Anydo.Anydo

SUSPICIOUS

4acb4a8c9b5135e3498f1299d34899437c2e5ba997262448af2c37c39becb205 · 54%

AI Installer contains worm/syscall references

Mal-ecule

O₄(CCoErI)H₄(F₅Os₆Po₄U)Md₄(Bi₃PaSi₃)

Size 348.0 MB download

First seen 15 days ago

Analyzed 12 days ago

Ecosystem windows

Source electron-app.any.do

Anydo Setup 5.0.119.exe pe

0x23ac	2d00008b45d8a9f0ffffff7572817ddc	-...E......ur.}.
0x23bc	efbeadde7569817de8496e7374756081	....ui.}.Instu`.
0x23cc	7de4736f66747557817de04e756c6c75	}.softuW.}.Nullu
0x23dc	4e0945088b45088b0df881420083e002	N.E..E.....B....
0x23ec	09	.

0x77fc	77734469726563746f7279570000d601	wsDirectoryW....
0x780c	47657454656d70506174685700001101	GetTempPathW....
0x781c	476574436f6d6d616e644c696e655700	GetCommandLineW.
0x782c	e80147657456657273696f6e00001503	..GetVersion....
0x783c	5365744572726f724d6f64650000cd03	SetErrorMode....
0x784c	6c7374726c656e570000ca036c737472	lstrlenW....lstr
0x785c	6370796e570050014765744469736b46	cpynW.P.GetDiskF
0x786c	726565537061636557000a02476c6f62	reeSpaceW...Glob
0x787c	616c556e6c6f636b00000302476c6f62	alUnlock....Glob
0x788c	616c4c6f636b00006f00437265617465	alLock..o.Create
0x789c	546872656164000071014765744c6173	Thread..q.GetLas
0x78ac	744572726f7200004e00437265617465	tError..N.Create
0x78bc	4469726563746f727957000069004372	DirectoryW..i.Cr
0x78cc	6561746550726f63657373570000c502	eateProcessW....
0x78dc	52656d6f76654469726563746f727957	RemoveDirectoryW
0x78ec	0000c3036c737472636d706941005600	....lstrcmpiA.V.
0x78fc	43726561746546696c655700d4014765	CreateFileW...Ge
0x790c	7454656d7046696c654e616d65570000	tTempFileNameW..
0x791c	a403577269746546696c6500c6036c73	..WriteFile...ls
0x792c	747263707941000070024d6f76654669	trcpyA..p.MoveFi
0x793c	6c6545785700be036c73747263617457	leExW...lstrcatW
0x794c	0000c20147657453797374656d446972	....GetSystemDir
0x795c	6563746f72795700a00147657450726f	ectoryW...GetPro
0x796c	634164647265737300007f014765744d	cAddress....GetM
0x797c	6f64756c654861	oduleHa

0x7c9c	b9014c6f61644269746d617057001c00	..LoadBitmapW...
0x7cac	43616c6c57696e646f7750726f635700	CallWindowProcW.
0x7cbc	b101497357696e646f7756697369626c	..IsWindowVisibl
0x7ccc	65004200436c6f7365436c6970626f61	e.B.CloseClipboa
0x7cdc	726400004a02536574436c6970626f61	rd..J.SetClipboa
0x7cec	7264446174610000c100456d70747943	rdData....EmptyC
0x7cfc	6c6970626f6172640000f6014f70656e	lipboard....Open
0x7d0c	436c6970626f61726400a40254726163	Clipboard...Trac
0x7d1c	6b506f7075704d656e75000009004170	kPopupMenu....Ap
0x7d2c	70656e644d656e7557	pendMenuW

0x7f2e	7565727956616c756545785700000502	ueryValueExW....
0x7f3e	52656753657456616c75654578570000	RegSetValueExW..
0x7f4e	cb01526567436c6f73654b657900d901	..RegCloseKey...
0x7f5e	52656744656c65746556616c7565	RegDeleteValue

0x7fe8	5265674372656174654b657945785700	RegCreateKeyExW.
0x7ff8	41445641504933322e646c6c00003800	ADVAPI32.dll..8.
0x8008	496d6167654c6973745f44657374726f	ImageList_Destro
0x8018	79003400496d6167654c6973745f4164	y.4.ImageList_Ad
0x8028	644d61736b6564003700496d6167654c	dMasked.7.ImageL
0x8038	6973745f4372656174650000434f4d43	ist_Create..COMC
0x8048	544c33322e646c6c00001000436f4372	TL32.dll....CoCr
0x8058	65617465496e7374616e636500000501	eateInstance....
0x8068	4f6c65556e696e697469616c697a6500	OleUninitialize.
0x8078	ee004f6c65496e697469616c697a6500	..OleInitialize.
0x8088	6500436f5461736b4d656d4672656500	e.CoTaskMemFree.
0x8098	6f6c6533322e646c6c00000000000000	ole32.dll.......
0x80a8	00000000000000000000000000000000	................
0x80b8	00000000000000000000000000000000	................
0x80c8	00000000000000000000000000000000	................
0x80d8	00000000000000000000000000000000	................
0x80e8	00000000000000000000000000000000	................
0x80f8	00000000000000000000000000000000	................
0x8108	00000000000000000000000000000000	................
0x8118	00000000000000000000000000000000	................
0x8128	00000000000000000000000000000000	................
0x8138	00000000000000000000000000000000	................
0x8148	00000000000000000000000000000000	................
0x8158	00000000000000000000000000000000	................
0x8168	00000000000000000000000000000000	................
0x8178	00000000000000000000000000000000	................
0x8188	00000000000000000000000000000000	................
0x8198	00000000000000000000000000000000	................
0x81a8	00000000000000000000000000000000	................
0x81b8	00000000000000000000000000000000	................
0x81c8	00000000000000000000000000000000	................
0x81d8	00000000000000000000000000000000	................
0x81e8	00000000000000000000000000000000	................
0x81f8	000000000000000080af470089134000	..........G...@.
0x8208	4e654000683940000a0000005c000000	Ne@.h9@.....\...
0x8218	ffffffff760065007200690066007900	....v.e.r.i.f.y.
0x8228	69006e006700200069006e0073007400	i.n.g. .i.n.s.t.
0x8238	61006c006c00650072003a0020002500	a.l.l.e.r.:. .%.
0x8248	640025002500000049006e0073007400	d.%.%...I.n.s.t.
0x8258	61006c006c0065007200200069006e00	a.l.l.e.r. .i.n.
0x8268	74006500670072006900740079002000	t.e.g.r.i.t.y. .
0x8278	63006800650063006b00200068006100	c.h.e.c.k. .h.a.
0x8288	730020006600610069006c0065006400	s. .f.a.i.l.e.d.
0x8298	2e00200043006f006d006d006f006e00	.. .C.o.m.m.o.n.
0x82a8	20006300610075007300650073002000	.c.a.u.s.e.s. .
0x82b8	69006e0063006c007500640065000a00	i.n.c.l.u.d.e...
0x82c8	69006e0063006f006d0070006c006500	i.n.c.o.m.p.l.e.
0x82d8	74006500200064006f0077006e006c00	t.e. .d.o.w.n.l.

