Static | ZeroBOX

PE Compile Time

2085-08-19 13:21:51

PDB Path

wextract.pdb

PE Imphash

4cea7ae85c87ddc7295d39ff9cda31d1

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x00007eb0 0x00008000 6.10999779688
.rdata 0x00009000 0x00002420 0x00003000 3.90650584012
.data 0x0000c000 0x00001f00 0x00001000 1.0384025678
.pdata 0x0000e000 0x00000444 0x00001000 1.46220237988
.rsrc 0x0000f000 0x0001f000 0x0001f000 6.80633805121
.reloc 0x0002e000 0x00000030 0x00001000 0.112822774835

Resources

Name Offset Size Language Sub-language File type
AVI 0x0000fb30 0x00002e1a LANG_ENGLISH SUBLANG_ENGLISH_US RIFF (little-endian) data, AVI, 272 x 60, 10.00 fps, video: RLE 8bpp
RT_ICON 0x000272d8 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x000272d8 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x000272d8 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x000272d8 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x000272d8 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x000272d8 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x000272d8 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x000272d8 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x000272d8 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x000272d8 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x000272d8 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x000272d8 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x000272d8 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_DIALOG 0x00028a68 0x0000010e LANG_PORTUGUESE SUBLANG_PORTUGUESE_BRAZILIAN data
RT_DIALOG 0x00028a68 0x0000010e LANG_PORTUGUESE SUBLANG_PORTUGUESE_BRAZILIAN data
RT_DIALOG 0x00028a68 0x0000010e LANG_PORTUGUESE SUBLANG_PORTUGUESE_BRAZILIAN data
RT_DIALOG 0x00028a68 0x0000010e LANG_PORTUGUESE SUBLANG_PORTUGUESE_BRAZILIAN data
RT_DIALOG 0x00028a68 0x0000010e LANG_PORTUGUESE SUBLANG_PORTUGUESE_BRAZILIAN data
RT_DIALOG 0x00028a68 0x0000010e LANG_PORTUGUESE SUBLANG_PORTUGUESE_BRAZILIAN data
RT_DIALOG 0x00028a68 0x0000010e LANG_PORTUGUESE SUBLANG_PORTUGUESE_BRAZILIAN data
RT_DIALOG 0x00028a68 0x0000010e LANG_PORTUGUESE SUBLANG_PORTUGUESE_BRAZILIAN data
RT_DIALOG 0x00028a68 0x0000010e LANG_PORTUGUESE SUBLANG_PORTUGUESE_BRAZILIAN data
RT_DIALOG 0x00028a68 0x0000010e LANG_PORTUGUESE SUBLANG_PORTUGUESE_BRAZILIAN data
RT_DIALOG 0x00028a68 0x0000010e LANG_PORTUGUESE SUBLANG_PORTUGUESE_BRAZILIAN data
RT_DIALOG 0x00028a68 0x0000010e LANG_PORTUGUESE SUBLANG_PORTUGUESE_BRAZILIAN data
RT_STRING 0x0002bb8c 0x000003b4 LANG_PORTUGUESE SUBLANG_PORTUGUESE_BRAZILIAN data
RT_STRING 0x0002bb8c 0x000003b4 LANG_PORTUGUESE SUBLANG_PORTUGUESE_BRAZILIAN data
RT_STRING 0x0002bb8c 0x000003b4 LANG_PORTUGUESE SUBLANG_PORTUGUESE_BRAZILIAN data
RT_STRING 0x0002bb8c 0x000003b4 LANG_PORTUGUESE SUBLANG_PORTUGUESE_BRAZILIAN data
RT_STRING 0x0002bb8c 0x000003b4 LANG_PORTUGUESE SUBLANG_PORTUGUESE_BRAZILIAN data
RT_STRING 0x0002bb8c 0x000003b4 LANG_PORTUGUESE SUBLANG_PORTUGUESE_BRAZILIAN data
RT_STRING 0x0002bb8c 0x000003b4 LANG_PORTUGUESE SUBLANG_PORTUGUESE_BRAZILIAN data
RT_STRING 0x0002bb8c 0x000003b4 LANG_PORTUGUESE SUBLANG_PORTUGUESE_BRAZILIAN data
