!Zt
/zJr/X.q
J>~\*d
%Vj5K
LT OA0
I;qjye2
0{P[j
ZY%l0M
z6&9^[
LTp9eP
}d#m7(
JK1?B6
fC2Ih:
{tZeuT)
cW0N:
FT;O?9
%A{Oan
xXDRIJb3
DjAQ%lT
7.^N}Jd:
){G<v`
'6i5?.\
ZX+rHl
)Wv.OD
,/G<0R7Qj
[LZj~.T
WDF<2X
&I$Pe)o
]qWjzS<
I Oln}
991=Uf
?wz[5tli
z8!r(X
Z%>`<Zx
?_@aA>j
tOoe[ ,
e);L%$
eaW=T|w
Nh5`}!
/w8U*^
O}Uz#d
VA1/BXS9
D4+-oQ
|!],)S
Z/gpv[
oho[Xm^
<Q=8(W
l\B0g:
TGcX$g{
R3jtt@
5sv)@{
D+07u/
0}p}Ue
Wg0?%5
~:kHq;_
}rA;~P
cd|U^YE
&}>tj4
S*IS2M
ri~os)S
MSGYiz
xNUi9CKC
mBSaE["
>?R&>a
ft5G:g~
2A3,j|
x}"T|1M
3q2^H.
4jNNp,
xp\nWN{
QnKF-\f
Erdn::n
5"W3FCV
67k{mzT
Dat!i6
_@<y-"
z&bBYUF
{59F}!s
YOrOzs
Qj4hI@
u0X/>N
;CeF^b
]G/Ebk
(dltml
bC0/7K
kS1)M<
Z>^I(s
:?=^-$J
4z9A?N\w
xxX)urKdz?
HUu#UTDVe
Sfh]s
S4~oS8
Q35QP|!A^Er7
IKz,`igi)!
7Vj(q=
}!zMp'f
YFfuE(
,^Kn`
,rE6b)@
|{Vii4
-Bt/S'
i05hfR
SaEswc
mlnES[
hrxCSF/
4/=Rmhm
lP`:Yi
++V,<t
#|")C+
(i-o=MM
f[xd}M
'{PenL
W\FK(,
"QXEU(
JJpJRRzS
he>~U>X
K9>nyW
UA@Ewu
;X@"bD
NZ^{k8
"x{Exn
\MWMdW:
(sP5@
Ts[MR-
kL",2
cr?t_5[
oLLq4b
-=w7ws
sh3z~}
0p|6Xw
S+Iy#An;
a}LD_J
DNR~cM
99Pov*
RfuTwgD|n
B06cC8
\E0zFs|cA
.JQ|m;
x:n0E^
Qmt]?Fy
vgtr?r
X)_K&'s
AX$33j
?)5$lM
nir^YX
USps3K
y+"VK
;^$?OHr
@cpiIY
4TV)o%Yk
[**cDY
?rG/oy
68 Y=$y
d17=pz
/AmH_P
427]f2
K?RC[9
~O[e$xn
#H.!afU
??&vz*
2+N8o
?+oX\)
yzH}Z'J
e#cZ /
1KhYL`.
,PI_ca"
.tV?!yJ|y4
lMCiU]-
:#C.G$
s5`iX!'
RJ!Zh
dpG)A2
rMR%@zD
dJv\a>
n[(+m2
^#/S-"
Upo?t<
3vU{iE
I'Hh\AKO
UhH3E!}N
(rQ;{$*
PjfVik
V^=kI)
C`kC3/#q[.
