filenameDefaultPack.EXE
size2938256 (0x2cd590)
md59ea5dad528a750951b8a5a7285e2b6a2
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavscan pending
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf8

Rich Header

lib idversiontimes used
187307166
1893071614
1883071668
1853071617
10201
192307169
126507271
183307161
186307161

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0x5183234b
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion10.10
SizeOfCode0x6600
SizeOfInitializedData0x2c4800
SizeOfUninitializedData0
AddressOfEntryPoint0x6926
BaseOfCode0x1000
BaseOfData0x8000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.2
ImageVersion6.2
SubsystemVersion5.1
Reserved10
SizeOfImage0x2cf000
SizeOfHeaders0x400
CheckSum0x2ce2b6
Subsystem2
DllCharacteristics0x8140
SizeOfStackReserve0x40000
SizeOfStackCommit0x2000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

namevavsizeraw sizeflags
.text0x10000x64240x6600R-X CODE
.data0x80000x1e6c0x600RW- IDATA
.idata0xa0000x10bc0x1200R-- IDATA
.rsrc0xc0000x2c1e580x2c2000R-- IDATA
.reloc0x2ce0000xe0a0x1000R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0xa0000xb4
RESOURCE0xc0000x2c1e58
EXCEPTION00
SECURITY0x2cb2000x2390
BASERELOC0x2ce0000x828
DEBUG0x10200x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x13980x40
Bound_IAT00
IAT0xa34c0x298
Delay_IAT00
CLR_Header00
typenamesizecp
AVI#3001118021252
ICON#116401252
ICON#27441252
ICON#34881252
ICON#42961252
ICON#537521252
ICON#622161252
ICON#717361252
ICON#813841252
ICON#9557621252
ICON#1096401252
ICON#1142641252
ICON#1224401252
ICON#1311281252
DIALOG#20017541252
DIALOG#20024321252
DIALOG#20033581252
DIALOG#20044481252
DIALOG#20053041252
DIALOG#20062881252
STRING#631401252
STRING#7613121252
STRING#7714841252
STRING#8012001252
STRING#8310981252
STRING#859741252
RCDATAADMQCMD71252
RCDATACABINET27784651252
RCDATAEXTRACTOPT41252
RCDATAFILESIZES361252
RCDATAFINISHMSG71252
RCDATALICENSE71252
RCDATAPACKINSTSPACE41252
RCDATAPOSTRUNPROGRAM71252
RCDATAREBOOT41252
RCDATARUNPROGRAM281252
RCDATASHOWWINDOW41252
RCDATATITLE131252
RCDATAUPROMPT71252
RCDATAUSRQCMD71252
GROUP_ICON#30001881252
VERSION#113041252
VERSION#110641252
MANIFEST#115111252
idlangstring
10001033Please select a folder to store the extracted files.
10011033%s
12001033Failed to get disk space information from: %s. System Message: %s.
12011033A required resource cannot be located.
12021033Are you sure you want to cancel?
12041033Unable to retrieve operating system version information.
12051033Memory allocation request failed.
12081033Unable to create extraction thread.
12101033Cabinet is not valid.
12111033Filetable full.
12121033Can not change to destination folder.
12131033Setup could not find a drive with %s KB free disk space to install the program. Please free up some space first and press RETRY or press CANCEL to exit setup.
12141033That folder is invalid. Please make sure the folder exists and is writable.
12151033You must specify a folder with fully qualified pathname or choose Cancel.
12161033Could not update folder edit box.
12171033Could not load functions required for browser dialog.
12181033Could not load Shell32.dll required for browser dialog.
