filename | setup.exe | |
---|---|---|
size | 517592 (0x7e5d8) | |
md5 | 94abff530379f7c8708710fd631f5fa4 | |
type | PE32 executable (GUI) Intel 80386, for MS Windows | |
mimetype | application/x-dosexec | |
clamav | OK | |
virustotal | → scan with virustotal.com | |
histogram |
MZ Header
signature | MZ |
bytes_in_last_block | 0x90 |
blocks_in_file | 3 |
num_relocs | 0 |
header_paragraphs | 4 |
min_extra_paragraphs | 0 |
max_extra_paragraphs | 0xffff |
ss | 0 |
sp | 0xb8 |
checksum | 0 |
ip | 0 |
cs | 0 |
reloc_table_offset | 0x40 |
overlay_number | 0 |
reserved0 | 0 |
oem_id | 0 |
oem_info | 0 |
reserved2 | 0 |
reserved3 | 0 |
reserved4 | 0 |
reserved5 | 0 |
reserved6 | 0 |
lfanew | 0xf8 |
Rich Header
lib id | version | times used |
---|---|---|
171 | 30319 | 58 |
158 | 30319 | 20 |
170 | 30319 | 157 |
147 | 30729 | 23 |
1 | 0 | 337 |
158 | 30311 | 1 |
171 | 30311 | 35 |
155 | 30311 | 1 |
154 | 30311 | 1 |
157 | 30311 | 1 |
DOS stub
00000000: 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 |........!..L.!Th| 00000010: 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f |is program canno| 00000020: 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 |t be run in DOS | 00000030: 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 |mode....$.......|
PE Header
Packer / Compiler
Sections
name | va | vsize | raw size | flags | |
---|---|---|---|---|---|
.text | 0x1000 | 0x4e948 | 0x4ea00 | R-X CODE | |
.data | 0x50000 | 0x40ac | 0x1c00 | RW- IDATA | |
.rsrc | 0x55000 | 0x28ea8 | 0x29000 | R-- IDATA | |
.reloc | 0x7e000 | 0x4740 | 0x4800 | R-- IDATA DISCARDABLE |
Data Directory
module_name | hint | ord | function_name |
---|---|---|---|
KERNEL32.dll | 920 | Process32NextW | |
KERNEL32.dll | 918 | Process32FirstW | |
KERNEL32.dll | 190 | CreateToolhelp32Snapshot | |
KERNEL32.dll | 449 | GetCurrentProcessId | |
KERNEL32.dll | 549 | GetNativeSystemInfo | |
KERNEL32.dll | 1126 | SetFilePointer | |
KERNEL32.dll | 723 | HeapSetInformation | |
KERNEL32.dll | 133 | CreateEventW | |
KERNEL32.dll | 1113 | SetEvent | |
KERNEL32.dll | 1201 | SizeofResource | |
KERNEL32.dll | 852 | LockResource | |
KERNEL32.dll | 833 | LoadResource | |
KERNEL32.dll | 334 | FindResourceW | |
KERNEL32.dll | 676 | GetVersionExW | |
KERNEL32.dll | 100 | CompareStringW | |
KERNEL32.dll | 490 | GetFileAttributesW | |
KERNEL32.dll | 532 | GetModuleFileNameW | |
KERNEL32.dll | 285 | ExpandEnvironmentStringsW | |
