ba45d1711ee3ee910c969c0f1573bdd5c93111670b526d812d02d8f93912f235

HOSTILE

ba45d1711ee3ee910c969c0f1573bdd5c93111670b526d812d02d8f93912f235 · 92%

AI Kernel driver hooks SSDT for evasion

Mal-ecule

O₂(Er₂I)H₃(Db₂Os₆Po₄)Md₄(Bi₃PaPt)

Size 878.5 KB download

First seen 16 days ago

Analyzed 15 days ago

Source virussign.com

Also detected by 3 sources

Windows SSDT enumeration hook driver: virussign.com_99a2bf105df43d45e6ef9383ed788b70.vir:0xdf1a

Hidden (encoded) PE directory parsing API: virussign.com_99a2bf105df43d45e6ef9383ed788b70.vir:0xe13c

Hidden (encoded) PE header parsing API: virussign.com_99a2bf105df43d45e6ef9383ed788b70.vir:0xe11a

virussign.com_99a2bf105df43d45e6ef9383ed788b70.vir pe

0x23c5	8d45b85033ff68ff0f1f008d45f050c7	.E.P3.h.....E.P.
0x23d5	45b818000000897dbcc745c400020000	E......}..E.....
0x23e5	897dc0897dc8897dcc897dd4897df0e8	.}..}..}..}..}..
0x23f5	17f1ffffffd085c00f8c4e0300005356	..........N...SV
0x2405	8b353cf001006a40bb00100000538d45	.5<...j@.....S.E
0x2415	ec50578d45f450ff75f0897df4c745ec	.PW.E.P.u..}..E.
0x2425	00040000ffd685c07c098b45f48b4d0c	........\|..E..M.
0x2435	8941086a04538d45ec50578d45e850ff	.A.j.S.E.PW.E.P.
0x2445	75f0897de8c745ec00040000ffd685c0	u..}..E.........
0x2455	7c098b45e88b4d0c89410c8d45dc50ff	\|..E..M..A..E.P.
0x2465	75d0e8e0f6ffffffd085c00f8cd90200	u...............
0x2475	00ff75dce8acf4ffffffd08b45f4897d	..u.........E..}
0x2485	e03bc70f84a70200008b75	.;........u

0xde9a	00007300790073006100000077006900	..s.y.s.a...w.i.
0xdeaa	6e006500000070006300690000006d00	n.e...p.c.i...m.
0xdeba	73007200000074006d00700000007500	s.r...t.m.p...u.
0xdeca	7300620000006f006c00650000006100	s.b...o.l.e...a.
0xdeda	6900700000006a006100790000007600	i.p...j.a.y...v.
0xdeea	65007200000073006100690000006c00	e.r...s.a.i...l.
0xdefa	6100630000006a007000670000006800	a.c...j.p.g...h.
0xdf0a	69006400000070006e006700000000cc	i.d...p.n.g.....
0xdf1a	4b006500530065007200760069006300	K.e.S.e.r.v.i.c.Windows SSDT enumeration hook driver
0xdf2a	65004400650073006300720069007000	e.D.e.s.c.r.i.p.
0xdf3a	74006f0072005400610062006c006500	t.o.r.T.a.b.l.e.
0xdf4a	00005a0077004f00700065006e005000	..Z.w.O.p.e.n.P.
0xdf5a	72006f00630065007300730000005000	r.o.c.e.s.s...P.
0xdf6a	73005300650074004c006f0061006400	s.S.e.t.L.o.a.d.
0xdf7a	49006d006100670065004e006f007400	I.m.a.g.e.N.o.t.
0xdf8a	69006600790052006f00750074006900	i.f.y.R.o.u.t.i.
0xdf9a	6e00650000005a007700440075007000	n.e...Z.w.D.u.p.
0xdfaa	6c006900630061007400650054006f00	l.i.c.a.t.e.T.o.
0xdfba	6b0065006e0000005000730053006500	k.e.n...P.s.S.e.
0xdfca	74004300720065006100740065005000	t.C.r.e.a.t.e.P.
0xdfda	72006f0063006500730073004e006f00	r.o.c.e.s.s.N.o.
0xdfea	740069006600790052006f0075007400	t.i.f.y.R.o.u.t.
0xdffa	69006e00650000005a0077004f007000	i.n.e...Z.w.O.p.
0xe00a	65006e00460069006c00650000005a00	e.n.F.i.l.e...Z.
0xe01a	77005100750065007200790049006e00	w.Q.u.e.r.y.I.n.
0xe02a	66006f0072006d006100740069006f00	f.o.r.m.a.t.i.o.
0xe03a	6e00500072006f006300650073007300	n.P.r.o.c.e.s.s.
0xe04a	00005a00770051007500650072007900	..Z.w.Q.u.e.r.y.
0xe05a	530079007300740065006d0049006e00	S.y.s.t.e.m.I.n.
0xe06a	66006f0072006d006100740069006f00	f.o.r.m.a.t.i.o.
0xe07a	6e0000005a0077004f00700065006e00	n...Z.w.O.p.e.n.
0xe08a	4b006500790000005a00770044006500	K.e.y...Z.w.D.e.
0xe09a	6c006500740065004b00650079000000	l.e.t.e.K.e.y...
0xe0aa	5a007700530065007400560061006c00	Z.w.S.e.t.V.a.l.
0xe0ba	750065004b006500790000005a007700	u.e.K.e.y...Z.w.
0xe0ca	5100750065007200790056006f006c00	Q.u.e.r.y.V.o.l.
0xe0da	75006d00650049006e0066006f007200	u.m.e.I.n.f.o.r.
0xe0ea	6d006100740069006f006e0046006900	m.a.t.i.o.n.F.i.
0xe0fa	6c00650000005a007700430072006500	l.e...Z.w.C.r.e.
0xe10a	610074006500460069006c0065000000	a.t.e.F.i.l.e...
0xe11a	520074006c0049006d00610067006500	R.t.l.I.m.a.g.e.Hidden (encoded) PE header parsing API
0xe12a	4e007400480065006100640065007200	N.t.H.e.a.d.e.r.
0xe13a	0000520074006c0049006d0061006700	..R.t.l.I.m.a.g.Hidden (encoded) PE directory parsing API
0xe14a	65004400690072006500630074006f00	e.D.i.r.e.c.t.o.
0xe15a	7200790045006e007400720079005400	r.y.E.n.t.r.y.T.
0xe16a	6f00440061007400610000005a007700	o.D.a.t.a...Z.w.
0xe17a	4f00700065006e00500072006f006300	O.p.e.n.P.r.o.c.
0xe18a	65007300730054006f006b0065006e00	e.s.s.T.o.k.e.n.