12201033Error creating process <%s>. Reason: %s
12211033The cluster size in this system is not supported.
12221033A required resource appears to be corrupted.
12231033Windows 95 or Windows NT 4.0 Beta 2 or greater is required for this installation.
12241033Error loading %s
12251033GetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used.
12261033Windows 95 or Windows NT is required to install
12271033Could not create folder '%s'
12281033To install this program, you need %s KB disk space on drive %s. It is recommended that you free up the required disk space before you continue. Do you still want to continue?
12641033Error retrieving Windows folder
12691033NT Shutdown: OpenProcessToken error.
12701033NT Shutdown: AdjustTokenPrivileges error.
12711033NT Shutdown: ExitWindowsEx error.
12721033Extracting file failed. It is most likely caused by low memory (low disk space for swapping file) or corrupted Cabinet file.
12731033The setup program could not retrieve the volume information for drive (%s) . System message: %s.
12741033Setup could not find a drive with %s KB free disk space to install the program. Please free up some space and try again.
12751033The installation program appears to be damaged or corrupted. Contact the vendor of this application.
13121033Command line option syntax error. Type Command /? for Help.
13131033Command line options: /Q -- Quiet modes for package, /T:<full path> -- Specifies temporary working folder, /C -- Extract files only to the folder when used also with /T. /C:<Cmd> -- Override Install Command defined by author.
13141033You must restart your computer before the new settings will take effect. Do you want to restart your computer now?
13161033Another copy of the '%s' package is already running on your system. Do you want to run another copy?
13171033Could not find the file: %s.
13511033You do not have administrator privileges on this machine. Some installations cannot be completed correctly unless they are run by an administrator.
13541033The folder '%s' does not exist. Do you want to create it?
13551033Another copy of the '%s' package is already running on your system. You can only run one copy at a time.
13561033The '%s' package is not compatible with the version of Windows you are running.
13571033The '%s' package is not compatible with the version of the file: %s on your system.
module_namehintordfunction_name
ADVAPI32.dll530OpenProcessToken
ADVAPI32.dll367GetTokenInformation
ADVAPI32.dll677RegSetValueExA
ADVAPI32.dll280EqualSid
ADVAPI32.dll661RegQueryValueExA
ADVAPI32.dll428LookupPrivilegeValueA
ADVAPI32.dll608RegCreateKeyExA
ADVAPI32.dll648RegOpenKeyExA
ADVAPI32.dll655RegQueryInfoKeyA
ADVAPI32.dll623RegDeleteValueA
ADVAPI32.dll32AllocateAndInitializeSid
ADVAPI32.dll307FreeSid
ADVAPI32.dll31AdjustTokenPrivileges
ADVAPI32.dll600RegCloseKey
KERNEL32.dll683GetPrivateProfileIntA
KERNEL32.dll585GetFileAttributesA
KERNEL32.dll897IsDBCSLeadByte
KERNEL32.dll746GetSystemDirectoryA
KERNEL32.dll839GlobalUnlock
KERNEL32.dll724GetShortPathNameA
KERNEL32.dll193CreateDirectoryA
KERNEL32.dll392FindFirstFileA
KERNEL32.dll618GetLastError
KERNEL32.dll693GetProcAddress
KERNEL32.dll1182RemoveDirectoryA