Objectives

0x7c9c	b9014c6f61644269746d617057001c00	..LoadBitmapW...
0x7cac	43616c6c57696e646f7750726f635700	CallWindowProcW.
0x7cbc	b101497357696e646f7756697369626c	..IsWindowVisibl
0x7ccc	65004200436c6f7365436c6970626f61	e.B.CloseClipboa
0x7cdc	726400004a02536574436c6970626f61	rd..J.SetClipboa
0x7cec	7264446174610000c100456d70747943	rdData....EmptyC
0x7cfc	6c6970626f6172640000f6014f70656e	lipboard....Open
0x7d0c	436c6970626f61726400a40254726163	Clipboard...Trac
0x7d1c	6b506f7075704d656e75000009004170	kPopupMenu....Ap
0x7d2c	70656e644d656e7557	pendMenuW

0x7fe8	5265674372656174654b657945785700	RegCreateKeyExW.
0x7ff8	41445641504933322e646c6c00003800	ADVAPI32.dll..8.
0x8008	496d6167654c6973745f44657374726f	ImageList_Destro
0x8018	79003400496d6167654c6973745f4164	y.4.ImageList_Ad
0x8028	644d61736b6564003700496d6167654c	dMasked.7.ImageL
0x8038	6973745f4372656174650000434f4d43	ist_Create..COMC
0x8048	544c33322e646c6c00001000436f4372	TL32.dll....CoCr
0x8058	65617465496e7374616e636500000501	eateInstance....
0x8068	4f6c65556e696e697469616c697a6500	OleUninitialize.
0x8078	ee004f6c65496e697469616c697a6500	..OleInitialize.
0x8088	6500436f5461736b4d656d4672656500	e.CoTaskMemFree.
0x8098	6f6c6533322e646c6c00000000000000	ole32.dll.......
0x80a8	00000000000000000000000000000000	................
0x80b8	00000000000000000000000000000000	................
0x80c8	00000000000000000000000000000000	................
0x80d8	00000000000000000000000000000000	................
0x80e8	00000000000000000000000000000000	................
0x80f8	00000000000000000000000000000000	................
0x8108	00000000000000000000000000000000	................
0x8118	00000000000000000000000000000000	................
0x8128	00000000000000000000000000000000	................
0x8138	00000000000000000000000000000000	................
0x8148	00000000000000000000000000000000	................
0x8158	00000000000000000000000000000000	................
0x8168	00000000000000000000000000000000	................
0x8178	00000000000000000000000000000000	................
0x8188	00000000000000000000000000000000	................
0x8198	00000000000000000000000000000000	................
0x81a8	00000000000000000000000000000000	................
0x81b8	00000000000000000000000000000000	................
0x81c8	00000000000000000000000000000000	................
0x81d8	00000000000000000000000000000000	................
0x81e8	00000000000000000000000000000000	................
0x81f8	000000000000000080af470089134000	..........G...@.
0x8208	4e654000683940000a0000005c000000	Ne@.h9@.....\...
0x8218	ffffffff760065007200690066007900	....v.e.r.i.f.y.
0x8228	69006e006700200069006e0073007400	i.n.g. .i.n.s.t.
0x8238	61006c006c00650072003a0020002500	a.l.l.e.r.:. .%.
0x8248	640025002500000049006e0073007400	d.%.%...I.n.s.t.
0x8258	61006c006c0065007200200069006e00	a.l.l.e.r. .i.n.
0x8268	74006500670072006900740079002000	t.e.g.r.i.t.y. .
0x8278	63006800650063006b00200068006100	c.h.e.c.k. .h.a.
0x8288	730020006600610069006c0065006400	s. .f.a.i.l.e.d.
0x8298	2e00200043006f006d006d006f006e00	.. .C.o.m.m.o.n.
0x82a8	20006300610075007300650073002000	.c.a.u.s.e.s. .
0x82b8	69006e0063006c007500640065000a00	i.n.c.l.u.d.e...
0x82c8	69006e0063006f006d0070006c006500	i.n.c.o.m.p.l.e.
0x82d8	74006500200064006f0077006e006c00	t.e. .d.o.w.n.l.

0x7fe8	5265674372656174654b657945785700	RegCreateKeyExW.
0x7ff8	41445641504933322e646c6c00003800	ADVAPI32.dll..8.
0x8008	496d6167654c6973745f44657374726f	ImageList_Destro
0x8018	79003400496d6167654c6973745f4164	y.4.ImageList_Ad
0x8028	644d61736b6564003700496d6167654c	dMasked.7.ImageL
0x8038	6973745f4372656174650000434f4d43	ist_Create..COMC
0x8048	544c33322e646c6c00001000436f4372	TL32.dll....CoCr
0x8058	65617465496e7374616e636500000501	eateInstance....
0x8068	4f6c65556e696e697469616c697a6500	OleUninitialize.
0x8078	ee004f6c65496e697469616c697a6500	..OleInitialize.
0x8088	6500436f5461736b4d656d4672656500	e.CoTaskMemFree.
0x8098	6f6c6533322e646c6c00000000000000	ole32.dll.......
0x80a8	00000000000000000000000000000000	................
0x80b8	00000000000000000000000000000000	................
0x80c8	00000000000000000000000000000000	................
0x80d8	00000000000000000000000000000000	................
0x80e8	00000000000000000000000000000000	................
0x80f8	00000000000000000000000000000000	................
0x8108	00000000000000000000000000000000	................
0x8118	00000000000000000000000000000000	................
0x8128	00000000000000000000000000000000	................
0x8138	00000000000000000000000000000000	................
0x8148	00000000000000000000000000000000	................
0x8158	00000000000000000000000000000000	................
0x8168	00000000000000000000000000000000	................
0x8178	00000000000000000000000000000000	................
0x8188	00000000000000000000000000000000	................
0x8198	00000000000000000000000000000000	................
0x81a8	00000000000000000000000000000000	................
0x81b8	00000000000000000000000000000000	................
0x81c8	00000000000000000000000000000000	................
0x81d8	00000000000000000000000000000000	................
0x81e8	00000000000000000000000000000000	................
0x81f8	000000000000000080af470089134000	..........G...@.
0x8208	4e654000683940000a0000005c000000	Ne@.h9@.....\...
0x8218	ffffffff760065007200690066007900	....v.e.r.i.f.y.
0x8228	69006e006700200069006e0073007400	i.n.g. .i.n.s.t.
0x8238	61006c006c00650072003a0020002500	a.l.l.e.r.:. .%.
0x8248	640025002500000049006e0073007400	d.%.%...I.n.s.t.
0x8258	61006c006c0065007200200069006e00	a.l.l.e.r. .i.n.
0x8268	74006500670072006900740079002000	t.e.g.r.i.t.y. .
0x8278	63006800650063006b00200068006100	c.h.e.c.k. .h.a.
0x8288	730020006600610069006c0065006400	s. .f.a.i.l.e.d.
0x8298	2e00200043006f006d006d006f006e00	.. .C.o.m.m.o.n.
0x82a8	20006300610075007300650073002000	.c.a.u.s.e.s. .
0x82b8	69006e0063006c007500640065000a00	i.n.c.l.u.d.e...
0x82c8	69006e0063006f006d0070006c006500	i.n.c.o.m.p.l.e.
0x82d8	74006500200064006f0077006e006c00	t.e. .d.o.w.n.l.

0x8420	2e002000250064002500250000000000	.. .%.d.%.%.....
0x8430	53006500530068007500740064006f00	S.e.S.h.u.t.d.o.
0x8440	77006e00500072006900760069006c00	w.n.P.r.i.v.i.l.
0x8450	65006700650000004100000000000000	e.g.e...A.......
0x8460	2e0074006d0070000000000041000000	..t.m.p.....A...
0x8470	7e006e00730075000000000020005f00	~.n.s.u..... ._.
0x8480	3f003d000000000054004d0050000000	?.=.....T.M.P...
0x8490	540045004d005000000000004c006f00	T.E.M.P.....L.o.
0x84a0	770000005c00540065006d0070000000	w...\.T.e.m.p...
0x84b0	20002f00	./.

