IObit.MalwareFighter

SUSPICIOUS

103d3264de73abdc2c33a4f15ab0c291aa0d8b7318b861cb63cebc630aef6b30 · 54%

AI Legitimate IObit installer with standard features

Mal-ecule

O₄(CP₃DyI₂)H₆(DbF₂Mg₂Os₇Po₆U)Md₃(Bi₄PaSi₃)

Size 64.8 MB download

First seen 10 days ago

Analyzed 7 days ago

Ecosystem windows

Source cdn.iobit.com

Inno DBK privileged process loader: iobit_malware_fighter_setup.exe:0x0

Inno installer exposes DBK wrapper staging: iobit_malware_fighter_setup.exe:0x0

HKLM Run registry key path: iobit_malware_fighter_setup.exe:0x15b0303

iobit_malware_fighter_setup.exe pe

0x0	4d5a50000200000004000f00ffff0000	MZP.............Inno DBK privileged process loader
0x10	b80000000000000040001a0000000000	........@.......
0x20	00000000000000000000000000000000	................
0x30	00000000000000000000000000010000	................
0x40	ba10000e1fb409cd21b8014ccd219090	........!..L.!..
0x50	546869732070726f6772616d206d7573	This program mus
0x60	742062652072756e20756e6465722057	t be run under W
0x70	696e33320d0a24370000000000000000	in32..$7........
0x80	00000000000000000000000000000000	................
0x90	00000000000000000000000000000000	................
0xa0	00000000000000000000000000000000	................
0xb0	00000000000000000000000000000000	................
0xc0	00000000000000000000000000000000	................
0xd0	00000000000000000000000000000000	................
0xe0	00000000000000000000000000000000	................
0xf0	00000000000000000000000000000000	................
0x100	504500004c010b00102c166800000000	PE..L....,.h....
0x110	00000000e00002010b01021900c00a00	................
0x120	00	.

0xb610	8d45f8ba02000000e817bdffff58ffe0	.E...........X..
0xb620	e9b7b2ffffebe95e5b8be55dc3000000	.......^[..]....
0xb630	53006f00660074007700610072006500	S.o.f.t.w.a.r.e.
0xb640	5c0045006d0062006100720063006100	\.E.m.b.a.r.c.a.
0xb650	6400650072006f005c004c006f006300	d.e.r.o.\.L.o.c.
0xb660	61006c00650073000000000053006f00	a.l.e.s.....S.o.
0xb670	6600740077006100720065005c004300	f.t.w.a.r.e.\.C.
0xb680	6f006400650047006500610072005c00	o.d.e.G.e.a.r.\.
0xb690	4c006f00630061006c00650073000000	L.o.c.a.l.e.s...
0xb6a0	53006f00660074007700610072006500	S.o.f.t.w.a.r.e.Inno DBK privileged process loader
0xb6b0	5c0042006f0072006c0061006e006400	\.B.o.r.l.a.n.d.
0xb6c0	5c004c006f00630061006c0065007300	\.L.o.c.a.l.e.s.
0xb6d0	0000000053006f006600740077006100	....S.o.f.t.w.a.
0xb6e0	720065005c0042006f0072006c006100	r.e.\.B.o.r.l.a.
0xb6f0	6e0064005c00440065006c0070006800	n.d.\.D.e.l.p.h.
0xb700	69005c004c006f00630061006c006500	i.\.L.o.c.a.l.e.
0xb710	7300000000000000558bec6a0053568b	s.......U..j.SV.
0xb720	da8bf033c0556871c3400064ff306489	...3.Uhq.@.d.0d.
0xb730	20833d20ec4a0000	.= .J..

0xe41e	000094f0400000000000e2f040000800	....@.......@...
0xe42e	0000ec16400048634000506340004465	....@.Hc@.Pc@.De
0xe43e	40003c6540005c654000606540006465	@.<e@.\e@.`e@.de
0xe44e	400058654000dc614000f461400040f3	@.Xe@..a@..a@.@.
0xe45e	40002c5b40002c5b40002c5b40002c5b	@.,[@.,[@.,[@.,[
0xe46e	40002c5b40002c5b40002c5b40002c5b	@.,[@.,[@.,[@.,[
0xe47e	40002c5b40002c5b40002c5b40002c5b	@.,[@.,[@.,[@.,[
0xe48e	40002c5b400000000900f2f040004100	@.,[@.......@.A.
0xe49e	f4ff0af140004d00ffff31f14000ca00	....@.M...1.@...Inno installer exposes DBK wrapper staging
0xe4ae	0c0069f140004200f4ff91f140004200	..i.@.B.....@.B.
0xe4be	f4ffbbf140004100f4fff8f140004100	....@.A.....@.A.
0xe4ce	f4ff35f240004100f4ff81f240004100	..5.@.A.....@.A.
0xe4de	f4ff0d000f544d756c74695761697445	.....TMultiWaitE
0xe4ee	76656e74180028ec4a00064372656174	vent..(.J..Creat
0xe4fe	650300d0f240000800000200270040f3	e....@......'.@.
0xe50e	40000744657374726f79030000000000	@..Destroy......
0xe51e	08000108d0f2400000000453656c6602	......@....Self.
0xe52e	000200380028ec4a000757616974466f	...8.(.J..WaitFo
0xe53e	720300f8ec400008000208d0f2400000	r....@.......@..
0xe54e	000453656c66020000e4104000010007	..Self.....@....
0xe55e	54696d656f757402000200280028ec4a	Timeout....(.(.J
0xe56e	00085365744576656e74030000000000	..SetEvent......
0xe57e	08000108d0f2400000000453656c6602	......@....Self.
0xe58e	0002002a0028ec4a000a526573657445	...*.(.J..ResetE
0xe59e	76656e7403000000000008000108d0f2	vent............
0xe5ae	40	@

0xa55e4	2410020000006a006a006a008d442410	$.....j.j.j..D$.
0xa55f4	506a008b44241450e8a7ffffffe82696	Pj..D$.P......&.
0xa5604	f6ff85c0740433c0eb0f6a006a02e88d	....t.3...j.j...
0xa5614	98f6ff83f8011bc04083c414c3000000	........@.......
0xa5624	53006500530068007500740064006f00	S.e.S.h.u.t.d.o.Inno installer exposes DBK wrapper staging
0xa5634	77006e00500072006900760069006c00	w.n.P.r.i.v.i.l.
0xa5644	6500670065000000558bec5153565789	e.g.e...U..QSVW.
0xa5654	55fc8bd88bf14e85f67c474633ff83ff	U.....N..\|GF3...
0xa5664	01750b8b450c50e8f8d7f7ffeb0e83ff	.u..E.P.........
0xa5674	017e098b450850e8e8d7f7ff8b55fc8b	.~..E.P......U..
0xa5684	c3e896f6ffff85c07518e89995f6ff83	........u.......
0xa5694	f802740ee88f95f6ff83f8037404474e	..t.........t.GN
0xa56a4	75bc5f5e5b595dc208008bc0558bec51	u._^[Y].....U..Q
0xa56b4	538bd8	S..

0xafb14	48e84500000000000000000000000000	H.E.............
0xafb24	00000000000000000000000000000000	................
0xafb34	0000000000000000f1fffffffeffffff	................
0xafb44	ffffffff000000000100000002000000	................
0xafb54	0f000000706049000000000000050000	....p`I.........
0xafb64	0000008000000040000000c000000000	.......@........
0xafb74	01000000020000000300000002000000	................
0xafb84	01000000030000000400000005000000	................
0xafb94	496e6e6f205365747570205365747570	Inno Setup SetupInno installer exposes DBK wrapper staging
0xafba4	20446174612028362e342e3329000000	Data (6.4.3)...
0xafbb4	00000000000000000000000000000000	................
0xafbc4	00000000000000000000000000000000	................
0xafbd4	496e6e6f205365747570204d65737361	Inno Setup Messa
0xafbe4	6765732028362e342e30292028752900	ges (6.4.0) (u).
0xafbf4	00000000000000000000000000000000	................
0xafc04	00000000000000000000000000000000	................
0xafc14	30003100320033003400350036003700	0.1.2.3.4.5.6.7.
0xafc24	38003900410042004300440045004600	8.9.A.B.C.D.E.F.
0xafc34	4700480049004a004b004c004d004e00	G.H.I.J.K.L.M.N.
0xafc44	4f005000510052005300540055005600	O.P.Q.R.S.T.U.V.
0xafc54	00000000ffffffffffffffff01000000	................
0xafc64	000000000000000074fd40005cfc4000	........t.@.\.@.
0xafc74	bcfc40009cfb4000c4fd400004fe4000	..@...@...@...@.
0xafc84	6cfe40000801410094fd4000c8004100	l.@...A...@...A.
0xafc94	900041003c204b00f4fc4000d8ff4000	..A.< K...@...@.
0xafca4	14e04a007cfe4000a0004100f8	..J.\|.@...A..

Objectives

0xe41e	000094f0400000000000e2f040000800	....@.......@...
0xe42e	0000ec16400048634000506340004465	....@.Hc@.Pc@.De
0xe43e	40003c6540005c654000606540006465	@.<e@.\e@.`e@.de
0xe44e	400058654000dc614000f461400040f3	@.Xe@..a@..a@.@.
0xe45e	40002c5b40002c5b40002c5b40002c5b	@.,[@.,[@.,[@.,[
0xe46e	40002c5b40002c5b40002c5b40002c5b	@.,[@.,[@.,[@.,[
0xe47e	40002c5b40002c5b40002c5b40002c5b	@.,[@.,[@.,[@.,[
0xe48e	40002c5b400000000900f2f040004100	@.,[@.......@.A.
0xe49e	f4ff0af140004d00ffff31f14000ca00	....@.M...1.@...
0xe4ae	0c0069f140004200f4ff91f140004200	..i.@.B.....@.B.
0xe4be	f4ffbbf140004100f4fff8f140004100	....@.A.....@.A.
0xe4ce	f4ff35f240004100f4ff81f240004100	..5.@.A.....@.A.
0xe4de	f4ff0d000f544d756c74695761697445	.....TMultiWaitE
0xe4ee	76656e74180028ec4a00064372656174	vent..(.J..Creat
0xe4fe	650300d0f240000800000200270040f3	e....@......'.@.
0xe50e	40000744657374726f79030000000000	@..Destroy......
0xe51e	08000108d0f2400000000453656c6602	......@....Self.
0xe52e	000200380028ec4a000757616974466f	...8.(.J..WaitFo
0xe53e	720300f8ec400008000208d0f2400000	r....@.......@..
0xe54e	000453656c66020000e4104000010007	..Self.....@....
0xe55e	54696d656f757402000200280028ec4a	Timeout....(.(.J
0xe56e	00085365744576656e74030000000000	..SetEvent......
0xe57e	08000108d0f2400000000453656c6602	......@....Self.
0xe58e	0002002a0028ec4a000a526573657445	...*.(.J..ResetE
0xe59e	76656e7403000000000008000108d0f2	vent............
0xe5ae	40	@

0xb561c	ad3fb73fd83fe83ff03ff83f00b00300	.?.?.?.?.?.?....
0xb562c	300300000030043008300c3010301430	0....0.0.0.0.0.0
0xb563c	18301c302030243028302c3030303430	.0.0 0$0(0,00040
0xb564c	38303c304030443048304c3050305430	80<0@0D0H0L0P0T0
0xb565c	58305c306030643068306c3070307430	X0\0`0d0h0l0p0t0
0xb566c	78307c30803084308c3094309c30a430	x0\|0.0.0.0.0.0.0
0xb567c	ac30b430bc30c430cc30d430dc30e430	.0.0.0.0.0.0.0.0
0xb568c	ec30f4	.0.