0xefc0	00000000000000000000000000000000	................
0xefd0	00000000000000000000000000000000	................
0xefe0	00000000000000000000000000000000	................
0xeff0	00000000000000000000000000000000	................
0xf000	b4840600000000001083060028830600	............(...
0xf010	328306003c830600508306006a830600	2...<...P...j...
0xf020	7c830600948306009e830600b6830600	\|...............Dynamically resolves kernel routine addresses
0xf030	f2830600fc830600148406001e840600	................
0xf040	38840600488406005e8406006a840600	8...H...^...j...
0xf050	7e8406008884060096840600f8820600	~...............
0xf060	d2830600d08406000000000000000000	................
0xf070	330032002e0034003900330030003100	3.2...4.9.3.0.1.
0xf080	3300000062616420616c6c6f63617469	3...bad allocati
0xf090	6f6e0000000000000000000000000000	on..............
0xf0a0	5a4b1b8e899b75d9faa0f4989e49563a	ZK....u......IV:
0xf0b0	6d84e713389dc767d2f780399b800333	m...8..g...9...3
0xf0c0	2079833149f7a2382a240ba58eb2b012	y.1I..8*$......
0xf0d0	74f4905dccf38dd720f3e289cc606ff6	t..].... ....`o.
0xf0e0	49ea27e7cf796926550022b4079f5e61	I.'..yi&U."...^a
0xf0f0	16bffa621ec6e068530e8a2ff93dc56c	...b...hS../.=.l
0xf100	08bd9b184556652c010d760ec7642afe	....EVe,..v..d*.
0xf110	3fe5f3b7560e2e26d0d73f7f46ba9827	?...V..&..?.F..'
0xf120	4080357da4fea9bbd9d84720f63a4975	@.5}......G .:Iu
0xf130	876e63e4caa833ea4d63a29f689ef1ad	.nc...3.Mc..h...
0xf140	ae5d361725a51ef50c24e774638b0d4f	.]6.%....$.tc..O
0xf150	6f9e2d371b6babeceee8cec961212da2	o.-7.k......a!-.
0xf160	f30f7af77c2e0baad72f85c4b86020b4	..z.\|..../...` .
0xf170	4c7e5eab1ccf6c8eba9ce9eba24e6b9b	L~^...l......Nk.
0xf180	837b4d44c26117dec93f0e061a1012c7	.{MD.a...?......
0xf190	58d0470d56980423b55f7963352df268	X.G.V..#._yc5-.h
0xf1a0	8fca7cca4f6b5174f4cc2e47539fcd16	..\|.OkQt...GS...
0xf1b0	0f5fd0274742ab7bdd43920a358e6171	._.'GB.{.C..5.aq
0xf1c0	4cf1c12a56aa6d800cf50cd1566207da	L..*V.m.....Vb..
0xf1d0	4344ef6d369b24b46d441cfd9e19def9	CD.m6.$.mD......
0xf1e0	039f0ffe70f7c549cba474ece0668d0c	....p..I..t..f..
0xf1f0	b2edc486af1fde2bae965029a61506d6	.......+..P)....
0xf200	b50da317dca637a48ac277c39b3fb7c7	......7...w..?..
0xf210	4c9d3dcc757c522a909cd15856d102b1	L.=.u\|R*...XV...
0xf220	09ecb3f3bd5ba8bcc4f6249ea7392422	.....[....$..9$"
0xf230	9231331dd983e6d3b4ec9fbb6b53022a	.13.........kS.*