Micro-behaviors

0x7fe8	5265674372656174654b657945785700	RegCreateKeyExW.
0x7ff8	41445641504933322e646c6c00003800	ADVAPI32.dll..8.
0x8008	496d6167654c6973745f44657374726f	ImageList_Destro
0x8018	79003400496d6167654c6973745f4164	y.4.ImageList_Ad
0x8028	644d61736b6564003700496d6167654c	dMasked.7.ImageL
0x8038	6973745f4372656174650000434f4d43	ist_Create..COMC
0x8048	544c33322e646c6c00001000436f4372	TL32.dll....CoCr
0x8058	65617465496e7374616e636500000501	eateInstance....
0x8068	4f6c65556e696e697469616c697a6500	OleUninitialize.
0x8078	ee004f6c65496e697469616c697a6500	..OleInitialize.
0x8088	6500436f5461736b4d656d4672656500	e.CoTaskMemFree.
0x8098	6f6c6533322e646c6c00000000000000	ole32.dll.......
0x80a8	00000000000000000000000000000000	................
0x80b8	00000000000000000000000000000000	................
0x80c8	00000000000000000000000000000000	................
0x80d8	00000000000000000000000000000000	................
0x80e8	00000000000000000000000000000000	................
0x80f8	00000000000000000000000000000000	................
0x8108	00000000000000000000000000000000	................
0x8118	00000000000000000000000000000000	................
0x8128	00000000000000000000000000000000	................
0x8138	00000000000000000000000000000000	................
0x8148	00000000000000000000000000000000	................
0x8158	00000000000000000000000000000000	................
0x8168	00000000000000000000000000000000	................
0x8178	00000000000000000000000000000000	................
0x8188	00000000000000000000000000000000	................
0x8198	00000000000000000000000000000000	................
0x81a8	00000000000000000000000000000000	................
0x81b8	00000000000000000000000000000000	................
0x81c8	00000000000000000000000000000000	................
0x81d8	00000000000000000000000000000000	................
0x81e8	00000000000000000000000000000000	................
0x81f8	000000000000000080af470089134000	..........G...@.
0x8208	4e654000683940000a0000005c000000	Ne@.h9@.....\...
0x8218	ffffffff760065007200690066007900	....v.e.r.i.f.y.
0x8228	69006e006700200069006e0073007400	i.n.g. .i.n.s.t.
0x8238	61006c006c00650072003a0020002500	a.l.l.e.r.:. .%.
0x8248	640025002500000049006e0073007400	d.%.%...I.n.s.t.
0x8258	61006c006c0065007200200069006e00	a.l.l.e.r. .i.n.
0x8268	74006500670072006900740079002000	t.e.g.r.i.t.y. .
0x8278	63006800650063006b00200068006100	c.h.e.c.k. .h.a.
0x8288	730020006600610069006c0065006400	s. .f.a.i.l.e.d.
0x8298	2e00200043006f006d006d006f006e00	.. .C.o.m.m.o.n.
0x82a8	20006300610075007300650073002000	.c.a.u.s.e.s. .
0x82b8	69006e0063006c007500640065000a00	i.n.c.l.u.d.e...
0x82c8	69006e0063006f006d0070006c006500	i.n.c.o.m.p.l.e.
0x82d8	74006500200064006f0077006e006c00	t.e. .d.o.w.n.l.

0x7fe8	5265674372656174654b657945785700	RegCreateKeyExW.
0x7ff8	41445641504933322e646c6c00003800	ADVAPI32.dll..8.
0x8008	496d6167654c6973745f44657374726f	ImageList_Destro
0x8018	79003400496d6167654c6973745f4164	y.4.ImageList_Ad
0x8028	644d61736b6564003700496d6167654c	dMasked.7.ImageL
0x8038	6973745f4372656174650000434f4d43	ist_Create..COMC
0x8048	544c33322e646c6c00001000436f4372	TL32.dll....CoCr
0x8058	65617465496e7374616e636500000501	eateInstance....
0x8068	4f6c65556e696e697469616c697a6500	OleUninitialize.
0x8078	ee004f6c65496e697469616c697a6500	..OleInitialize.
0x8088	6500436f5461736b4d656d4672656500	e.CoTaskMemFree.
0x8098	6f6c6533322e646c6c00000000000000	ole32.dll.......
0x80a8	00000000000000000000000000000000	................
0x80b8	00000000000000000000000000000000	................
0x80c8	00000000000000000000000000000000	................
0x80d8	00000000000000000000000000000000	................
0x80e8	00000000000000000000000000000000	................
0x80f8	00000000000000000000000000000000	................
0x8108	00000000000000000000000000000000	................
0x8118	00000000000000000000000000000000	................
0x8128	00000000000000000000000000000000	................
0x8138	00000000000000000000000000000000	................
0x8148	00000000000000000000000000000000	................
0x8158	00000000000000000000000000000000	................
0x8168	00000000000000000000000000000000	................
0x8178	00000000000000000000000000000000	................
0x8188	00000000000000000000000000000000	................
0x8198	00000000000000000000000000000000	................
0x81a8	00000000000000000000000000000000	................
0x81b8	00000000000000000000000000000000	................
0x81c8	00000000000000000000000000000000	................
0x81d8	00000000000000000000000000000000	................
0x81e8	00000000000000000000000000000000	................
0x81f8	000000000000000080af470089134000	..........G...@.
0x8208	4e654000683940000a0000005c000000	Ne@.h9@.....\...
0x8218	ffffffff760065007200690066007900	....v.e.r.i.f.y.
0x8228	69006e006700200069006e0073007400	i.n.g. .i.n.s.t.
0x8238	61006c006c00650072003a0020002500	a.l.l.e.r.:. .%.
0x8248	640025002500000049006e0073007400	d.%.%...I.n.s.t.
0x8258	61006c006c0065007200200069006e00	a.l.l.e.r. .i.n.
0x8268	74006500670072006900740079002000	t.e.g.r.i.t.y. .
0x8278	63006800650063006b00200068006100	c.h.e.c.k. .h.a.
0x8288	730020006600610069006c0065006400	s. .f.a.i.l.e.d.
0x8298	2e00200043006f006d006d006f006e00	.. .C.o.m.m.o.n.
0x82a8	20006300610075007300650073002000	.c.a.u.s.e.s. .
0x82b8	69006e0063006c007500640065000a00	i.n.c.l.u.d.e...
0x82c8	69006e0063006f006d0070006c006500	i.n.c.o.m.p.l.e.
0x82d8	74006500200064006f0077006e006c00	t.e. .d.o.w.n.l.