KERNEL32.dll | 698 | GlobalFree | |
KERNEL32.dll | 896 | OpenProcess | |
KERNEL32.dll | 624 | GetSystemDirectoryW | |
KERNEL32.dll | 214 | DeleteFileW | |
KERNEL32.dll | 643 | GetTempFileNameW | |
KERNEL32.dll | 645 | GetTempPathW | |
KERNEL32.dll | 840 | LocalFree | |
KERNEL32.dll | 350 | FormatMessageW | |
KERNEL32.dll | 960 | ReadFile | |
KERNEL32.dll | 663 | GetTimeFormatW | |
KERNEL32.dll | 456 | GetDateFormatW | |
KERNEL32.dll | 129 | CreateDirectoryW | |
KERNEL32.dll | 117 | CopyFileW | |
KERNEL32.dll | 1297 | WideCharToMultiByte | |
KERNEL32.dll | 687 | GetWindowsDirectoryW | |
KERNEL32.dll | 627 | GetSystemInfo | |
KERNEL32.dll | 448 | GetCurrentProcess | |
KERNEL32.dll | 476 | GetEnvironmentVariableW | |
KERNEL32.dll | 536 | GetModuleHandleW | |
KERNEL32.dll | 674 | GetVersion | |
KERNEL32.dll | 143 | CreateFileW | |
KERNEL32.dll | 237 | EndUpdateResourceW | |
KERNEL32.dll | 1202 | Sleep | |
KERNEL32.dll | 462 | GetDiskFreeSpaceExW | |
KERNEL32.dll | 209 | DeleteCriticalSection | |
KERNEL32.dll | 181 | CreateThread | |
KERNEL32.dll | 738 | InitializeCriticalSection | |
KERNEL32.dll | 238 | EnterCriticalSection | |
KERNEL32.dll | 825 | LeaveCriticalSection | |
KERNEL32.dll | 870 | MulDiv | |
KERNEL32.dll | 1358 | lstrlenW | |
KERNEL32.dll | 479 | GetExitCodeProcess | |
KERNEL32.dll | 1107 | SetEndOfFile | |
KERNEL32.dll | 659 | GetTickCount | |
KERNEL32.dll | 313 | FindFirstFileW | |
KERNEL32.dll | 325 | FindNextFileW | |
KERNEL32.dll | 302 | FindClose | |
KERNEL32.dll | 691 | GlobalAlloc | |
KERNEL32.dll | 831 | LoadLibraryW | |
KERNEL32.dll | 1246 | UpdateResourceA | |
KERNEL32.dll | 55 | BeginUpdateResourceA | |
KERNEL32.dll | 745 | InterlockedCompareExchange | |
KERNEL32.dll | 331 | FindResourceA | |
KERNEL32.dll | 211 | DeleteFileA | |
KERNEL32.dll | 1357 | lstrlenA | |
KERNEL32.dll | 136 | CreateFileA | |
KERNEL32.dll | 1247 | UpdateResourceW | |
KERNEL32.dll | 56 | BeginUpdateResourceW | |
KERNEL32.dll | 475 | GetEnvironmentVariableA | |
KERNEL32.dll | 1159 | SetStdHandle | |
KERNEL32.dll | 1316 | WriteConsoleW | |
KERNEL32.dll | 722 | HeapReAlloc | |
KERNEL32.dll | 780 | IsValidLocale | |
KERNEL32.dll | 269 | EnumSystemLocalesA | |
KERNEL32.dll | 516 | GetLocaleInfoA | |
KERNEL32.dll | 667 | GetUserDefaultLCID | |
KERNEL32.dll | 724 | HeapSize | |
KERNEL32.dll | 343 | FlushFileBuffers | |
KERNEL32.dll | 428 | GetConsoleMode | |