0x685e0	00000000000000000000000000000000	................
0x685f0	00000000000000000000000000000000	................
0x68600	00000000000000000000000000000100	................
0x68610	10000000180000800000000000000000	................
0x68620	00000000000001000100000030000080	............0...
0x68630	00000000000000000000000000000100	................
0x68640	0904000048000000608606009c020000	....H...`.......
0x68650	00000000000000000000000000000000	................
0x68660	9c0234000000560053005f0056004500	..4...V.S._.V.E.
0x68670	5200530049004f004e005f0049004e00	R.S.I.O.N._.I.N.
0x68680	46004f0000000000bd04effe00000100	F.O.............
0x68690	00000200000001000000020000000100	................
0x686a0	3f000000000000000400040003000000	?...............
0x686b0	070000000000000000000000fc010000	................
0x686c0	010053007400720069006e0067004600	..S.t.r.i.n.g.F.
0x686d0	69006c00650049006e0066006f000000	i.l.e.I.n.f.o...
0x686e0	d8010000010030003400300039003000	......0.4.0.9.0.
0x686f0	34006200300000005200190001004300	4.b.0...R.....C.
0x68700	6f006d00700061006e0079004e006100	o.m.p.a.n.y.N.a.
0x68710	6d0065000000000042006c0075007700	m.e.....B.l.u.w.
0x68720	2000280048006f006e00670020004b00	.(.H.o.n.g. .K.
0x68730	6f006e006700290020004c0069006d00	o.n.g.). .L.i.m.
0x68740	6900740065006400000000007a002900	i.t.e.d.....z.).
0x68750	0100460069006c006500440065007300	..F.i.l.e.D.e.s.
0x68760	6300720069007000740069006f006e00	c.r.i.p.t.i.o.n.
0x68770	0000000042007500740074006f006e00	....B.u.t.t.o.n.
0x68780	20004d0069006e00690070006f007200	.M.i.n.i.p.o.r.
0x68790	74002000440072006900760065007200	t. .D.r.i.v.e.r.
0x687a0	200066006f007200200049006e007000	.f.o.r. .I.n.p.
0x687b0	75007400200044006500760069006300	u.t. .D.e.v.i.c.
0x687c0	65007300000000003000080001004600	e.s.....0.....F.
0x687d0	69006c00650056006500720073006900	i.l.e.V.e.r.s.i.
0x687e0	6f006e000000000032002e0030002e00	o.n.....2...0...
0x687f0	31002e00300000005000180001005000	1...0...P.....P.
0x68800	72006f0064007500630074004e006100	r.o.d.u.c.t.N.a.
0x68810	6d006500000000005500530042002000	m.e.....U.S.B. .
0x68820	42007500740074006f006e0020004900	B.u.t.t.o.n. .I.
0x68830	6e007000750074002000440065007600	n.p.u.t. .D.e.v.
0x68840	69006300650000003400080001005000	i.c.e...4.....P.
0x68850	72006f00640075006300740056006500	r.o.d.u.c.t.V.e.
0x68860	7200730069006f006e00000032002e00	r.s.i.o.n...2...
0x68870	30002e0031002e00300000003c000c00	0...1...0...<...
0x68880	01004c006500670061006c0043006f00	..L.e.g.a.l.C.o.
0x68890	70007900720069006700680074000000	p.y.r.i.g.h.t...
0x688a0	a9002000320030003100300020004200	.. .2.0.1.0. .B.
0x688b0	6c007500770000004400000001005600	l.u.w...D.....V.
0x688c0	61007200460069006c00650049006e00	a.r.F.i.l.e.I.n.
0x688d0	66006f00000000002400040000005400	f.o.....$.....T.

0xb50f9	0a730702000a7d2d010004027b2d0100	.s....}-....{-..
0xb5109	0473d50200066f0802000a027b2d0100	.s....o.....{-..
0xb5119	046f0902000a2a1e02280a02000a2a44	.o......(....D
0xb5129	600000cecaefbe01000000910000006c	`..............l
0xb5139	53797374656d2e5265736f7572636573	System.Resources
0xb5149	2e5265736f757263655265616465722c	.ResourceReader,
0xb5159	206d73636f726c69622c205665727369	mscorlib, Versi
0xb5169	6f6e3d322e302e302e302c2043756c74	on=2.0.0.0, Cult
0xb5179	7572653d6e65757472616c2c20507562	ure=neutral, Pub
0xb5189	6c69634b6579546f6b656e3d62373761	licKeyToken=b77a
0xb5199	35633536313933346530383923537973	5c561934e089#Sys
0xb51a9	74656d2e5265736f75726365732e5275	tem.Resources.Ru
0xb51b9	6e74696d655265736f75726365536574	ntimeResourceSet
0xb51c9	02000000ee00000000000000504144	............PAD