0x7fe8	5265674372656174654b657945785700	RegCreateKeyExW.
0x7ff8	41445641504933322e646c6c00003800	ADVAPI32.dll..8.
0x8008	496d6167654c6973745f44657374726f	ImageList_Destro
0x8018	79003400496d6167654c6973745f4164	y.4.ImageList_Ad
0x8028	644d61736b6564003700496d6167654c	dMasked.7.ImageL
0x8038	6973745f4372656174650000434f4d43	ist_Create..COMC
0x8048	544c33322e646c6c00001000436f4372	TL32.dll....CoCr
0x8058	65617465496e7374616e636500000501	eateInstance....
0x8068	4f6c65556e696e697469616c697a6500	OleUninitialize.
0x8078	ee004f6c65496e697469616c697a6500	..OleInitialize.
0x8088	6500436f5461736b4d656d4672656500	e.CoTaskMemFree.
0x8098	6f6c6533322e646c6c00000000000000	ole32.dll.......
0x80a8	00000000000000000000000000000000	................
0x80b8	00000000000000000000000000000000	................
0x80c8	00000000000000000000000000000000	................
0x80d8	00000000000000000000000000000000	................
0x80e8	00000000000000000000000000000000	................
0x80f8	00000000000000000000000000000000	................
0x8108	00000000000000000000000000000000	................
0x8118	00000000000000000000000000000000	................
0x8128	00000000000000000000000000000000	................
0x8138	00000000000000000000000000000000	................
0x8148	00000000000000000000000000000000	................
0x8158	00000000000000000000000000000000	................
0x8168	00000000000000000000000000000000	................
0x8178	00000000000000000000000000000000	................
0x8188	00000000000000000000000000000000	................
0x8198	00000000000000000000000000000000	................
0x81a8	00000000000000000000000000000000	................
0x81b8	00000000000000000000000000000000	................
0x81c8	00000000000000000000000000000000	................
0x81d8	00000000000000000000000000000000	................
0x81e8	00000000000000000000000000000000	................
0x81f8	000000000000000080af470089134000	..........G...@.
0x8208	4e654000683940000a0000005c000000	Ne@.h9@.....\...
0x8218	ffffffff760065007200690066007900	....v.e.r.i.f.y.
0x8228	69006e006700200069006e0073007400	i.n.g. .i.n.s.t.
0x8238	61006c006c00650072003a0020002500	a.l.l.e.r.:. .%.
0x8248	640025002500000049006e0073007400	d.%.%...I.n.s.t.
0x8258	61006c006c0065007200200069006e00	a.l.l.e.r. .i.n.
0x8268	74006500670072006900740079002000	t.e.g.r.i.t.y. .
0x8278	63006800650063006b00200068006100	c.h.e.c.k. .h.a.
0x8288	730020006600610069006c0065006400	s. .f.a.i.l.e.d.
0x8298	2e00200043006f006d006d006f006e00	.. .C.o.m.m.o.n.
0x82a8	20006300610075007300650073002000	.c.a.u.s.e.s. .
0x82b8	69006e0063006c007500640065000a00	i.n.c.l.u.d.e...
0x82c8	69006e0063006f006d0070006c006500	i.n.c.o.m.p.l.e.
0x82d8	74006500200064006f0077006e006c00	t.e. .d.o.w.n.l.

0x77fc	77734469726563746f7279570000d601	wsDirectoryW....
0x780c	47657454656d70506174685700001101	GetTempPathW....
0x781c	476574436f6d6d616e644c696e655700	GetCommandLineW.
0x782c	e80147657456657273696f6e00001503	..GetVersion....
0x783c	5365744572726f724d6f64650000cd03	SetErrorMode....
0x784c	6c7374726c656e570000ca036c737472	lstrlenW....lstr
0x785c	6370796e570050014765744469736b46	cpynW.P.GetDiskF
0x786c	726565537061636557000a02476c6f62	reeSpaceW...Glob
0x787c	616c556e6c6f636b00000302476c6f62	alUnlock....Glob
0x788c	616c4c6f636b00006f00437265617465	alLock..o.Create
0x789c	546872656164000071014765744c6173	Thread..q.GetLas
0x78ac	744572726f7200004e00437265617465	tError..N.Create
0x78bc	4469726563746f727957000069004372	DirectoryW..i.Cr
0x78cc	6561746550726f63657373570000c502	eateProcessW....
0x78dc	52656d6f76654469726563746f727957	RemoveDirectoryW
0x78ec	0000c3036c737472636d706941005600	....lstrcmpiA.V.
0x78fc	43726561746546696c655700d4014765	CreateFileW...Ge
0x790c	7454656d7046696c654e616d65570000	tTempFileNameW..
0x791c	a403577269746546696c6500c6036c73	..WriteFile...ls
0x792c	747263707941000070024d6f76654669	trcpyA..p.MoveFi
0x793c	6c6545785700be036c73747263617457	leExW...lstrcatW
0x794c	0000c20147657453797374656d446972	....GetSystemDir
0x795c	6563746f72795700a00147657450726f	ectoryW...GetPro
0x796c	634164647265737300007f014765744d	cAddress....GetM
0x797c	6f64756c654861	oduleHa

0x7fe8	5265674372656174654b657945785700	RegCreateKeyExW.
0x7ff8	41445641504933322e646c6c00003800	ADVAPI32.dll..8.
0x8008	496d6167654c6973745f44657374726f	ImageList_Destro
0x8018	79003400496d6167654c6973745f4164	y.4.ImageList_Ad
0x8028	644d61736b6564003700496d6167654c	dMasked.7.ImageL
0x8038	6973745f4372656174650000434f4d43	ist_Create..COMC
0x8048	544c33322e646c6c00001000436f4372	TL32.dll....CoCr
0x8058	65617465496e7374616e636500000501	eateInstance....
0x8068	4f6c65556e696e697469616c697a6500	OleUninitialize.
0x8078	ee004f6c65496e697469616c697a6500	..OleInitialize.
0x8088	6500436f5461736b4d656d4672656500	e.CoTaskMemFree.
0x8098	6f6c6533322e646c6c00000000000000	ole32.dll.......
0x80a8	00000000000000000000000000000000	................
0x80b8	00000000000000000000000000000000	................
0x80c8	00000000000000000000000000000000	................
0x80d8	00000000000000000000000000000000	................
0x80e8	00000000000000000000000000000000	................
0x80f8	00000000000000000000000000000000	................
0x8108	00000000000000000000000000000000	................
0x8118	00000000000000000000000000000000	................
0x8128	00000000000000000000000000000000	................
0x8138	00000000000000000000000000000000	................
0x8148	00000000000000000000000000000000	................
0x8158	00000000000000000000000000000000	................
0x8168	00000000000000000000000000000000	................
0x8178	00000000000000000000000000000000	................
0x8188	00000000000000000000000000000000	................
0x8198	00000000000000000000000000000000	................
0x81a8	00000000000000000000000000000000	................
0x81b8	00000000000000000000000000000000	................
0x81c8	00000000000000000000000000000000	................
0x81d8	00000000000000000000000000000000	................
0x81e8	00000000000000000000000000000000	................
0x81f8	000000000000000080af470089134000	..........G...@.
0x8208	4e654000683940000a0000005c000000	Ne@.h9@.....\...
0x8218	ffffffff760065007200690066007900	....v.e.r.i.f.y.
0x8228	69006e006700200069006e0073007400	i.n.g. .i.n.s.t.
0x8238	61006c006c00650072003a0020002500	a.l.l.e.r.:. .%.
0x8248	640025002500000049006e0073007400	d.%.%...I.n.s.t.
0x8258	61006c006c0065007200200069006e00	a.l.l.e.r. .i.n.
0x8268	74006500670072006900740079002000	t.e.g.r.i.t.y. .
0x8278	63006800650063006b00200068006100	c.h.e.c.k. .h.a.
0x8288	730020006600610069006c0065006400	s. .f.a.i.l.e.d.
0x8298	2e00200043006f006d006d006f006e00	.. .C.o.m.m.o.n.
0x82a8	20006300610075007300650073002000	.c.a.u.s.e.s. .
0x82b8	69006e0063006c007500640065000a00	i.n.c.l.u.d.e...
0x82c8	69006e0063006f006d0070006c006500	i.n.c.o.m.p.l.e.
0x82d8	74006500200064006f0077006e006c00	t.e. .d.o.w.n.l.