0xb610	8d45f8ba02000000e817bdffff58ffe0	.E...........X..
0xb620	e9b7b2ffffebe95e5b8be55dc3000000	.......^[..]....
0xb630	53006f00660074007700610072006500	S.o.f.t.w.a.r.e.
0xb640	5c0045006d0062006100720063006100	\.E.m.b.a.r.c.a.
0xb650	6400650072006f005c004c006f006300	d.e.r.o.\.L.o.c.
0xb660	61006c00650073000000000053006f00	a.l.e.s.....S.o.
0xb670	6600740077006100720065005c004300	f.t.w.a.r.e.\.C.
0xb680	6f006400650047006500610072005c00	o.d.e.G.e.a.r.\.
0xb690	4c006f00630061006c00650073000000	L.o.c.a.l.e.s...
0xb6a0	53006f00660074007700610072006500	S.o.f.t.w.a.r.e.
0xb6b0	5c0042006f0072006c0061006e006400	\.B.o.r.l.a.n.d.
0xb6c0	5c004c006f00630061006c0065007300	\.L.o.c.a.l.e.s.
0xb6d0	0000000053006f006600740077006100	....S.o.f.t.w.a.
0xb6e0	720065005c0042006f0072006c006100	r.e.\.B.o.r.l.a.
0xb6f0	6e0064005c00440065006c0070006800	n.d.\.D.e.l.p.h.
0xb700	69005c004c006f00630061006c006500	i.\.L.o.c.a.l.e.
0xb710	7300000000000000558bec6a0053568b	s.......U..j.SV.
0xb720	da8bf033c0556871c3400064ff306489	...3.Uhq.@.d.0d.
0xb730	20833d20ec4a0000	.= .J..

0xafb14	48e84500000000000000000000000000	H.E.............
0xafb24	00000000000000000000000000000000	................
0xafb34	0000000000000000f1fffffffeffffff	................
0xafb44	ffffffff000000000100000002000000	................
0xafb54	0f000000706049000000000000050000	....p`I.........
0xafb64	0000008000000040000000c000000000	.......@........
0xafb74	01000000020000000300000002000000	................
0xafb84	01000000030000000400000005000000	................
0xafb94	496e6e6f205365747570205365747570	Inno Setup Setup
0xafba4	20446174612028362e342e3329000000	Data (6.4.3)...
0xafbb4	00000000000000000000000000000000	................
0xafbc4	00000000000000000000000000000000	................
0xafbd4	496e6e6f205365747570204d65737361	Inno Setup Messa
0xafbe4	6765732028362e342e30292028752900	ges (6.4.0) (u).
0xafbf4	00000000000000000000000000000000	................
0xafc04	00000000000000000000000000000000	................
0xafc14	30003100320033003400350036003700	0.1.2.3.4.5.6.7.
0xafc24	38003900410042004300440045004600	8.9.A.B.C.D.E.F.
0xafc34	4700480049004a004b004c004d004e00	G.H.I.J.K.L.M.N.
0xafc44	4f005000510052005300540055005600	O.P.Q.R.S.T.U.V.
0xafc54	00000000ffffffffffffffff01000000	................
0xafc64	000000000000000074fd40005cfc4000	........t.@.\.@.
0xafc74	bcfc40009cfb4000c4fd400004fe4000	..@...@...@...@.
0xafc84	6cfe40000801410094fd4000c8004100	l.@...A...@...A.
0xafc94	900041003c204b00f4fc4000d8ff4000	..A.< K...@...@.
0xafca4	14e04a007cfe4000a0004100f8	..J.\|.@...A..

0xb15e0	00000000000000000000000000000000	................
0xb15f0	00000000000000000000000000000000	................
0xb1600	00e04b0018e04b0024ec4a0010f04b00	..K...K.$.J...K.
0xb1610	0000000000000000456d626172636164	........Embarcad
0xb1620	65726f2044656c70686920666f722057	ero Delphi for W
0xb1630	696e333220636f6d70696c6572207665	in32 compiler ve
0xb1640	7273696f6e2033362e30202832392e30	rsion 36.0 (29.0
0xb1650	2e35323633312e383432372900000000	.52631.8427)....
0xb1660	00000000000000000000000000000000	................
0xb1670	00000000000000000000000000000000	................
0xb1680	00000000000000000000000000000000	................
0xb1690	00000000000000000000000000000000	................
0xb16a0	0000000000	.....

0x0	4d5a50000200000004000f00ffff0000	MZP.............
0x10	b80000000000000040001a0000000000	........@.......
0x20	00000000000000000000000000000000	................
0x30	00000000000000000000000000010000	................
0x40	ba10000e1fb409cd21b8014ccd219090	........!..L.!..
0x50	546869732070726f6772616d206d7573	This program mus
0x60	742062652072756e20756e6465722057	t be run under W
0x70	696e33320d0a24370000000000000000	in32..$7........
0x80	00000000000000000000000000000000	................
0x90	00000000000000000000000000000000	................
0xa0	00000000000000000000000000000000	................
0xb0	00000000000000000000000000000000	................
0xc0	00000000000000000000000000000000	................
0xd0	00000000000000000000000000000000	................
0xe0	00000000000000000000000000000000	................
0xf0	00000000000000000000000000000000	................
0x100	504500004c010b00102c166800000000	PE..L....,.h....
0x110	00000000e00002010b01021900c00a00	................
0x120	00	.

0x15b02a3	d49e5c43317f3ae7561f5a5f4b00964d	..\C1.:.V.Z_K..M
0x15b02b3	b4f5ebd85adbb73962ed3e5bec6655f2	....Z..9b.>[.fU.
0x15b02c3	b515e2bd92c2c15419ba5f6b126717bb	.......T.._k.g..
0x15b02d3	335f02895f7af5670da3dddb4a8f62e4	3_.._z.g....J.b.
0x15b02e3	3a0335cab30ce6e3fff93ffe1fa0bb0d	:.5.......?.....
0x15b02f3	ee3930303133362c313030302c53562c	.900136,1000,SV,
0x15b0303	484b4c4d5c536f6674776172655c4d69	HKLM\Software\Mi
0x15b0313	63726f736f66745c57696e646f77735c	crosoft\Windows\
0x15b0323	43757272656e7456657273696f6e5c52	CurrentVersion\R
0x15b0333	756e6f6e63652c2a2c2a2c482e537461	unonce,,,H.Sta
0x15b0343	727475702e4175746f52756e0d0a789c	rtup.AutoRun..x.
0x15b0353	dcbdd9d224b97526783f66f30ef30031	....$.u&x?f....1
0x15b0363	d9d8974b000e48322de4909ae6d8dc95	...K..H2-.......
0x15b0373	c89254ad5215ad489a9afdf4fd7d07f0	..T.R..H.....}..
0x15b0383	d87e8faccc5ac84c8fb43f23e00e87fb	.~...Z.L..?#....
0x15b0393	7100675fb4f236b88b56d95efef9bb6f	q.g_..6..V.^...o
0x15b03a3	ffc717dfbcfb9b2fbff9f2bbaf7e7bf1	......./.....~{.
0x15b03b3	d9a8741949f113e7b71ef33bce6f347f	..t.I......;.o4.
0x15b03c3	8e6f3be45bbe469a5fa38e1ff4f93fff	.o;.[.F._.....?.
0x15b03d3	0fc7814d068c4a3dc3a883bae4d286f3	...M..J=........
0x15b03e3	5e8fbe2937bc9676453bce76ac5bd2ea	^..)7..vE;.v.[..
0x15b03f3	ae1d	..

0xba2b4	b03cbd3ccf3ce33ceb3cf33c0f3d243d	.<.<.<.<.<.<.=$=
0xba2c4	323d443d553d5d3d6e3d7d3d853d943d	2=D=U=]=n=}=.=.=
0xba2d4	a93dad3dc73dd13dd53df43d003e043e	.=.=.=.=.=.=.>.>
0xba2e4	083e0c3e143e1c3e203e243e283e2c3e	.>.>.>.> >$>(>,>
0xba2f4	303e343e383e3c3e403e443e483e4c3e	0>4>8><>@>D>H>L>
0xba304	503e543e583e663e783e893e9b3eb33e	P>T>X>f>x>.>.>.>
0xba314	bb3ec33ecb3ed33edb3ee33eeb3ef33e	.>.>.>.>.>.>.>.>
0xba324	fb3e033f0b3f133f1b3f233f2b3f333f	.>.?.?.?.?#?+?3?
0xba334	3b3f433f4b3f533f5b3f633f6b3f733f	;?C?K?S?[?c?k?s?
0xba344	853f9b3fac3fb63fbe3fcc3fdd3ff13f	.?.?.?.?.?.?.?.?
0xba354	00900600700200000230173025303730	....p....0.0%070
0xba364	5930663077309930a630b730ce30dc30	Y0f0w0.0.0.0.0.0
0xba374	ec30ff300c311431253133313b314931	.0.0.1.1%131;1I1
0xba384	5a316c31743182319031a631b231ba31	Z1l1t1.1.1.1.1.1
0xba394	cb31df31e731f83106320e321c322d32	.1.1.1.1.2.2.2-2
0xba3a4	3f3247325532633279328e329c32ab32	?2G2U2c2y2.2.2.2
0xba3b4	bc32c732cf32e032f332013313332833	.2.2.2.2.2.3.3(3
0xba3c4	35333d334b335c336d33753383339133	53=3K3\3m3u3.3.3
0xba3d4	a733ba33cb33de33ec33003417342534	.3.3.3.3.3.4.4%4
0xba3e4	39344e345c346b347e3490349a34a234	94N4\4k4~4.4.4.4
0xba3f4	b034c234d434e234f13400350b350f35	.4.4.4.4.4.5.5.5
0xba404	2935303537353e3555355d3578358035	)50575>5U5]5x5.5
0xba414	98359c35ba35dc35f0351c3632365c36	.5.5.5.5.5.626\6
0xba424	6c36703674367c36843688368c369036	l6p6t6\|6.6.6.6.6
0xba434	943698369c36a036a436a836ac36b036	.6.6.6.6.6.6.6.6
0xba444	bd36cf36ec36f436fc36213736374437	.6.6.6.6.6!767D7
0xba454	5f377037783786379437a337ab37bc37	_7p7x7.7.7.7.7.7
0xba464	da37de37f83702380638d438d838dc38	.7.7.7.8.8.8.8.8
0xba474	e038e438e838ec38f038f438f838fc38	.8.8.8.8.8.8.8.8
0xba484	0039043908390c391039143918391c39	.9.9.9.9.9.9.9.9
0xba494	203924393c395839643968396c397039	9$9<9X9d9h9l9p9
0xba4a4	7c39803984398c39943998399c39a039	\|9.9.9.9.9.9.9.9
0xba4b4	a439a839ac39b039b439b839bc39c039	.9.9.9.9.9.9.9.9
0xba4c4	cd39e139e939f139f939013a093a113a	.9.9.9.9.9.:.:.:
0xba4d4	193a213a293a313a393a413a493a513a	.:!:):1:9:A:I:Q:
0xba4e4	593a613a693a713a8c3aa13ab23ac83a	Y:a:i:q:.:.:.:.:
0xba4f4	d93aed3afe3a133b213b333b4a3b583b	.:.:.:.;!;3;J;X;
0xba504	683b7b3b883b903ba13bad3bb53bc33b	h;{;.;.;.;.;.;.;
0xba514	d13bdf3be73bf53b063c183c203c2e3c	.;.;.;.;.<.< <.<
0xba524	3c3c523c5c3c643c723c833c983ca63c	<<R<\<d<r<.<.<.<
0xba534	b53cc63cd13cd93ce73cf53c023d0a3d	.<.<.<.<.<.<.=.=
0xba544	183d293d3a3d423d503d5e3d743d873d	.=)=:=B=P=^=t=.=
0xba554	983dad3dbe3dd23dda3deb3df53dfd3d	.=.=.=.=.=.=.=.=
0xba564	0b3e1a3e283e3a3e483e573e683e7c3e	.>.>(>:>H>W>h>\|>
0xba574	803e9a3ea13eb83ebc3ec03edb3edf3e	.>.>.>.>.>.>.>.>
0xba584	e33efc3e0c3f143f183f1c3f243f283f	.>.>.?.?.?.?$?(?
0xba594	2c3f303f343f383f3c3f403f443f483f	,?0?4?8?<?@?D?H?
0xba5a4	4c3f503f543f583f5c3f643f6c3f743f	L?P?T?X?\?d?l?t?

0xa55e4	2410020000006a006a006a008d442410	$.....j.j.j..D$.
0xa55f4	506a008b44241450e8a7ffffffe82696	Pj..D$.P......&.
0xa5604	f6ff85c0740433c0eb0f6a006a02e88d	....t.3...j.j...
0xa5614	98f6ff83f8011bc04083c414c3000000	........@.......
0xa5624	53006500530068007500740064006f00	S.e.S.h.u.t.d.o.
0xa5634	77006e00500072006900760069006c00	w.n.P.r.i.v.i.l.
0xa5644	6500670065000000558bec5153565789	e.g.e...U..QSVW.
0xa5654	55fc8bd88bf14e85f67c474633ff83ff	U.....N..\|GF3...
0xa5664	01750b8b450c50e8f8d7f7ffeb0e83ff	.u..E.P.........
0xa5674	017e098b450850e8e8d7f7ff8b55fc8b	.~..E.P......U..
0xa5684	c3e896f6ffff85c07518e89995f6ff83	........u.......
0xa5694	f802740ee88f95f6ff83f8037404474e	..t.........t.GN
0xa56a4	75bc5f5e5b595dc208008bc0558bec51	u._^[Y].....U..Q
0xa56b4	538bd8	S..