:-tJ'@
qHxh@?i
fXF|n^3
CvFq3)
)uaY:G
C+2;@#
z f~bi>
}Z.XWH
xjlQ{
uHu~zEY@/
[[iVvJ)
N4A13uYExC$
G]\GT3>.{
^1GJ,5?B<2
.FMGPh
$)qkFY
7q+sa&
T="(P_E
UV]vKl
)Ql![0
qB 4BO
V?} D5
_P%ufl{
fg.]Ip
L _zIH
I>E*{T(J
_]z<bQ
Z|U'kj
lN#C;*
XHF~'.h
b,1=Dp
C%;%cY
1)U)L13$j
/jN[/)
h#&.jV
"$fk`Zn
E`oLYgx
]'T~o _o
[8X}Dup&
bN!P'z
gN@+tv
j`"E15
@,EIS0-l+
V\Fh8'p
{T,r9c
nlP,@-
JAWrx!H
O1W8b6
-@31LzC
qPPjx/;
y!kB;9
x(R.#z
(O0G:F
R>neGm
Q)&s;)/
!<d4u_
CuV~e]
R76d,o
~FUe@J
)3Zl%P
0sv&gF
':'>'N&b.z.
m5mAmMmUm
M$]d]`^
_Poq_P<m
+8)DKQ
=gRp@q
]MegE}
]U/AS$
#N#X#ZN]
*^Uhdf
]fEk/o/r/
;aN7R7e4
7\rhh~
h#X#&f
rp*?vS
WCdkQs
|{qY9Y
=,8]rM
#}v+]N
0Zg!Q6
=LE4LI
yE"m&CY?u
<None>
P<None>
<none>
"dxwsetup.exe"
DirectX 9.0 Web setup
PA<None>
P"dxwsetup.exe" /windowsupdate
PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPAD
Washington1
Redmond1
Microsoft Corporation1(0&
Microsoft Code Signing PCA 20110
200304183947Z
210303183947Z0t1
Washington1
Redmond1
Microsoft Corporation1
Microsoft Corporation0
E0C1)0'
Microsoft Operations Puerto Rico1
230012+4583850
Chttp://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl0a
Ehttp://www.microsoft.com/pkiops/certs/MicCodSigPCA2011_2011-07-08.crt0
"oRTg
Washington1
Redmond1
Microsoft Corporation1200
)Microsoft Root Certificate Authority 20110
110708205909Z
260708210909Z0~1
Washington1
Redmond1
Microsoft Corporation1(0&
Microsoft Code Signing PCA 20110
Ihttp://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl0^
Bhttp://www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt0
3http://www.microsoft.com/pkiops/docs/primarycps.htm0@
*?*kXIc
QEX82q'
WqVNHE
Washington1
Redmond1
Microsoft Corporation1(0&
Microsoft Code Signing PCA 2011
(https://devblogs.microsoft.com/directx/ 0
6DA{!m?
20210217210101.86Z0
Washington1
Redmond1
Microsoft Corporation1%0#
Microsoft America Operations1&0$
Thales TSS ESN:2264-E33E-780C1%0#
Microsoft Time-Stamp Service
Washington1
Redmond1
Microsoft Corporation1&0$
Microsoft Time-Stamp PCA 20100
201112182558Z
220211182558Z0
Washington1
Redmond1
Microsoft Corporation1%0#
Microsoft America Operations1&0$
Thales TSS ESN:2264-E33E-780C1%0#
Microsoft Time-Stamp Service0
Ehttp://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0Z
>http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0
<Wr>}Z
jr55 ;t
Washington1
Redmond1
Microsoft Corporation1200
)Microsoft Root Certificate Authority 20100
100701213655Z
250701214655Z0|1
Washington1
Redmond1
Microsoft Corporation1&0$
Microsoft Time-Stamp PCA 20100
$`2X`F
Ehttp://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z
>http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
1http://www.microsoft.com/PKI/docs/CPS/default.htm0@
oK0D$"<
r~akow
Washington1
Redmond1
Microsoft Corporation1%0#
Microsoft America Operations1&0$
Thales TSS ESN:2264-E33E-780C1%0#
Microsoft Time-Stamp Service
Washington1
Redmond1
Microsoft Corporation1&0$
Microsoft Time-Stamp PCA 20100
20210218034108Z
20210219034108Z0w0=
Washington1
Redmond1
Microsoft Corporation1&0$
Microsoft Time-Stamp PCA 2010
Washington1
Redmond1
Microsoft Corporation1&0$
Microsoft Time-Stamp PCA 2010
(Fs(Q8q
xkf+^R
CheckTokenMembership
advapi32.dll
SeShutdownPrivilege
DelNodeRunDLL32
advpack.dll
wininit.ini
Software\Microsoft\Windows\CurrentVersion\App Paths
setupapi.dll
setupx.dll
Version
AdvancedINF
Reboot
UPDFILE%lu
CABINET
IXP%03d.TMP
RegServer
LoadString() Error. Could not load string resource.