KERNEL32.dll1280SetFileAttributesA
KERNEL32.dll828GlobalFree
KERNEL32.dll388FindClose
KERNEL32.dll689GetPrivateProfileStringA
KERNEL32.dll960LoadLibraryA
KERNEL32.dll969LocalAlloc
KERNEL32.dll1526WritePrivateProfileStringA
KERNEL32.dll636GetModuleFileNameA
KERNEL32.dll409FindNextFileA
KERNEL32.dll164CompareStringA
KERNEL32.dll1545_lopen
KERNEL32.dll142CloseHandle
KERNEL32.dll973LocalFree
KERNEL32.dll288DeleteFileA
KERNEL32.dll365ExitProcess
KERNEL32.dll308DosDateTimeToFileTime
KERNEL32.dll206CreateFileA
KERNEL32.dll417FindResourceA
KERNEL32.dll821GlobalAlloc
KERNEL32.dll368ExpandEnvironmentStringsA
KERNEL32.dll966LoadResource
KERNEL32.dll1467WaitForSingleObject
KERNEL32.dll1276SetEvent
KERNEL32.dll641GetModuleHandleW
KERNEL32.dll435FormatMessageA
KERNEL32.dll1292SetFileTime
KERNEL32.dll1521WriteFile
KERNEL32.dll568GetDriveTypeA
KERNEL32.dll804GetVolumeInformationA
KERNEL32.dll1392TerminateThread
KERNEL32.dll1374SizeofResource
KERNEL32.dll199CreateEventA
KERNEL32.dll581GetExitCodeProcess
KERNEL32.dll235CreateProcessA
KERNEL32.dll1112ReadFile
KERNEL32.dll1544_llseek
KERNEL32.dll766GetTempFileNameA
KERNEL32.dll1198ResetEvent
KERNEL32.dll984LockResource
KERNEL32.dll750GetSystemInfo
KERNEL32.dll961LoadLibraryExA
KERNEL32.dll226CreateMutexA
KERNEL32.dll540GetCurrentDirectoryA
KERNEL32.dll802GetVersionExA
KERNEL32.dll801GetVersion
KERNEL32.dll768GetTempPathA
KERNEL32.dll257CreateThread
KERNEL32.dll971LocalFileTimeToFileTime
KERNEL32.dll1288SetFilePointer
KERNEL32.dll813GetWindowsDirectoryA
KERNEL32.dll1552lstrcmpA
KERNEL32.dll1542_lclose
KERNEL32.dll832GlobalLock
KERNEL32.dll547GetCurrentProcess
KERNEL32.dll443FreeResource
KERNEL32.dll440FreeLibrary
KERNEL32.dll1375Sleep
KERNEL32.dll878InterlockedExchange
KERNEL32.dll875InterlockedCompareExchange
KERNEL32.dll726GetStartupInfoA
KERNEL32.dll1424UnhandledExceptionFilter
KERNEL32.dll1360SetUnhandledExceptionFilter
KERNEL32.dll1391TerminateProcess
KERNEL32.dll1044OutputDebugStringA
KERNEL32.dll1210RtlUnwind
KERNEL32.dll638GetModuleHandleA
KERNEL32.dll1084QueryPerformanceCounter
KERNEL32.dll548GetCurrentProcessId
KERNEL32.dll552GetCurrentThreadId
KERNEL32.dll756GetSystemTimeAsFileTime
KERNEL32.dll784GetTickCount
KERNEL32.dll333EnumResourceLanguagesA
KERNEL32.dll1003MulDiv
KERNEL32.dll562GetDiskFreeSpaceA
KERNEL32.dll1262SetCurrentDirectoryA
GDI32.dll491GetDeviceCaps
USER32.dll722SetForegroundWindow
USER32.dll594MsgWaitForMultipleObjects
USER32.dll687SendDlgItemMessageA
USER32.dll458GetWindowRect
USER32.dll309GetDC
USER32.dll776SetWindowLongA
USER32.dll580MessageBoxA
USER32.dll451GetWindowLongA
USER32.dll617PeekMessageA
USER32.dll674ReleaseDC
USER32.dll317GetDlgItem
USER32.dll779SetWindowPos
USER32.dll796ShowWindow
USER32.dll181DispatchMessageA
USER32.dll783SetWindowTextA
USER32.dll229EnableWindow
USER32.dll29CallWindowProcA
USER32.dll175DialogBoxIndirectParamA
USER32.dll319GetDlgItemTextA
USER32.dll558LoadStringA
USER32.dll579MessageBeep
USER32.dll57CharUpperA
USER32.dll47CharNextA
USER32.dll261ExitWindowsEx
USER32.dll50CharPrevA
USER32.dll232EndDialog
USER32.dll312GetDesktopWindow
USER32.dll718SetDlgItemTextA
USER32.dll692SendMessageA
USER32.dll425GetSystemMetrics
msvcrt.dll55void __cdecl terminate(void)