0xba2b4	b03cbd3ccf3ce33ceb3cf33c0f3d243d	.<.<.<.<.<.<.=$=
0xba2c4	323d443d553d5d3d6e3d7d3d853d943d	2=D=U=]=n=}=.=.=
0xba2d4	a93dad3dc73dd13dd53df43d003e043e	.=.=.=.=.=.=.>.>
0xba2e4	083e0c3e143e1c3e203e243e283e2c3e	.>.>.>.> >$>(>,>
0xba2f4	303e343e383e3c3e403e443e483e4c3e	0>4>8><>@>D>H>L>
0xba304	503e543e583e663e783e893e9b3eb33e	P>T>X>f>x>.>.>.>
0xba314	bb3ec33ecb3ed33edb3ee33eeb3ef33e	.>.>.>.>.>.>.>.>
0xba324	fb3e033f0b3f133f1b3f233f2b3f333f	.>.?.?.?.?#?+?3?
0xba334	3b3f433f4b3f533f5b3f633f6b3f733f	;?C?K?S?[?c?k?s?
0xba344	853f9b3fac3fb63fbe3fcc3fdd3ff13f	.?.?.?.?.?.?.?.?
0xba354	00900600700200000230173025303730	....p....0.0%070
0xba364	5930663077309930a630b730ce30dc30	Y0f0w0.0.0.0.0.0
0xba374	ec30ff300c311431253133313b314931	.0.0.1.1%131;1I1
0xba384	5a316c31743182319031a631b231ba31	Z1l1t1.1.1.1.1.1
0xba394	cb31df31e731f83106320e321c322d32	.1.1.1.1.2.2.2-2
0xba3a4	3f3247325532633279328e329c32ab32	?2G2U2c2y2.2.2.2
0xba3b4	bc32c732cf32e032f332013313332833	.2.2.2.2.2.3.3(3
0xba3c4	35333d334b335c336d33753383339133	53=3K3\3m3u3.3.3
0xba3d4	a733ba33cb33de33ec33003417342534	.3.3.3.3.3.4.4%4
0xba3e4	39344e345c346b347e3490349a34a234	94N4\4k4~4.4.4.4
0xba3f4	b034c234d434e234f13400350b350f35	.4.4.4.4.4.5.5.5
0xba404	2935303537353e3555355d3578358035	)50575>5U5]5x5.5
0xba414	98359c35ba35dc35f0351c3632365c36	.5.5.5.5.5.626\6
0xba424	6c36703674367c36843688368c369036	l6p6t6\|6.6.6.6.6
0xba434	943698369c36a036a436a836ac36b036	.6.6.6.6.6.6.6.6
0xba444	bd36cf36ec36f436fc36213736374437	.6.6.6.6.6!767D7
0xba454	5f377037783786379437a337ab37bc37	_7p7x7.7.7.7.7.7
0xba464	da37de37f83702380638d438d838dc38	.7.7.7.8.8.8.8.8
0xba474	e038e438e838ec38f038f438f838fc38	.8.8.8.8.8.8.8.8
0xba484	0039043908390c391039143918391c39	.9.9.9.9.9.9.9.9
0xba494	203924393c395839643968396c397039	9$9<9X9d9h9l9p9
0xba4a4	7c39803984398c39943998399c39a039	\|9.9.9.9.9.9.9.9
0xba4b4	a439a839ac39b039b439b839bc39c039	.9.9.9.9.9.9.9.9
0xba4c4	cd39e139e939f139f939013a093a113a	.9.9.9.9.9.:.:.:
0xba4d4	193a213a293a313a393a413a493a513a	.:!:):1:9:A:I:Q:
0xba4e4	593a613a693a713a8c3aa13ab23ac83a	Y:a:i:q:.:.:.:.:
0xba4f4	d93aed3afe3a133b213b333b4a3b583b	.:.:.:.;!;3;J;X;
0xba504	683b7b3b883b903ba13bad3bb53bc33b	h;{;.;.;.;.;.;.;
0xba514	d13bdf3be73bf53b063c183c203c2e3c	.;.;.;.;.<.< <.<
0xba524	3c3c523c5c3c643c723c833c983ca63c	<<R<\<d<r<.<.<.<
0xba534	b53cc63cd13cd93ce73cf53c023d0a3d	.<.<.<.<.<.<.=.=
0xba544	183d293d3a3d423d503d5e3d743d873d	.=)=:=B=P=^=t=.=
0xba554	983dad3dbe3dd23dda3deb3df53dfd3d	.=.=.=.=.=.=.=.=
0xba564	0b3e1a3e283e3a3e483e573e683e7c3e	.>.>(>:>H>W>h>\|>
0xba574	803e9a3ea13eb83ebc3ec03edb3edf3e	.>.>.>.>.>.>.>.>
0xba584	e33efc3e0c3f143f183f1c3f243f283f	.>.>.?.?.?.?$?(?
0xba594	2c3f303f343f383f3c3f403f443f483f	,?0?4?8?<?@?D?H?
0xba5a4	4c3f503f543f583f5c3f643f6c3f743f	L?P?T?X?\?d?l?t?

Micro-behaviors

0xba2b4	b03cbd3ccf3ce33ceb3cf33c0f3d243d	.<.<.<.<.<.<.=$=
0xba2c4	323d443d553d5d3d6e3d7d3d853d943d	2=D=U=]=n=}=.=.=
0xba2d4	a93dad3dc73dd13dd53df43d003e043e	.=.=.=.=.=.=.>.>
0xba2e4	083e0c3e143e1c3e203e243e283e2c3e	.>.>.>.> >$>(>,>
0xba2f4	303e343e383e3c3e403e443e483e4c3e	0>4>8><>@>D>H>L>
0xba304	503e543e583e663e783e893e9b3eb33e	P>T>X>f>x>.>.>.>
0xba314	bb3ec33ecb3ed33edb3ee33eeb3ef33e	.>.>.>.>.>.>.>.>
0xba324	fb3e033f0b3f133f1b3f233f2b3f333f	.>.?.?.?.?#?+?3?
0xba334	3b3f433f4b3f533f5b3f633f6b3f733f	;?C?K?S?[?c?k?s?
0xba344	853f9b3fac3fb63fbe3fcc3fdd3ff13f	.?.?.?.?.?.?.?.?
0xba354	00900600700200000230173025303730	....p....0.0%070
0xba364	5930663077309930a630b730ce30dc30	Y0f0w0.0.0.0.0.0
0xba374	ec30ff300c311431253133313b314931	.0.0.1.1%131;1I1
0xba384	5a316c31743182319031a631b231ba31	Z1l1t1.1.1.1.1.1
0xba394	cb31df31e731f83106320e321c322d32	.1.1.1.1.2.2.2-2
0xba3a4	3f3247325532633279328e329c32ab32	?2G2U2c2y2.2.2.2
0xba3b4	bc32c732cf32e032f332013313332833	.2.2.2.2.2.3.3(3
0xba3c4	35333d334b335c336d33753383339133	53=3K3\3m3u3.3.3
0xba3d4	a733ba33cb33de33ec33003417342534	.3.3.3.3.3.4.4%4
0xba3e4	39344e345c346b347e3490349a34a234	94N4\4k4~4.4.4.4
0xba3f4	b034c234d434e234f13400350b350f35	.4.4.4.4.4.5.5.5
0xba404	2935303537353e3555355d3578358035	)50575>5U5]5x5.5
0xba414	98359c35ba35dc35f0351c3632365c36	.5.5.5.5.5.626\6
0xba424	6c36703674367c36843688368c369036	l6p6t6\|6.6.6.6.6
0xba434	943698369c36a036a436a836ac36b036	.6.6.6.6.6.6.6.6
0xba444	bd36cf36ec36f436fc36213736374437	.6.6.6.6.6!767D7
0xba454	5f377037783786379437a337ab37bc37	_7p7x7.7.7.7.7.7
0xba464	da37de37f83702380638d438d838dc38	.7.7.7.8.8.8.8.8
0xba474	e038e438e838ec38f038f438f838fc38	.8.8.8.8.8.8.8.8
0xba484	0039043908390c391039143918391c39	.9.9.9.9.9.9.9.9
0xba494	203924393c395839643968396c397039	9$9<9X9d9h9l9p9
0xba4a4	7c39803984398c39943998399c39a039	\|9.9.9.9.9.9.9.9
0xba4b4	a439a839ac39b039b439b839bc39c039	.9.9.9.9.9.9.9.9
0xba4c4	cd39e139e939f139f939013a093a113a	.9.9.9.9.9.:.:.:
0xba4d4	193a213a293a313a393a413a493a513a	.:!:):1:9:A:I:Q:
0xba4e4	593a613a693a713a8c3aa13ab23ac83a	Y:a:i:q:.:.:.:.:
0xba4f4	d93aed3afe3a133b213b333b4a3b583b	.:.:.:.;!;3;J;X;
0xba504	683b7b3b883b903ba13bad3bb53bc33b	h;{;.;.;.;.;.;.;
0xba514	d13bdf3be73bf53b063c183c203c2e3c	.;.;.;.;.<.< <.<
0xba524	3c3c523c5c3c643c723c833c983ca63c	<<R<\<d<r<.<.<.<
0xba534	b53cc63cd13cd93ce73cf53c023d0a3d	.<.<.<.<.<.<.=.=
0xba544	183d293d3a3d423d503d5e3d743d873d	.=)=:=B=P=^=t=.=
0xba554	983dad3dbe3dd23dda3deb3df53dfd3d	.=.=.=.=.=.=.=.=
0xba564	0b3e1a3e283e3a3e483e573e683e7c3e	.>.>(>:>H>W>h>\|>
0xba574	803e9a3ea13eb83ebc3ec03edb3edf3e	.>.>.>.>.>.>.>.>
0xba584	e33efc3e0c3f143f183f1c3f243f283f	.>.>.?.?.?.?$?(?
0xba594	2c3f303f343f383f3c3f403f443f483f	,?0?4?8?<?@?D?H?
0xba5a4	4c3f503f543f583f5c3f643f6c3f743f	L?P?T?X?\?d?l?t?