Objectives

0xde9a	00007300790073006100000077006900	..s.y.s.a...w.i.
0xdeaa	6e006500000070006300690000006d00	n.e...p.c.i...m.
0xdeba	73007200000074006d00700000007500	s.r...t.m.p...u.
0xdeca	7300620000006f006c00650000006100	s.b...o.l.e...a.
0xdeda	6900700000006a006100790000007600	i.p...j.a.y...v.
0xdeea	65007200000073006100690000006c00	e.r...s.a.i...l.
0xdefa	6100630000006a007000670000006800	a.c...j.p.g...h.
0xdf0a	69006400000070006e006700000000cc	i.d...p.n.g.....
0xdf1a	4b006500530065007200760069006300	K.e.S.e.r.v.i.c.
0xdf2a	65004400650073006300720069007000	e.D.e.s.c.r.i.p.
0xdf3a	74006f0072005400610062006c006500	t.o.r.T.a.b.l.e.
0xdf4a	00005a0077004f00700065006e005000	..Z.w.O.p.e.n.P.
0xdf5a	72006f00630065007300730000005000	r.o.c.e.s.s...P.
0xdf6a	73005300650074004c006f0061006400	s.S.e.t.L.o.a.d.
0xdf7a	49006d006100670065004e006f007400	I.m.a.g.e.N.o.t.
0xdf8a	69006600790052006f00750074006900	i.f.y.R.o.u.t.i.
0xdf9a	6e00650000005a007700440075007000	n.e...Z.w.D.u.p.
0xdfaa	6c006900630061007400650054006f00	l.i.c.a.t.e.T.o.
0xdfba	6b0065006e0000005000730053006500	k.e.n...P.s.S.e.
0xdfca	74004300720065006100740065005000	t.C.r.e.a.t.e.P.
0xdfda	72006f0063006500730073004e006f00	r.o.c.e.s.s.N.o.
0xdfea	740069006600790052006f0075007400	t.i.f.y.R.o.u.t.
0xdffa	69006e00650000005a0077004f007000	i.n.e...Z.w.O.p.
0xe00a	65006e00460069006c00650000005a00	e.n.F.i.l.e...Z.
0xe01a	77005100750065007200790049006e00	w.Q.u.e.r.y.I.n.
0xe02a	66006f0072006d006100740069006f00	f.o.r.m.a.t.i.o.
0xe03a	6e00500072006f006300650073007300	n.P.r.o.c.e.s.s.
0xe04a	00005a00770051007500650072007900	..Z.w.Q.u.e.r.y.
0xe05a	530079007300740065006d0049006e00	S.y.s.t.e.m.I.n.
0xe06a	66006f0072006d006100740069006f00	f.o.r.m.a.t.i.o.
0xe07a	6e0000005a0077004f00700065006e00	n...Z.w.O.p.e.n.
0xe08a	4b006500790000005a00770044006500	K.e.y...Z.w.D.e.
0xe09a	6c006500740065004b00650079000000	l.e.t.e.K.e.y...
0xe0aa	5a007700530065007400560061006c00	Z.w.S.e.t.V.a.l.
0xe0ba	750065004b006500790000005a007700	u.e.K.e.y...Z.w.
0xe0ca	5100750065007200790056006f006c00	Q.u.e.r.y.V.o.l.
0xe0da	75006d00650049006e0066006f007200	u.m.e.I.n.f.o.r.
0xe0ea	6d006100740069006f006e0046006900	m.a.t.i.o.n.F.i.
0xe0fa	6c00650000005a007700430072006500	l.e...Z.w.C.r.e.
0xe10a	610074006500460069006c0065000000	a.t.e.F.i.l.e...
0xe11a	520074006c0049006d00610067006500	R.t.l.I.m.a.g.e.
0xe12a	4e007400480065006100640065007200	N.t.H.e.a.d.e.r.
0xe13a	0000520074006c0049006d0061006700	..R.t.l.I.m.a.g.
0xe14a	65004400690072006500630074006f00	e.D.i.r.e.c.t.o.
0xe15a	7200790045006e007400720079005400	r.y.E.n.t.r.y.T.
0xe16a	6f00440061007400610000005a007700	o.D.a.t.a...Z.w.
0xe17a	4f00700065006e00500072006f006300	O.p.e.n.P.r.o.c.
0xe18a	65007300730054006f006b0065006e00	e.s.s.T.o.k.e.n.