?terminate@@YAXXZ

msvcrt.dll295_controlfp
msvcrt.dll472_initterm
msvcrt.dll212__setusermatherr
msvcrt.dll503_ismbblead
msvcrt.dll190__p__fmode
msvcrt.dll276_cexit
msvcrt.dll355_exit
msvcrt.dll1171exit
msvcrt.dll1266memset
msvcrt.dll1262memcpy
msvcrt.dll210__set_app_type
msvcrt.dll145__getmainargs
msvcrt.dll257_amsg_exit
msvcrt.dll185__p__commode
msvcrt.dll106_XcptFilter
msvcrt.dll343_errno
msvcrt.dll971_vsnprintf
msvcrt.dll231_acmdln
COMCTL32.dll17
Cabinet.dll22
Cabinet.dll23
Cabinet.dll21
Cabinet.dll20
VERSION.dllGetFileVersionInfoA
VERSION.dll4GetFileVersionInfoSizeA
VERSION.dll15VerQueryValueA

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionDefaultPack.EXE
FileVersion1.7.63.1
InternalNameWextract
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenameWEXTRACT.EXE .MUI
ProductNameDefaultPack.EXE
ProductVersion1.7.63.1

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionWin32 Cabinet Self-Extractor
FileVersion10.00.9200.16384 (win8_rtm.120725-1247)
InternalNameWextract
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenameWEXTRACT.EXE .MUI
ProductNameWindows® Internet Explorer
ProductVersion10.00.9200.16384

VS_FIXEDFILEINFO

FileVersion1.7.63.1
ProductVersion1.7.63.1
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0

VS_FIXEDFILEINFO

FileVersion10.0.9200.16384
ProductVersion10.0.9200.16384
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0

Signers (1)

issuer: /C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Code Signing PCA 2011
serial: 33000001DF6BF02E92A74AB4D00000000001DF

Certificates (2)

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:01:df:6b:f0:2e:92:a7:4a:b4:d0:00:00:00:00:01:df
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Code Signing PCA 2011
        Validity
            Not Before: Dec 15 21:31:45 2020 GMT
            Not After : Dec  2 21:31:45 2021 GMT
        Subject: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Corporation
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:b6:bb:19:59:10:00:a3:a9:f1:e4:b8:5c:a8:0b:
                    07:cb:db:9a:1f:23:d0:d9:58:ab:78:c0:48:f7:24:
                    14:38:f0:63:ed:d5:4b:03:bf:cd:f8:09:ca:14:50:
                    f3:27:b3:fe:82:b4:fa:1a:43:84:e1:cb:f9:1b:38:
                    e8:3f:cc:90:27:ac:97:a2:31:0a:91:7b:62:ec:75:
                    bf:cd:48:8d:a0:5d:75:fd:95:a7:75:ff:23:d4:0c:
                    e5:e8:e0:63:70:3e:35:ea:d4:96:62:f8:76:55:f7:
                    56:d4:af:a6:63:cd:e3:e3:d6:0f:9b:7a:9b:2a:77:
                    f1:c2:d5:74:9c:8f:47:d3:dd:a0:31:2d:1c:a4:25:
                    2c:c4:c4:40:66:53:d7:92:ca:e3:b0:52:ea:be:0a:
                    b8:ae:75:0b:56:18:c7:49:53:ae:74:bf:f2:a6:cd:
                    f3:38:e9:8e:a5:a3:f3:02:9e:7a:6f:cf:7c:c4:2f:
                    b3:cc:75:47:70:aa:3f:e7:62:11:86:dd:45:48:2f:
                    15:fb:b4:07:4c:6f:3e:cb:37:ee:96:38:8a:53:d4:
                    0e:35:af:06:a8:39:59:ef:fb:c5:1a:f7:81:f0:86:
                    36:66:bb:54:bb:df:27:95:ed:16:59:37:1a:21:11:
                    e8:09:8b:d6:18:b2:c5:da:ed:46:54:52:40:82:03:
                    e2:a7
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Extended Key Usage: 
                1.3.6.1.4.1.311.76.8.1, Code Signing
            X509v3 Subject Key Identifier: 
                38:F6:CC:2F:C2:1D:90:D1:AD:09:F3:26:54:FB:6F:23:A5:59:F3:E3
            X509v3 Subject Alternative Name: 
                DirName:/OU=Microsoft Operations Puerto Rico/serialNumber=230012+463009
            X509v3 Authority Key Identifier: 
                keyid:48:6E:64:E5:50:05:D3:82:AA:17:37:37:22:B5:6D:A8:CA:75:02:95