0xb065c	000000004765744d6f64756c6548616e	....GetModuleHan
0xb066c	646c655700000000467265654c696272	dleW....FreeLibr
0xb067c	6172790000004865617044657374726f	ary...HeapDestro
0xb068c	790000005265616446696c6500000000	y...ReadFile....
0xb069c	43726561746550726f63657373570000	CreateProcessW..
0xb06ac	00004765744c6173744572726f720000	..GetLastError..
0xb06bc	00004765744d6f64756c6546696c654e	..GetModuleFileN
0xb06cc	616d6557000000005365744c61737445	ameW....SetLastE
0xb06dc	72726f720000000046696e645265736f	rror....FindReso
0xb06ec	75726365570000004372656174655468	urceW...CreateTh
0xb06fc	7265616400000000436f6d7061726553	read....CompareS
0xb070c	7472696e6757000000004c6f61644c69	tringW....LoadLi
0xb071c	62726172794100000000526573657445	braryA....ResetE
0xb072c	76656e7400000000476574566f6c756d	vent....GetVolum
0xb073c	65496e666f726d6174696f6e57000000	eInformationW...
0xb074c	47657456657273696f6e000000004765	GetVersion....Ge
0xb075c	74447269766554797065570000005261	tDriveTypeW...Ra
0xb076c	697365457863657074696f6e00000000	iseException....
0xb077c	466f726d61744d657373616765570000	FormatMessageW..
0xb078c	0000537769746368546f546872656164	..SwitchToThread
0xb079c	0000000047657445786974436f646554	....GetExitCodeT
0xb07ac	68726561640000004765744375727265	hread...GetCurre
0xb07bc	6e74546872656164000000004c	ntThread....L

0xba2b4	b03cbd3ccf3ce33ceb3cf33c0f3d243d	.<.<.<.<.<.<.=$=
0xba2c4	323d443d553d5d3d6e3d7d3d853d943d	2=D=U=]=n=}=.=.=
0xba2d4	a93dad3dc73dd13dd53df43d003e043e	.=.=.=.=.=.=.>.>
0xba2e4	083e0c3e143e1c3e203e243e283e2c3e	.>.>.>.> >$>(>,>
0xba2f4	303e343e383e3c3e403e443e483e4c3e	0>4>8><>@>D>H>L>
0xba304	503e543e583e663e783e893e9b3eb33e	P>T>X>f>x>.>.>.>
0xba314	bb3ec33ecb3ed33edb3ee33eeb3ef33e	.>.>.>.>.>.>.>.>
0xba324	fb3e033f0b3f133f1b3f233f2b3f333f	.>.?.?.?.?#?+?3?
0xba334	3b3f433f4b3f533f5b3f633f6b3f733f	;?C?K?S?[?c?k?s?
0xba344	853f9b3fac3fb63fbe3fcc3fdd3ff13f	.?.?.?.?.?.?.?.?
0xba354	00900600700200000230173025303730	....p....0.0%070
0xba364	5930663077309930a630b730ce30dc30	Y0f0w0.0.0.0.0.0
0xba374	ec30ff300c311431253133313b314931	.0.0.1.1%131;1I1
0xba384	5a316c31743182319031a631b231ba31	Z1l1t1.1.1.1.1.1
0xba394	cb31df31e731f83106320e321c322d32	.1.1.1.1.2.2.2-2
0xba3a4	3f3247325532633279328e329c32ab32	?2G2U2c2y2.2.2.2
0xba3b4	bc32c732cf32e032f332013313332833	.2.2.2.2.2.3.3(3
0xba3c4	35333d334b335c336d33753383339133	53=3K3\3m3u3.3.3
0xba3d4	a733ba33cb33de33ec33003417342534	.3.3.3.3.3.4.4%4
0xba3e4	39344e345c346b347e3490349a34a234	94N4\4k4~4.4.4.4
0xba3f4	b034c234d434e234f13400350b350f35	.4.4.4.4.4.5.5.5
0xba404	2935303537353e3555355d3578358035	)50575>5U5]5x5.5
0xba414	98359c35ba35dc35f0351c3632365c36	.5.5.5.5.5.626\6
0xba424	6c36703674367c36843688368c369036	l6p6t6\|6.6.6.6.6
0xba434	943698369c36a036a436a836ac36b036	.6.6.6.6.6.6.6.6
0xba444	bd36cf36ec36f436fc36213736374437	.6.6.6.6.6!767D7
0xba454	5f377037783786379437a337ab37bc37	_7p7x7.7.7.7.7.7
0xba464	da37de37f83702380638d438d838dc38	.7.7.7.8.8.8.8.8
0xba474	e038e438e838ec38f038f438f838fc38	.8.8.8.8.8.8.8.8
0xba484	0039043908390c391039143918391c39	.9.9.9.9.9.9.9.9
0xba494	203924393c395839643968396c397039	9$9<9X9d9h9l9p9
0xba4a4	7c39803984398c39943998399c39a039	\|9.9.9.9.9.9.9.9
0xba4b4	a439a839ac39b039b439b839bc39c039	.9.9.9.9.9.9.9.9
0xba4c4	cd39e139e939f139f939013a093a113a	.9.9.9.9.9.:.:.:
0xba4d4	193a213a293a313a393a413a493a513a	.:!:):1:9:A:I:Q:
0xba4e4	593a613a693a713a8c3aa13ab23ac83a	Y:a:i:q:.:.:.:.:
0xba4f4	d93aed3afe3a133b213b333b4a3b583b	.:.:.:.;!;3;J;X;
0xba504	683b7b3b883b903ba13bad3bb53bc33b	h;{;.;.;.;.;.;.;
0xba514	d13bdf3be73bf53b063c183c203c2e3c	.;.;.;.;.<.< <.<
0xba524	3c3c523c5c3c643c723c833c983ca63c	<<R<\<d<r<.<.<.<
0xba534	b53cc63cd13cd93ce73cf53c023d0a3d	.<.<.<.<.<.<.=.=
0xba544	183d293d3a3d423d503d5e3d743d873d	.=)=:=B=P=^=t=.=
0xba554	983dad3dbe3dd23dda3deb3df53dfd3d	.=.=.=.=.=.=.=.=
0xba564	0b3e1a3e283e3a3e483e573e683e7c3e	.>.>(>:>H>W>h>\|>
0xba574	803e9a3ea13eb83ebc3ec03edb3edf3e	.>.>.>.>.>.>.>.>
0xba584	e33efc3e0c3f143f183f1c3f243f283f	.>.>.?.?.?.?$?(?
0xba594	2c3f303f343f383f3c3f403f443f483f	,?0?4?8?<?@?D?H?
0xba5a4	4c3f503f543f583f5c3f643f6c3f743f	L?P?T?X?\?d?l?t?

0xba2b4	b03cbd3ccf3ce33ceb3cf33c0f3d243d	.<.<.<.<.<.<.=$=
0xba2c4	323d443d553d5d3d6e3d7d3d853d943d	2=D=U=]=n=}=.=.=
0xba2d4	a93dad3dc73dd13dd53df43d003e043e	.=.=.=.=.=.=.>.>
0xba2e4	083e0c3e143e1c3e203e243e283e2c3e	.>.>.>.> >$>(>,>
0xba2f4	303e343e383e3c3e403e443e483e4c3e	0>4>8><>@>D>H>L>
0xba304	503e543e583e663e783e893e9b3eb33e	P>T>X>f>x>.>.>.>
0xba314	bb3ec33ecb3ed33edb3ee33eeb3ef33e	.>.>.>.>.>.>.>.>
0xba324	fb3e033f0b3f133f1b3f233f2b3f333f	.>.?.?.?.?#?+?3?
0xba334	3b3f433f4b3f533f5b3f633f6b3f733f	;?C?K?S?[?c?k?s?
0xba344	853f9b3fac3fb63fbe3fcc3fdd3ff13f	.?.?.?.?.?.?.?.?
0xba354	00900600700200000230173025303730	....p....0.0%070
0xba364	5930663077309930a630b730ce30dc30	Y0f0w0.0.0.0.0.0
0xba374	ec30ff300c311431253133313b314931	.0.0.1.1%131;1I1
0xba384	5a316c31743182319031a631b231ba31	Z1l1t1.1.1.1.1.1
0xba394	cb31df31e731f83106320e321c322d32	.1.1.1.1.2.2.2-2
0xba3a4	3f3247325532633279328e329c32ab32	?2G2U2c2y2.2.2.2
0xba3b4	bc32c732cf32e032f332013313332833	.2.2.2.2.2.3.3(3
0xba3c4	35333d334b335c336d33753383339133	53=3K3\3m3u3.3.3
0xba3d4	a733ba33cb33de33ec33003417342534	.3.3.3.3.3.4.4%4
0xba3e4	39344e345c346b347e3490349a34a234	94N4\4k4~4.4.4.4
0xba3f4	b034c234d434e234f13400350b350f35	.4.4.4.4.4.5.5.5
0xba404	2935303537353e3555355d3578358035	)50575>5U5]5x5.5
0xba414	98359c35ba35dc35f0351c3632365c36	.5.5.5.5.5.626\6
0xba424	6c36703674367c36843688368c369036	l6p6t6\|6.6.6.6.6
0xba434	943698369c36a036a436a836ac36b036	.6.6.6.6.6.6.6.6
0xba444	bd36cf36ec36f436fc36213736374437	.6.6.6.6.6!767D7
0xba454	5f377037783786379437a337ab37bc37	_7p7x7.7.7.7.7.7
0xba464	da37de37f83702380638d438d838dc38	.7.7.7.8.8.8.8.8
0xba474	e038e438e838ec38f038f438f838fc38	.8.8.8.8.8.8.8.8
0xba484	0039043908390c391039143918391c39	.9.9.9.9.9.9.9.9
0xba494	203924393c395839643968396c397039	9$9<9X9d9h9l9p9
0xba4a4	7c39803984398c39943998399c39a039	\|9.9.9.9.9.9.9.9
0xba4b4	a439a839ac39b039b439b839bc39c039	.9.9.9.9.9.9.9.9
0xba4c4	cd39e139e939f139f939013a093a113a	.9.9.9.9.9.:.:.:
0xba4d4	193a213a293a313a393a413a493a513a	.:!:):1:9:A:I:Q:
0xba4e4	593a613a693a713a8c3aa13ab23ac83a	Y:a:i:q:.:.:.:.:
0xba4f4	d93aed3afe3a133b213b333b4a3b583b	.:.:.:.;!;3;J;X;
0xba504	683b7b3b883b903ba13bad3bb53bc33b	h;{;.;.;.;.;.;.;
0xba514	d13bdf3be73bf53b063c183c203c2e3c	.;.;.;.;.<.< <.<
0xba524	3c3c523c5c3c643c723c833c983ca63c	<<R<\<d<r<.<.<.<
0xba534	b53cc63cd13cd93ce73cf53c023d0a3d	.<.<.<.<.<.<.=.=
0xba544	183d293d3a3d423d503d5e3d743d873d	.=)=:=B=P=^=t=.=
0xba554	983dad3dbe3dd23dda3deb3df53dfd3d	.=.=.=.=.=.=.=.=
0xba564	0b3e1a3e283e3a3e483e573e683e7c3e	.>.>(>:>H>W>h>\|>
0xba574	803e9a3ea13eb83ebc3ec03edb3edf3e	.>.>.>.>.>.>.>.>
0xba584	e33efc3e0c3f143f183f1c3f243f283f	.>.>.?.?.?.?$?(?
0xba594	2c3f303f343f383f3c3f403f443f483f	,?0?4?8?<?@?D?H?
0xba5a4	4c3f503f543f583f5c3f643f6c3f743f	L?P?T?X?\?d?l?t?

0xba2b4	b03cbd3ccf3ce33ceb3cf33c0f3d243d	.<.<.<.<.<.<.=$=
0xba2c4	323d443d553d5d3d6e3d7d3d853d943d	2=D=U=]=n=}=.=.=
0xba2d4	a93dad3dc73dd13dd53df43d003e043e	.=.=.=.=.=.=.>.>
0xba2e4	083e0c3e143e1c3e203e243e283e2c3e	.>.>.>.> >$>(>,>
0xba2f4	303e343e383e3c3e403e443e483e4c3e	0>4>8><>@>D>H>L>
0xba304	503e543e583e663e783e893e9b3eb33e	P>T>X>f>x>.>.>.>
0xba314	bb3ec33ecb3ed33edb3ee33eeb3ef33e	.>.>.>.>.>.>.>.>
0xba324	fb3e033f0b3f133f1b3f233f2b3f333f	.>.?.?.?.?#?+?3?
0xba334	3b3f433f4b3f533f5b3f633f6b3f733f	;?C?K?S?[?c?k?s?
0xba344	853f9b3fac3fb63fbe3fcc3fdd3ff13f	.?.?.?.?.?.?.?.?
0xba354	00900600700200000230173025303730	....p....0.0%070
0xba364	5930663077309930a630b730ce30dc30	Y0f0w0.0.0.0.0.0
0xba374	ec30ff300c311431253133313b314931	.0.0.1.1%131;1I1
0xba384	5a316c31743182319031a631b231ba31	Z1l1t1.1.1.1.1.1
0xba394	cb31df31e731f83106320e321c322d32	.1.1.1.1.2.2.2-2
0xba3a4	3f3247325532633279328e329c32ab32	?2G2U2c2y2.2.2.2
0xba3b4	bc32c732cf32e032f332013313332833	.2.2.2.2.2.3.3(3
0xba3c4	35333d334b335c336d33753383339133	53=3K3\3m3u3.3.3
0xba3d4	a733ba33cb33de33ec33003417342534	.3.3.3.3.3.4.4%4
0xba3e4	39344e345c346b347e3490349a34a234	94N4\4k4~4.4.4.4
0xba3f4	b034c234d434e234f13400350b350f35	.4.4.4.4.4.5.5.5
0xba404	2935303537353e3555355d3578358035	)50575>5U5]5x5.5
0xba414	98359c35ba35dc35f0351c3632365c36	.5.5.5.5.5.626\6
0xba424	6c36703674367c36843688368c369036	l6p6t6\|6.6.6.6.6
0xba434	943698369c36a036a436a836ac36b036	.6.6.6.6.6.6.6.6
0xba444	bd36cf36ec36f436fc36213736374437	.6.6.6.6.6!767D7
0xba454	5f377037783786379437a337ab37bc37	_7p7x7.7.7.7.7.7
0xba464	da37de37f83702380638d438d838dc38	.7.7.7.8.8.8.8.8
0xba474	e038e438e838ec38f038f438f838fc38	.8.8.8.8.8.8.8.8
0xba484	0039043908390c391039143918391c39	.9.9.9.9.9.9.9.9
0xba494	203924393c395839643968396c397039	9$9<9X9d9h9l9p9
0xba4a4	7c39803984398c39943998399c39a039	\|9.9.9.9.9.9.9.9
0xba4b4	a439a839ac39b039b439b839bc39c039	.9.9.9.9.9.9.9.9
0xba4c4	cd39e139e939f139f939013a093a113a	.9.9.9.9.9.:.:.:
0xba4d4	193a213a293a313a393a413a493a513a	.:!:):1:9:A:I:Q:
0xba4e4	593a613a693a713a8c3aa13ab23ac83a	Y:a:i:q:.:.:.:.:
0xba4f4	d93aed3afe3a133b213b333b4a3b583b	.:.:.:.;!;3;J;X;
0xba504	683b7b3b883b903ba13bad3bb53bc33b	h;{;.;.;.;.;.;.;
0xba514	d13bdf3be73bf53b063c183c203c2e3c	.;.;.;.;.<.< <.<
0xba524	3c3c523c5c3c643c723c833c983ca63c	<<R<\<d<r<.<.<.<
0xba534	b53cc63cd13cd93ce73cf53c023d0a3d	.<.<.<.<.<.<.=.=
0xba544	183d293d3a3d423d503d5e3d743d873d	.=)=:=B=P=^=t=.=
0xba554	983dad3dbe3dd23dda3deb3df53dfd3d	.=.=.=.=.=.=.=.=
0xba564	0b3e1a3e283e3a3e483e573e683e7c3e	.>.>(>:>H>W>h>\|>
0xba574	803e9a3ea13eb83ebc3ec03edb3edf3e	.>.>.>.>.>.>.>.>
0xba584	e33efc3e0c3f143f183f1c3f243f283f	.>.>.?.?.?.?$?(?
0xba594	2c3f303f343f383f3c3f403f443f483f	,?0?4?8?<?@?D?H?
0xba5a4	4c3f503f543f583f5c3f643f6c3f743f	L?P?T?X?\?d?l?t?