PACKINSTSPACE
FILESIZES
<None>
UPROMPT
TMP4351$.TMP
LICENSE
FINISHMSG
VERCHECK
INSTANCECHECK
EXTRACTOPT
POSTRUNPROGRAM
RUNPROGRAM
USRQCMD
ADMQCMD
SHOWWINDOW
REBOOT
msdownld.tmp
Control Panel\Desktop\ResourceLocale
wextract.pdb
PSSSSSSh
PSSSSSSh
Pj@PhQ
u'VVVV
PVVVVVV
t6SWWW
EtHHt
t8SShs7
VVj VVV
Uj@UVh
4SVWh<
j SVh$
j WVhJ
G9}lu@h
YYt79^(t@
G9V(tU
tBHt-Ht Ht
HtiHt<Ht
oWWWW3
F WWWWWW
HteHt3H
tBHt-Ht Ht
HtrHtJHt
YYuhSj
G"f;Fjr
9LDICt
8LDICt
>LDICt
t19uHu%
ET@;El
FreeSid
AllocateAndInitializeSid
EqualSid
GetTokenInformation
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueA
RegCloseKey
RegDeleteValueA
RegOpenKeyExA
RegSetValueExA
RegQueryValueExA
RegCreateKeyExA
RegQueryInfoKeyA
ADVAPI32.dll
FreeLibrary
GetProcAddress
LoadLibraryA
CloseHandle
LocalFree
LocalAlloc
GetLastError
GetCurrentProcess
GetModuleFileNameA
lstrlenA
GetSystemDirectoryA
RemoveDirectoryA
FindClose
FindNextFileA
DeleteFileA
SetFileAttributesA
lstrcmpA
FindFirstFileA
lstrcatA
lstrcpyA
_lclose
_llseek
_lopen
WritePrivateProfileStringA
GetWindowsDirectoryA
CreateDirectoryA
GetFileAttributesA
ExpandEnvironmentStringsA
IsDBCSLeadByte
GetShortPathNameA
GetPrivateProfileStringA
GetPrivateProfileIntA
lstrcmpiA
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
FreeResource
LockResource
LoadResource
SizeofResource
FindResourceA
ReadFile
WriteFile
SetFilePointer
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
SetCurrentDirectoryA
GetTempFileNameA
ExitProcess
CreateFileA
LoadLibraryExA
lstrcpynA
GetVolumeInformationA
FormatMessageA
GetCurrentDirectoryA
GetVersionExA
GetExitCodeProcess
WaitForSingleObject
CreateProcessA
GetTempPathA
GetSystemInfo
CreateMutexA
SetEvent
CreateEventA
CreateThread
ResetEvent
TerminateThread
GetDriveTypeA
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
KERNEL32.dll
GetDeviceCaps
GDI32.dll
MessageBeep
SetDlgItemTextA
LoadStringA
GetDesktopWindow
EndDialog
ExitWindowsEx
wsprintfA
CharNextA
CharUpperA
CharPrevA
SetWindowLongA
GetWindowLongA
CallWindowProcA
DispatchMessageA
MsgWaitForMultipleObjects
PeekMessageA
SendMessageA
SetWindowPos
ReleaseDC
GetWindowRect
SendDlgItemMessageA
GetDlgItem
SetForegroundWindow
SetWindowTextA
MessageBoxA
DialogBoxIndirectParamA
ShowWindow
EnableWindow
GetDlgItemTextA
USER32.dll
COMCTL32.dll
VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA
VERSION.dll
EnumResourceLanguagesA
MulDiv
GetDiskFreeSpaceA
GetSystemMetrics
WEXTRACT
*MEMCAB
rundll32.exe %s,InstallHinfSection %s 128 %s
SHELL32.DLL
SHGetSpecialFolderLocation
SHBrowseForFolder
SHGetPathFromIDList
DefaultInstall
DefaultInstall
DoInfInstall
Software\Microsoft\Windows\CurrentVersion\RunOnce
System\CurrentControlSet\Control\Session Manager
PendingFileRenameOperations
System\CurrentControlSet\Control\Session Manager\FileRenameOperations
wextract_cleanup%d
%s /D:%s
rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"
Command.com /c %s
WEXTRACT
*MEMCAB
rundll32.exe %s,InstallHinfSection %s 128 %s
SHELL32.DLL
SHGetSpecialFolderLocation
SHBrowseForFolder
SHGetPathFromIDList
DefaultInstall
DefaultInstall
DoInfInstall
AVI LIST
hdrlavih8
strlstrh8
vidsRLE
LISTv$
movi00dc(
DVCLAL
PACKAGEINFO
MAINICON(
License
MS Shell Dlg
Please read the following license agreement. Press the PAGE DOWN key to see the rest of the agreement.