            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl

            Authority Information Access: 
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/MicCodSigPCA2011_2011-07-08.crt

            X509v3 Basic Constraints: critical
                CA:FALSE
    Signature Algorithm: sha256WithRSAEncryption
         9e:7a:87:b4:3c:98:50:56:95:02:4b:c0:2b:47:aa:ab:a9:e1:
         a0:bf:79:49:94:2e:dd:19:e9:67:bb:5d:43:cf:50:47:7f:be:
         ec:0f:b8:86:ba:fb:57:8c:71:9a:40:79:04:e6:d2:d1:82:be:
         30:02:c4:d3:66:ad:8f:05:a0:3d:da:58:43:af:16:74:b1:ab:
         a0:96:47:91:b6:5d:80:44:46:fb:bb:44:4c:59:77:68:a1:78:
         2a:9a:12:68:63:ac:91:95:e9:4c:f9:c2:68:ca:36:3d:7a:00:
         31:53:06:a6:c4:04:42:cc:22:99:9a:b7:21:0d:e7:45:07:c1:
         94:9d:0f:a0:c3:1c:37:ff:8f:92:cf:19:4c:bd:41:a0:f6:2c:
         26:9a:24:b7:a7:2a:97:9f:6a:e8:2c:a9:65:82:30:83:22:7c:
         f7:61:e9:b6:dc:9b:1c:a8:35:66:d4:0b:52:54:97:71:c4:4c:
         96:e8:0f:80:47:0d:64:96:a0:3c:48:0f:62:78:b8:6f:5d:6c:
         9e:34:40:81:fd:1d:c9:0d:33:23:d6:8b:5e:a4:f1:59:45:39:
         a4:22:05:88:f4:f4:6f:6c:2c:c7:34:6a:0a:dc:86:aa:99:06:
         33:c3:fd:19:ac:ce:f1:e6:a8:99:52:2d:09:80:5c:25:20:72:
         07:1f:e9:4b:47:12:63:00:41:1c:06:71:24:e0:d4:ab:14:97:
         a1:21:83:be:64:df:a9:42:57:9e:d9:d6:90:be:28:92:89:35:
         16:20:83:67:88:e9:c9:73:90:ba:76:fa:7a:02:17:be:48:10:
         ee:36:f6:b8:ed:ba:3b:0d:26:f1:1c:25:78:3b:e1:38:ca:e7:
         1e:cb:a9:88:e3:db:a3:32:ab:a1:26:ba:a5:a1:6d:55:28:7c:
         f5:a6:d4:4a:8a:11:f1:07:59:72:27:a6:9a:81:61:71:69:04:
         c0:58:38:b2:9c:ef:60:d3:f8:9c:8b:35:f7:7d:ba:d5:6c:93:
         69:13:19:a1:c7:86:ba:7e:c6:09:3d:91:97:ae:77:b9:48:fe:
         17:e8:3d:e1:ce:b7:02:1c:d2:ab:89:21:74:be:07:94:52:0f:
         d9:e3:ef:db:db:26:7d:49:c7:b4:6a:ba:c9:81:43:2e:74:f4:
         ab:f6:3e:0e:2d:e3:c2:5a:05:f0:45:a4:90:74:6d:4a:e5:e5:
         15:46:d3:9b:0a:ff:94:30:e0:6e:96:62:2a:12:d2:ec:20:53:
         0e:3d:f6:23:42:f9:8b:9d:f6:fa:e1:dc:cf:0f:36:a1:90:e6:
         62:66:26:21:44:8c:6d:93:a0:4b:ae:61:ef:de:eb:8f:92:49:
         e8:e9:1e:11:42:68:01:5c
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            61:0e:90:d2:00:00:00:00:00:03
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Root Certificate Authority 2011
        Validity
            Not Before: Jul  8 20:59:09 2011 GMT
            Not After : Jul  8 21:09:09 2026 GMT
        Subject: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Code Signing PCA 2011
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (4096 bit)
                Modulus:
                    00:ab:f0:fa:72:10:1c:2e:ad:d8:6e:aa:82:10:4d:
                    34:ba:f2:b6:58:21:9f:42:1b:2a:6b:e9:5a:50:aa:
                    b8:06:38:1a:04:49:ba:7f:c3:0c:1e:dd:37:6b:c6:
                    12:d8:0b:f0:38:c2:99:06:b0:c8:39:d5:01:14:31:
                    42:d3:89:0d:79:64:87:7e:94:60:24:6c:af:9e:49:
                    9c:e9:68:5e:d2:df:9b:53:b2:0a:2c:c3:af:d9:a9:
                    2b:ae:7a:09:af:d7:96:59:ca:60:1a:05:e9:66:76:
                    e8:32:52:26:12:2f:e7:ab:08:50:cf:b3:44:b7:5d:
                    d8:c4:2e:03:75:ab:68:f3:cb:6d:f3:3a:5c:a1:16:
                    f4:46:ba:e0:38:64:ac:6e:64:35:78:a6:a0:63:0f:
                    2d:d3:40:93:f8:e3:de:07:0d:d5:5c:79:a5:49:29:
                    e7:0d:be:a0:13:77:be:94:3d:ef:fb:e3:2b:5a:10:
                    1f:4d:56:28:a2:7a:72:e0:12:3a:b7:49:5e:d8:ed:
                    ed:43:91:83:d9:7b:b2:7b:86:1b:d9:3e:b1:8c:5d:
                    e8:89:4f:84:1a:f2:a1:2f:59:e4:90:3b:2d:ae:33:
                    58:c5:b7:3e:fe:32:d3:b3:03:3d:b1:b2:af:92:38:
                    7e:d2:9d:80:2c:f5:4e:56:91:21:35:25:c3:39:6e:
                    64:7f:53:ba:9c:0f:ad:19:23:84:cb:f4:ba:03:86:
                    8d:f7:5f:f0:d0:52:bf:8c:94:87:bc:c0:21:74:25:
                    5f:18:28:b6:cc:27:28:38:25:98:39:4a:36:cf:7c:
                    b1:92:ae:1c:23:a7:a9:66:ec:61:1f:6a:e1:28:49:
                    9d:5f:88:e2:25:5d:d3:21:4b:3e:52:c4:b5:57:3f:
                    24:03:f0:d1:7a:5b:2f:d5:23:e3:70:5d:0f:51:46:
                    77:b3:f8:00:e1:bc:ac:02:82:5f:db:c0:15:b3:bd:
                    1b:d4:55:4b:e7:39:a1:0f:e9:23:49:bc:18:b8:44:
                    7c:45:e4:c1:c3:72:7a:e0:72:e7:24:df:bf:46:99:
                    c5:ef:c2:1c:57:db:83:8d:ec:4d:49:30:a7:ab:8e:
                    df:ec:5b:9f:af:fc:dd:b0:66:e2:c1:97:81:7b:ed:
                    d6:ed:4b:e7:49:29:a7:13:28:a6:a7:7d:67:80:e6:
                    8a:62:78:5f:b2:2f:84:d7:57:9c:5c:bf:77:28:28:
                    f1:ed:6d:c3:28:8f:2c:8f:40:37:4f:c1:e1:85:44:
                    89:c4:09:4c:c5:d4:a5:43:2f:74:95:f7:6e:f8:78:
                    20:58:2c:13:5d:60:95:9a:3e:4f:33:84:da:b0:88:
                    17:de:9e:4e:f4:96:b0:bc:46:a0:6c:98:d2:e0:d6:
                    88:8c:0b
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            1.3.6.1.4.1.311.21.1: 
                ...
            X509v3 Subject Key Identifier: 
                48:6E:64:E5:50:05:D3:82:AA:17:37:37:22:B5:6D:A8:CA:75:02:95
            1.3.6.1.4.1.311.20.2: 
                .
.S.u.b.C.A
            X509v3 Key Usage: 
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier: 
                keyid:72:2D:3A:02:31:90:43:B9:14:05:4E:E1:EA:A7:C7:31:D1:23:89:34

