filenamedotnetfx_a86fd901dfe693e5d9465b4f89715da.exe
size4194011 (0x3ffedb)
md50249148c1133d20e34215a69b6dfb094
typePE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, MS CAB-Installer self-extracting archive
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xd0

Rich Header

lib idversiontimes used
10126
19904913
621341
0024

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections3
TimeDateStamp0x393d628c
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x307
Magic0x10b
LinkerVersion5.12
SizeOfCode0x8800
SizeOfInitializedData0x1719a00
SizeOfUninitializedData0
AddressOfEntryPoint0x2891
BaseOfCode0x1000
BaseOfData0xa000
ImageBase0x1000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.0
ImageVersion5.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x1726000
SizeOfHeaders0x600
CheckSum0x172de5a
Subsystem2
DllCharacteristics0x8000
SizeOfStackReserve0x40000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS CAB SFX module

Sections

namevavsizeraw sizeflags
.text0x10000x878a0x8800R-X CODE
.data0xa0000x1c0c0x400RW- IDATA
.rsrc0xc0000x171a0000x1719600R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x8c200x8c
RESOURCE0xc0000x17195bc
EXCEPTION00
SECURITY0x17229100x1af8
BASERELOC00
DEBUG0x12100x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x10000x210
Delay_IAT00
CLR_Header00
typenamesizecp
AVI#3001118021252
ICON#17441252
ICON#22961252
DIALOG#20017161252
DIALOG#20023941252
DIALOG#20033201252
DIALOG#20044061252
DIALOG#20052701252
DIALOG#20062501252
STRING#631401252
STRING#7613121252
STRING#7714841252
STRING#8012001252
STRING#8310981252
STRING#859741252
RCDATAADMQCMD71252
RCDATACABINET241942101252
RCDATAEXTRACTOPT41252
RCDATAFILESIZES361252
RCDATAFINISHMSG71252
RCDATALICENSE71252
RCDATAPACKINSTSPACE41252
RCDATAPOSTRUNPROGRAM71252
RCDATAREBOOT41252
RCDATARUNPROGRAM141252
RCDATASHOWWINDOW41252
RCDATATITLE351252
RCDATAUPROMPT641252
RCDATAUSRQCMD71252
GROUP_ICON#3000341252
VERSION#132881252
idlangstring
10001033Please select a folder to store the extracted files.
10011033%s
12001033Failed to get disk space information from: %s. System Message: %s.
12011033A required resource cannot be located.
12021033Are you sure you want to cancel?
12041033Unable to retrieve operating system version information.
12051033Memory allocation request failed.
12081033Unable to create extraction thread.
12101033Cabinet is not valid.
12111033Filetable full.
12121033Can not change to destination folder.
12131033Setup could not find a drive with %s KB free disk space to install the program. Please free up some space first and press RETRY or press CANCEL to exit setup.
12141033That folder is invalid. Please make sure the folder exists and is writable.
12151033You must specify a folder with fully qualified pathname or choose Cancel.
12161033Could not update folder edit box.
12171033Could not load functions required for browser dialog.
12181033Could not load Shell32.dll required for browser dialog.
12201033Error creating process <%s>. Reason: %s
12211033The cluster size in this system is not supported.
12221033A required resource appears to be corrupted.
12231033Windows 95 or Windows NT 4.0 Beta 2 or greater is required for this installation.
12241033Error loading %s
12251033GetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used.
12261033Windows 95 or Windows NT is required to install
12271033Could not create folder '%s'
12281033To install this program, you need %s KB disk space on drive %s. It is recommended that you free up the required disk space before you continue. Do you still want to continue?
12641033Error retrieving Windows folder
12691033NT Shutdown: OpenProcessToken error.
12701033NT Shutdown: AdjustTokenPrivileges error.
12711033NT Shutdown: ExitWindowsEx error.
12721033Extracting file failed. It is most likely caused by low memory (low disk space for swapping file) or corrupted Cabinet file.
12731033The setup program could not retrieve the volume information for drive (%s) . System message: %s.
12741033Setup could not find a drive with %s KB free disk space to install the program. Please free up some space and try again.
12751033The installation program appears to be damaged or corrupted. Contact the vendor of this application.
13121033Command line option syntax error. Type Command /? for Help.
13131033Command line options: /Q -- Quiet modes for package, /T:<full path> -- Specifies temporary working folder, /C -- Extract files only to the folder when used also with /T. /C:<Cmd> -- Override Install Command defined by author.
13141033You must restart your computer before the new settings will take effect. Do you want to restart your computer now?
13161033Another copy of the '%s' package is already running on your system. Do you want to run another copy?
