setup.exe

info
MZ
PE
resources
strings
imports
exports
foremost
7zip
hexdump
disasm
log
discuss
donate

filename	setup.exe
size	1065961 (0x1043e9)
md5	284df216214e1ff69de2126ec825bb9f

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	scan pending
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x118

Rich Header

lib id	version	times used
241	40116	13
243	40116	141
242	40116	24
199	41118	2
259	24123	22
260	24123	19
261	24123	44
131	30729	10
147	30729	5
1	0	266
261	24215	49
256	24215	1
255	24210	1
258	24215	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	6
TimeDateStamp	0x5e7c7dc7
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x102
Magic	0x10b
LinkerVersion	14.0
SizeOfCode	0x30600
SizeOfInitializedData	0x3e200
SizeOfUninitializedData	0
AddressOfEntryPoint	0x1e1f9
BaseOfCode	0x1000
BaseOfData	0x32000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	5.1
ImageVersion	0.0
SubsystemVersion	5.1
Reserved1	0
SizeOfImage	0x73000
SizeOfHeaders	0x400
CheckSum	0
Subsystem	2
DllCharacteristics	0x8140
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x30581	0x30600	R-X CODE
.rdata	0x32000	0xa332	0xa400	R-- IDATA
.data	0x3d000	0x238b0	0x1200	RW- IDATA
.gfids	0x61000	0xe8	0x200	R-- IDATA
.rsrc	0x62000	0xdfd0	0xe000	R-- IDATA
.reloc	0x70000	0x210c	0x2200	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0x3b540	0x34
IMPORT	0x3b574	0x3c
RESOURCE	0x62000	0xdfd0
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0x70000	0x210c
DEBUG	0x397d0	0x54
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0x34218	0x40
Bound_IAT	0	0
IAT	0x32000	0x260
Delay_IAT	0x3aaec	0x120
CLR_Header	0	0

show previews

type	name	size
PNG	#101	2885
PNG	#102	5545
ICON	#1	1384
ICON	#2	2216
ICON	#3	3752
ICON	#4	1128
ICON	#5	4264
ICON	#6	9640
ICON	#7	15729
DIALOG	ASKNEXTVOL	646
DIALOG	GETPASSWORD1	314
DIALOG	LICENSEDLG	236
DIALOG	RENAMEDLG	302
DIALOG	REPLACEFILEDLG	824
DIALOG	STARTDLG	594
STRING	#7	482
STRING	#8	460
STRING	#9	440
STRING	#10	326
STRING	#11	1094
STRING	#12	358
STRING	#13	338
STRING	#14	266
STRING	#15	188
STRING	#16	214
GROUP_ICON	#100	104
MANIFEST	#1	1875

id	lang	string
100	1033	Select destination folder
101	1033	Extracting %s
102	1033	Skipping %s
103	1033	Unexpected end of archive
104	1033	The file "%s" header is corrupt
105	1033	Corrupt header is found
106	1033	Main archive header is corrupt
110	1033	The archive comment header is corrupt
111	1033	The archive comment is corrupt
112	1033	Not enough memory
113	1033	Unknown method in %s
114	1033	Cannot open %s
120	1033	Cannot create %s
121	1033	Cannot create folder %s
122	1033	Checksum error in the encrypted file %s. Corrupt file or wrong password.
123	1033	Checksum error in %s
124	1033	Packed data checksum error in %s
131	1033	Write error in the file %s
132	1033	Read error in the file %s
133	1033	File close error
134	1033	The required volume is absent
140	1033	The archive is either in unknown format or damaged
141	1033	Extracting from %s
142	1033	Next volume
143	1033	The archive header is corrupt
144	1033	Close
150	1033	Error
151	1033	Errors encountered while performing the operation Look at the information window for more details
152	1033	bytes
153	1033	modified on
154	1033	folder is not accessible
160	1033	Some files could not be created. Please close all applications, reboot Windows and restart this installation
161	1033	Some installation files are corrupt. Please download a fresh copy and retry the installation
162	1033	All files
170	1033	<ul><li>Press <b>Install</b> button to start extraction.</li><br><br>
171	1033	<ul><li>Press <b>Extract</b> button to start extraction.</li><br><br>
172	1033	<li>Use <b>Browse</b> button to select the destination
173	1033	folder from the folders tree. It can be also entered
174	1033	manually.</li><br><br>
175	1033	<li>If the destination folder does not exist, it will be
176	1033	created automatically before extraction.</li></ul>
180	1033	The archive is corrupt
185	1033	Extracting files to %s folder
186	1033	Extracting files to temporary folder
190	1033	Extract
191	1033	Extraction progress
195	1033	Total path and file name length must not exceed %d characters
200	1033	Unknown encryption method in %s
201	1033	The specified password is incorrect.
202	1033	Incorrect password for %s
210	1033	Cannot copy %s to %s.
220	1033	Cannot create symbolic link %s
221	1033	Cannot create hard link %s
222	1033	You need to unpack the link target first
225	1033	You may need to run this self-extracting archive as administrator
230	1033	Pause
231	1033	Continue
240	1033	Security warning
241	1033	Please remove %s from folder %s. It is unsecure to run %s until it is done.