0xde9a	00007300790073006100000077006900	..s.y.s.a...w.i.
0xdeaa	6e006500000070006300690000006d00	n.e...p.c.i...m.
0xdeba	73007200000074006d00700000007500	s.r...t.m.p...u.
0xdeca	7300620000006f006c00650000006100	s.b...o.l.e...a.
0xdeda	6900700000006a006100790000007600	i.p...j.a.y...v.
0xdeea	65007200000073006100690000006c00	e.r...s.a.i...l.
0xdefa	6100630000006a007000670000006800	a.c...j.p.g...h.
0xdf0a	69006400000070006e006700000000cc	i.d...p.n.g.....
0xdf1a	4b006500530065007200760069006300	K.e.S.e.r.v.i.c.
0xdf2a	65004400650073006300720069007000	e.D.e.s.c.r.i.p.
0xdf3a	74006f0072005400610062006c006500	t.o.r.T.a.b.l.e.
0xdf4a	00005a0077004f00700065006e005000	..Z.w.O.p.e.n.P.
0xdf5a	72006f00630065007300730000005000	r.o.c.e.s.s...P.
0xdf6a	73005300650074004c006f0061006400	s.S.e.t.L.o.a.d.
0xdf7a	49006d006100670065004e006f007400	I.m.a.g.e.N.o.t.
0xdf8a	69006600790052006f00750074006900	i.f.y.R.o.u.t.i.
0xdf9a	6e00650000005a007700440075007000	n.e...Z.w.D.u.p.
0xdfaa	6c006900630061007400650054006f00	l.i.c.a.t.e.T.o.
0xdfba	6b0065006e0000005000730053006500	k.e.n...P.s.S.e.
0xdfca	74004300720065006100740065005000	t.C.r.e.a.t.e.P.
0xdfda	72006f0063006500730073004e006f00	r.o.c.e.s.s.N.o.
0xdfea	740069006600790052006f0075007400	t.i.f.y.R.o.u.t.
0xdffa	69006e00650000005a0077004f007000	i.n.e...Z.w.O.p.
0xe00a	65006e00460069006c00650000005a00	e.n.F.i.l.e...Z.
0xe01a	77005100750065007200790049006e00	w.Q.u.e.r.y.I.n.
0xe02a	66006f0072006d006100740069006f00	f.o.r.m.a.t.i.o.
0xe03a	6e00500072006f006300650073007300	n.P.r.o.c.e.s.s.
0xe04a	00005a00770051007500650072007900	..Z.w.Q.u.e.r.y.
0xe05a	530079007300740065006d0049006e00	S.y.s.t.e.m.I.n.
0xe06a	66006f0072006d006100740069006f00	f.o.r.m.a.t.i.o.
0xe07a	6e0000005a0077004f00700065006e00	n...Z.w.O.p.e.n.
0xe08a	4b006500790000005a00770044006500	K.e.y...Z.w.D.e.
0xe09a	6c006500740065004b00650079000000	l.e.t.e.K.e.y...
0xe0aa	5a007700530065007400560061006c00	Z.w.S.e.t.V.a.l.
0xe0ba	750065004b006500790000005a007700	u.e.K.e.y...Z.w.
0xe0ca	5100750065007200790056006f006c00	Q.u.e.r.y.V.o.l.
0xe0da	75006d00650049006e0066006f007200	u.m.e.I.n.f.o.r.
0xe0ea	6d006100740069006f006e0046006900	m.a.t.i.o.n.F.i.
0xe0fa	6c00650000005a007700430072006500	l.e...Z.w.C.r.e.
0xe10a	610074006500460069006c0065000000	a.t.e.F.i.l.e...
0xe11a	520074006c0049006d00610067006500	R.t.l.I.m.a.g.e.
0xe12a	4e007400480065006100640065007200	N.t.H.e.a.d.e.r.
0xe13a	0000520074006c0049006d0061006700	..R.t.l.I.m.a.g.
0xe14a	65004400690072006500630074006f00	e.D.i.r.e.c.t.o.
0xe15a	7200790045006e007400720079005400	r.y.E.n.t.r.y.T.
0xe16a	6f00440061007400610000005a007700	o.D.a.t.a...Z.w.
0xe17a	4f00700065006e00500072006f006300	O.p.e.n.P.r.o.c.
0xe18a	65007300730054006f006b0065006e00	e.s.s.T.o.k.e.n.