RT_STRING 0x0002bb8c 0x000003b4 LANG_PORTUGUESE SUBLANG_PORTUGUESE_BRAZILIAN data
RT_STRING 0x0002bb8c 0x000003b4 LANG_PORTUGUESE SUBLANG_PORTUGUESE_BRAZILIAN data
RT_STRING 0x0002bb8c 0x000003b4 LANG_PORTUGUESE SUBLANG_PORTUGUESE_BRAZILIAN data
RT_STRING 0x0002bb8c 0x000003b4 LANG_PORTUGUESE SUBLANG_PORTUGUESE_BRAZILIAN data
RT_RCDATA 0x0002c2b4 0x00000007 LANG_ENGLISH SUBLANG_ENGLISH_US ASCII text, with no line terminators
RT_RCDATA 0x0002c2b4 0x00000007 LANG_ENGLISH SUBLANG_ENGLISH_US ASCII text, with no line terminators
RT_RCDATA 0x0002c2b4 0x00000007 LANG_ENGLISH SUBLANG_ENGLISH_US ASCII text, with no line terminators
RT_RCDATA 0x0002c2b4 0x00000007 LANG_ENGLISH SUBLANG_ENGLISH_US ASCII text, with no line terminators
RT_RCDATA 0x0002c2b4 0x00000007 LANG_ENGLISH SUBLANG_ENGLISH_US ASCII text, with no line terminators
RT_RCDATA 0x0002c2b4 0x00000007 LANG_ENGLISH SUBLANG_ENGLISH_US ASCII text, with no line terminators
RT_RCDATA 0x0002c2b4 0x00000007 LANG_ENGLISH SUBLANG_ENGLISH_US ASCII text, with no line terminators
RT_RCDATA 0x0002c2b4 0x00000007 LANG_ENGLISH SUBLANG_ENGLISH_US ASCII text, with no line terminators
RT_RCDATA 0x0002c2b4 0x00000007 LANG_ENGLISH SUBLANG_ENGLISH_US ASCII text, with no line terminators
RT_RCDATA 0x0002c2b4 0x00000007 LANG_ENGLISH SUBLANG_ENGLISH_US ASCII text, with no line terminators
RT_RCDATA 0x0002c2b4 0x00000007 LANG_ENGLISH SUBLANG_ENGLISH_US ASCII text, with no line terminators
RT_RCDATA 0x0002c2b4 0x00000007 LANG_ENGLISH SUBLANG_ENGLISH_US ASCII text, with no line terminators
RT_RCDATA 0x0002c2b4 0x00000007 LANG_ENGLISH SUBLANG_ENGLISH_US ASCII text, with no line terminators
RT_RCDATA 0x0002c2b4 0x00000007 LANG_ENGLISH SUBLANG_ENGLISH_US ASCII text, with no line terminators
RT_GROUP_ICON 0x0002c2bc 0x000000bc LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_VERSION 0x0002c780 0x00000444 LANG_PORTUGUESE SUBLANG_PORTUGUESE_BRAZILIAN data
RT_VERSION 0x0002c780 0x00000444 LANG_PORTUGUESE SUBLANG_PORTUGUESE_BRAZILIAN data
RT_MANIFEST 0x0002cbc4 0x000007e6 LANG_ENGLISH SUBLANG_ENGLISH_US XML 1.0 document, ASCII text, with CRLF line terminators

Imports

Library ADVAPI32.dll:
0x140009150 GetTokenInformation
0x140009158 RegDeleteValueA
0x140009160 RegOpenKeyExA
0x140009168 RegQueryInfoKeyA
0x140009170 FreeSid
0x140009178 OpenProcessToken
0x140009180 RegSetValueExA
0x140009188 RegCreateKeyExA
0x140009190 LookupPrivilegeValueA
0x140009198 AllocateAndInitializeSid
0x1400091a0 RegQueryValueExA
0x1400091a8 EqualSid
0x1400091b0 RegCloseKey
0x1400091b8 AdjustTokenPrivileges
Library KERNEL32.dll:
0x140009210 _lopen
0x140009218 _llseek
0x140009220 CompareStringA
0x140009228 GetLastError
0x140009230 GetFileAttributesA
0x140009238 GetSystemDirectoryA
0x140009240 LoadLibraryA
0x140009248 DeleteFileA
0x140009250 GlobalAlloc
0x140009258 GlobalFree
0x140009260 CloseHandle
0x140009270 IsDBCSLeadByte
0x140009278 GetWindowsDirectoryA
0x140009280 SetFileAttributesA
0x140009288 GetProcAddress
0x140009290 GlobalLock
0x140009298 LocalFree
0x1400092a0 RemoveDirectoryA
0x1400092a8 FreeLibrary
0x1400092b0 _lclose
0x1400092b8 CreateDirectoryA
0x1400092c0 GetPrivateProfileIntA
0x1400092c8 GetPrivateProfileStringA