module_name	hint	function_name
KERNEL32.dll	514	GetLastError
KERNEL32.dll	1139	SetLastError
KERNEL32.dll	350	FormatMessageW
KERNEL32.dll	448	GetCurrentProcess
KERNEL32.dll	221	DeviceIoControl
KERNEL32.dll	1130	SetFileTime
KERNEL32.dll	82	CloseHandle
KERNEL32.dll	129	CreateDirectoryW
KERNEL32.dll	1027	RemoveDirectoryW
KERNEL32.dll	143	CreateFileW
KERNEL32.dll	214	DeleteFileW
KERNEL32.dll	147	CreateHardLinkW
KERNEL32.dll	609	GetShortPathNameW
KERNEL32.dll	527	GetLongPathNameW
KERNEL32.dll	867	MoveFileW
KERNEL32.dll	499	GetFileType
KERNEL32.dll	612	GetStdHandle
KERNEL32.dll	1317	WriteFile
KERNEL32.dll	960	ReadFile
KERNEL32.dll	343	FlushFileBuffers
KERNEL32.dll	1107	SetEndOfFile
KERNEL32.dll	1126	SetFilePointer
KERNEL32.dll	1121	SetFileAttributesW
KERNEL32.dll	490	GetFileAttributesW
KERNEL32.dll	302	FindClose
KERNEL32.dll	313	FindFirstFileW
KERNEL32.dll	325	FindNextFileW
KERNEL32.dll	676	GetVersionExW
KERNEL32.dll	447	GetCurrentDirectoryW
KERNEL32.dll	507	GetFullPathNameW
KERNEL32.dll	348	FoldStringW
KERNEL32.dll	532	GetModuleFileNameW
KERNEL32.dll	536	GetModuleHandleW
KERNEL32.dll	334	FindResourceW
KERNEL32.dll	354	FreeLibrary
KERNEL32.dll	581	GetProcAddress
KERNEL32.dll	449	GetCurrentProcessId
KERNEL32.dll	281	ExitProcess
KERNEL32.dll	1171	SetThreadExecutionState
KERNEL32.dll	1202	Sleep
KERNEL32.dll	831	LoadLibraryW
KERNEL32.dll	624	GetSystemDirectoryW
KERNEL32.dll	100	CompareStringW
KERNEL32.dll	16	AllocConsole
KERNEL32.dll	351	FreeConsole
KERNEL32.dll	23	AttachConsole
KERNEL32.dll	1316	WriteConsoleW
KERNEL32.dll	582	GetProcessAffinityMask
KERNEL32.dll	181	CreateThread
KERNEL32.dll	1177	SetThreadPriority
KERNEL32.dll	738	InitializeCriticalSection
KERNEL32.dll	238	EnterCriticalSection
KERNEL32.dll	825	LeaveCriticalSection
KERNEL32.dll	209	DeleteCriticalSection
KERNEL32.dll	1113	SetEvent
KERNEL32.dll	1039	ResetEvent
KERNEL32.dll	1022	ReleaseSemaphore
KERNEL32.dll	1273	WaitForSingleObject
KERNEL32.dll	133	CreateEventW
KERNEL32.dll	174	CreateSemaphoreW
KERNEL32.dll	631	GetSystemTime
KERNEL32.dll	1214	SystemTimeToTzSpecificLocalTime
KERNEL32.dll	1232	TzSpecificLocalTimeToSystemTime
KERNEL32.dll	1213	SystemTimeToFileTime
KERNEL32.dll	292	FileTimeToLocalFileTime
KERNEL32.dll	838	LocalFileTimeToFileTime
KERNEL32.dll	293	FileTimeToSystemTime
KERNEL32.dll	370	GetCPInfo
KERNEL32.dll	766	IsDBCSLeadByte
KERNEL32.dll	871	MultiByteToWideChar
KERNEL32.dll	1297	WideCharToMultiByte
KERNEL32.dll	691	GlobalAlloc
KERNEL32.dll	852	LockResource
KERNEL32.dll	702	GlobalLock
KERNEL32.dll	709	GlobalUnlock
KERNEL32.dll	698	GlobalFree
KERNEL32.dll	833	LoadResource
KERNEL32.dll	1201	SizeofResource
KERNEL32.dll	1101	SetCurrentDirectoryW
KERNEL32.dll	479	GetExitCodeProcess
KERNEL32.dll	515	GetLocalTime
KERNEL32.dll	659	GetTickCount
KERNEL32.dll	855	MapViewOfFile
KERNEL32.dll	1238	UnmapViewOfFile
KERNEL32.dll	140	CreateFileMappingW
KERNEL32.dll	889	OpenFileMappingW
KERNEL32.dll	391	GetCommandLineW
KERNEL32.dll	1111	SetEnvironmentVariableW
KERNEL32.dll	285	ExpandEnvironmentStringsW
KERNEL32.dll	645	GetTempPathW
KERNEL32.dll	864	MoveFileExW
KERNEL32.dll	518	GetLocaleInfoW
KERNEL32.dll	663	GetTimeFormatW
KERNEL32.dll	456	GetDateFormatW
KERNEL32.dll	563	GetNumberFormatW
KERNEL32.dll	1127	SetFilePointerEx
KERNEL32.dll	428	GetConsoleMode
KERNEL32.dll	410	GetConsoleCP
KERNEL32.dll	724	HeapSize
KERNEL32.dll	1159	SetStdHandle
KERNEL32.dll	586	GetProcessHeap
KERNEL32.dll	945	RaiseException
KERNEL32.dll	627	GetSystemInfo
KERNEL32.dll	1263	VirtualProtect
KERNEL32.dll	1265	VirtualQuery
KERNEL32.dll	829	LoadLibraryExA
KERNEL32.dll	772	IsProcessorFeaturePresent
KERNEL32.dll	768	IsDebuggerPresent
KERNEL32.dll	1235	UnhandledExceptionFilter
KERNEL32.dll	1189	SetUnhandledExceptionFilter
KERNEL32.dll	611	GetStartupInfoW
KERNEL32.dll	935	QueryPerformanceCounter
KERNEL32.dll	453	GetCurrentThreadId
KERNEL32.dll	633	GetSystemTimeAsFileTime
KERNEL32.dll	743	InitializeSListHead
KERNEL32.dll	1216	TerminateProcess
KERNEL32.dll	1048	RtlUnwind
KERNEL32.dll	234	EncodePointer
KERNEL32.dll	739	InitializeCriticalSectionAndSpinCount
KERNEL32.dll	1221	TlsAlloc
KERNEL32.dll	1223	TlsGetValue
KERNEL32.dll	1224	TlsSetValue
KERNEL32.dll	1222	TlsFree
KERNEL32.dll	830	LoadLibraryExW
KERNEL32.dll	936	QueryPerformanceFrequency
KERNEL32.dll	535	GetModuleHandleExW
KERNEL32.dll	531	GetModuleFileNameA
KERNEL32.dll	360	GetACP
KERNEL32.dll	719	HeapFree
KERNEL32.dll	715	HeapAlloc
KERNEL32.dll	722	HeapReAlloc
KERNEL32.dll	617	GetStringTypeW
KERNEL32.dll	813	LCMapStringW
KERNEL32.dll	307	FindFirstFileExA
KERNEL32.dll	323	FindNextFileA
KERNEL32.dll	778	IsValidCodePage
KERNEL32.dll	567	GetOEMCP
KERNEL32.dll	390	GetCommandLineA
KERNEL32.dll	474	GetEnvironmentStringsW
KERNEL32.dll	353	FreeEnvironmentStringsW
KERNEL32.dll	202	DecodePointer
gdiplus.dll	628	GdiplusShutdown
gdiplus.dll	629	GdiplusStartup
gdiplus.dll	95	GdipCreateHBITMAPFromBitmap
gdiplus.dll	82	GdipCreateBitmapFromStreamICM
gdiplus.dll	81	GdipCreateBitmapFromStream
gdiplus.dll	152	GdipDisposeImage
gdiplus.dll	54	GdipCloneImage
gdiplus.dll	237	GdipFree
gdiplus.dll	33	GdipAlloc

