filenameB8E76061F54304B43D42C4F892A657FB
size5697536 (0x56f000)
md5b8e76061f54304b43d42c4f892a657fb
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x100

Rich Header

lib idversiontimes used
1255072717
1095072795
9540351
10193
93403511
1105072736
122507271
124507271
002
120507271

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0x46a4e59a
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x103
Magic0x10b
LinkerVersion8.0
SizeOfCode0xf000
SizeOfInitializedData0xf000
SizeOfUninitializedData0
AddressOfEntryPoint0x7eb8
BaseOfCode0x1000
BaseOfData0x10000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x1000
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x574000
SizeOfHeaders0x1000
CheckSum0
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x7d00
SizeOfStackCommit0x1000
SizeOfHeapReserve0x7d00
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

namevavsizeraw sizeflags
.text0x10000xe6d80xf000R-X CODE
.rdata0x100000x29f20x3000R-- IDATA
.data0x130000x62e40x2000RW- IDATA
.rsrc0x1a0000x97800xa000R-- IDATA
_winzip_0x240000x5500000x550000R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x129c00x32
IMPORT0x11a740x78
RESOURCE0x1a0000x50d8
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x116580x40
Bound_IAT00
IAT0x100000x2d8
Delay_IAT00
CLR_Header00
typenamesizecp
WZ_MANIFESTADMIN_MANIFEST9891252
ICON#137521252
ICON#222161252
ICON#313841252
DIALOG#1002901252
DIALOG#4004021252
STRING#637641252
STRING#6414961252
STRING#6523821252
STRING#6623221252
STRING#6712781252
STRING#12613041252
STRING#1271101252
GROUP_ICON#1621252
MANIFEST#19891252
idlangstring
10001033This is an incomplete self-extractor; please re-create the file and try again.
10011033Please insert disk %d in drive %s.
10021033Please insert last disk of set in drive %s.
10031033No disk or invalid disk in drive. Please insert disk number %d.
10041033The disk in the drive appears to be missing or has an incorrect label. Insert disk number %d.
10051033No password specified
10061033Incorrect password specified
10071033NOAUTO
10081033Setup
10091033WAIT
10101033&Done
10111033Are you sure that the SETUP program has completed? Click Yes to exit, or No to continue waiting.
10121033If you Cancel now, temporary files will not be deleted. Are you sure you want to Cancel now?
10131033AUTO
10141033This 32-bit self-extracting Zip file requires Windows 95, 98, NT, 2000 or XP.
10151033Unable to create a temporary folder to extract to. Possible Cause: you do not have proper permissions to create files or folders in your temporary folder. See your system or network administrator.
10161033Could not run %s.
10171033%s is still running; if you cancel now, temporary files will not be deleted. Cancel anyway?
10181033Error, no command has been defined.
10191033Deleting temporary files
10211033Abort unzip operation?
10221033File %s is in use by the system. Skipping ...
10231033Unzip Aborted
10241033Error %d running command %s
10251033Error changing to "Unzip To" folder
10261033File %s already exists. Overwrite file?
10271033No folder specified.
10281033\TEMP
10291033This file is intended for use under Windows 95, 98, NT, 2000, XP or a system with compatible long filename support. On the version of Windows you are currently running, any long filenames will probably be truncated and improper operation may result. Continue anyway?
10301033TEMP=
10311033%d file(s) unzipped successfully
10321033To unzip all files in %s to the specified folder press the Unzip button.
10331033WinZip
10341033extensions
10351033When &done unzipping run:
10361033When &done unzipping open:
10371033This copy of WinZip Self-Extractor is NOT LICENSED for distribution. Any distribution of this file is prohibited and is a violation of US Copyright law and international treaty. The registered version does not display this message.
10381033WinZip not found on your system. WinZip is an award-winning Windows archive utility that brings the convenience of Windows to the use of Zip files. WinZip features built-in ZIP and UNZIP and an easy to use drag-and-drop interface. Fully functional evaluation versions of WinZip are available from the WinZip web site: http://www.winzip.com