0xcdb44	7000690063006d006400001569006e00	p.i.c.m.d...i.n.
0xcdb54	7300740061006c006c00650072007300	s.t.a.l.l.e.r.s.
0xcdb64	00196c006f00670073005c0069006e00	..l.o.g.s.\.i.n.
0xcdb74	7300740061006c006c0000032000000b	s.t.a.l.l... ...
0xcdb84	720075006e006100730000032e000009	r.u.n.a.s.......
0xcdb94	2e00740078007400000f2f0074002000	..t.x.t.../.t. .
0xcdba4	300020002f0072000039770069006e00	0. ./.r..9w.i.n.
0xcdbb4	330032005f006c006f00670069006300	3.2._.l.o.g.i.c.
0xcdbc4	61006c006400690073006b002e006400	a.l.d.i.s.k...d.
0xcdbd4	65007600690063006500690064003d00	e.v.i.c.e.i.d.=.
0xcdbe4	22000013460072006500650053007000	"...F.r.e.e.S.p.
0xcdbf4	610063006500000d2500740065006d00	a.c.e...%.t.e.m.
0xcdc04	7000250000315200650062006f006f00	p.%..1R.e.b.o.o.
0xcdc14	74004400650073006300720069007000	t.D.e.s.c.r.i.p.
0xcdc24	74006f007200460069006c0065002e00	t.o.r.F.i.l.e...
0xcdc34	640065007300002f5700650062005000	d.e.s../W.e.b.P.
0xcdc44	490043006d00640049006e0073007400	I.C.m.d.I.n.s.t.
0xcdc54	61006c006c0050006c0061006e002e00	a.l.l.P.l.a.n...
0xcdc64	78006d006c0000197300680075007400	x.m.l...s.h.u.t.
0xcdc74	64006f0077006e002e00650078006500	d.o.w.n...e.x.e.
0xcdc84	006353004f0046005400570041005200	.cS.O.F.T.W.A.R.
0xcdc94	45005c004d006900630072006f007300	E.\.M.i.c.r.o.s.
0xcdca4	6f00660074005c00570069006e006400	o.f.t.\.W.i.n.d.
0xcdcb4	6f00770073005c004300750072007200	o.w.s.\.C.u.r.r.
0xcdcc4	65006e00740056006500720073006900	e.n.t.V.e.r.s.i.
0xcdcd4	6f006e005c00520075006e004f006e00	o.n.\.R.u.n.O.n.
0xcdce4	63006500002157006500620050004900	c.e..!W.e.b.P.I.
0xcdcf4	43006f006d006d0061006e0064004c00	C.o.m.m.a.n.d.L.
0xcdd04	69006e00650000332500770069006e00	i.n.e..3%.w.i.n.
0xcdd14	64006900720025005c00730079007300	d.i.r.%.\.s.y.s.
0xcdd24	740065006d00330032005c0063006d00	t.e.m.3.2.\.c.m.
0xcdd34	64002e00650078006500003953004f00	d...e.x.e..9S.O.
0xcdd44	4600540057004100520045005c004d00	F.T.W.A.R.E.\.M.
0xcdd54	6900630072006f0073006f0066007400	i.c.r.o.s.o.f.t.
0xcdd64	5c005700650062004d00610074007200	\.W.e.b.M.a.t.r.
0xcdd74	69007800001749006e00730074006100	i.x...I.n.s.t.a.
0xcdd84	6c006c005000610074006800001b5700	l.l.P.a.t.h...W.
0xcdd94	650062004d0061007400720069007800	e.b.M.a.t.r.i.x.
0xcdda4	2e	.

Micro-behaviors

0xc8d25	6773417474726962757465004d617273	gsAttribute.Mars
0xc8d35	68616c004765744c61737457696e3332	hal.GetLastWin32
0xc8d45	4572726f720050726f63657373004765	Error.Process.Ge
0xc8d55	7443757272656e7450726f6365737300	tCurrentProcess.
0xc8d65	50726f636573734d6f64756c65006765	ProcessModule.ge
0xc8d75	745f4d61696e4d6f64756c6500676574	t_MainModule.get
0xc8d85	5f4d6f64756c654e616d650047657446	_ModuleName.GetF
0xc8d95	696c654e616d65576974686f75744578	ileNameWithoutEx
0xc8da5	74656e73696f6e006765745f49640067	tension.get_Id.g
0xc8db5	65745f496e76617269616e7443756c74	et_InvariantCult
0xc8dc5	75726500496e74333200537472696e67	ure.Int32.String
0xc8dd5	0049466f726d617450726f7669646572	.IFormatProvider
0xc8de5	00466f726d617400456d707479004173	.Format.Empty.As
0xc8df5	73656d626c7900476574457865637574	sembly.GetExecut
0xc8e05	696e67417373656d626c79006765745f	ingAssembly.get_
0xc8e15	4c6f636174696f6e0046696c65566572	Location.FileVer
0xc8e25	73696f6e496e666f0047657456657273	sionInfo.GetVers
0xc8e35	696f6e496e666f006765745f46696c65	ionInfo.get_File
0xc8e45	4d616a6f7250617274006765745f4669	MajorPart.get_Fi
0xc8e55	6c654d696e6f7250617274006765745f	leMinorPart.get_
0xc8e65	46696c654275696c645061	FileBuildPa