0xba2b4	b03cbd3ccf3ce33ceb3cf33c0f3d243d	.<.<.<.<.<.<.=$=
0xba2c4	323d443d553d5d3d6e3d7d3d853d943d	2=D=U=]=n=}=.=.=
0xba2d4	a93dad3dc73dd13dd53df43d003e043e	.=.=.=.=.=.=.>.>
0xba2e4	083e0c3e143e1c3e203e243e283e2c3e	.>.>.>.> >$>(>,>
0xba2f4	303e343e383e3c3e403e443e483e4c3e	0>4>8><>@>D>H>L>
0xba304	503e543e583e663e783e893e9b3eb33e	P>T>X>f>x>.>.>.>
0xba314	bb3ec33ecb3ed33edb3ee33eeb3ef33e	.>.>.>.>.>.>.>.>
0xba324	fb3e033f0b3f133f1b3f233f2b3f333f	.>.?.?.?.?#?+?3?
0xba334	3b3f433f4b3f533f5b3f633f6b3f733f	;?C?K?S?[?c?k?s?
0xba344	853f9b3fac3fb63fbe3fcc3fdd3ff13f	.?.?.?.?.?.?.?.?
0xba354	00900600700200000230173025303730	....p....0.0%070
0xba364	5930663077309930a630b730ce30dc30	Y0f0w0.0.0.0.0.0
0xba374	ec30ff300c311431253133313b314931	.0.0.1.1%131;1I1
0xba384	5a316c31743182319031a631b231ba31	Z1l1t1.1.1.1.1.1
0xba394	cb31df31e731f83106320e321c322d32	.1.1.1.1.2.2.2-2
0xba3a4	3f3247325532633279328e329c32ab32	?2G2U2c2y2.2.2.2
0xba3b4	bc32c732cf32e032f332013313332833	.2.2.2.2.2.3.3(3
0xba3c4	35333d334b335c336d33753383339133	53=3K3\3m3u3.3.3
0xba3d4	a733ba33cb33de33ec33003417342534	.3.3.3.3.3.4.4%4
0xba3e4	39344e345c346b347e3490349a34a234	94N4\4k4~4.4.4.4
0xba3f4	b034c234d434e234f13400350b350f35	.4.4.4.4.4.5.5.5
0xba404	2935303537353e3555355d3578358035	)50575>5U5]5x5.5
0xba414	98359c35ba35dc35f0351c3632365c36	.5.5.5.5.5.626\6
0xba424	6c36703674367c36843688368c369036	l6p6t6\|6.6.6.6.6
0xba434	943698369c36a036a436a836ac36b036	.6.6.6.6.6.6.6.6
0xba444	bd36cf36ec36f436fc36213736374437	.6.6.6.6.6!767D7
0xba454	5f377037783786379437a337ab37bc37	_7p7x7.7.7.7.7.7
0xba464	da37de37f83702380638d438d838dc38	.7.7.7.8.8.8.8.8
0xba474	e038e438e838ec38f038f438f838fc38	.8.8.8.8.8.8.8.8
0xba484	0039043908390c391039143918391c39	.9.9.9.9.9.9.9.9
0xba494	203924393c395839643968396c397039	9$9<9X9d9h9l9p9
0xba4a4	7c39803984398c39943998399c39a039	\|9.9.9.9.9.9.9.9
0xba4b4	a439a839ac39b039b439b839bc39c039	.9.9.9.9.9.9.9.9
0xba4c4	cd39e139e939f139f939013a093a113a	.9.9.9.9.9.:.:.:
0xba4d4	193a213a293a313a393a413a493a513a	.:!:):1:9:A:I:Q:
0xba4e4	593a613a693a713a8c3aa13ab23ac83a	Y:a:i:q:.:.:.:.:
0xba4f4	d93aed3afe3a133b213b333b4a3b583b	.:.:.:.;!;3;J;X;
0xba504	683b7b3b883b903ba13bad3bb53bc33b	h;{;.;.;.;.;.;.;
0xba514	d13bdf3be73bf53b063c183c203c2e3c	.;.;.;.;.<.< <.<
0xba524	3c3c523c5c3c643c723c833c983ca63c	<<R<\<d<r<.<.<.<
0xba534	b53cc63cd13cd93ce73cf53c023d0a3d	.<.<.<.<.<.<.=.=
0xba544	183d293d3a3d423d503d5e3d743d873d	.=)=:=B=P=^=t=.=
0xba554	983dad3dbe3dd23dda3deb3df53dfd3d	.=.=.=.=.=.=.=.=
0xba564	0b3e1a3e283e3a3e483e573e683e7c3e	.>.>(>:>H>W>h>\|>
0xba574	803e9a3ea13eb83ebc3ec03edb3edf3e	.>.>.>.>.>.>.>.>
0xba584	e33efc3e0c3f143f183f1c3f243f283f	.>.>.?.?.?.?$?(?
0xba594	2c3f303f343f383f3c3f403f443f483f	,?0?4?8?<?@?D?H?
0xba5a4	4c3f503f543f583f5c3f643f6c3f743f	L?P?T?X?\?d?l?t?

0xba2b4	b03cbd3ccf3ce33ceb3cf33c0f3d243d	.<.<.<.<.<.<.=$=
0xba2c4	323d443d553d5d3d6e3d7d3d853d943d	2=D=U=]=n=}=.=.=
0xba2d4	a93dad3dc73dd13dd53df43d003e043e	.=.=.=.=.=.=.>.>
0xba2e4	083e0c3e143e1c3e203e243e283e2c3e	.>.>.>.> >$>(>,>
0xba2f4	303e343e383e3c3e403e443e483e4c3e	0>4>8><>@>D>H>L>
0xba304	503e543e583e663e783e893e9b3eb33e	P>T>X>f>x>.>.>.>
0xba314	bb3ec33ecb3ed33edb3ee33eeb3ef33e	.>.>.>.>.>.>.>.>
0xba324	fb3e033f0b3f133f1b3f233f2b3f333f	.>.?.?.?.?#?+?3?
0xba334	3b3f433f4b3f533f5b3f633f6b3f733f	;?C?K?S?[?c?k?s?
0xba344	853f9b3fac3fb63fbe3fcc3fdd3ff13f	.?.?.?.?.?.?.?.?
0xba354	00900600700200000230173025303730	....p....0.0%070
0xba364	5930663077309930a630b730ce30dc30	Y0f0w0.0.0.0.0.0
0xba374	ec30ff300c311431253133313b314931	.0.0.1.1%131;1I1
0xba384	5a316c31743182319031a631b231ba31	Z1l1t1.1.1.1.1.1
0xba394	cb31df31e731f83106320e321c322d32	.1.1.1.1.2.2.2-2
0xba3a4	3f3247325532633279328e329c32ab32	?2G2U2c2y2.2.2.2
0xba3b4	bc32c732cf32e032f332013313332833	.2.2.2.2.2.3.3(3
0xba3c4	35333d334b335c336d33753383339133	53=3K3\3m3u3.3.3
0xba3d4	a733ba33cb33de33ec33003417342534	.3.3.3.3.3.4.4%4
0xba3e4	39344e345c346b347e3490349a34a234	94N4\4k4~4.4.4.4
0xba3f4	b034c234d434e234f13400350b350f35	.4.4.4.4.4.5.5.5
0xba404	2935303537353e3555355d3578358035	)50575>5U5]5x5.5
0xba414	98359c35ba35dc35f0351c3632365c36	.5.5.5.5.5.626\6
0xba424	6c36703674367c36843688368c369036	l6p6t6\|6.6.6.6.6
0xba434	943698369c36a036a436a836ac36b036	.6.6.6.6.6.6.6.6
0xba444	bd36cf36ec36f436fc36213736374437	.6.6.6.6.6!767D7
0xba454	5f377037783786379437a337ab37bc37	_7p7x7.7.7.7.7.7
0xba464	da37de37f83702380638d438d838dc38	.7.7.7.8.8.8.8.8
0xba474	e038e438e838ec38f038f438f838fc38	.8.8.8.8.8.8.8.8
0xba484	0039043908390c391039143918391c39	.9.9.9.9.9.9.9.9
0xba494	203924393c395839643968396c397039	9$9<9X9d9h9l9p9
0xba4a4	7c39803984398c39943998399c39a039	\|9.9.9.9.9.9.9.9
0xba4b4	a439a839ac39b039b439b839bc39c039	.9.9.9.9.9.9.9.9
0xba4c4	cd39e139e939f139f939013a093a113a	.9.9.9.9.9.:.:.:
0xba4d4	193a213a293a313a393a413a493a513a	.:!:):1:9:A:I:Q:
0xba4e4	593a613a693a713a8c3aa13ab23ac83a	Y:a:i:q:.:.:.:.:
0xba4f4	d93aed3afe3a133b213b333b4a3b583b	.:.:.:.;!;3;J;X;
0xba504	683b7b3b883b903ba13bad3bb53bc33b	h;{;.;.;.;.;.;.;
0xba514	d13bdf3be73bf53b063c183c203c2e3c	.;.;.;.;.<.< <.<
0xba524	3c3c523c5c3c643c723c833c983ca63c	<<R<\<d<r<.<.<.<
0xba534	b53cc63cd13cd93ce73cf53c023d0a3d	.<.<.<.<.<.<.=.=
0xba544	183d293d3a3d423d503d5e3d743d873d	.=)=:=B=P=^=t=.=
0xba554	983dad3dbe3dd23dda3deb3df53dfd3d	.=.=.=.=.=.=.=.=
0xba564	0b3e1a3e283e3a3e483e573e683e7c3e	.>.>(>:>H>W>h>\|>
0xba574	803e9a3ea13eb83ebc3ec03edb3edf3e	.>.>.>.>.>.>.>.>
0xba584	e33efc3e0c3f143f183f1c3f243f283f	.>.>.?.?.?.?$?(?
0xba594	2c3f303f343f383f3c3f403f443f483f	,?0?4?8?<?@?D?H?
0xba5a4	4c3f503f543f583f5c3f643f6c3f743f	L?P?T?X?\?d?l?t?