10391033Can't create output file: %s
10401033Unsupported compression method
10411033ZIP damaged: file %s: Bad CRC. Possible cause: file transfer error.
10421033Invalid ZIP header. Possible cause: file transfer error.
10431033Could not create "%s" - unzip operation cancelled.
10441033Error in folder name specified on the command line.
10451033Unzipping %s
10461033Error writing to %s. Possible cause: disk full.
10471033Error reading %s. Possible cause: bad disk or file transfer error.
10481033I/O error on file. Possible cause: file transfer error.
10491033To unzip all files in %s press the "Unzip" button. Files will be unzipped to the folder specified in the "Unzip To Folder" field. This folder will be created if it does not exist. You can also unzip this file with a standard zip utility like WinZip.
10501033Zip file is damaged, truncated, or has been changed since it was created. If you downloaded this file, try downloading again.
10511033%s %s
10521033Licensed to %s
10531033NOT LICENSED FOR DISTRIBUTION OF ANY KIND
10541033WinZip® Self-Extractor © WinZip International LLC http://www.winzip.com
10551033This self-extracting Zip file was created by a registered user of WinZip Self-Extractor %s (%s) WinZip(R) Self-Extractor is Copyright(c) 1995-2007 by WinZip International LLC (www.winzip.com)
10561033This self-extracting Zip file was created by an unregistered user of WinZip Self-Extractor %s (%s) WinZip(R) Self-Extractor is Copyright(c) 1995-2007 by WinZip International LLC (www.winzip.com)
10571033Drive %s is not a valid drive, unzip operation cancelled.
10581033Cannot use command file %s Windows does not have a program associated to run with it.
10591033TMP=
10601033Unzip to Folder:
10611033TEMP
10621033Zip file contains filenames longer than are allowed by Windows. WinZip Self-Extractor cannot process this Zip file.
10631033this self-extractor file
10641033The selected folder contains unsupported characters, please choose a different folder.
10691033Invalid command line parameter (%s).
20001033WinZip Self-Extractor
20011033Please save the file %s (created on your desktop) and inform WinZip Computing. Internet: support@winzip.com Web: http://www.winzip.com Postal mail: P.O. Box 540, Mansfield, CT 06268 USA
20021033WinZip Self-Extractor header corrupt. Possible cause: bad disk or file transfer error
20031033not enough memory
20041033WinZip internal error in file %s line %d
20051033Current date/time: %02d/%02d/%04d %02d:%02d
20061033Module name = %s
20071033Operating System Version %d.%02d
20081033Windows NT
20091033Win32s
20101033Windows 95/98
20111033Version %d.%d
20121033Memory in use = %ld%%
20131033Total physical memory = %ld Kbytes
20141033Physical memory available = %ld Kbytes
20151033Total virtual memory = %ld Kbytes
20161033Virtual memory available = %ld Kbytes
module_namehintordfunction_name
SHELL32.dll188SHGetPathFromIDListA
SHELL32.dll195SHGetSpecialFolderLocation
SHELL32.dll265ShellExecuteExA
SHELL32.dll183SHGetMalloc
USER32.dll13BeginPaint
USER32.dll346GetSysColor
USER32.dll255GetClientRect
USER32.dll620SetRect
USER32.dll200EndPaint
USER32.dll442LoadCursorA
USER32.dll296GetLastActivePopup
USER32.dll658ShowWindow
USER32.dll514PostMessageA
USER32.dll571SendMessageA
USER32.dll196EnableWindow
USER32.dll355GetTopWindow
USER32.dll640SetWindowLongA
USER32.dll366GetWindowLongA
USER32.dll646SetWindowTextA
USER32.dll599SetForegroundWindow
USER32.dll579SetActiveWindow
USER32.dll595SetDlgItemTextA
USER32.dll53CharUpperBuffA
USER32.dll446LoadIconA
USER32.dll648SetWindowWord
USER32.dll566SendDlgItemMessageA
USER32.dll273GetDlgItem
USER32.dll403InvalidateRect
USER32.dll700UpdateWindow
USER32.dll459LoadStringA
USER32.dll479MessageBoxA
USER32.dll634SetTimer
USER32.dll314GetMessageA
USER32.dll437KillTimer
USER32.dll516PostQuitMessage
USER32.dll158DialogBoxParamA
USER32.dll275GetDlgItemTextA
USER32.dll198EndDialog
USER32.dll372GetWindowRect
USER32.dll349GetSystemMetrics
USER32.dll643SetWindowPos
USER32.dll512PeekMessageA
USER32.dll682TranslateMessage
USER32.dll161DispatchMessageA
USER32.dll589SetCursor
USER32.dll42CharNextA