0xefc0	00000000000000000000000000000000	................
0xefd0	00000000000000000000000000000000	................
0xefe0	00000000000000000000000000000000	................
0xeff0	00000000000000000000000000000000	................
0xf000	b4840600000000001083060028830600	............(...
0xf010	328306003c830600508306006a830600	2...<...P...j...
0xf020	7c830600948306009e830600b6830600	\|...............
0xf030	f2830600fc830600148406001e840600	................
0xf040	38840600488406005e8406006a840600	8...H...^...j...
0xf050	7e8406008884060096840600f8820600	~...............
0xf060	d2830600d08406000000000000000000	................
0xf070	330032002e0034003900330030003100	3.2...4.9.3.0.1.
0xf080	3300000062616420616c6c6f63617469	3...bad allocati
0xf090	6f6e0000000000000000000000000000	on..............
0xf0a0	5a4b1b8e899b75d9faa0f4989e49563a	ZK....u......IV:
0xf0b0	6d84e713389dc767d2f780399b800333	m...8..g...9...3
0xf0c0	2079833149f7a2382a240ba58eb2b012	y.1I..8*$......
0xf0d0	74f4905dccf38dd720f3e289cc606ff6	t..].... ....`o.
0xf0e0	49ea27e7cf796926550022b4079f5e61	I.'..yi&U."...^a
0xf0f0	16bffa621ec6e068530e8a2ff93dc56c	...b...hS../.=.l
0xf100	08bd9b184556652c010d760ec7642afe	....EVe,..v..d*.
0xf110	3fe5f3b7560e2e26d0d73f7f46ba9827	?...V..&..?.F..'
0xf120	4080357da4fea9bbd9d84720f63a4975	@.5}......G .:Iu
0xf130	876e63e4caa833ea4d63a29f689ef1ad	.nc...3.Mc..h...
0xf140	ae5d361725a51ef50c24e774638b0d4f	.]6.%....$.tc..O
0xf150	6f9e2d371b6babeceee8cec961212da2	o.-7.k......a!-.
0xf160	f30f7af77c2e0baad72f85c4b86020b4	..z.\|..../...` .
0xf170	4c7e5eab1ccf6c8eba9ce9eba24e6b9b	L~^...l......Nk.
0xf180	837b4d44c26117dec93f0e061a1012c7	.{MD.a...?......
0xf190	58d0470d56980423b55f7963352df268	X.G.V..#._yc5-.h
0xf1a0	8fca7cca4f6b5174f4cc2e47539fcd16	..\|.OkQt...GS...
0xf1b0	0f5fd0274742ab7bdd43920a358e6171	._.'GB.{.C..5.aq
0xf1c0	4cf1c12a56aa6d800cf50cd1566207da	L..*V.m.....Vb..
0xf1d0	4344ef6d369b24b46d441cfd9e19def9	CD.m6.$.mD......
0xf1e0	039f0ffe70f7c549cba474ece0668d0c	....p..I..t..f..
0xf1f0	b2edc486af1fde2bae965029a61506d6	.......+..P)....
0xf200	b50da317dca637a48ac277c39b3fb7c7	......7...w..?..
0xf210	4c9d3dcc757c522a909cd15856d102b1	L.=.u\|R*...XV...
0xf220	09ecb3f3bd5ba8bcc4f6249ea7392422	.....[....$..9$"
0xf230	9231331dd983e6d3b4ec9fbb6b53022a	.13.........kS.*

0xcdb44	7000690063006d006400001569006e00	p.i.c.m.d...i.n.
0xcdb54	7300740061006c006c00650072007300	s.t.a.l.l.e.r.s.
0xcdb64	00196c006f00670073005c0069006e00	..l.o.g.s.\.i.n.
0xcdb74	7300740061006c006c0000032000000b	s.t.a.l.l... ...
0xcdb84	720075006e006100730000032e000009	r.u.n.a.s.......
0xcdb94	2e00740078007400000f2f0074002000	..t.x.t.../.t. .
0xcdba4	300020002f0072000039770069006e00	0. ./.r..9w.i.n.
0xcdbb4	330032005f006c006f00670069006300	3.2._.l.o.g.i.c.
0xcdbc4	61006c006400690073006b002e006400	a.l.d.i.s.k...d.
0xcdbd4	65007600690063006500690064003d00	e.v.i.c.e.i.d.=.
0xcdbe4	22000013460072006500650053007000	"...F.r.e.e.S.p.
0xcdbf4	610063006500000d2500740065006d00	a.c.e...%.t.e.m.
0xcdc04	7000250000315200650062006f006f00	p.%..1R.e.b.o.o.
0xcdc14	74004400650073006300720069007000	t.D.e.s.c.r.i.p.
0xcdc24	74006f007200460069006c0065002e00	t.o.r.F.i.l.e...
0xcdc34	640065007300002f5700650062005000	d.e.s../W.e.b.P.
0xcdc44	490043006d00640049006e0073007400	I.C.m.d.I.n.s.t.
0xcdc54	61006c006c0050006c0061006e002e00	a.l.l.P.l.a.n...
0xcdc64	78006d006c0000197300680075007400	x.m.l...s.h.u.t.
0xcdc74	64006f0077006e002e00650078006500	d.o.w.n...e.x.e.
0xcdc84	006353004f0046005400570041005200	.cS.O.F.T.W.A.R.
0xcdc94	45005c004d006900630072006f007300	E.\.M.i.c.r.o.s.
0xcdca4	6f00660074005c00570069006e006400	o.f.t.\.W.i.n.d.
0xcdcb4	6f00770073005c004300750072007200	o.w.s.\.C.u.r.r.
0xcdcc4	65006e00740056006500720073006900	e.n.t.V.e.r.s.i.
0xcdcd4	6f006e005c00520075006e004f006e00	o.n.\.R.u.n.O.n.
0xcdce4	63006500002157006500620050004900	c.e..!W.e.b.P.I.
0xcdcf4	43006f006d006d0061006e0064004c00	C.o.m.m.a.n.d.L.
0xcdd04	69006e00650000332500770069006e00	i.n.e..3%.w.i.n.
0xcdd14	64006900720025005c00730079007300	d.i.r.%.\.s.y.s.
0xcdd24	740065006d00330032005c0063006d00	t.e.m.3.2.\.c.m.
0xcdd34	64002e00650078006500003953004f00	d...e.x.e..9S.O.
0xcdd44	4600540057004100520045005c004d00	F.T.W.A.R.E.\.M.
0xcdd54	6900630072006f0073006f0066007400	i.c.r.o.s.o.f.t.
0xcdd64	5c005700650062004d00610074007200	\.W.e.b.M.a.t.r.
0xcdd74	69007800001749006e00730074006100	i.x...I.n.s.t.a.
0xcdd84	6c006c005000610074006800001b5700	l.l.P.a.t.h...W.
0xcdd94	650062004d0061007400720069007800	e.b.M.a.t.r.i.x.
0xcdda4	2e	.