0x15b02a3	d49e5c43317f3ae7561f5a5f4b00964d	..\C1.:.V.Z_K..M
0x15b02b3	b4f5ebd85adbb73962ed3e5bec6655f2	....Z..9b.>[.fU.
0x15b02c3	b515e2bd92c2c15419ba5f6b126717bb	.......T.._k.g..
0x15b02d3	335f02895f7af5670da3dddb4a8f62e4	3_.._z.g....J.b.
0x15b02e3	3a0335cab30ce6e3fff93ffe1fa0bb0d	:.5.......?.....
0x15b02f3	ee3930303133362c313030302c53562c	.900136,1000,SV,
0x15b0303	484b4c4d5c536f6674776172655c4d69	HKLM\Software\Mi
0x15b0313	63726f736f66745c57696e646f77735c	crosoft\Windows\
0x15b0323	43757272656e7456657273696f6e5c52	CurrentVersion\R
0x15b0333	756e6f6e63652c2a2c2a2c482e537461	unonce,,,H.Sta
0x15b0343	727475702e4175746f52756e0d0a789c	rtup.AutoRun..x.
0x15b0353	dcbdd9d224b97526783f66f30ef30031	....$.u&x?f....1
0x15b0363	d9d8974b000e48322de4909ae6d8dc95	...K..H2-.......
0x15b0373	c89254ad5215ad489a9afdf4fd7d07f0	..T.R..H.....}..
0x15b0383	d87e8faccc5ac84c8fb43f23e00e87fb	.~...Z.L..?#....
0x15b0393	7100675fb4f236b88b56d95efef9bb6f	q.g_..6..V.^...o
0x15b03a3	ffc717dfbcfb9b2fbff9f2bbaf7e7bf1	......./.....~{.
0x15b03b3	d9a8741949f113e7b71ef33bce6f347f	..t.I......;.o4.
0x15b03c3	8e6f3be45bbe469a5fa38e1ff4f93fff	.o;.[.F._.....?.
0x15b03d3	0fc7814d068c4a3dc3a883bae4d286f3	...M..J=........
0x15b03e3	5e8fbe2937bc9676453bce76ac5bd2ea	^..)7..vE;.v.[..
0x15b03f3	ae1d	..

0xba2b4	b03cbd3ccf3ce33ceb3cf33c0f3d243d	.<.<.<.<.<.<.=$=
0xba2c4	323d443d553d5d3d6e3d7d3d853d943d	2=D=U=]=n=}=.=.=
0xba2d4	a93dad3dc73dd13dd53df43d003e043e	.=.=.=.=.=.=.>.>
0xba2e4	083e0c3e143e1c3e203e243e283e2c3e	.>.>.>.> >$>(>,>
0xba2f4	303e343e383e3c3e403e443e483e4c3e	0>4>8><>@>D>H>L>
0xba304	503e543e583e663e783e893e9b3eb33e	P>T>X>f>x>.>.>.>
0xba314	bb3ec33ecb3ed33edb3ee33eeb3ef33e	.>.>.>.>.>.>.>.>
0xba324	fb3e033f0b3f133f1b3f233f2b3f333f	.>.?.?.?.?#?+?3?
0xba334	3b3f433f4b3f533f5b3f633f6b3f733f	;?C?K?S?[?c?k?s?
0xba344	853f9b3fac3fb63fbe3fcc3fdd3ff13f	.?.?.?.?.?.?.?.?
0xba354	00900600700200000230173025303730	....p....0.0%070
0xba364	5930663077309930a630b730ce30dc30	Y0f0w0.0.0.0.0.0
0xba374	ec30ff300c311431253133313b314931	.0.0.1.1%131;1I1
0xba384	5a316c31743182319031a631b231ba31	Z1l1t1.1.1.1.1.1
0xba394	cb31df31e731f83106320e321c322d32	.1.1.1.1.2.2.2-2
0xba3a4	3f3247325532633279328e329c32ab32	?2G2U2c2y2.2.2.2
0xba3b4	bc32c732cf32e032f332013313332833	.2.2.2.2.2.3.3(3
0xba3c4	35333d334b335c336d33753383339133	53=3K3\3m3u3.3.3
0xba3d4	a733ba33cb33de33ec33003417342534	.3.3.3.3.3.4.4%4
0xba3e4	39344e345c346b347e3490349a34a234	94N4\4k4~4.4.4.4
0xba3f4	b034c234d434e234f13400350b350f35	.4.4.4.4.4.5.5.5
0xba404	2935303537353e3555355d3578358035	)50575>5U5]5x5.5
0xba414	98359c35ba35dc35f0351c3632365c36	.5.5.5.5.5.626\6
0xba424	6c36703674367c36843688368c369036	l6p6t6\|6.6.6.6.6
0xba434	943698369c36a036a436a836ac36b036	.6.6.6.6.6.6.6.6
0xba444	bd36cf36ec36f436fc36213736374437	.6.6.6.6.6!767D7
0xba454	5f377037783786379437a337ab37bc37	_7p7x7.7.7.7.7.7
0xba464	da37de37f83702380638d438d838dc38	.7.7.7.8.8.8.8.8
0xba474	e038e438e838ec38f038f438f838fc38	.8.8.8.8.8.8.8.8
0xba484	0039043908390c391039143918391c39	.9.9.9.9.9.9.9.9
0xba494	203924393c395839643968396c397039	9$9<9X9d9h9l9p9
0xba4a4	7c39803984398c39943998399c39a039	\|9.9.9.9.9.9.9.9
0xba4b4	a439a839ac39b039b439b839bc39c039	.9.9.9.9.9.9.9.9
0xba4c4	cd39e139e939f139f939013a093a113a	.9.9.9.9.9.:.:.:
0xba4d4	193a213a293a313a393a413a493a513a	.:!:):1:9:A:I:Q:
0xba4e4	593a613a693a713a8c3aa13ab23ac83a	Y:a:i:q:.:.:.:.:
0xba4f4	d93aed3afe3a133b213b333b4a3b583b	.:.:.:.;!;3;J;X;
0xba504	683b7b3b883b903ba13bad3bb53bc33b	h;{;.;.;.;.;.;.;
0xba514	d13bdf3be73bf53b063c183c203c2e3c	.;.;.;.;.<.< <.<
0xba524	3c3c523c5c3c643c723c833c983ca63c	<<R<\<d<r<.<.<.<
0xba534	b53cc63cd13cd93ce73cf53c023d0a3d	.<.<.<.<.<.<.=.=
0xba544	183d293d3a3d423d503d5e3d743d873d	.=)=:=B=P=^=t=.=
0xba554	983dad3dbe3dd23dda3deb3df53dfd3d	.=.=.=.=.=.=.=.=
0xba564	0b3e1a3e283e3a3e483e573e683e7c3e	.>.>(>:>H>W>h>\|>
0xba574	803e9a3ea13eb83ebc3ec03edb3edf3e	.>.>.>.>.>.>.>.>
0xba584	e33efc3e0c3f143f183f1c3f243f283f	.>.>.?.?.?.?$?(?
0xba594	2c3f303f343f383f3c3f403f443f483f	,?0?4?8?<?@?D?H?
0xba5a4	4c3f503f543f583f5c3f643f6c3f743f	L?P?T?X?\?d?l?t?

0xba2b4	b03cbd3ccf3ce33ceb3cf33c0f3d243d	.<.<.<.<.<.<.=$=
0xba2c4	323d443d553d5d3d6e3d7d3d853d943d	2=D=U=]=n=}=.=.=
0xba2d4	a93dad3dc73dd13dd53df43d003e043e	.=.=.=.=.=.=.>.>
0xba2e4	083e0c3e143e1c3e203e243e283e2c3e	.>.>.>.> >$>(>,>
0xba2f4	303e343e383e3c3e403e443e483e4c3e	0>4>8><>@>D>H>L>
0xba304	503e543e583e663e783e893e9b3eb33e	P>T>X>f>x>.>.>.>
0xba314	bb3ec33ecb3ed33edb3ee33eeb3ef33e	.>.>.>.>.>.>.>.>
0xba324	fb3e033f0b3f133f1b3f233f2b3f333f	.>.?.?.?.?#?+?3?
0xba334	3b3f433f4b3f533f5b3f633f6b3f733f	;?C?K?S?[?c?k?s?
0xba344	853f9b3fac3fb63fbe3fcc3fdd3ff13f	.?.?.?.?.?.?.?.?
0xba354	00900600700200000230173025303730	....p....0.0%070
0xba364	5930663077309930a630b730ce30dc30	Y0f0w0.0.0.0.0.0
0xba374	ec30ff300c311431253133313b314931	.0.0.1.1%131;1I1
0xba384	5a316c31743182319031a631b231ba31	Z1l1t1.1.1.1.1.1
0xba394	cb31df31e731f83106320e321c322d32	.1.1.1.1.2.2.2-2
0xba3a4	3f3247325532633279328e329c32ab32	?2G2U2c2y2.2.2.2
0xba3b4	bc32c732cf32e032f332013313332833	.2.2.2.2.2.3.3(3
0xba3c4	35333d334b335c336d33753383339133	53=3K3\3m3u3.3.3
0xba3d4	a733ba33cb33de33ec33003417342534	.3.3.3.3.3.4.4%4
0xba3e4	39344e345c346b347e3490349a34a234	94N4\4k4~4.4.4.4
0xba3f4	b034c234d434e234f13400350b350f35	.4.4.4.4.4.5.5.5
0xba404	2935303537353e3555355d3578358035	)50575>5U5]5x5.5
0xba414	98359c35ba35dc35f0351c3632365c36	.5.5.5.5.5.626\6
0xba424	6c36703674367c36843688368c369036	l6p6t6\|6.6.6.6.6
0xba434	943698369c36a036a436a836ac36b036	.6.6.6.6.6.6.6.6
0xba444	bd36cf36ec36f436fc36213736374437	.6.6.6.6.6!767D7
0xba454	5f377037783786379437a337ab37bc37	_7p7x7.7.7.7.7.7
0xba464	da37de37f83702380638d438d838dc38	.7.7.7.8.8.8.8.8
0xba474	e038e438e838ec38f038f438f838fc38	.8.8.8.8.8.8.8.8
0xba484	0039043908390c391039143918391c39	.9.9.9.9.9.9.9.9
0xba494	203924393c395839643968396c397039	9$9<9X9d9h9l9p9
0xba4a4	7c39803984398c39943998399c39a039	\|9.9.9.9.9.9.9.9
0xba4b4	a439a839ac39b039b439b839bc39c039	.9.9.9.9.9.9.9.9
0xba4c4	cd39e139e939f139f939013a093a113a	.9.9.9.9.9.:.:.:
0xba4d4	193a213a293a313a393a413a493a513a	.:!:):1:9:A:I:Q:
0xba4e4	593a613a693a713a8c3aa13ab23ac83a	Y:a:i:q:.:.:.:.:
0xba4f4	d93aed3afe3a133b213b333b4a3b583b	.:.:.:.;!;3;J;X;
0xba504	683b7b3b883b903ba13bad3bb53bc33b	h;{;.;.;.;.;.;.;
0xba514	d13bdf3be73bf53b063c183c203c2e3c	.;.;.;.;.<.< <.<
0xba524	3c3c523c5c3c643c723c833c983ca63c	<<R<\<d<r<.<.<.<
0xba534	b53cc63cd13cd93ce73cf53c023d0a3d	.<.<.<.<.<.<.=.=
0xba544	183d293d3a3d423d503d5e3d743d873d	.=)=:=B=P=^=t=.=
0xba554	983dad3dbe3dd23dda3deb3df53dfd3d	.=.=.=.=.=.=.=.=
0xba564	0b3e1a3e283e3a3e483e573e683e7c3e	.>.>(>:>H>W>h>\|>
0xba574	803e9a3ea13eb83ebc3ec03edb3edf3e	.>.>.>.>.>.>.>.>
0xba584	e33efc3e0c3f143f183f1c3f243f283f	.>.>.?.?.?.?$?(?
0xba594	2c3f303f343f383f3c3f403f443f483f	,?0?4?8?<?@?D?H?
0xba5a4	4c3f503f543f583f5c3f643f6c3f743f	L?P?T?X?\?d?l?t?