0x7c9c	b9014c6f61644269746d617057001c00	..LoadBitmapW...
0x7cac	43616c6c57696e646f7750726f635700	CallWindowProcW.
0x7cbc	b101497357696e646f7756697369626c	..IsWindowVisibl
0x7ccc	65004200436c6f7365436c6970626f61	e.B.CloseClipboa
0x7cdc	726400004a02536574436c6970626f61	rd..J.SetClipboa
0x7cec	7264446174610000c100456d70747943	rdData....EmptyC
0x7cfc	6c6970626f6172640000f6014f70656e	lipboard....Open
0x7d0c	436c6970626f61726400a40254726163	Clipboard...Trac
0x7d1c	6b506f7075704d656e75000009004170	kPopupMenu....Ap
0x7d2c	70656e644d656e7557	pendMenuW

0x7fe8	5265674372656174654b657945785700	RegCreateKeyExW.
0x7ff8	41445641504933322e646c6c00003800	ADVAPI32.dll..8.
0x8008	496d6167654c6973745f44657374726f	ImageList_Destro
0x8018	79003400496d6167654c6973745f4164	y.4.ImageList_Ad
0x8028	644d61736b6564003700496d6167654c	dMasked.7.ImageL
0x8038	6973745f4372656174650000434f4d43	ist_Create..COMC
0x8048	544c33322e646c6c00001000436f4372	TL32.dll....CoCr
0x8058	65617465496e7374616e636500000501	eateInstance....
0x8068	4f6c65556e696e697469616c697a6500	OleUninitialize.
0x8078	ee004f6c65496e697469616c697a6500	..OleInitialize.
0x8088	6500436f5461736b4d656d4672656500	e.CoTaskMemFree.
0x8098	6f6c6533322e646c6c00000000000000	ole32.dll.......
0x80a8	00000000000000000000000000000000	................
0x80b8	00000000000000000000000000000000	................
0x80c8	00000000000000000000000000000000	................
0x80d8	00000000000000000000000000000000	................
0x80e8	00000000000000000000000000000000	................
0x80f8	00000000000000000000000000000000	................
0x8108	00000000000000000000000000000000	................
0x8118	00000000000000000000000000000000	................
0x8128	00000000000000000000000000000000	................
0x8138	00000000000000000000000000000000	................
0x8148	00000000000000000000000000000000	................
0x8158	00000000000000000000000000000000	................
0x8168	00000000000000000000000000000000	................
0x8178	00000000000000000000000000000000	................
0x8188	00000000000000000000000000000000	................
0x8198	00000000000000000000000000000000	................
0x81a8	00000000000000000000000000000000	................
0x81b8	00000000000000000000000000000000	................
0x81c8	00000000000000000000000000000000	................
0x81d8	00000000000000000000000000000000	................
0x81e8	00000000000000000000000000000000	................
0x81f8	000000000000000080af470089134000	..........G...@.
0x8208	4e654000683940000a0000005c000000	Ne@.h9@.....\...
0x8218	ffffffff760065007200690066007900	....v.e.r.i.f.y.
0x8228	69006e006700200069006e0073007400	i.n.g. .i.n.s.t.
0x8238	61006c006c00650072003a0020002500	a.l.l.e.r.:. .%.
0x8248	640025002500000049006e0073007400	d.%.%...I.n.s.t.
0x8258	61006c006c0065007200200069006e00	a.l.l.e.r. .i.n.
0x8268	74006500670072006900740079002000	t.e.g.r.i.t.y. .
0x8278	63006800650063006b00200068006100	c.h.e.c.k. .h.a.
0x8288	730020006600610069006c0065006400	s. .f.a.i.l.e.d.
0x8298	2e00200043006f006d006d006f006e00	.. .C.o.m.m.o.n.
0x82a8	20006300610075007300650073002000	.c.a.u.s.e.s. .
0x82b8	69006e0063006c007500640065000a00	i.n.c.l.u.d.e...
0x82c8	69006e0063006f006d0070006c006500	i.n.c.o.m.p.l.e.
0x82d8	74006500200064006f0077006e006c00	t.e. .d.o.w.n.l.

0x7fe8	5265674372656174654b657945785700	RegCreateKeyExW.
0x7ff8	41445641504933322e646c6c00003800	ADVAPI32.dll..8.
0x8008	496d6167654c6973745f44657374726f	ImageList_Destro
0x8018	79003400496d6167654c6973745f4164	y.4.ImageList_Ad
0x8028	644d61736b6564003700496d6167654c	dMasked.7.ImageL
0x8038	6973745f4372656174650000434f4d43	ist_Create..COMC
0x8048	544c33322e646c6c00001000436f4372	TL32.dll....CoCr
0x8058	65617465496e7374616e636500000501	eateInstance....
0x8068	4f6c65556e696e697469616c697a6500	OleUninitialize.
0x8078	ee004f6c65496e697469616c697a6500	..OleInitialize.
0x8088	6500436f5461736b4d656d4672656500	e.CoTaskMemFree.
0x8098	6f6c6533322e646c6c00000000000000	ole32.dll.......
0x80a8	00000000000000000000000000000000	................
0x80b8	00000000000000000000000000000000	................
0x80c8	00000000000000000000000000000000	................
0x80d8	00000000000000000000000000000000	................
0x80e8	00000000000000000000000000000000	................
0x80f8	00000000000000000000000000000000	................
0x8108	00000000000000000000000000000000	................
0x8118	00000000000000000000000000000000	................
0x8128	00000000000000000000000000000000	................
0x8138	00000000000000000000000000000000	................
0x8148	00000000000000000000000000000000	................
0x8158	00000000000000000000000000000000	................
0x8168	00000000000000000000000000000000	................
0x8178	00000000000000000000000000000000	................
0x8188	00000000000000000000000000000000	................
0x8198	00000000000000000000000000000000	................
0x81a8	00000000000000000000000000000000	................
0x81b8	00000000000000000000000000000000	................
0x81c8	00000000000000000000000000000000	................
0x81d8	00000000000000000000000000000000	................
0x81e8	00000000000000000000000000000000	................
0x81f8	000000000000000080af470089134000	..........G...@.
0x8208	4e654000683940000a0000005c000000	Ne@.h9@.....\...
0x8218	ffffffff760065007200690066007900	....v.e.r.i.f.y.
0x8228	69006e006700200069006e0073007400	i.n.g. .i.n.s.t.
0x8238	61006c006c00650072003a0020002500	a.l.l.e.r.:. .%.
0x8248	640025002500000049006e0073007400	d.%.%...I.n.s.t.
0x8258	61006c006c0065007200200069006e00	a.l.l.e.r. .i.n.
0x8268	74006500670072006900740079002000	t.e.g.r.i.t.y. .
0x8278	63006800650063006b00200068006100	c.h.e.c.k. .h.a.
0x8288	730020006600610069006c0065006400	s. .f.a.i.l.e.d.
0x8298	2e00200043006f006d006d006f006e00	.. .C.o.m.m.o.n.
0x82a8	20006300610075007300650073002000	.c.a.u.s.e.s. .
0x82b8	69006e0063006c007500640065000a00	i.n.c.l.u.d.e...
0x82c8	69006e0063006f006d0070006c006500	i.n.c.o.m.p.l.e.
0x82d8	74006500200064006f0077006e006c00	t.e. .d.o.w.n.l.

0x8420	2e002000250064002500250000000000	.. .%.d.%.%.....
0x8430	53006500530068007500740064006f00	S.e.S.h.u.t.d.o.
0x8440	77006e00500072006900760069006c00	w.n.P.r.i.v.i.l.
0x8450	65006700650000004100000000000000	e.g.e...A.......
0x8460	2e0074006d0070000000000041000000	..t.m.p.....A...
0x8470	7e006e00730075000000000020005f00	~.n.s.u..... ._.
0x8480	3f003d000000000054004d0050000000	?.=.....T.M.P...
0x8490	540045004d005000000000004c006f00	T.E.M.P.....L.o.
0x84a0	770000005c00540065006d0070000000	w...\.T.e.m.p...
0x84b0	20002f00	./.