0x1400092d0 GlobalUnlock
0x1400092d8 ReadFile
0x1400092e0 SizeofResource
0x1400092e8 WriteFile
0x1400092f0 GetDriveTypeA
0x1400092f8 LoadLibraryExA
0x140009300 SetFileTime
0x140009308 SetFilePointer
0x140009310 FindResourceA
0x140009318 CreateMutexA
0x140009320 GetVolumeInformationA
0x140009328 WaitForSingleObject
0x140009330 GetCurrentDirectoryA
0x140009338 FreeResource
0x140009340 GetVersion
0x140009348 SetCurrentDirectoryA
0x140009350 GetTempPathA
0x140009358 LocalFileTimeToFileTime
0x140009360 CreateFileA
0x140009368 SetEvent
0x140009370 TerminateThread
0x140009378 GetVersionExA
0x140009380 LockResource
0x140009388 GetSystemInfo
0x140009390 CreateThread
0x140009398 ResetEvent
0x1400093a0 LoadResource
0x1400093a8 ExitProcess
0x1400093b0 GetModuleHandleW
0x1400093b8 CreateProcessA
0x1400093c0 FormatMessageA
0x1400093c8 GetTempFileNameA
0x1400093d0 DosDateTimeToFileTime
0x1400093d8 CreateEventA
0x1400093e0 GetExitCodeProcess
0x1400093f0 LocalAlloc
0x1400093f8 lstrcmpA
0x140009400 FindNextFileA
0x140009408 GetCurrentProcess
0x140009410 FindFirstFileA
0x140009418 GetModuleFileNameA
0x140009420 GetShortPathNameA
0x140009428 Sleep
0x140009430 GetStartupInfoW
0x140009438 RtlCaptureContext
0x140009440 RtlLookupFunctionEntry
0x140009448 RtlVirtualUnwind
0x140009450 UnhandledExceptionFilter
0x140009460 TerminateProcess
0x140009468 QueryPerformanceCounter
0x140009470 GetCurrentProcessId
0x140009478 GetCurrentThreadId
0x140009480 GetSystemTimeAsFileTime
0x140009488 GetTickCount
0x140009490 EnumResourceLanguagesA
0x140009498 GetDiskFreeSpaceA
0x1400094a0 MulDiv
0x1400094a8 FindClose
Library GDI32.dll:
0x140009200 GetDeviceCaps
Library USER32.dll:
0x1400094b8 ShowWindow
0x1400094c8 SetWindowPos
0x1400094d0 GetDC
0x1400094d8 GetWindowRect
0x1400094e0 DispatchMessageA
0x1400094e8 GetSystemMetrics
0x1400094f0 CallWindowProcA
0x1400094f8 SetWindowTextA
0x140009500 MessageBoxA
0x140009508 SendDlgItemMessageA
0x140009510 SendMessageA
0x140009518 GetDlgItem
0x140009520 DialogBoxIndirectParamA
0x140009528 GetWindowLongPtrA
0x140009530 SetWindowLongPtrA
0x140009538 SetForegroundWindow
0x140009540 ReleaseDC
0x140009548 EnableWindow
0x140009550 CharNextA
0x140009558 LoadStringA
0x140009560 CharPrevA
0x140009568 EndDialog
0x140009570 MessageBeep
0x140009578 ExitWindowsEx
0x140009580 SetDlgItemTextA
0x140009588 CharUpperA
0x140009590 GetDesktopWindow
0x140009598 PeekMessageA
0x1400095a0 GetDlgItemTextA
Library msvcrt.dll:
0x1400095d0 ?terminate@@YAXXZ
0x1400095d8 _commode
0x1400095e0 _fmode
0x1400095e8 _acmdln
0x1400095f0 __C_specific_handler
0x1400095f8 memset
0x140009600 __setusermatherr
0x140009608 _ismbblead
0x140009610 _cexit
0x140009618 _exit
0x140009620 exit
0x140009628 __set_app_type
0x140009630 __getmainargs
0x140009638 _amsg_exit
0x140009640 _XcptFilter
0x140009648 memcpy_s
0x140009650 _vsnprintf
0x140009658 _initterm
0x140009660 memcpy
Library COMCTL32.dll:
0x1400091c8 None
Library Cabinet.dll:
0x1400091d8 None
0x1400091e0 None
0x1400091e8 None
0x1400091f0 None
Library VERSION.dll:
0x1400095b0 VerQueryValueA
0x1400095b8 GetFileVersionInfoSizeA
0x1400095c0 GetFileVersionInfoA

!This program cannot be run in DOS mode.