ord	entry_va	function_name

module_name	sfxrar.exe
flags	0
timestamp	2020-03-26 10:02:47
version	0.0
ordinal_base	1
nFunctions	0
nNames	0
Names(0)	0
Functions(0)	0
NameOrdinals(0)	0

show previews

offset	size	type	comment
0	312320	EXE	03/26/2020 10:02:47	#
15c1	15	HTM		#
3c850	2885	PNG	(93 x 302)	#
3d398	5545	PNG	(186 x 604)	#
440b8	15729	PNG	(256 x 256)	#
4c400	753641	BIN	overlay data past EOF	#

Scanning the drive for archives:
1 file, 1065961 bytes (1041 KiB)


--
Type = Rar5
Offset = 312320
Physical Size = 753641
Solid = -
Blocks = 3
Encrypted = -
Multivolume = -
Volumes = 1
Comment = Silent=1
Overwrite=1
Path="C:/crtref/"
Setup=MMHfyN1KUsTJOBvBjzGlbdHS9oVV2j.vbe
Update=U

   Date      Time    Attr         Size   Compressed  Name
------------------- ----- ------------ ------------  ------------------------
2020-12-08 12:05:21 ....A       898712       752697  9rgZVeNcpNbOK5vGmyvU.exe
2020-12-08 12:05:02 ....A          142          142  MMHfyN1KUsTJOBvBjzGlbdHS9oVV2j.vbe
2020-12-08 12:05:02 ....A          422          375  qJinAgXQ4XD9SKHPndOH6nHwmTlPZ3.bat
------------------- ----- ------------ ------------  ------------------------
2020-12-08 12:05:21             899276       753214  3 files

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] ignoring invalid PEdump::BITMAPINFOHEADER

[?] can't find file_offset of VA 0x0