0x7fe8	5265674372656174654b657945785700	RegCreateKeyExW.
0x7ff8	41445641504933322e646c6c00003800	ADVAPI32.dll..8.
0x8008	496d6167654c6973745f44657374726f	ImageList_Destro
0x8018	79003400496d6167654c6973745f4164	y.4.ImageList_Ad
0x8028	644d61736b6564003700496d6167654c	dMasked.7.ImageL
0x8038	6973745f4372656174650000434f4d43	ist_Create..COMC
0x8048	544c33322e646c6c00001000436f4372	TL32.dll....CoCr
0x8058	65617465496e7374616e636500000501	eateInstance....
0x8068	4f6c65556e696e697469616c697a6500	OleUninitialize.
0x8078	ee004f6c65496e697469616c697a6500	..OleInitialize.
0x8088	6500436f5461736b4d656d4672656500	e.CoTaskMemFree.
0x8098	6f6c6533322e646c6c00000000000000	ole32.dll.......
0x80a8	00000000000000000000000000000000	................
0x80b8	00000000000000000000000000000000	................
0x80c8	00000000000000000000000000000000	................
0x80d8	00000000000000000000000000000000	................
0x80e8	00000000000000000000000000000000	................
0x80f8	00000000000000000000000000000000	................
0x8108	00000000000000000000000000000000	................
0x8118	00000000000000000000000000000000	................
0x8128	00000000000000000000000000000000	................
0x8138	00000000000000000000000000000000	................
0x8148	00000000000000000000000000000000	................
0x8158	00000000000000000000000000000000	................
0x8168	00000000000000000000000000000000	................
0x8178	00000000000000000000000000000000	................
0x8188	00000000000000000000000000000000	................
0x8198	00000000000000000000000000000000	................
0x81a8	00000000000000000000000000000000	................
0x81b8	00000000000000000000000000000000	................
0x81c8	00000000000000000000000000000000	................
0x81d8	00000000000000000000000000000000	................
0x81e8	00000000000000000000000000000000	................
0x81f8	000000000000000080af470089134000	..........G...@.
0x8208	4e654000683940000a0000005c000000	Ne@.h9@.....\...
0x8218	ffffffff760065007200690066007900	....v.e.r.i.f.y.
0x8228	69006e006700200069006e0073007400	i.n.g. .i.n.s.t.
0x8238	61006c006c00650072003a0020002500	a.l.l.e.r.:. .%.
0x8248	640025002500000049006e0073007400	d.%.%...I.n.s.t.
0x8258	61006c006c0065007200200069006e00	a.l.l.e.r. .i.n.
0x8268	74006500670072006900740079002000	t.e.g.r.i.t.y. .
0x8278	63006800650063006b00200068006100	c.h.e.c.k. .h.a.
0x8288	730020006600610069006c0065006400	s. .f.a.i.l.e.d.
0x8298	2e00200043006f006d006d006f006e00	.. .C.o.m.m.o.n.
0x82a8	20006300610075007300650073002000	.c.a.u.s.e.s. .
0x82b8	69006e0063006c007500640065000a00	i.n.c.l.u.d.e...
0x82c8	69006e0063006f006d0070006c006500	i.n.c.o.m.p.l.e.
0x82d8	74006500200064006f0077006e006c00	t.e. .d.o.w.n.l.

0x7f2e	7565727956616c756545785700000502	ueryValueExW....
0x7f3e	52656753657456616c75654578570000	RegSetValueExW..
0x7f4e	cb01526567436c6f73654b657900d901	..RegCloseKey...
0x7f5e	52656744656c65746556616c7565	RegDeleteValue

0x7fe8	5265674372656174654b657945785700	RegCreateKeyExW.
0x7ff8	41445641504933322e646c6c00003800	ADVAPI32.dll..8.
0x8008	496d6167654c6973745f44657374726f	ImageList_Destro
0x8018	79003400496d6167654c6973745f4164	y.4.ImageList_Ad
0x8028	644d61736b6564003700496d6167654c	dMasked.7.ImageL
0x8038	6973745f4372656174650000434f4d43	ist_Create..COMC
0x8048	544c33322e646c6c00001000436f4372	TL32.dll....CoCr
0x8058	65617465496e7374616e636500000501	eateInstance....
0x8068	4f6c65556e696e697469616c697a6500	OleUninitialize.
0x8078	ee004f6c65496e697469616c697a6500	..OleInitialize.
0x8088	6500436f5461736b4d656d4672656500	e.CoTaskMemFree.
0x8098	6f6c6533322e646c6c00000000000000	ole32.dll.......
0x80a8	00000000000000000000000000000000	................
0x80b8	00000000000000000000000000000000	................
0x80c8	00000000000000000000000000000000	................
0x80d8	00000000000000000000000000000000	................
0x80e8	00000000000000000000000000000000	................
0x80f8	00000000000000000000000000000000	................
0x8108	00000000000000000000000000000000	................
0x8118	00000000000000000000000000000000	................
0x8128	00000000000000000000000000000000	................
0x8138	00000000000000000000000000000000	................
0x8148	00000000000000000000000000000000	................
0x8158	00000000000000000000000000000000	................
0x8168	00000000000000000000000000000000	................
0x8178	00000000000000000000000000000000	................
0x8188	00000000000000000000000000000000	................
0x8198	00000000000000000000000000000000	................
0x81a8	00000000000000000000000000000000	................
0x81b8	00000000000000000000000000000000	................
0x81c8	00000000000000000000000000000000	................
0x81d8	00000000000000000000000000000000	................
0x81e8	00000000000000000000000000000000	................
0x81f8	000000000000000080af470089134000	..........G...@.
0x8208	4e654000683940000a0000005c000000	Ne@.h9@.....\...
0x8218	ffffffff760065007200690066007900	....v.e.r.i.f.y.
0x8228	69006e006700200069006e0073007400	i.n.g. .i.n.s.t.
0x8238	61006c006c00650072003a0020002500	a.l.l.e.r.:. .%.
0x8248	640025002500000049006e0073007400	d.%.%...I.n.s.t.
0x8258	61006c006c0065007200200069006e00	a.l.l.e.r. .i.n.
0x8268	74006500670072006900740079002000	t.e.g.r.i.t.y. .
0x8278	63006800650063006b00200068006100	c.h.e.c.k. .h.a.
0x8288	730020006600610069006c0065006400	s. .f.a.i.l.e.d.
0x8298	2e00200043006f006d006d006f006e00	.. .C.o.m.m.o.n.
0x82a8	20006300610075007300650073002000	.c.a.u.s.e.s. .
0x82b8	69006e0063006c007500640065000a00	i.n.c.l.u.d.e...
0x82c8	69006e0063006f006d0070006c006500	i.n.c.o.m.p.l.e.
0x82d8	74006500200064006f0077006e006c00	t.e. .d.o.w.n.l.

0x77fc	77734469726563746f7279570000d601	wsDirectoryW....
0x780c	47657454656d70506174685700001101	GetTempPathW....
0x781c	476574436f6d6d616e644c696e655700	GetCommandLineW.
0x782c	e80147657456657273696f6e00001503	..GetVersion....
0x783c	5365744572726f724d6f64650000cd03	SetErrorMode....
0x784c	6c7374726c656e570000ca036c737472	lstrlenW....lstr
0x785c	6370796e570050014765744469736b46	cpynW.P.GetDiskF
0x786c	726565537061636557000a02476c6f62	reeSpaceW...Glob
0x787c	616c556e6c6f636b00000302476c6f62	alUnlock....Glob
0x788c	616c4c6f636b00006f00437265617465	alLock..o.Create
0x789c	546872656164000071014765744c6173	Thread..q.GetLas
0x78ac	744572726f7200004e00437265617465	tError..N.Create
0x78bc	4469726563746f727957000069004372	DirectoryW..i.Cr
0x78cc	6561746550726f63657373570000c502	eateProcessW....
0x78dc	52656d6f76654469726563746f727957	RemoveDirectoryW
0x78ec	0000c3036c737472636d706941005600	....lstrcmpiA.V.
0x78fc	43726561746546696c655700d4014765	CreateFileW...Ge
0x790c	7454656d7046696c654e616d65570000	tTempFileNameW..
0x791c	a403577269746546696c6500c6036c73	..WriteFile...ls
0x792c	747263707941000070024d6f76654669	trcpyA..p.MoveFi
0x793c	6c6545785700be036c73747263617457	leExW...lstrcatW
0x794c	0000c20147657453797374656d446972	....GetSystemDir
0x795c	6563746f72795700a00147657450726f	ectoryW...GetPro
0x796c	634164647265737300007f014765744d	cAddress....GetM
0x797c	6f64756c654861	oduleHa