KERNEL32.dll | 410 | GetConsoleCP | |
KERNEL32.dll | 586 | GetProcessHeap | |
KERNEL32.dll | 871 | MultiByteToWideChar | |
KERNEL32.dll | 813 | LCMapStringW | |
KERNEL32.dll | 617 | GetStringTypeW | |
KERNEL32.dll | 518 | GetLocaleInfoW | |
KERNEL32.dll | 778 | IsValidCodePage | |
KERNEL32.dll | 567 | GetOEMCP | |
KERNEL32.dll | 360 | GetACP | |
KERNEL32.dll | 768 | IsDebuggerPresent | |
KERNEL32.dll | 1235 | UnhandledExceptionFilter | |
KERNEL32.dll | 1216 | TerminateProcess | |
KERNEL32.dll | 715 | HeapAlloc | |
KERNEL32.dll | 772 | IsProcessorFeaturePresent | |
KERNEL32.dll | 633 | GetSystemTimeAsFileTime | |
KERNEL32.dll | 935 | QueryPerformanceCounter | |
KERNEL32.dll | 717 | HeapCreate | |
KERNEL32.dll | 453 | GetCurrentThreadId | |
KERNEL32.dll | 748 | InterlockedExchange | |
KERNEL32.dll | 1212 | SwitchToThread | |
KERNEL32.dll | 514 | GetLastError | |
KERNEL32.dll | 1273 | WaitForSingleObject | |
KERNEL32.dll | 82 | CloseHandle | |
KERNEL32.dll | 581 | GetProcAddress | |
KERNEL32.dll | 354 | FreeLibrary | |
KERNEL32.dll | 1317 | WriteFile | |
KERNEL32.dll | 1139 | SetLastError | |
KERNEL32.dll | 751 | InterlockedIncrement | |
KERNEL32.dll | 1222 | TlsFree | |
KERNEL32.dll | 1224 | TlsSetValue | |
KERNEL32.dll | 1223 | TlsGetValue | |
KERNEL32.dll | 1221 | TlsAlloc | |
KERNEL32.dll | 499 | GetFileType | |
KERNEL32.dll | 739 | InitializeCriticalSectionAndSpinCount | |
KERNEL32.dll | 836 | LocalAlloc | |
KERNEL32.dll | 828 | LoadLibraryA | |
KERNEL32.dll | 945 | RaiseException | |
KERNEL32.dll | 391 | GetCommandLineW | |
KERNEL32.dll | 611 | GetStartupInfoW | |
KERNEL32.dll | 1048 | RtlUnwind | |
KERNEL32.dll | 719 | HeapFree | |
KERNEL32.dll | 747 | InterlockedDecrement | |
KERNEL32.dll | 370 | GetCPInfo | |
KERNEL32.dll | 1189 | SetUnhandledExceptionFilter | |
KERNEL32.dll | 281 | ExitProcess | |
KERNEL32.dll | 612 | GetStdHandle | |
KERNEL32.dll | 353 | FreeEnvironmentStringsW | |
KERNEL32.dll | 474 | GetEnvironmentStringsW | |
KERNEL32.dll | 1135 | SetHandleCount | |
GDI32.dll | 525 | GetStockObject | |
GDI32.dll | 293 | EnumFontFamiliesExW | |
GDI32.dll | 64 | CreateFontIndirectW | |
GDI32.dll | 230 | DeleteObject | |
GDI32.dll | 48 | CreateCompatibleDC | |
GDI32.dll | 459 | GetDeviceCaps | |
GDI32.dll | 509 | GetObjectW | |
GDI32.dll | 227 | DeleteDC | |
GDI32.dll | 631 | SelectObject | |
GDI32.dll | 550 | GetTextMetricsW | |
GDI32.dll | 542 | GetTextExtentPoint32W | |