Do you accept all of the terms of the preceding License Agreement? If you choose No, Install will close. To install you must accept this agreement.
Temporary folder
MS Shell Dlg
Please type the location where you want to place the extracted files.
&Browse...
Cancel
Overwrite file
MS Shell Dlg
Do you want to overwrite the file:
Yes To &All
Extract
MS Shell Dlg
&Cancel
Extracting
Initializing... Please wait...
msctls_progress32
Generic1
SysAnimate32
Extract
MS Shell Dlg
&Cancel
Extracting
Initializing... Please wait...
Warning
MS Shell Dlg
&Continue
Do you want to continue?
4Please select a folder to store the extracted files.
CFailed to get disk space information from: %s.
System Message: %s.&A required resource cannot be located. Are you sure you want to cancel?
8Unable to retrieve operating system version information.!Memory allocation request failed.
#Unable to create extraction thread.
Cabinet is not valid.
Filetable full.%Can not change to destination folder.
Setup could not find a drive with %s KB free disk space to install the program. Please free up some space first and press RETRY or press CANCEL to exit setup.KThat folder is invalid. Please make sure the folder exists and is writable.IYou must specify a folder with fully qualified pathname or choose Cancel.!Could not update folder edit box.5Could not load functions required for browser dialog.7Could not load Shell32.dll required for browser dialog.
(Error creating process <%s>. Reason: %s1The cluster size in this system is not supported.,A required resource appears to be corrupted.QWindows 95 or Windows NT 4.0 Beta 2 or greater is required for this installation.
Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install
Could not create folder '%s'
To install this program, you need %s KB disk space on drive %s. It is recommended that you free up the required disk space before you continue.
Do you still want to continue?
Error retrieving Windows folder
$NT Shutdown: OpenProcessToken error.)NT Shutdown: AdjustTokenPrivileges error.!NT Shutdown: ExitWindowsEx error.}Extracting file failed. It is most likely caused by low memory (low disk space for swapping file) or corrupted Cabinet file.aThe setup program could not retrieve the volume information for drive (%s) .
System message: %s.xSetup could not find a drive with %s KB free disk space to install the program. Please free up some space and try again.eThe installation program appears to be damaged or corrupted. Contact the vendor of this application.
;Command line option syntax error. Type Command /? for Help.
Command line options:
/Q -- Quiet modes for package,
/T:<full path> -- Specifies temporary working folder,
/C -- Extract files only to the folder when used also with /T.
/C:<Cmd> -- Override Install Command defined by author.
sYou must restart your computer before the new settings will take effect.
Do you want to restart your computer now?
eAnother copy of the '%s' package is already running on your system. Do you want to run another copy?
Could not find the file: %s.
You do not have administrator privileges on this machine. Some installations cannot be completed correctly unless they are run by an administrator.
:The folder '%s' does not exist. Do you want to create it?hAnother copy of the '%s' package is already running on your system. You can only run one copy at a time.OThe '%s' package is not compatible with the version of Windows you are running.SThe '%s' package is not compatible with the version of the file: %s on your system.