0x8700	6c7455494c616e677561676500000000	ltUILanguage....
0x8710	4765744469736b467265655370616365	GetDiskFreeSpace
0x8720	4578570053657444656661756c74446c	ExW.SetDefaultDl
0x8730	6c4469726563746f7269657300000000	lDirectories....
0x8740	4b4552	KER

0x7fe8	5265674372656174654b657945785700	RegCreateKeyExW.
0x7ff8	41445641504933322e646c6c00003800	ADVAPI32.dll..8.
0x8008	496d6167654c6973745f44657374726f	ImageList_Destro
0x8018	79003400496d6167654c6973745f4164	y.4.ImageList_Ad
0x8028	644d61736b6564003700496d6167654c	dMasked.7.ImageL
0x8038	6973745f4372656174650000434f4d43	ist_Create..COMC
0x8048	544c33322e646c6c00001000436f4372	TL32.dll....CoCr
0x8058	65617465496e7374616e636500000501	eateInstance....
0x8068	4f6c65556e696e697469616c697a6500	OleUninitialize.
0x8078	ee004f6c65496e697469616c697a6500	..OleInitialize.
0x8088	6500436f5461736b4d656d4672656500	e.CoTaskMemFree.
0x8098	6f6c6533322e646c6c00000000000000	ole32.dll.......
0x80a8	00000000000000000000000000000000	................
0x80b8	00000000000000000000000000000000	................
0x80c8	00000000000000000000000000000000	................
0x80d8	00000000000000000000000000000000	................
0x80e8	00000000000000000000000000000000	................
0x80f8	00000000000000000000000000000000	................
0x8108	00000000000000000000000000000000	................
0x8118	00000000000000000000000000000000	................
0x8128	00000000000000000000000000000000	................
0x8138	00000000000000000000000000000000	................
0x8148	00000000000000000000000000000000	................
0x8158	00000000000000000000000000000000	................
0x8168	00000000000000000000000000000000	................
0x8178	00000000000000000000000000000000	................
0x8188	00000000000000000000000000000000	................
0x8198	00000000000000000000000000000000	................
0x81a8	00000000000000000000000000000000	................
0x81b8	00000000000000000000000000000000	................
0x81c8	00000000000000000000000000000000	................
0x81d8	00000000000000000000000000000000	................
0x81e8	00000000000000000000000000000000	................
0x81f8	000000000000000080af470089134000	..........G...@.
0x8208	4e654000683940000a0000005c000000	Ne@.h9@.....\...
0x8218	ffffffff760065007200690066007900	....v.e.r.i.f.y.
0x8228	69006e006700200069006e0073007400	i.n.g. .i.n.s.t.
0x8238	61006c006c00650072003a0020002500	a.l.l.e.r.:. .%.
0x8248	640025002500000049006e0073007400	d.%.%...I.n.s.t.
0x8258	61006c006c0065007200200069006e00	a.l.l.e.r. .i.n.
0x8268	74006500670072006900740079002000	t.e.g.r.i.t.y. .
0x8278	63006800650063006b00200068006100	c.h.e.c.k. .h.a.
0x8288	730020006600610069006c0065006400	s. .f.a.i.l.e.d.
0x8298	2e00200043006f006d006d006f006e00	.. .C.o.m.m.o.n.
0x82a8	20006300610075007300650073002000	.c.a.u.s.e.s. .
0x82b8	69006e0063006c007500640065000a00	i.n.c.l.u.d.e...
0x82c8	69006e0063006f006d0070006c006500	i.n.c.o.m.p.l.e.
0x82d8	74006500200064006f0077006e006c00	t.e. .d.o.w.n.l.

0x77fc	77734469726563746f7279570000d601	wsDirectoryW....
0x780c	47657454656d70506174685700001101	GetTempPathW....
0x781c	476574436f6d6d616e644c696e655700	GetCommandLineW.
0x782c	e80147657456657273696f6e00001503	..GetVersion....
0x783c	5365744572726f724d6f64650000cd03	SetErrorMode....
0x784c	6c7374726c656e570000ca036c737472	lstrlenW....lstr
0x785c	6370796e570050014765744469736b46	cpynW.P.GetDiskF
0x786c	726565537061636557000a02476c6f62	reeSpaceW...Glob
0x787c	616c556e6c6f636b00000302476c6f62	alUnlock....Glob
0x788c	616c4c6f636b00006f00437265617465	alLock..o.Create
0x789c	546872656164000071014765744c6173	Thread..q.GetLas
0x78ac	744572726f7200004e00437265617465	tError..N.Create
0x78bc	4469726563746f727957000069004372	DirectoryW..i.Cr
0x78cc	6561746550726f63657373570000c502	eateProcessW....
0x78dc	52656d6f76654469726563746f727957	RemoveDirectoryW
0x78ec	0000c3036c737472636d706941005600	....lstrcmpiA.V.
0x78fc	43726561746546696c655700d4014765	CreateFileW...Ge
0x790c	7454656d7046696c654e616d65570000	tTempFileNameW..
0x791c	a403577269746546696c6500c6036c73	..WriteFile...ls
0x792c	747263707941000070024d6f76654669	trcpyA..p.MoveFi
0x793c	6c6545785700be036c73747263617457	leExW...lstrcatW
0x794c	0000c20147657453797374656d446972	....GetSystemDir
0x795c	6563746f72795700a00147657450726f	ectoryW...GetPro
0x796c	634164647265737300007f014765744d	cAddress....GetM
0x797c	6f64756c654861	oduleHa

0x7fe8	5265674372656174654b657945785700	RegCreateKeyExW.
0x7ff8	41445641504933322e646c6c00003800	ADVAPI32.dll..8.
0x8008	496d6167654c6973745f44657374726f	ImageList_Destro
0x8018	79003400496d6167654c6973745f4164	y.4.ImageList_Ad
0x8028	644d61736b6564003700496d6167654c	dMasked.7.ImageL
0x8038	6973745f4372656174650000434f4d43	ist_Create..COMC
0x8048	544c33322e646c6c00001000436f4372	TL32.dll....CoCr
0x8058	65617465496e7374616e636500000501	eateInstance....
0x8068	4f6c65556e696e697469616c697a6500	OleUninitialize.
0x8078	ee004f6c65496e697469616c697a6500	..OleInitialize.
0x8088	6500436f5461736b4d656d4672656500	e.CoTaskMemFree.
0x8098	6f6c6533322e646c6c00000000000000	ole32.dll.......
0x80a8	00000000000000000000000000000000	................
0x80b8	00000000000000000000000000000000	................
0x80c8	00000000000000000000000000000000	................
0x80d8	00000000000000000000000000000000	................
0x80e8	00000000000000000000000000000000	................
0x80f8	00000000000000000000000000000000	................
0x8108	00000000000000000000000000000000	................
0x8118	00000000000000000000000000000000	................
0x8128	00000000000000000000000000000000	................
0x8138	00000000000000000000000000000000	................
0x8148	00000000000000000000000000000000	................
0x8158	00000000000000000000000000000000	................
0x8168	00000000000000000000000000000000	................
0x8178	00000000000000000000000000000000	................
0x8188	00000000000000000000000000000000	................
0x8198	00000000000000000000000000000000	................
0x81a8	00000000000000000000000000000000	................
0x81b8	00000000000000000000000000000000	................
0x81c8	00000000000000000000000000000000	................
0x81d8	00000000000000000000000000000000	................
0x81e8	00000000000000000000000000000000	................
0x81f8	000000000000000080af470089134000	..........G...@.
0x8208	4e654000683940000a0000005c000000	Ne@.h9@.....\...
0x8218	ffffffff760065007200690066007900	....v.e.r.i.f.y.
0x8228	69006e006700200069006e0073007400	i.n.g. .i.n.s.t.
0x8238	61006c006c00650072003a0020002500	a.l.l.e.r.:. .%.
0x8248	640025002500000049006e0073007400	d.%.%...I.n.s.t.
0x8258	61006c006c0065007200200069006e00	a.l.l.e.r. .i.n.
0x8268	74006500670072006900740079002000	t.e.g.r.i.t.y. .
0x8278	63006800650063006b00200068006100	c.h.e.c.k. .h.a.
0x8288	730020006600610069006c0065006400	s. .f.a.i.l.e.d.
0x8298	2e00200043006f006d006d006f006e00	.. .C.o.m.m.o.n.
0x82a8	20006300610075007300650073002000	.c.a.u.s.e.s. .
0x82b8	69006e0063006c007500640065000a00	i.n.c.l.u.d.e...
0x82c8	69006e0063006f006d0070006c006500	i.n.c.o.m.p.l.e.
0x82d8	74006500200064006f0077006e006c00	t.e. .d.o.w.n.l.