            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl

            Authority Information Access: 
                CA Issuers - URI:http://www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt

            X509v3 Certificate Policies: 
                Policy: 1.3.6.1.4.1.311.46.3
                  CPS: http://www.microsoft.com/pkiops/docs/primarycps.htm
                  User Notice:
                    Explicit Text:  

    Signature Algorithm: sha256WithRSAEncryption
         67:f2:86:a5:98:e0:54:79:1a:2e:d3:d8:74:67:22:9b:0b:96:
         11:e1:63:92:99:42:96:7d:d2:79:0c:90:c1:65:5f:2e:2c:3e:
         f8:c3:72:d1:6d:83:fe:be:3f:e8:0a:ca:3b:bf:47:a9:a3:f3:
         69:db:63:bf:22:35:a5:97:5d:65:84:90:7d:8b:46:50:55:d8:
         0c:92:7c:d2:1a:4b:1c:f3:3c:42:8b:52:d0:b0:fd:6b:e3:3e:
         07:2e:29:9b:e6:3d:1b:a5:d4:b5:1d:77:94:39:e2:e9:64:c9:
         44:3d:78:7a:23:f3:13:7d:a6:90:74:83:8d:f4:cb:26:02:46:
         2a:c2:8a:10:bb:a4:a9:05:0c:9b:ed:68:fa:68:2e:95:a0:2a:
         3f:2a:6b:58:49:63:1f:09:69:6e:5a:98:96:e4:83:f4:c0:8f:
         f3:46:2b:de:fc:3b:d0:bd:35:ef:6e:25:ae:e5:af:27:ed:d0:
         dd:f3:0e:af:99:28:97:98:4d:0e:3d:0b:f2:08:89:d6:1f:c3:
         32:18:e2:f0:c5:2d:ce:5b:9e:b4:49:39:0a:c6:0a:c2:c6:ad:
         ae:e5:b2:d9:db:15:88:51:45:58:38:32:71:27:1a:7f:b1:f4:
         27:f8:de:2c:3a:20:69:98:b2:59:89:68:6e:6f:a7:b7:74:c3:
         40:05:06:a6:01:2a:28:3e:82:3f:13:4d:66:0b:c0:b3:4d:f5:
         e1:8f:7f:1c:6f:15:7d:45:a7:76:e5:40:2a:65:a3:c3:5d:52:
         62:86:c3:1d:63:36:97:86:df:da:f3:f8:f2:16:a1:9a:27:e1:
         cd:a5:97:d0:ee:5d:63:41:e3:5b:07:9c:87:3e:06:77:06:d1:
         06:b1:75:1f:14:be:61:61:b5:f0:dc:c6:1b:04:be:df:41:c7:
         0e:28:ee:de:65:2f:ec:97:f6:a1:5c:96:d8:00:d6:a1:46:bd:
         59:f3:97:a5:09:4b:48:10:99:80:1f:d0:00:29:c5:b1:9b:a5:
         3f:45:77:1e:35:c6:d2:a2:a2:9f:7a:7a:22:fa:48:95:1f:ab:
         fb:47:23:80:f5:9e:f8:bf:6b:b7:4b:97:e2:eb:75:78:1a:ec:
         ea:37:99:79:18:4b:ff:d6:b3:23:68:75:e6:af:fa:fc:8b:eb:
         0b:80:ea:69:3b:af:fc:30:ed:04:4c:8e:df:df:75:6d:63:91:
         3d:d1:9d:56:4e:4f:bf:80:57:22:a1:78:11:32:21:7a:ef:41:
         0a:b1:3f:fb:a8:cc:a4:5d:c1:a1:88:9b:57:71:56:4e:48:45:
         c0:42:c9:9b:76:5b:0a:80:48:6b:fd:79:9f:c1:bd:6d:6d:6a:
         c9:52:73:13:0d:7a:50:cd