ole32.dll | 108 | CoUninitialize | |
ole32.dll | 62 | CoInitialize | |
Secur32.dll | 27 | GetComputerObjectNameW | |
SHELL32.dll | 289 | ShellExecuteExW | |
SHELL32.dll | 207 | SHGetMalloc | |
SHELL32.dll | 215 | SHGetPathFromIDListW | |
SHELL32.dll | 223 | SHGetSpecialFolderLocation | |
SHELL32.dll | 290 | ShellExecuteW | |
SHELL32.dll | 286 | ShellExecuteA | |
USER32.dll | 526 | MessageBoxA | |
USER32.dll | 732 | ShowScrollBar | |
USER32.dll | 276 | GetClientRect | |
USER32.dll | 631 | SendMessageA | |
USER32.dll | 644 | SetClassLongW | |
USER32.dll | 715 | SetWindowTextW | |
USER32.dll | 491 | LoadCursorW | |
USER32.dll | 648 | SetCursor | |
USER32.dll | 97 | CreateDialogIndirectParamW | |
USER32.dll | 659 | SetForegroundWindow | |
USER32.dll | 216 | EnableWindow | |
USER32.dll | 300 | GetFocus | |
USER32.dll | 658 | SetFocus | |
USER32.dll | 621 | ScreenToClient | |
USER32.dll | 539 | MoveWindow | |
USER32.dll | 493 | LoadIconW | |
USER32.dll | 656 | SetDlgItemTextW | |
USER32.dll | 636 | SendMessageW | |
USER32.dll | 295 | GetDlgItem | |
USER32.dll | 540 | MsgWaitForMultipleObjects | |
USER32.dll | 563 | PeekMessageW | |
USER32.dll | 461 | IsDialogMessageW | |
USER32.dll | 764 | TranslateMessage | |
USER32.dll | 175 | DispatchMessageW | |
USER32.dll | 166 | DestroyWindow | |
USER32.dll | 735 | ShowWindow | |
USER32.dll | 627 | SendDlgItemMessageW | |
USER32.dll | 412 | GetWindowRect | |
USER32.dll | 748 | SystemParametersInfoW | |
USER32.dll | 245 | ExitWindowsEx | |
USER32.dll | 533 | MessageBoxW | |
USER32.dll | 208 | DrawTextW | |
USER32.dll | 382 | GetSystemMetrics | |
USER32.dll | 289 | GetDC | |
USER32.dll | 292 | GetDialogBaseUnits | |
USER32.dll | 613 | ReleaseDC | |
USER32.dll | 99 | CreateDialogParamW | |
USER32.dll | 495 | LoadImageW | |
CRYPT32.dll | 61 | CertFreeCertificateChain | |
CRYPT32.dll | 116 | CertVerifyCertificateChainPolicy | |
CRYPT32.dll | 69 | CertGetCertificateChain | |
WININET.dll | 116 | InternetCrackUrlW | |
WININET.dll | 109 | InternetCombineUrlW | |
msi.dll | 8 | ||
msi.dll | 150 | ||
msi.dll | 78 | ||
msi.dll | 92 |
ord | entry_va | function_name | |
---|---|---|---|
1 | 0x19c45 | _DecodePointerInternal@4 | |
2 | 0x19c23 | _EncodePointerInternal@4 |
StringTable 040904B0
CompanyName | |
FileDescription | Setup |
FileVersion | 10.0.30319.1 built by: RTMRel |
InternalName | setup.exe |
LegalCopyright | © Microsoft Corporation. All rights reserved. |