IkRichd
`.rdata
@.data
.pdata
@.rsrc
@.reloc
q0R^G'
p0R^G'
q0R^G'
u*9Q<|%
LcA<E3
H3E H3E
UAUAVH
H!|$0H
H!|$ E3
uY!D$(E3
UVWATAUAVAWH
t"D8!H
tlE8&tgL
A_A^A]A\_^]
USVWATAUAVAWH
HA_A^A]A\_^[]
@8+tjH
UVWATAVH
A^A\_^]
u#!D$(E3
L$ SVWH
u*!D$(E3
u4!D$(E3
WATAUAVAWH
A_A^A]A\_
UVWATAUAVAWH
pA_A^A]A\_^]
x UATAUAVAWH
HcD$0L
teA8t`3
A_A^A]A\]
u0!D$(E3
u=!D$(E3
u>!D$(E3
q0R^G'
!\$(E3
u !D$(E3
u !D$(E3
l$ VWAVH
` UAVAWH
u.!D$(E3
u9!D$(E3
l$ VWAVH
x UATAUAVAWH
A_A^A]A\]
uA!D$(E3
@USVWATAVAWH
A_A^A\_^[]
|$ UATAUAVAWH
<"u.A8F
<AtG<Dt:<It-<Nt <Pt
<Et<Gt
A_A^A]A\]
UATAUAVAWH
A_A^A]A\]
9D$Pu5
x AUAVAWH
@A_A^A]
q1[8''Y
8\u6H;
advapi32.dll
CheckTokenMembership
Reboot
AdvancedINF
Version
setupx.dll
setupapi.dll
SeShutdownPrivilege
advpack.dll
DelNodeRunDLL32
wininit.ini
Software\Microsoft\Windows\CurrentVersion\App Paths
HeapSetInformation
EXTRACTOPT
INSTANCECHECK
VERCHECK
DecryptFileA
LICENSE
<None>
REBOOT
SHOWWINDOW
ADMQCMD
USRQCMD
RUNPROGRAM
POSTRUNPROGRAM
FINISHMSG
LoadString() Error. Could not load string resource.
CABINET
FILESIZES
PACKINSTSPACE
UPROMPT
IXP%03d.TMP
msdownld.tmp
TMP4351$.TMP
RegServer
UPDFILE%lu
Control Panel\Desktop\ResourceLocale
wextract.pdb
.text$mn
.text$mn$00
.text$x
.rdata$brc
.idata$5
.00cfg
.CRT$XCA
.CRT$XCAA
.CRT$XCZ
.CRT$XIA
.CRT$XIAA
.CRT$XIY
.CRT$XIZ
.gehcont
.gfids
.rdata
.rdata$voltmd
.rdata$zzzdbg
.xdata
.idata$2
.idata$3
.idata$4
.idata$6
.pdata
.rsrc$01
.rsrc$02
GetTokenInformation
RegDeleteValueA
RegOpenKeyExA
RegQueryInfoKeyA
FreeSid
OpenProcessToken
RegSetValueExA
RegCreateKeyExA
LookupPrivilegeValueA
AllocateAndInitializeSid
RegQueryValueExA
EqualSid
RegCloseKey
AdjustTokenPrivileges
ADVAPI32.dll
GetShortPathNameA
GetModuleFileNameA
FindFirstFileA
GetCurrentProcess
FindNextFileA
ExpandEnvironmentStringsA
FindClose
LocalAlloc
lstrcmpA
_lopen
_llseek
CompareStringA
GetLastError
GetFileAttributesA
GetSystemDirectoryA
LoadLibraryA
DeleteFileA
GlobalAlloc
GlobalFree
CloseHandle
WritePrivateProfileStringA
IsDBCSLeadByte
GetWindowsDirectoryA
SetFileAttributesA
GetProcAddress
GlobalLock
LocalFree
RemoveDirectoryA
FreeLibrary
_lclose
CreateDirectoryA
GetPrivateProfileIntA
GetPrivateProfileStringA
GlobalUnlock
ReadFile
SizeofResource
WriteFile
GetDriveTypeA
LoadLibraryExA
SetFileTime
SetFilePointer
FindResourceA
CreateMutexA
GetVolumeInformationA
WaitForSingleObject
GetCurrentDirectoryA
FreeResource
GetVersion
SetCurrentDirectoryA
GetTempPathA
LocalFileTimeToFileTime
CreateFileA
SetEvent
TerminateThread
GetVersionExA
LockResource
GetSystemInfo
CreateThread
ResetEvent
LoadResource
ExitProcess
GetModuleHandleW
CreateProcessA
FormatMessageA