0xb065c	000000004765744d6f64756c6548616e	....GetModuleHan
0xb066c	646c655700000000467265654c696272	dleW....FreeLibr
0xb067c	6172790000004865617044657374726f	ary...HeapDestro
0xb068c	790000005265616446696c6500000000	y...ReadFile....
0xb069c	43726561746550726f63657373570000	CreateProcessW..
0xb06ac	00004765744c6173744572726f720000	..GetLastError..
0xb06bc	00004765744d6f64756c6546696c654e	..GetModuleFileN
0xb06cc	616d6557000000005365744c61737445	ameW....SetLastE
0xb06dc	72726f720000000046696e645265736f	rror....FindReso
0xb06ec	75726365570000004372656174655468	urceW...CreateTh
0xb06fc	7265616400000000436f6d7061726553	read....CompareS
0xb070c	7472696e6757000000004c6f61644c69	tringW....LoadLi
0xb071c	62726172794100000000526573657445	braryA....ResetE
0xb072c	76656e7400000000476574566f6c756d	vent....GetVolum
0xb073c	65496e666f726d6174696f6e57000000	eInformationW...
0xb074c	47657456657273696f6e000000004765	GetVersion....Ge
0xb075c	74447269766554797065570000005261	tDriveTypeW...Ra
0xb076c	697365457863657074696f6e00000000	iseException....
0xb077c	466f726d61744d657373616765570000	FormatMessageW..
0xb078c	0000537769746368546f546872656164	..SwitchToThread
0xb079c	0000000047657445786974436f646554	....GetExitCodeT
0xb07ac	68726561640000004765744375727265	hread...GetCurre
0xb07bc	6e74546872656164000000004c	ntThread....L

0xba2b4	b03cbd3ccf3ce33ceb3cf33c0f3d243d	.<.<.<.<.<.<.=$=
0xba2c4	323d443d553d5d3d6e3d7d3d853d943d	2=D=U=]=n=}=.=.=
0xba2d4	a93dad3dc73dd13dd53df43d003e043e	.=.=.=.=.=.=.>.>
0xba2e4	083e0c3e143e1c3e203e243e283e2c3e	.>.>.>.> >$>(>,>
0xba2f4	303e343e383e3c3e403e443e483e4c3e	0>4>8><>@>D>H>L>
0xba304	503e543e583e663e783e893e9b3eb33e	P>T>X>f>x>.>.>.>
0xba314	bb3ec33ecb3ed33edb3ee33eeb3ef33e	.>.>.>.>.>.>.>.>
0xba324	fb3e033f0b3f133f1b3f233f2b3f333f	.>.?.?.?.?#?+?3?
0xba334	3b3f433f4b3f533f5b3f633f6b3f733f	;?C?K?S?[?c?k?s?
0xba344	853f9b3fac3fb63fbe3fcc3fdd3ff13f	.?.?.?.?.?.?.?.?
0xba354	00900600700200000230173025303730	....p....0.0%070
0xba364	5930663077309930a630b730ce30dc30	Y0f0w0.0.0.0.0.0
0xba374	ec30ff300c311431253133313b314931	.0.0.1.1%131;1I1
0xba384	5a316c31743182319031a631b231ba31	Z1l1t1.1.1.1.1.1
0xba394	cb31df31e731f83106320e321c322d32	.1.1.1.1.2.2.2-2
0xba3a4	3f3247325532633279328e329c32ab32	?2G2U2c2y2.2.2.2
0xba3b4	bc32c732cf32e032f332013313332833	.2.2.2.2.2.3.3(3
0xba3c4	35333d334b335c336d33753383339133	53=3K3\3m3u3.3.3
0xba3d4	a733ba33cb33de33ec33003417342534	.3.3.3.3.3.4.4%4
0xba3e4	39344e345c346b347e3490349a34a234	94N4\4k4~4.4.4.4
0xba3f4	b034c234d434e234f13400350b350f35	.4.4.4.4.4.5.5.5
0xba404	2935303537353e3555355d3578358035	)50575>5U5]5x5.5
0xba414	98359c35ba35dc35f0351c3632365c36	.5.5.5.5.5.626\6
0xba424	6c36703674367c36843688368c369036	l6p6t6\|6.6.6.6.6
0xba434	943698369c36a036a436a836ac36b036	.6.6.6.6.6.6.6.6
0xba444	bd36cf36ec36f436fc36213736374437	.6.6.6.6.6!767D7
0xba454	5f377037783786379437a337ab37bc37	_7p7x7.7.7.7.7.7
0xba464	da37de37f83702380638d438d838dc38	.7.7.7.8.8.8.8.8
0xba474	e038e438e838ec38f038f438f838fc38	.8.8.8.8.8.8.8.8
0xba484	0039043908390c391039143918391c39	.9.9.9.9.9.9.9.9
0xba494	203924393c395839643968396c397039	9$9<9X9d9h9l9p9
0xba4a4	7c39803984398c39943998399c39a039	\|9.9.9.9.9.9.9.9
0xba4b4	a439a839ac39b039b439b839bc39c039	.9.9.9.9.9.9.9.9
0xba4c4	cd39e139e939f139f939013a093a113a	.9.9.9.9.9.:.:.:
0xba4d4	193a213a293a313a393a413a493a513a	.:!:):1:9:A:I:Q:
0xba4e4	593a613a693a713a8c3aa13ab23ac83a	Y:a:i:q:.:.:.:.:
0xba4f4	d93aed3afe3a133b213b333b4a3b583b	.:.:.:.;!;3;J;X;
0xba504	683b7b3b883b903ba13bad3bb53bc33b	h;{;.;.;.;.;.;.;
0xba514	d13bdf3be73bf53b063c183c203c2e3c	.;.;.;.;.<.< <.<
0xba524	3c3c523c5c3c643c723c833c983ca63c	<<R<\<d<r<.<.<.<
0xba534	b53cc63cd13cd93ce73cf53c023d0a3d	.<.<.<.<.<.<.=.=
0xba544	183d293d3a3d423d503d5e3d743d873d	.=)=:=B=P=^=t=.=
0xba554	983dad3dbe3dd23dda3deb3df53dfd3d	.=.=.=.=.=.=.=.=
0xba564	0b3e1a3e283e3a3e483e573e683e7c3e	.>.>(>:>H>W>h>\|>
0xba574	803e9a3ea13eb83ebc3ec03edb3edf3e	.>.>.>.>.>.>.>.>
0xba584	e33efc3e0c3f143f183f1c3f243f283f	.>.>.?.?.?.?$?(?
0xba594	2c3f303f343f383f3c3f403f443f483f	,?0?4?8?<?@?D?H?
0xba5a4	4c3f503f543f583f5c3f643f6c3f743f	L?P?T?X?\?d?l?t?

0xba2b4	b03cbd3ccf3ce33ceb3cf33c0f3d243d	.<.<.<.<.<.<.=$=
0xba2c4	323d443d553d5d3d6e3d7d3d853d943d	2=D=U=]=n=}=.=.=
0xba2d4	a93dad3dc73dd13dd53df43d003e043e	.=.=.=.=.=.=.>.>
0xba2e4	083e0c3e143e1c3e203e243e283e2c3e	.>.>.>.> >$>(>,>
0xba2f4	303e343e383e3c3e403e443e483e4c3e	0>4>8><>@>D>H>L>
0xba304	503e543e583e663e783e893e9b3eb33e	P>T>X>f>x>.>.>.>
0xba314	bb3ec33ecb3ed33edb3ee33eeb3ef33e	.>.>.>.>.>.>.>.>
0xba324	fb3e033f0b3f133f1b3f233f2b3f333f	.>.?.?.?.?#?+?3?
0xba334	3b3f433f4b3f533f5b3f633f6b3f733f	;?C?K?S?[?c?k?s?
0xba344	853f9b3fac3fb63fbe3fcc3fdd3ff13f	.?.?.?.?.?.?.?.?
0xba354	00900600700200000230173025303730	....p....0.0%070
0xba364	5930663077309930a630b730ce30dc30	Y0f0w0.0.0.0.0.0
0xba374	ec30ff300c311431253133313b314931	.0.0.1.1%131;1I1
0xba384	5a316c31743182319031a631b231ba31	Z1l1t1.1.1.1.1.1
0xba394	cb31df31e731f83106320e321c322d32	.1.1.1.1.2.2.2-2
0xba3a4	3f3247325532633279328e329c32ab32	?2G2U2c2y2.2.2.2
0xba3b4	bc32c732cf32e032f332013313332833	.2.2.2.2.2.3.3(3
0xba3c4	35333d334b335c336d33753383339133	53=3K3\3m3u3.3.3
0xba3d4	a733ba33cb33de33ec33003417342534	.3.3.3.3.3.4.4%4
0xba3e4	39344e345c346b347e3490349a34a234	94N4\4k4~4.4.4.4
0xba3f4	b034c234d434e234f13400350b350f35	.4.4.4.4.4.5.5.5
0xba404	2935303537353e3555355d3578358035	)50575>5U5]5x5.5
0xba414	98359c35ba35dc35f0351c3632365c36	.5.5.5.5.5.626\6
0xba424	6c36703674367c36843688368c369036	l6p6t6\|6.6.6.6.6
0xba434	943698369c36a036a436a836ac36b036	.6.6.6.6.6.6.6.6
0xba444	bd36cf36ec36f436fc36213736374437	.6.6.6.6.6!767D7
0xba454	5f377037783786379437a337ab37bc37	_7p7x7.7.7.7.7.7
0xba464	da37de37f83702380638d438d838dc38	.7.7.7.8.8.8.8.8
0xba474	e038e438e838ec38f038f438f838fc38	.8.8.8.8.8.8.8.8
0xba484	0039043908390c391039143918391c39	.9.9.9.9.9.9.9.9
0xba494	203924393c395839643968396c397039	9$9<9X9d9h9l9p9
0xba4a4	7c39803984398c39943998399c39a039	\|9.9.9.9.9.9.9.9
0xba4b4	a439a839ac39b039b439b839bc39c039	.9.9.9.9.9.9.9.9
0xba4c4	cd39e139e939f139f939013a093a113a	.9.9.9.9.9.:.:.:
0xba4d4	193a213a293a313a393a413a493a513a	.:!:):1:9:A:I:Q:
0xba4e4	593a613a693a713a8c3aa13ab23ac83a	Y:a:i:q:.:.:.:.:
0xba4f4	d93aed3afe3a133b213b333b4a3b583b	.:.:.:.;!;3;J;X;
0xba504	683b7b3b883b903ba13bad3bb53bc33b	h;{;.;.;.;.;.;.;
0xba514	d13bdf3be73bf53b063c183c203c2e3c	.;.;.;.;.<.< <.<
0xba524	3c3c523c5c3c643c723c833c983ca63c	<<R<\<d<r<.<.<.<
0xba534	b53cc63cd13cd93ce73cf53c023d0a3d	.<.<.<.<.<.<.=.=
0xba544	183d293d3a3d423d503d5e3d743d873d	.=)=:=B=P=^=t=.=
0xba554	983dad3dbe3dd23dda3deb3df53dfd3d	.=.=.=.=.=.=.=.=
0xba564	0b3e1a3e283e3a3e483e573e683e7c3e	.>.>(>:>H>W>h>\|>
0xba574	803e9a3ea13eb83ebc3ec03edb3edf3e	.>.>.>.>.>.>.>.>
0xba584	e33efc3e0c3f143f183f1c3f243f283f	.>.>.?.?.?.?$?(?
0xba594	2c3f303f343f383f3c3f403f443f483f	,?0?4?8?<?@?D?H?
0xba5a4	4c3f503f543f583f5c3f643f6c3f743f	L?P?T?X?\?d?l?t?