VS_VERSION_INFO
StringFileInfo
040904B0
CompanyName
Microsoft Corporation
FileDescription
DirectX 9.0 Web setup
FileVersion
9.29.1974.0
InternalName
DXWebSetup
LegalCopyright
Copyright (c) Microsoft Corporation. All rights reserved.
OriginalFilename
dxwebsetup.exe
ProductName
Microsoft
Windows
Operating System
ProductVersion
9.29.1974.0
VarFileInfo
Translation
Legal_policy_statement
"Microsoft Direct
Legal_Policy_Statement
ADMQCMD
CABINET
EXTRACTOPT
FILESIZES
FINISHMSG
LICENSE
PACKINSTSPACE
POSTRUNPROGRAM
REBOOT
RUNPROGRAM
SHOWWINDOW
UPROMPT
USRQCMD
Antivirus Signature
Bkav W32.NeshtaB.PE
Lionic Virus.Win32.Neshta.n!c
Elastic Windows.Virus.Neshta
ClamAV Win.Trojan.Neshuta-1
CMC Clean
CAT-QuickHeal W32.Neshta.C8
Skyhigh BehavesLike.Win32.HLLP.fc
ALYac Gen:Variant.Ransom.Venus.15
Cylance Unsafe
Zillya Virus.Neshta.Win32.1
CrowdStrike win/malicious_confidence_100% (W)
Alibaba Virus:Win32/Neshta.3bb
K7GW Virus ( 00556e571 )
K7AntiVirus Virus ( 00556e571 )
Baidu Win32.Virus.Neshta.a
VirIT Win32.Delf.FE
Paloalto generic.ml
Symantec W32.Neshuta
tehtris Clean
ESET-NOD32 Win32/Neshta.A
APEX Malicious
Avast Win32:Apanas [Trj]
Cynet Malicious (score: 100)
Kaspersky Virus.Win32.Neshta.a
BitDefender Gen:Variant.Ransom.Venus.15
NANO-Antivirus Trojan.Win32.Winlock.fmobyw
ViRobot Win32.Neshta.Gen.A
MicroWorld-eScan Gen:Variant.Ransom.Venus.15
Tencent Virus.Win32.Neshta.a
Sophos W32/Neshta-D
F-Secure Malware.W32/Neshta.A
DrWeb Win32.HLLP.Neshta
VIPRE Gen:Variant.Ransom.Venus.15
TrendMicro PE_NESHTA.A
McAfeeD Real Protect-LS!2CCA96957071
Trapmine malicious.high.ml.score
CTX exe.ransomware.venus
Emsisoft Gen:Variant.Ransom.Venus.15 (B)
huorong Virus/Neshta.c
FireEye Generic.mg.2cca969570717a0a
Jiangmin Virus.Neshta.a
Webroot Clean
Varist W32/Neshta.OBIX-2981
Avira W32/Neshta.A
Fortinet W32/Generic.AC.171!tr
Antiy-AVL Virus/Win32.Neshta.a
Kingsoft Win32.Neshta.nl.30720
Gridinsoft Virus.Neshta.A.sd!yf
Xcitium Win32.Neshta.A@3ypg
Arcabit Trojan.Ransom.Venus.15
SUPERAntiSpyware Clean
ZoneAlarm Virus.Win32.Neshta.a
Microsoft Virus:Win32/Neshta.A
Google Detected
AhnLab-V3 Win32/Neshta.Gen
Acronis Clean
McAfee W32/HLLP.41472.e
TACHYON Virus/W32.Neshta
VBA32 Virus.Win32.Neshta.a
Malwarebytes Generic.Malware.AI.DDS
Panda W32/Neshta.A
Zoner Virus.Win32.19514
TrendMicro-HouseCall PE_NESHTA.A
Rising Virus.Neshta!1.EFA5 (CLASSIC)
Yandex Trojan.GenAsa!Mo0tdcmmg3o
Ikarus Virus.Win32.Renamer
MaxSecure Virus.Infector.Gen9
GData Win32.Virus.Neshta.D
AVG Win32:Apanas [Trj]
DeepInstinct MALICIOUS
alibabacloud Virus:Win/Neshta.B
No IRMA results available.