GetTempFileNameA
DosDateTimeToFileTime
CreateEventA
GetExitCodeProcess
KERNEL32.dll
GetDeviceCaps
GDI32.dll
GetDesktopWindow
CharUpperA
SetDlgItemTextA
ExitWindowsEx
MessageBeep
EndDialog
CharPrevA
LoadStringA
CharNextA
EnableWindow
ReleaseDC
SetForegroundWindow
SetWindowLongPtrA
GetWindowLongPtrA
PeekMessageA
GetDlgItem
SendMessageA
SendDlgItemMessageA
MessageBoxA
SetWindowTextA
CallWindowProcA
GetDlgItemTextA
DialogBoxIndirectParamA
ShowWindow
MsgWaitForMultipleObjects
SetWindowPos
GetWindowRect
DispatchMessageA
USER32.dll
_vsnprintf
memcpy_s
_XcptFilter
_amsg_exit
__getmainargs
__set_app_type
_cexit
_ismbblead
__setusermatherr
_initterm
__C_specific_handler
_acmdln
_fmode
_commode
msvcrt.dll
?terminate@@YAXXZ
COMCTL32.dll
Cabinet.dll
GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoA
VERSION.dll
GetStartupInfoW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
EnumResourceLanguagesA
GetDiskFreeSpaceA
MulDiv
GetSystemMetrics
memcpy
memset
System\CurrentControlSet\Control\Session Manager
rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"
Software\Microsoft\Windows\CurrentVersion\RunOnce
wextract_cleanup%d
rundll32.exe %s,InstallHinfSection %s 128 %s
PendingFileRenameOperations
DefaultInstall
Command.com /c %s
%s /D:%s
System\CurrentControlSet\Control\Session Manager\FileRenameOperations
SHELL32.DLL
DoInfInstall
SHBrowseForFolder
SHGetPathFromIDList
*MEMCAB
AVI LIST
hdrlavih8
strlstrh8
vidsRLE
LISTv$
movi00dc(
wgwwxx
wwwwwwp
wwwwwwp
\)((Bc
tZXXXj!
kXZt&'pp
\Xt'Qp
IhhI>In
IG>G>h
:>G>G>h
ICGIGn
:>>>H>r
eeRC>:y
RCIeeee
kII=GCR
>~32"*_h
nhII:h
h40.+Il
{{aFIdqx
WPMMMPPUW
WWWUWW
W***lf
****kf
PM/1NJ\
~dD>>CEwC9
8w>68~
~xxwwEwu~
ExxwwEEx
X)$DJF
}:75235:p~
"&&4(A?=
(@KM<"
Q999999999Q
GGGGGGGGGGG
wh:Mzn
{BPMS}
h0`0p@o6kll4
,m$I"=
[H)Yk6x
gF@m1%
(C!xg0
?Ed`n0
6_z0#;
Gx:=,F1
]h]e()I
ij8::f{{
iw;t:=
B/#5/s
xl}QO.
Gg}W_n
(Nhsp
$&Bu^C
VaL_d1PY
n`nT";
78><bp
RCYH($
Bj,*3E
t\gWh$
F'u@&:
GdYNRV
<g0>&o
ZpNbx!
nE&Lh/
PH7TJ)
Mx!]x1
9NZ|QA9
!#hG*I
VLon8:
4mp-LeQ
[|Y2
|Zg}UUK
Z-Y,fX
b3eSAy
R!Spss
dCJ5@K
GGGXky
aaV<^-
|bdA*0jq
@^@i-"
D,evd2
6X'e7U
@75MU:
cVUI)#j]
M{Zk}Hr-@
f?:88x#
W%y%)JMU
pINJJ<KP[Efk
Y%HRIZH
x4z]*EU
G`Zw-B)p
4K9=9e
T1R;D2]
j[3PC"$
2yT(t
A6@XAY
mma[W[
uUQ45MS#
L&V)eNNN
Y.s0)Q4a
'FtHc1
n@WXl3
TX@'IR
_>99y5I
)%u]Q
8I&DQF
QIDAT{
UUqttt
I\D <,
#)QQD"#
W6Z]#P\
LaFN"M
la:EOu#
c:gazz
?<tyt
gA`0)%UJ
9=D2'O
yyHaOO
P@@sRCCRCC
O??qYIIYVEECRBB
L==^\KKpYHHeUDD2SDD
J<<Q[IIaZIIfXGGKVFF1WII
J<<BYHHSYHHVXHHCXHH8SDD#RCC
H::2UEE:UDD9TEE)SCC"SED
SCC%RBB"QBB
]LLNQBB
aOOx[JJgSCC%QBB
\JJX[IIdZJJQUEE&QBB
ZII?XGGKXGG?TDD0SDD
SCC%QBB
ab`L4K*
ZZ[:443
WFFYO??