OriginalFilename | setup.exe |
ProductName | |
ProductVersion | 10.0.30319.1 |
VS_FIXEDFILEINFO
FileVersion | 10.0.30319.1 |
ProductVersion | 10.0.30319.1 |
StrucVersion | 0x10000 |
FileFlagsMask | 0x3f |
FileFlags | 0 |
FileOS | 4 |
FileType | 1 |
FileSubtype | 0 |
Signers (1)
issuer: /CN=\x00I\x00N\x00\\x00p\x00a\x00r\x00e\x00s\x00h\x00.\x00g\x00.\x00p\x00r\x00a\x00j\x00a\x00p\x00a\x00t\x00i
serial: 3BE1EA04C5AA40844BA0029C58B04415
Certificates (1)
Certificate: Data: Version: 3 (0x2) Serial Number: 3b:e1:ea:04:c5:aa:40:84:4b:a0:02:9c:58:b0:44:15 Signature Algorithm: sha1WithRSAEncryption Issuer: CN=\x00I\x00N\x00\\x00p\x00a\x00r\x00e\x00s\x00h\x00.\x00g\x00.\x00p\x00r\x00a\x00j\x00a\x00p\x00a\x00t\x00i Validity Not Before: Apr 24 14:55:01 2014 GMT Not After : Apr 24 20:55:01 2015 GMT Subject: CN=\x00I\x00N\x00\\x00p\x00a\x00r\x00e\x00s\x00h\x00.\x00g\x00.\x00p\x00r\x00a\x00j\x00a\x00p\x00a\x00t\x00i Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public-Key: (1024 bit) Modulus: 00:a8:98:af:3d:43:37:68:d9:a3:58:0a:0c:94:2b: ba:bf:82:f0:c6:5b:e2:10:d2:54:fd:bd:2f:92:ba: 1c:bf:1c:d6:e7:cc:14:0d:8d:bc:90:6d:1a:82:80: e3:53:77:01:30:11:31:97:5b:31:70:ec:65:15:cd: cf:e3:63:00:7d:e7:f6:db:4a:0e:6e:01:93:fa:05: b6:1b:04:ea:c8:67:55:b9:13:01:18:ae:7f:32:e8: 2e:a9:60:2e:2e:dd:77:5c:da:fc:dd:5c:4a:6e:9c: 28:8b:ca:10:a0:6e:51:a6:ba:27:c5:13:d2:7f:1c: 36:39:19:e5:96:bd:fe:31:bd Exponent: 65537 (0x10001) Signature Algorithm: sha1WithRSAEncryption 5d:27:4e:ba:b2:9c:57:dc:20:6c:ee:e7:9c:ed:4f:a6:6c:2b: 15:95:0b:c1:1f:6a:db:8a:11:31:73:1c:d0:f8:f1:59:fa:9f: 65:5f:72:0d:68:8b:75:49:a4:2a:08:80:2c:44:f3:a6:bb:54: cc:86:51:83:20:47:d9:c3:38:e8:bc:0d:71:8a:88:d9:0b:72: 12:11:cc:da:1c:71:de:1a:7e:d7:bd:8c:c2:a4:e8:6b:81:6f: df:bb:93:0d:d1:56:2b:ab:f6:e8:5f:bc:50:26:fd:42:f8:94: 0e:a3:d5:b2:5c:6f:8c:b2:e1:a7:07:87:14:1f:14:28:bc:83: e7:1b
pkcs7-signedData
- 1
- SHA1: nil
- 1.3.6.1.4.1.311.2.1.4
- #0
- 1.3.6.1.4.1.311.2.1.15
- :
00 3c 00 3c 00 3c 00 4f 00 62 00 73 00 6f 00 6c |.<.<.<.O.b.s.o.l| 00 65 00 74 00 65 00 3e 00 3e 00 3e |.e.t.e.>.>.> |
- :
- SHA1
74 77 0a 8a bc 41 f8 8b 48 68 56 0c d2 e1 51 89 |tw...A..HhV...Q.| 4e f8 32 84 |N.2. |
- 1.3.6.1.4.1.311.2.1.15
- #0
- #2
- 2
- 3B:E1:EA:04:C5:AA:40:84:4B:A0:02:9C:58:B0:44:15
- RSA-SHA1: nil
- CN:
00 49 00 4e 00 5c 00 70 00 61 00 72 00 65 00 73 |.I.N.\.p.a.r.e.s| 00 68 00 2e 00 67 00 2e 00 70 00 72 00 61 00 6a |.h...g...p.r.a.j| 00 61 00 70 00 61 00 74 00 69 |.a.p.a.t.i |