Metadata

0xcb8af	6170706c69636174696f6e3e0d0a2020	application>..
0xcb8bf	2020202020203c737570706f72746564	<supported
0xcb8cf	4f532049643d227b6532303131343537	OS Id="{e2011457
0xcb8df	2d313534362d343363352d613566652d	-1546-43c5-a5fe-
0xcb8ef	3030386465656533643366307d222f3e	008deee3d3f0}"/>
0xcb8ff	0d0a20202020202020203c737570706f	.. <suppo
0xcb90f	727465644f532049643d227b33353133	rtedOS Id="{3513
0xcb91f	386239612d356439362d346662642d38	8b9a-5d96-4fbd-8
0xcb92f	6532642d613234343032323566393361	e2d-a2440225f93a
0xcb93f	7d222f3e0d0a20202020202020203c73	}"/>.. <s
0xcb94f	7570706f727465644f532049643d227b	upportedOS Id="{
0xcb95f	34613266323865332d353362392d3434	4a2f28e3-53b9-44
0xcb96f	34312d626139632d6436396434613461	41-ba9c-d69d4a4a
0xcb97f	366533387d222f3e0d0a202020202020	6e38}"/>..
0xcb98f	20203c737570706f727465644f532049	<supportedOS I
0xcb99f	643d227b31663637366337362d383065	d="{1f676c76-80e
0xcb9af	312d343233392d393562622d38336430	1-4239-95bb-83d0
0xcb9bf	66366430646137387d222f3e0d0a2020	f6d0da78}"/>..
0xcb9cf	2020202020203c737570706f72746564	<supported
0xcb9df	4f532049643d227b3865306637613132	OS Id="{8e0f7a12
0xcb9ef	2d626662332d346665382d623961352d	-bfb3-4fe8-b9a5-
0xcb9ff	3438666435306131356139617d222f3e	48fd50a15a9a}"/>
0xcba0f	0d0a202020203c2f6170706c69636174	.. </applicat
0xcba1f	696f6e3e0d0a3c2f636f6d7061746962	ion>..</compatib
0xcba2f	696c6974793e0d0a3c66696c65206e61	ility>..<file na
0xcba3f	6d653d22636f6d63746c33322e646c6c	me="comctl32.dll
0xcba4f	22206c6f616446726f6d3d2225537973	" loadFrom="%Sys
0xcba5f	74656d526f6f74255c73797374656d33	temRoot%\system3
0xcba6f	325c22202f3e0d0a3c66696c65206e61	2\" />..<file na
0xcba7f	6d653d226d70722e646c6c22206c6f61	me="mpr.dll" loa
0xcba8f	6446726f6d3d222553797374656d526f	dFrom="%SystemRo
0xcba9f	6f74255c73797374656d33325c22202f	ot%\system32\" /
0xcbaaf	3e0d0a3c66696c65206e616d653d226e	>..<file name="n
0xcbabf	657461706933322e646c6c22206c6f61	etapi32.dll" loa
0xcbacf	6446726f6d3d222553797374656d526f	dFrom="%SystemRo
0xcbadf	6f74255c73797374656d33325c22202f	ot%\system32\" /
0xcbaef	3e0d0a3c66696c65206e616d653d226e	>..<file name="n
0xcbaff	65747574696c732e646c6c22206c6f61	etutils.dll" loa
0xcbb0f	6446726f6d3d222553797374656d526f	dFrom="%SystemRo
0xcbb1f	6f74255c73797374656d33325c22202f	ot%\system32\" /
0xcbb2f	3e0d0a3c66696c65206e616d653d2274	>..<file name="t
0xcbb3f	65787473686170696e672e646c6c2220	extshaping.dll"
0xcbb4f	6c6f616446726f6d3d22255379737465	loadFrom="%Syste
0xcbb5f	6d526f6f74255c73797374656d33325c	mRoot%\system32\
0xcbb6f	22202f3e0d0a3c66696c65206e616d65	" />..<file name
0xcbb7f	3d2276657273696f6e2e646c6c22206c	="version.dll" l
0xcbb8f	6f616446726f6d3d222553797374656d	oadFrom="%System
0xcbb9f	526f6f74255c73797374656d33325c22	Root%\system32\"

0xe3cca0	b6f8cf2b449d7b1584ef4da0becc98a4	...+D.{...M.....
0xe3ccb0	8fc9c7b9a9bc62b36ebf28a48417b1ac	......b.n.(.....
0xe3ccc0	76426f789c8543ca316f8c17aa058bd4	vBox..C.1o......
0xe3ccd0	36c95418b16c144f500eff19c167fa5a	6.T..l.OP....g.Z
0xe3cce0	ddb0d710be40649bf3821679e3a73192	.....@d....y..1.
0xe3ccf0	d313e3e08797b40b6a8353e73117b966	........j.S.1..f
0xe3cd00	936e49df	.nI.

0x15b02a3	d49e5c43317f3ae7561f5a5f4b00964d	..\C1.:.V.Z_K..M
0x15b02b3	b4f5ebd85adbb73962ed3e5bec6655f2	....Z..9b.>[.fU.
0x15b02c3	b515e2bd92c2c15419ba5f6b126717bb	.......T.._k.g..
0x15b02d3	335f02895f7af5670da3dddb4a8f62e4	3_.._z.g....J.b.
0x15b02e3	3a0335cab30ce6e3fff93ffe1fa0bb0d	:.5.......?.....
0x15b02f3	ee3930303133362c313030302c53562c	.900136,1000,SV,
0x15b0303	484b4c4d5c536f6674776172655c4d69	HKLM\Software\Mi
0x15b0313	63726f736f66745c57696e646f77735c	crosoft\Windows\
0x15b0323	43757272656e7456657273696f6e5c52	CurrentVersion\R
0x15b0333	756e6f6e63652c2a2c2a2c482e537461	unonce,,,H.Sta
0x15b0343	727475702e4175746f52756e0d0a789c	rtup.AutoRun..x.
0x15b0353	dcbdd9d224b97526783f66f30ef30031	....$.u&x?f....1
0x15b0363	d9d8974b000e48322de4909ae6d8dc95	...K..H2-.......
0x15b0373	c89254ad5215ad489a9afdf4fd7d07f0	..T.R..H.....}..
0x15b0383	d87e8faccc5ac84c8fb43f23e00e87fb	.~...Z.L..?#....
0x15b0393	7100675fb4f236b88b56d95efef9bb6f	q.g_..6..V.^...o
0x15b03a3	ffc717dfbcfb9b2fbff9f2bbaf7e7bf1	......./.....~{.
0x15b03b3	d9a8741949f113e7b71ef33bce6f347f	..t.I......;.o4.
0x15b03c3	8e6f3be45bbe469a5fa38e1ff4f93fff	.o;.[.F._.....?.
0x15b03d3	0fc7814d068c4a3dc3a883bae4d286f3	...M..J=........
0x15b03e3	5e8fbe2937bc9676453bce76ac5bd2ea	^..)7..vE;.v.[..
0x15b03f3	ae1d	..

0x40bb607	585308a2300d06092a864886f70d0101	XS..0...*.H.....
0x40bb617	0b0500304c3120301e060355040b1317	...0L1 0...U....
0x40bb627	476c6f62616c5369676e20526f6f7420	GlobalSign Root
0x40bb637	4341202d20523331133011060355040a	CA - R31.0...U..
0x40bb647	130a476c6f62616c5369676e31133011	..GlobalSign1.0.
0x40bb657	0603550403130a476c6f62616c536967	..U....GlobalSig
0x40bb667	6e301e170d3039303331383130303030	n0...09031810000
0x40bb677	305a170d323930333138313030303030	0Z..290318100000
0x40bb687	5a304c3120301e060355040b1317476c	Z0L1 0...U....Gl
0x40bb697	6f62616c5369676e20526f6f74204341	obalSign Root CA
0x40bb6a7	202d	-

0x40bbf7b	30303030305a3053310b300906035504	00000Z0S1.0...U.
0x40bbf8b	061302424531193017060355040a1310	...BE1.0...U....
0x40bbf9b	476c6f62616c5369676e206e762d7361	GlobalSign nv-sa
0x40bbfab	3129302706035504031320476c6f6261	1)0'..U... Globa
0x40bbfbb	6c5369676e20436f6465205369676e69	lSign Code Signi
0x40bbfcb	6e6720526f6f74205234353082022230	ng Root R450.."0
0x40bbfdb	0d06092a864886f70d01010105000382	...*.H..........
0x40bbfeb	020f003082020a0282020100b62dc530	...0.........-.0
0x40bbffb	dd7ae8ab903d0372b03a4b991661b2e5	.z...=.r.:K..a..
0x40bc00b	ffa5671d371ce57eec9383	..g.7..~...

0x40bcbe0	30303030305a305c310b300906035504	00000Z0\1.0...U.
0x40bcbf0	061302424531193017060355040a1310	...BE1.0...U....
0x40bcc00	476c6f62616c5369676e206e762d7361	GlobalSign nv-sa
0x40bcc10	3132303006035504031329476c6f6261	1200..U...)Globa
0x40bcc20	6c5369676e2047434320523435204556	lSign GCC R45 EV
0x40bcc30	20436f64655369676e696e6720434120	CodeSigning CA
0x40bcc40	3230323030820222300d06092a864886	20200.."0...*.H.
0x40bcc50	f70d01010105000382020f003082020a	............0...
0x40bcc60	0282020100cb20ef971eb9013243a05b	...... .....2C.[
0x40bcc70	a98a23fd205eae38128bca2cd4ff41d8	..#. ^.8...,..A.
0x40bcc80	1a55d41953	.U..S

signed Authenticode chain CN: IObit Co.\

file

0xafb14	48e84500000000000000000000000000	H.E.............
0xafb24	00000000000000000000000000000000	................
0xafb34	0000000000000000f1fffffffeffffff	................
0xafb44	ffffffff000000000100000002000000	................
0xafb54	0f000000706049000000000000050000	....p`I.........
0xafb64	0000008000000040000000c000000000	.......@........
0xafb74	01000000020000000300000002000000	................
0xafb84	01000000030000000400000005000000	................
0xafb94	496e6e6f205365747570205365747570	Inno Setup Setup
0xafba4	20446174612028362e342e3329000000	Data (6.4.3)...
0xafbb4	00000000000000000000000000000000	................
0xafbc4	00000000000000000000000000000000	................
0xafbd4	496e6e6f205365747570204d65737361	Inno Setup Messa
0xafbe4	6765732028362e342e30292028752900	ges (6.4.0) (u).
0xafbf4	00000000000000000000000000000000	................
0xafc04	00000000000000000000000000000000	................
0xafc14	30003100320033003400350036003700	0.1.2.3.4.5.6.7.
0xafc24	38003900410042004300440045004600	8.9.A.B.C.D.E.F.
0xafc34	4700480049004a004b004c004d004e00	G.H.I.J.K.L.M.N.
0xafc44	4f005000510052005300540055005600	O.P.Q.R.S.T.U.V.
0xafc54	00000000ffffffffffffffff01000000	................
0xafc64	000000000000000074fd40005cfc4000	........t.@.\.@.
0xafc74	bcfc40009cfb4000c4fd400004fe4000	..@...@...@...@.
0xafc84	6cfe40000801410094fd4000c8004100	l.@...A...@...A.
0xafc94	900041003c204b00f4fc4000d8ff4000	..A.< K...@...@.
0xafca4	14e04a007cfe4000a0004100f8	..J.\|.@...A..

sfx/inno-setup Inno Setup extraction failed

20 of 34 traits shown

Identity

SHA-256	103d3264de73abdc2c33a4f15ab0c291aa0d8b7318b861cb63cebc630aef6b30
Filename	iobit_malware_fighter_setup.exe
Package	IObit.MalwareFighter

Origin

Source	forager
Feed	winget.run
Ecosystem	windows
Domain	iobit.com
URL	https://cdn.iobit.com/dl/iobit_malware_fighter_setup.exe

Timeline

First seen	14 Jul 2026 12:14 UTC
First analyzed	17 Jul 2026 18:20 UTC
Last analyzed	17 Jul 2026 18:20 UTC
Last updated	17 Jul 2026 18:20 UTC

Labeling

Label	unknown
Label source	forager
Traits version	32522

Not seeing what you expected? Let us know

0xa2a9c	44240cc6442410008d54240c33c9b8dc	D$..D$...T$.3...
0xa2aac	364a00e8d4fdffff8b4424083bc6740a	6J.......D$.;.t.
0xa2abc	b806000000e8a6fcffff83c4145f5e5b	............._^[
0xa2acc	c3000000b0040200ffffffff16000000	................
0xa2adc	4c007a006d0061004400650063006f00	L.z.m.a.D.e.c.o.
0xa2aec	6400650020006600610069006c006500	d.e. .f.a.i.l.e.
0xa2afc	64002000280025006400290000000000	d. .(.%.d.).....
0xa2b0c	c6401100c6401000c38d400064668d80	.@...@....@.df..
0xa2b1c	0000000083ec745355568bb424840000	......tSUV..$...
0xa2b2c	005733ff897c24248b46108b4e088944	.W3..\|$$.F..N..D
0xa2b3c	242cb801000000d3e08b4e0448894424	$,........N.H.D$
0xa2b4c	54b801000000d3e0488b5e4889442458	T.......H.^H.D$X
0xa2b5c	8b06894424448b	...D$D.