eee8AB@
[IIZYHHRVFF;RCC
jjj;FFD
[HH/RBBRBB
ggg=EED
FFF?@>?
[\\?>>=
]^^@JAC
^__AQFJ
cccCIHH
YYYEHGG
TTTI444
WWWILLL
<None>
APPBIT~1.BAT
x(Vu-b&
<None>
P<None>
<None>
cmd /c appbitcoin.bat
bitcoin3000
<None>
P<None>
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<!-- Copyright (c) Microsoft Corporation -->
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity version="5.1.0.0"
processorArchitecture="amd64"
name="wextract"
type="win32"/>
<description>IExpress extraction tool</description>
<dependency>
<dependentAssembly>
<assemblyIdentity
type="win32"
name="Microsoft.Windows.Common-Controls"
version="6.0.0.0"
processorArchitecture="amd64"
publicKeyToken="6595b64144ccf1df"
language="*"
/>
</dependentAssembly>
</dependency>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel
level="asInvoker"
uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
<compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">
<application>
<!--This Id value indicates the application supports Windows Vista/Server 2008 functionality -->
<supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>
<!--This Id value indicates the application supports Windows 7/Server 2008 R2 functionality-->
<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>
<!--This Id value indicates the application supports Windows 8/Server 2012 functionality-->
<supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>
<!-- This Id value indicates the application supports Windows Blue/Server 2012 R2 functionality-->
<supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/>
<!-- This Id value indicates the application supports Windows Threshold functionality-->
<supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/>
</application>
</compatibility>
</assembly>
PAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDI
Kernel32.dll
ADMQCMD
CABINET
EXTRACTOPT
FILESIZES
FINISHMSG
LICENSE
PACKINSTSPACE
POSTRUNPROGRAM
REBOOT
RUNPROGRAM
SHOWWINDOW
UPROMPT
USRQCMD
License
MS Shell Dlg
Please read the following license agreement. Press the PAGE DOWN key to see the rest of the agreement.
Do you accept all of the terms of the preceding License Agreement? If you choose No, Install will close. To install you must accept this agreement.
MS Shell Dlg
Leia o Contrato de Licen
a a seguir. Pressione a tecla PAGE DOWN para ver a continua
o do contrato.
aceita todos os termos do Contrato de Licen
a acima? Se escolher N
o, a instala
fechada. Para concluir a instala
o, voc
precisa aceitar o contrato.
Temporary folder
MS Shell Dlg
Please type the location where you want to place the extracted files.
&Browse...
Cancel
Pasta tempor
MS Shell Dlg
Digite o local em que deseja colocar os arquivos extra
&Procurar...
Cancelar
Overwrite file
MS Shell Dlg
Do you want to overwrite the file:
Yes To &All
Substituir arquivo
MS Shell Dlg
Deseja substituir o arquivo:
Sim para &todos
Extract
MS Shell Dlg
&Cancel
Extracting
Initializing... Please wait...
msctls_progress32
Generic1
SysAnimate32
Extrair
MS Shell Dlg
&Cancelar
Extraindo
Inicializando... Aguarde...
msctls_progress32
Generic1
SysAnimate32
Extract
MS Shell Dlg
&Cancel
Extracting
Initializing... Please wait...
Extrair
MS Shell Dlg
&Cancelar
Extraindo
Inicializando... Aguarde...
Warning
MS Shell Dlg
&Continue
Do you want to continue?
MS Shell Dlg
&Continuar
Deseja continuar?
4Please select a folder to store the extracted files.
9Selecione uma pasta para armazenar os arquivos extra
CFailed to get disk space information from: %s.
System Message: %s.&A required resource cannot be located. Are you sure you want to cancel?