13171033Could not find the file: %s.
13511033You do not have administrator privileges on this machine. Some installations cannot be completed correctly unless they are run by an administrator.
13541033The folder '%s' does not exist. Do you want to create it?
13551033Another copy of the '%s' package is already running on your system. You can only run one copy at a time.
13561033The '%s' package is not compatible with the version of Windows you are running.
13571033The '%s' package is not compatible with the version of the file: %s on your system.
module_namehintordfunction_name
ADVAPI32.dll388RegCloseKey
ADVAPI32.dll26AllocateAndInitializeSid
ADVAPI32.dll172EqualSid
ADVAPI32.dll233GetTokenInformation
ADVAPI32.dll359OpenProcessToken
ADVAPI32.dll25AdjustTokenPrivileges
ADVAPI32.dll280LookupPrivilegeValueA
ADVAPI32.dll177FreeSid
ADVAPI32.dll397RegDeleteValueA
ADVAPI32.dll413RegOpenKeyExA
ADVAPI32.dll434RegSetValueExA
ADVAPI32.dll423RegQueryValueExA
ADVAPI32.dll392RegCreateKeyExA
ADVAPI32.dll418RegQueryInfoKeyA
KERNEL32.dll485LocalAlloc
KERNEL32.dll301GetLastError
KERNEL32.dll265GetCurrentProcess
KERNEL32.dll479LoadLibraryA
KERNEL32.dll30CloseHandle
KERNEL32.dll489LocalFree
KERNEL32.dll288GetFileAttributesA
KERNEL32.dll335GetPrivateProfileStringA
KERNEL32.dll329GetPrivateProfileIntA
KERNEL32.dll821lstrlenA
KERNEL32.dll812lstrcmpiA
KERNEL32.dll806lstrcatA
KERNEL32.dll356GetShortPathNameA
KERNEL32.dll368GetSystemDirectoryA
KERNEL32.dll587RemoveDirectoryA
KERNEL32.dll815lstrcpyA
KERNEL32.dll172FindNextFileA
KERNEL32.dll92DeleteFileA
KERNEL32.dll659SetFileAttributesA
KERNEL32.dll809lstrcmpA
KERNEL32.dll163FindFirstFileA
KERNEL32.dll799_lclose
KERNEL32.dll801_llseek
KERNEL32.dll802_lopen
KERNEL32.dll787WritePrivateProfileStringA
KERNEL32.dll407GetWindowsDirectoryA
KERNEL32.dll312GetModuleFileNameA
KERNEL32.dll159FindClose
KERNEL32.dll419GlobalFree
KERNEL32.dll430GlobalUnlock
KERNEL32.dll423GlobalLock
KERNEL32.dll412GlobalAlloc
KERNEL32.dll468IsDBCSLeadByte
KERNEL32.dll140ExitProcess
KERNEL32.dll339GetProcAddress
KERNEL32.dll358GetStartupInfoA
KERNEL32.dll218GetCommandLineA
KERNEL32.dll484LoadResource
KERNEL32.dll178FindResourceA
KERNEL32.dll66CreateMutexA
KERNEL32.dll656SetEvent
KERNEL32.dll52CreateEventA
KERNEL32.dll648SetCurrentDirectoryA
KERNEL32.dll77CreateThread
KERNEL32.dll594ResetEvent
KERNEL32.dll716TerminateThread
KERNEL32.dll399GetVersionExA
KERNEL32.dll195FreeLibrary
KERNEL32.dll286GetExitCodeProcess
KERNEL32.dll765WaitForSingleObject
KERNEL32.dll71CreateProcessA
KERNEL32.dll382GetTempPathA
KERNEL32.dll197FreeResource
KERNEL32.dll498LockResource
KERNEL32.dll706SizeofResource
KERNEL32.dll55CreateFileA
KERNEL32.dll573ReadFile
KERNEL32.dll782WriteFile
KERNEL32.dll661SetFilePointer
KERNEL32.dll663SetFileTime
KERNEL32.dll487LocalFileTimeToFileTime
KERNEL32.dll104DosDateTimeToFileTime
KERNEL32.dll380GetTempFileNameA
KERNEL32.dll370GetSystemInfo
KERNEL32.dll279GetDriveTypeA
KERNEL32.dll818lstrcpynA
KERNEL32.dll401GetVolumeInformationA
KERNEL32.dll263GetCurrentDirectoryA
KERNEL32.dll480LoadLibraryExA
KERNEL32.dll314GetModuleHandleA
KERNEL32.dll48CreateDirectoryA
KERNEL32.dll143ExpandEnvironmentStringsA
KERNEL32.dll190FormatMessageA
KERNEL32.dll122EnumResourceLanguagesA
KERNEL32.dll513MulDiv
KERNEL32.dll275GetDiskFreeSpaceA
GDI32.dll301GetDeviceCaps
USER32.dll213ExitWindowsEx
USER32.dll37CharNextA
USER32.dll47CharUpperA
USER32.dll40CharPrevA
USER32.dll605SetWindowLongA
USER32.dll691wsprintfA
USER32.dll346GetWindowLongA
USER32.dll22CallWindowProcA
USER32.dll261GetDlgItem
USER32.dll564SetForegroundWindow
USER32.dll611SetWindowTextA
USER32.dll531SendDlgItemMessageA
USER32.dll185EnableWindow
USER32.dll258GetDesktopWindow
USER32.dll187EndDialog
USER32.dll151DispatchMessageA
USER32.dll431LoadStringA
USER32.dll481PeekMessageA
USER32.dll451MessageBoxA
USER32.dll608SetWindowPos
USER32.dll519ReleaseDC
USER32.dll256GetDC
USER32.dll352GetWindowRect
USER32.dll623ShowWindow
USER32.dll146DialogBoxIndirectParamA
USER32.dll560SetDlgItemTextA
USER32.dll450MessageBeep
USER32.dll536SendMessageA
USER32.dll263GetDlgItemTextA
USER32.dll463MsgWaitForMultipleObjects
USER32.dll329GetSystemMetrics
COMCTL32.dll17
VERSION.dllGetFileVersionInfoA
VERSION.dll10VerQueryValueA
VERSION.dll1GetFileVersionInfoSizeA

VS_FIXEDFILEINFO

dwSignature0
FileVersion0.0.0.0
ProductVersion0.0.0.0
StrucVersion0
FileFlagsMask0
FileFlags0
FileOS0
FileType0
FileSubtype0
offsetsizetypecomment
15c115HTM#
99a011794AVI#
ee121701376EXE03/01/2001 21:56:32#
183ba11794AVI#
1aff021814528EXE03/01/2001 21:56:32#
1b94aa11794AVI#
36ca0a98304EXE02/21/2003 02:48:33#
3a064229520BMP(118 x 237)#
3a7992361801BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] invalid VS_VERSIONINFO child type nil