undefined method `first' for #

offsetsizetypecomment
02929152EXE05/03/2013 02:39:07#
15c115HTM#
8c1011794AVI#
ea0c55762PNG(256 x 256)#
2cb2009104PKCS7Authenticode Signature#
Scanning the drive for archives:
1 file, 2938256 bytes (2870 KiB)


--
Type = PE
WARNING = Checksum error
Physical Size = 2938256
CPU = x86
Characteristics = Executable 32-bit
Created = 2013-05-03 02:39:07
Headers Size = 1024
Checksum = 2941622
Name = WEXTRACT.EXE            .MUI
Image Size = 2945024
Section Alignment = 4096
File Alignment = 512
Code Size = 26112
Initialized Data Size = 2902016
Uninitialized Data Size = 0
Linker Version = 10.10
OS Version = 6.2
Image Version = 6.2
Subsystem Version = 5.1
Subsystem = Windows GUI
DLL Characteristics = Relocated NX-Compatible TerminalServerAware
Stack Reserve = 262144
Stack Commit = 8192
Heap Reserve = 1048576
Heap Commit = 4096
Image Base = 4194304
Comment = FileVersion: 1.7.63.1
FileVersion: 10.0.9200.16384
FileVersion: 10.00.9200.16384 (win8_rtm.120725-1247)
ProductVersion: 1.7.63.1
ProductVersion: 10.0.9200.16384
ProductVersion: 10.00.9200.16384
CompanyName: Microsoft Corporation
FileDescription: DefaultPack.EXE
FileDescription: Win32 Cabinet Self-Extractor                                           
InternalName: Wextract                
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFilename: WEXTRACT.EXE            .MUI
ProductName: DefaultPack.EXE
ProductName: Windows® Internet Explorer
----
Path = .rsrc/1033/RCDATA/CABINET
Size = 2778465
Packed Size = 2778465
--
Path = .rsrc/1033/RCDATA/CABINET
Type = Cab
Physical Size = 2778465
Method = LZX:21
Blocks = 1
Volumes = 1
Volume Index = 0
ID = 8666

   Date      Time    Attr         Size   Compressed  Name
------------------- ----- ------------ ------------  ------------------------
2018-03-08 02:40:56 ....A      6970728               DefaultPack.EXE
2017-12-26 05:00:32 ....A       227815               InstallerConfig.xml
2017-12-26 05:00:32 ....A         1429               Logo.png
2017-12-26 05:00:32 ....A       270398               Pack.ico
2017-12-26 05:00:32 ....A        34631               SampleImage.png
2017-12-26 05:00:32 ....A         1746               Logo_zh-cn.png
2017-12-26 04:58:42 ....A       144008               BingSvc.exe
------------------- ----- ------------ ------------  ------------------------
2018-03-08 02:40:56            7650755      2938256  7 files

Warnings: 1
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable







[?] ignoring invalid PEdump::BITMAPINFOHEADER