8Unable to retrieve operating system version information.!Memory allocation request failed.
#Unable to create extraction thread.
Cabinet is not valid.
Filetable full.%Can not change to destination folder.
Setup could not find a drive with %s KB free disk space to install the program. Please free up some space first and press RETRY or press CANCEL to exit setup.KThat folder is invalid. Please make sure the folder exists and is writable.IYou must specify a folder with fully qualified pathname or choose Cancel.OFalha ao obter informa
es de espa
o em disco de: %s.
Mensagem do sistema: %s..Um recurso necess
o pode ser encontrado.#Tem certeza de que deseja cancelar?
vel recuperar as informa
es de vers
o do sistema operacional.'Falha do pedido de aloca
o de mem
vel criar thread de extra
+O arquivo de gabinete (.cab) n
Tabela de arquivos cheia.-N
vel mudar para a pasta de destino.
o foi poss
vel encontrar uma unidade com %s KB de espa
o livre em disco para instalar o programa. Libere espa
o e pressione 'Repetir' ou pressione 'Cancelar' para sair da instala
o.NPasta inv
lida. Certifique-se de que a pasta existe e de que permite grava
o.ZEspecifique uma pasta com um nome de caminho totalmente qualificado ou clique em Cancelar.
!Could not update folder edit box.5Could not load functions required for browser dialog.7Could not load Shell32.dll required for browser dialog.
(Error creating process <%s>. Reason: %s1The cluster size in this system is not supported.,A required resource appears to be corrupted.QWindows 95 or Windows NT 4.0 Beta 2 or greater is required for this installation.
Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install
Could not create folder '%s'
To install this program, you need %s KB disk space on drive %s. It is recommended that you free up the required disk space before you continue.
Do you still want to continue?
o foi poss
vel atualizar a caixa de edi
o da pasta.QN
o foi poss
vel carregar as fun
es necess
caixa de di
logo do navegador.RN
o foi poss
vel carregar Shell32.dll, necess
caixa de di
logo do navegador.
)Erro ao criar o processo <%s>. Causa: %s7N
suporte para o tamanho do cluster deste sistema..Um recurso necess
rio parece estar corrompido.IA instala
o requer o Windows 95 ou o Windows NT 4.0 beta 2 ou posterior.
Erro ao carregar %smFalha de GetProcAddress() na fun
o '%s'. Poss
vel causa: a vers
o incorreta de advpack.dll est
sendo usada.>O Windows 95 ou o Windows NT
necess
rio para esta instala
o foi poss
vel criar a pasta '%s'
Para instalar este programa, voc
precisa de %s KB de espa
o livre na unidade %s.
recomend
vel que voc
libere o espa
o em disco necess
rio antes de continuar.
Deseja continuar mesmo assim?
Error retrieving Windows folder
$NT Shutdown: OpenProcessToken error.)NT Shutdown: AdjustTokenPrivileges error.!NT Shutdown: ExitWindowsEx error.}Extracting file failed. It is most likely caused by low memory (low disk space for swapping file) or corrupted Cabinet file.aThe setup program could not retrieve the volume information for drive (%s) .
System message: %s.xSetup could not find a drive with %s KB free disk space to install the program. Please free up some space and try again.eThe installation program appears to be damaged or corrupted. Contact the vendor of this application.
$Erro ao recuperar a pasta do Windows
*Desligamento do NT: erro OpenProcessToken./Desligamento do NT: erro AdjustTokenPrivileges.'Desligamento do NT: erro ExitWindowsEx.
Falha ao extrair arquivo. Causa mais prov
vel: mem
ria insuficiente (espa
o em disco insuficiente para arquivo de permuta) ou arquivo de gabinete (.cab) corrompido._As informa
es de volume da unidade (%s) n
o puderam ser recuperadas.
Mensagem do sistema: %s.
o foi poss
vel encontrar uma unidade com %s KB de espa
o livre em disco para instalar o programa. Libere espa
o e tente novamente.pO programa de instala
o parece estar danificado ou corrompido. Entre em contato com o fornecedor do aplicativo.
;Command line option syntax error. Type Command /? for Help.
Command line options:
/Q -- Quiet modes for package,
/T:<full path> -- Specifies temporary working folder,
/C -- Extract files only to the folder when used also with /T.
/C:<Cmd> -- Override Install Command defined by author.
sYou must restart your computer before the new settings will take effect.
Do you want to restart your computer now?
eAnother copy of the '%s' package is already running on your system. Do you want to run another copy?