0x7fe8	5265674372656174654b657945785700	RegCreateKeyExW.
0x7ff8	41445641504933322e646c6c00003800	ADVAPI32.dll..8.
0x8008	496d6167654c6973745f44657374726f	ImageList_Destro
0x8018	79003400496d6167654c6973745f4164	y.4.ImageList_Ad
0x8028	644d61736b6564003700496d6167654c	dMasked.7.ImageL
0x8038	6973745f4372656174650000434f4d43	ist_Create..COMC
0x8048	544c33322e646c6c00001000436f4372	TL32.dll....CoCr
0x8058	65617465496e7374616e636500000501	eateInstance....
0x8068	4f6c65556e696e697469616c697a6500	OleUninitialize.
0x8078	ee004f6c65496e697469616c697a6500	..OleInitialize.
0x8088	6500436f5461736b4d656d4672656500	e.CoTaskMemFree.
0x8098	6f6c6533322e646c6c00000000000000	ole32.dll.......
0x80a8	00000000000000000000000000000000	................
0x80b8	00000000000000000000000000000000	................
0x80c8	00000000000000000000000000000000	................
0x80d8	00000000000000000000000000000000	................
0x80e8	00000000000000000000000000000000	................
0x80f8	00000000000000000000000000000000	................
0x8108	00000000000000000000000000000000	................
0x8118	00000000000000000000000000000000	................
0x8128	00000000000000000000000000000000	................
0x8138	00000000000000000000000000000000	................
0x8148	00000000000000000000000000000000	................
0x8158	00000000000000000000000000000000	................
0x8168	00000000000000000000000000000000	................
0x8178	00000000000000000000000000000000	................
0x8188	00000000000000000000000000000000	................
0x8198	00000000000000000000000000000000	................
0x81a8	00000000000000000000000000000000	................
0x81b8	00000000000000000000000000000000	................
0x81c8	00000000000000000000000000000000	................
0x81d8	00000000000000000000000000000000	................
0x81e8	00000000000000000000000000000000	................
0x81f8	000000000000000080af470089134000	..........G...@.
0x8208	4e654000683940000a0000005c000000	Ne@.h9@.....\...
0x8218	ffffffff760065007200690066007900	....v.e.r.i.f.y.
0x8228	69006e006700200069006e0073007400	i.n.g. .i.n.s.t.
0x8238	61006c006c00650072003a0020002500	a.l.l.e.r.:. .%.
0x8248	640025002500000049006e0073007400	d.%.%...I.n.s.t.
0x8258	61006c006c0065007200200069006e00	a.l.l.e.r. .i.n.
0x8268	74006500670072006900740079002000	t.e.g.r.i.t.y. .
0x8278	63006800650063006b00200068006100	c.h.e.c.k. .h.a.
0x8288	730020006600610069006c0065006400	s. .f.a.i.l.e.d.
0x8298	2e00200043006f006d006d006f006e00	.. .C.o.m.m.o.n.
0x82a8	20006300610075007300650073002000	.c.a.u.s.e.s. .
0x82b8	69006e0063006c007500640065000a00	i.n.c.l.u.d.e...
0x82c8	69006e0063006f006d0070006c006500	i.n.c.o.m.p.l.e.
0x82d8	74006500200064006f0077006e006c00	t.e. .d.o.w.n.l.

Metadata

0x84b8	000000004e0043005200430000000000	....N.C.R.C.....
0x84c8	4e005300490053002000450072007200	N.S.I.S. .E.r.r.
0x84d8	6f007200000000004500720072006f00	o.r.....E.r.r.o.
0x84e8	72002000770072006900	r. .w.r.i.

0x28070	740069006f006e00000000000904e404	t.i.o.n.........
0x28080	3c3f786d6c2076657273696f6e3d2231	<?xml version="1
0x28090	2e302220656e636f64696e673d225554	.0" encoding="UT
0x280a0	462d3822207374616e64616c6f6e653d	F-8" standalone=
0x280b0	22796573223f3e3c617373656d626c79	"yes"?><assembly
0x280c0	20786d6c6e733d2275726e3a73636865	xmlns="urn:sche
0x280d0	6d61732d6d6963726f736f66742d636f	mas-microsoft-co
0x280e0	6d3a61736d2e763122206d616e696665	m:asm.v1" manife
0x280f0	737456657273696f6e3d22312e30223e	stVersion="1.0">
0x28100	3c617373656d626c794964656e746974	<assemblyIdentit
0x28110	792076657273696f6e3d22312e302e30	y version="1.0.0

signed Authenticode chain CN: Any.do Ltd

strings-truncated String extraction truncated due to limits (count: 100000, total bytes: 50 MB)

file

20 of 31 traits shown

Identity

SHA-256	4acb4a8c9b5135e3498f1299d34899437c2e5ba997262448af2c37c39becb205
Filename	Anydo Setup 5.0.119.exe
Package	Anydo.Anydo

Origin

Source	forager
Feed	winget.run
Ecosystem	windows
Domain	any.do
URL	https://electron-app.any.do/_windows/Anydo%20Setup%205.0.119.exe

Timeline

First seen	9 Jul 2026 12:50 UTC
First analyzed	12 Jul 2026 09:39 UTC
Last analyzed	12 Jul 2026 09:39 UTC
Last updated	12 Jul 2026 09:39 UTC

Labeling

Label	unknown
Label source	forager
Traits version	e4daa

Not seeing what you expected? Let us know

0x602dfc9	96c5aac4464a6015abf741b597128d0c	....FJ`...A.....
0x602dfd9	73736e5d49280a2a973447b3a82a8c00	ssn]I(..4G....
0x602dfe9	12de465cb6e543ddccc8cc11ea1a5fc0	..F\..C......._.
0x602dff9	8ae59d	...

0x195bb	ffffffffff89504e470d0a1a0a000000	......PNG.......
0x195cb	0d494844520000010000000100080600	.IHDR...........
0x195db	00005c72a866000053c34944415478da	..\r.f..S.IDATx.
0x195eb	ed7d7bac	.}{.

0x282c9	657374656450726976696c656765733e	estedPrivileges>
0x282d9	3c726571756573746564457865637574	<requestedExecut
0x282e9	696f6e4c6576656c206c6576656c3d22	ionLevel level="
0x282f9	6173496e766f6b657222207569416363	asInvoker" uiAcc
0x28309	6573733d2266616c7365222f3e3c2f72	ess="false"/></r
0x28319	657175657374656450726976696c6567	equestedPrivileg
0x28329	65733e3c2f7365637572697479	es></security