- 2014-04-24 14:55:01 UTC: 2015-04-24 20:55:01 UTC
- CN:
00 49 00 4e 00 5c 00 70 00 61 00 72 00 65 00 73 |.I.N.\.p.a.r.e.s| 00 68 00 2e 00 67 00 2e 00 70 00 72 00 61 00 6a |.h...g...p.r.a.j| 00 61 00 70 00 61 00 74 00 69 |.a.p.a.t.i |
- #5
- rsaEncryption: nil
- A8:98:AF:3D:43:37:68:D9:A3:58:0A:0C:94:2B:BA:BF:
82:F0:C6:5B:E2:10:D2:54:FD:BD:2F:92:BA:1C:BF:1C:
D6:E7:CC:14:0D:8D:BC:90:6D:1A:82:80:E3:53:77:01:
30:11:31:97:5B:31:70:EC:65:15:CD:CF:E3:63:00:7D:
E7:F6:DB:4A:0E:6E:01:93:FA:05:B6:1B:04:EA:C8:67:
55:B9:13:01:18:AE:7F:32:E8:2E:A9:60:2E:2E:DD:77:
5C:DA:FC:DD:5C:4A:6E:9C:28:8B:CA:10:A0:6E:51:A6:
BA:27:C5:13:D2:7F:1C:36:39:19:E5:96:BD:FE:31:BD: 0x010001
- RSA-SHA1:
5d 27 4e ba b2 9c 57 dc 20 6c ee e7 9c ed 4f a6 |]'N...W. l....O.| 6c 2b 15 95 0b c1 1f 6a db 8a 11 31 73 1c d0 f8 |l+.....j...1s...| f1 59 fa 9f 65 5f 72 0d 68 8b 75 49 a4 2a 08 80 |.Y..e_r.h.uI.*..| 2c 44 f3 a6 bb 54 cc 86 51 83 20 47 d9 c3 38 e8 |,D...T..Q. G..8.| bc 0d 71 8a 88 d9 0b 72 12 11 cc da 1c 71 de 1a |..q....r.....q..| 7e d7 bd 8c c2 a4 e8 6b 81 6f df bb 93 0d d1 56 |~......k.o.....V| 2b ab f6 e8 5f bc 50 26 fd 42 f8 94 0e a3 d5 b2 |+..._.P&.B......| 5c 6f 8c b2 e1 a7 07 87 14 1f 14 28 bc 83 e7 1b |\o.........(....|
- 2
- 1
- #0
- CN:
00 49 00 4e 00 5c 00 70 00 61 00 72 00 65 00 73 |.I.N.\.p.a.r.e.s| 00 68 00 2e 00 67 00 2e 00 70 00 72 00 61 00 6a |.h...g...p.r.a.j| 00 61 00 70 00 61 00 74 00 69 |.a.p.a.t.i |
- 3B:E1:EA:04:C5:AA:40:84:4B:A0:02:9C:58:B0:44:15
- CN:
- SHA1: nil
- #2
- 1.3.6.1.4.1.311.2.1.12
- nil
- contentType: 1.3.6.1.4.1.311.2.1.4
- messageDigest:
85 99 28 86 26 be af eb fb e2 5f 6e 5f 9a c9 ce |..(.&....._n_...| 99 2c 35 fe |.,5. |
- 1.3.6.1.4.1.311.2.1.12
- rsaEncryption:
67 af 7e 4f 5e 8c 1a 10 cc 82 9a 0b 44 fe 4e 36 |g.~O^.......D.N6| 24 98 ee a3 15 f1 be c6 0b da 8f 98 fb 6c 9b 89 |$............l..| 65 ea 57 9b 07 5f bd 51 f4 9c 4b 33 bb 1a 3d 3b |e.W.._.Q..K3..=;| 82 64 3d 3d cf 5a 2a 8c ee 19 bc bf 0f 88 a5 d5 |.d==.Z*.........| 1e ad 19 45 75 bf ef 62 e5 44 60 7a d5 11 63 f9 |...Eu..b.D`z..c.| 41 0c 3e 96 51 9c 63 2e 8a f9 0f 7f fc f9 4e 1b |A.>.Q.c.......N.| 30 3e 20 4a 29 38 70 1b 50 69 84 4c ef 89 72 bb |0> J)8p.Pi.L..r.| 90 37 46 3f 30 4e 87 aa fb 42 25 c4 8d c6 0e e4 |.7F?0N...B%.....|
- #0
Please donate some bucks to keep this site up and running: | |
Ko-fi | |
---|---|
Yandex.Money | |
Thank you! |
everything is OK