Could not find the file: %s.
SErro de sintaxe da op
o de linha de comando. Digite o comando /? para obter ajuda.
es de linha de comando:
/Q -- Modos silenciosos para o pacote,
/T:<caminho completo> -- Especifica a pasta de trabalho,
/C -- Extrai somente arquivos para a pasta quando usado tamb
m com /T.
/C:<comando> -- Substitui o comando de instala
o definido pelo autor.
necess
rio reiniciar o computador para que as novas configura
es tenham efeito.
Deseja reiniciar o computador agora?
_Uma outra c
pia do pacote '%s' j
sendo executada no sistema. Deseja executar outra c
pia?)N
o foi poss
vel encontrar o arquivo: %s.
You do not have administrator privileges on this machine. Some installations cannot be completed correctly unless they are run by an administrator.
:The folder '%s' does not exist. Do you want to create it?hAnother copy of the '%s' package is already running on your system. You can only run one copy at a time.OThe '%s' package is not compatible with the version of Windows you are running.SThe '%s' package is not compatible with the version of the file: %s on your system.
o possui privil
gios de administrador neste computador. Algumas instala
o conclu
das com
xito quando executadas por um administrador.
(A pasta '%s' n
o existe. Deseja cri
-la?sUma outra c
pia do pacote '%s' j
sendo executada no sistema. Apenas uma c
pia pode ser executada de cada vez.PO pacote '%s' n
compat
vel com a vers
o do Windows que est
sendo executada.FO pacote '%s' n
compat
vel com a vers
o do arquivo: %s do sistema.
VS_VERSION_INFO
StringFileInfo
040904B0
CompanyName
Microsoft Corporation
FileDescription
Win32 Cabinet Self-Extractor
FileVersion
11.00.22621.1 (WinBuild.160101.0800)
InternalName
Wextract
LegalCopyright
Microsoft Corporation. All rights reserved.
OriginalFilename
WEXTRACT.EXE .MUI
ProductName
Internet Explorer
ProductVersion
11.00.22621.1
VarFileInfo
Translation
VS_VERSION_INFO
StringFileInfo
041604B0
CompanyName
Microsoft Corporation
FileDescription
Autoextrator de arquivo de gabinete Win32
FileVersion
11.00.22621.4599 (WinBuild.160101.0800)
InternalName
Wextract
LegalCopyright
Microsoft Corporation. Todos os direitos reservados.
OriginalFilename
WEXTRACT.EXE .MUI
ProductName
Internet Explorer
ProductVersion
11.00.22621.4599
VarFileInfo
Translation
Antivirus Signature
Bkav W32.Common.112AC9F5
Lionic Trojan.Win32.ReverseShell.4!c
tehtris Clean
MicroWorld-eScan Trojan.Generic.37175218
Cylance Unsafe
Zillya Clean
CrowdStrike win/malicious_confidence_100% (W)
K7GW Trojan ( 00599bc41 )
K7AntiVirus Trojan ( 00599bc41 )
Baidu Clean
VirIT Clean
Symantec Trojan Horse
ESET-NOD32 PowerShell/ReverseShell.BD
APEX Malicious
Paloalto generic.ml
Cynet Malicious (score: 99)
Alibaba Backdoor:Script/ReverseShell.00d1c16f
NANO-Antivirus Trojan.Win64.PowerShell.kuannz
ViRobot Clean
Tencent Win32.Backdoor.Agent.Ctgl
F-Secure Exploit.EXP/YAV.Minerva.tcbde
VIPRE Trojan.Generic.37175218
TrendMicro Clean
McAfeeD ti!20A3DEC03B75
Trapmine Clean
huorong Clean
Jiangmin Clean
Webroot
Avira TR/ReverseShell.epnfc
Antiy-AVL Clean
Kingsoft Win32.Troj.Unknown.a
Gridinsoft Clean
Microsoft Trojan:Win32/Etset!rfn
SUPERAntiSpyware Clean
Google Detected
AhnLab-V3 Trojan/Win.SNH-gen.C5728081
Acronis Clean
TACHYON Clean
Malwarebytes Trojan.Dropper.WXT
Zoner Clean
TrendMicro-HouseCall Clean
Rising Backdoor.Agent/PS!1.FF8D (CLASSIC)
Yandex Clean
Ikarus Trojan.Script
MaxSecure Clean
DeepInstinct MALICIOUS
alibabacloud Spy:Win/TRSpy
No IRMA results available.