USER32.dll380GetWindowWord
USER32.dll142DefWindowProcA
USER32.dll534RegisterClassA
USER32.dll325GetParent
KERNEL32.dll547InitializeCriticalSection
KERNEL32.dll594LoadLibraryA
KERNEL32.dll372GetLocaleInfoA
KERNEL32.dll854Sleep
KERNEL32.dll152EnterCriticalSection
KERNEL32.dll593LeaveCriticalSection
KERNEL32.dll445GetStringTypeW
KERNEL32.dll442GetStringTypeA
KERNEL32.dll581LCMapStringW
KERNEL32.dll629MultiByteToWideChar
KERNEL32.dll580LCMapStringA
KERNEL32.dll458GetSystemTimeAsFileTime
KERNEL32.dll323GetCurrentProcessId
KERNEL32.dll675QueryPerformanceCounter
KERNEL32.dll899VirtualFree
KERNEL32.dll530HeapCreate
KERNEL32.dll532HeapDestroy
KERNEL32.dll129DeleteCriticalSection
KERNEL32.dll358GetFileType
KERNEL32.dll804SetHandleCount
KERNEL32.dll343GetEnvironmentStringsW
KERNEL32.dll916WideCharToMultiByte
KERNEL32.dll247FreeEnvironmentStringsW
KERNEL32.dll341GetEnvironmentStrings
KERNEL32.dll246FreeEnvironmentStringsA
KERNEL32.dll441GetStdHandle
KERNEL32.dll326GetCurrentThreadId
KERNEL32.dll489GetVersionExA
KERNEL32.dll206FindClose
KERNEL32.dll210FindFirstFileA
KERNEL32.dll778SetCurrentDirectoryA
KERNEL32.dll75CreateDirectoryA
KERNEL32.dll799SetFileTime
KERNEL32.dll602LocalFileTimeToFileTime
KERNEL32.dll143DosDateTimeToFileTime
KERNEL32.dll897VirtualAlloc
KERNEL32.dll339GetDriveTypeA
KERNEL32.dll344GetEnvironmentVariableA
KERNEL32.dll131DeleteFileA
KERNEL32.dll793SetFileAttributesA
KERNEL32.dll708RemoveDirectoryA
KERNEL32.dll784SetEndOfFile
KERNEL32.dll795SetFilePointer
KERNEL32.dll52CloseHandle
KERNEL32.dll881UnmapViewOfFile
KERNEL32.dll616MapViewOfFile
KERNEL32.dll84CreateFileMappingA
KERNEL32.dll355GetFileSize
KERNEL32.dll83CreateFileA
KERNEL32.dll499GetWindowsDirectoryA
KERNEL32.dll623MoveFileExA
KERNEL32.dll950_lclose
KERNEL32.dll639OpenFile
KERNEL32.dll511GlobalFree
KERNEL32.dll522GlobalUnlock
KERNEL32.dll514GlobalHandle
KERNEL32.dll952_llseek
KERNEL32.dll954_lread
KERNEL32.dll953_lopen
KERNEL32.dll515GlobalLock
KERNEL32.dll504GlobalAlloc
KERNEL32.dll516GlobalMemoryStatus
KERNEL32.dll488GetVersion
KERNEL32.dll381GetModuleFileNameA
KERNEL32.dll932WriteFile
KERNEL32.dll456GetSystemTime
KERNEL32.dll102CreateProcessA
KERNEL32.dll972lstrlenA
KERNEL32.dll604LocalFree
KERNEL32.dll185ExitProcess
KERNEL32.dll383GetModuleHandleA
KERNEL32.dll951_lcreat
KERNEL32.dll491GetVolumeInformationA
KERNEL32.dll479GetTickCount
KERNEL32.dll243FormatMessageA
KERNEL32.dll369GetLastError
KERNEL32.dll917WinExec
KERNEL32.dll955_lwrite
KERNEL32.dll912WaitForSingleObject
KERNEL32.dll789SetErrorMode
KERNEL32.dll538HeapReAlloc
KERNEL32.dll290GetConsoleCP
KERNEL32.dll307GetConsoleMode
KERNEL32.dll540HeapSize
KERNEL32.dll823SetStdHandle
KERNEL32.dll921WriteConsoleA
KERNEL32.dll309GetConsoleOutputCP
KERNEL32.dll931WriteConsoleW
KERNEL32.dll238FlushFileBuffers
KERNEL32.dll600LocalAlloc
KERNEL32.dll220FindNextFileA
KERNEL32.dll727RtlUnwind
KERNEL32.dll272GetCommandLineA
KERNEL32.dll534HeapFree
KERNEL32.dll528HeapAlloc
KERNEL32.dll419GetProcessHeap
KERNEL32.dll439GetStartupInfoA
KERNEL32.dll862TerminateProcess
KERNEL32.dll322GetCurrentProcess
KERNEL32.dll878UnhandledExceptionFilter
KERNEL32.dll842SetUnhandledExceptionFilter
KERNEL32.dll569IsDebuggerPresent
KERNEL32.dll260GetCPInfo
KERNEL32.dll556InterlockedIncrement
KERNEL32.dll552InterlockedDecrement
KERNEL32.dll253GetACP
KERNEL32.dll403GetOEMCP
KERNEL32.dll575IsValidCodePage
KERNEL32.dll416GetProcAddress
KERNEL32.dll869TlsGetValue
KERNEL32.dll867TlsAlloc
KERNEL32.dll870TlsSetValue
KERNEL32.dll868TlsFree
KERNEL32.dll808SetLastError
GDI32.dll572SetTextColor
GDI32.dll570SetTextAlign
GDI32.dll332GetBkColor
GDI32.dll436GetTextExtentPoint32A
GDI32.dll221ExtTextOutA
GDI32.dll46CreateDCA
GDI32.dll363GetDeviceCaps
GDI32.dll58CreateFontIndirectA
GDI32.dll140DeleteDC
GDI32.dll526SelectObject
GDI32.dll143DeleteObject
GDI32.dll533SetBkColor
COMCTL32.dll17
ordentry_vafunction_name
module_nameSI32E.SFX
flags0
timestamp2007-07-23 17:30:02
version0.0
ordinal_base1
nFunctions0
nNames0
Names(0)0
Functions(0)0
NameOrdinals(0)0
offsetsizetypecomment
15c115HTM#
1f0865569073ZIP#
56eab71353BINoverlay data past EOF#
Scanning the drive for archives:
1 file, 5697536 bytes (5564 KiB)


--
Type = PE
Physical Size = 5697536
CPU = x86
Characteristics = Executable 32-bit NoRelocs
Created = 2007-07-23 17:30:02
Headers Size = 4096
Checksum = 0
Image Size = 5718016
Section Alignment = 4096
File Alignment = 4096
Code Size = 61440
Initialized Data Size = 61440
Uninitialized Data Size = 0
Linker Version = 8.0
OS Version = 4.0
Image Version = 0.0
Subsystem Version = 4.0
Subsystem = Windows GUI
Stack Reserve = 32000
Stack Commit = 4096
Heap Reserve = 32000
Heap Commit = 4096
Image Base = 4194304
----
Path = _winzip_
Size = 5570560
Packed Size = 5570560
Virtual Size = 5570560
Characteristics = InitializedData Discardable Read
Offset = 126976
Virtual Address = 0x24000
--
Path = _winzip_
Type = zip
WARNINGS:
There are data after the end of archive
Offset = -126976
Physical Size = 5696183
Tail Size = 1353
Embedded Stub Size = 127110

   Date      Time    Attr         Size   Compressed  Name
------------------- ----- ------------ ------------  ------------------------
2008-06-13 15:21:48 ....A      1374208       600080  IsoView/Arbortext IsoView 7.0.msi
2008-06-13 15:21:44 ....A      3054202      3046418  IsoView/Defaul~1.cab
2008-01-08 14:56:50 ....A       268447       259035  IsoView/IsoView7License.iso
2008-06-13 15:21:36 ....A      1931323      1433106  IsoView/ISSetup.dll
2007-02-22 17:20:36 ....A       229894        20073  IsoView/setup.bmp
2008-06-13 15:21:48 ....A       332640       180928  IsoView/setup.exe
2006-05-16 14:44:52 ....A        71466        28579  IsoView/setup.isn
------------------- ----- ------------ ------------  ------------------------
2008-06-13 15:21:48            7262180      5568219  7 files

Warnings: 1
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable







[?] can't find file_offset of VA 0x0