0xc3c6d	006765745f436f756c644e6f7446696e	.get_CouldNotFin
0xc3c7d	64006765745f436f756c644e6f744765	d.get_CouldNotGe
0xc3c8d	7456657273696f6e4d616e6167657254	tVersionManagerT
0xc3c9d	797065006765745f436f756c644e6f74	ype.get_CouldNot
0xc3cad	52756e417341646d696e006765745f43	RunAsAdmin.get_C
0xc3cbd	6f756e74657248656164696e67446f77	ounterHeadingDow
0xc3ccd	6e53697a65006765745f436f756e7465	nSize.get_Counte
0xc3cdd	7248656164696e67446f776e54696d65	rHeadingDownTime
0xc3ced	006765745f436f756e74657248656164	.get_CounterHead
0xc3cfd	696e67496e737453697a65006765745f	ingInstSize.get_
0xc3d0d	436f756e74657248656164696e67496e	CounterHeadingIn
0xc3d1d	737454696d65006765745f436f756e74	stTime.get_Count
0xc3d2d	657248656164696e674c	erHeadingL

0xefc0	00000000000000000000000000000000	................
0xefd0	00000000000000000000000000000000	................
0xefe0	00000000000000000000000000000000	................
0xeff0	00000000000000000000000000000000	................
0xf000	b4840600000000001083060028830600	............(...
0xf010	328306003c830600508306006a830600	2...<...P...j...
0xf020	7c830600948306009e830600b6830600	\|...............
0xf030	f2830600fc830600148406001e840600	................
0xf040	38840600488406005e8406006a840600	8...H...^...j...
0xf050	7e8406008884060096840600f8820600	~...............
0xf060	d2830600d08406000000000000000000	................
0xf070	330032002e0034003900330030003100	3.2...4.9.3.0.1.
0xf080	3300000062616420616c6c6f63617469	3...bad allocati
0xf090	6f6e0000000000000000000000000000	on..............
0xf0a0	5a4b1b8e899b75d9faa0f4989e49563a	ZK....u......IV:
0xf0b0	6d84e713389dc767d2f780399b800333	m...8..g...9...3
0xf0c0	2079833149f7a2382a240ba58eb2b012	y.1I..8*$......
0xf0d0	74f4905dccf38dd720f3e289cc606ff6	t..].... ....`o.
0xf0e0	49ea27e7cf796926550022b4079f5e61	I.'..yi&U."...^a
0xf0f0	16bffa621ec6e068530e8a2ff93dc56c	...b...hS../.=.l
0xf100	08bd9b184556652c010d760ec7642afe	....EVe,..v..d*.
0xf110	3fe5f3b7560e2e26d0d73f7f46ba9827	?...V..&..?.F..'
0xf120	4080357da4fea9bbd9d84720f63a4975	@.5}......G .:Iu
0xf130	876e63e4caa833ea4d63a29f689ef1ad	.nc...3.Mc..h...
0xf140	ae5d361725a51ef50c24e774638b0d4f	.]6.%....$.tc..O
0xf150	6f9e2d371b6babeceee8cec961212da2	o.-7.k......a!-.
0xf160	f30f7af77c2e0baad72f85c4b86020b4	..z.\|..../...` .
0xf170	4c7e5eab1ccf6c8eba9ce9eba24e6b9b	L~^...l......Nk.
0xf180	837b4d44c26117dec93f0e061a1012c7	.{MD.a...?......
0xf190	58d0470d56980423b55f7963352df268	X.G.V..#._yc5-.h
0xf1a0	8fca7cca4f6b5174f4cc2e47539fcd16	..\|.OkQt...GS...
0xf1b0	0f5fd0274742ab7bdd43920a358e6171	._.'GB.{.C..5.aq
0xf1c0	4cf1c12a56aa6d800cf50cd1566207da	L..*V.m.....Vb..
0xf1d0	4344ef6d369b24b46d441cfd9e19def9	CD.m6.$.mD......
0xf1e0	039f0ffe70f7c549cba474ece0668d0c	....p..I..t..f..
0xf1f0	b2edc486af1fde2bae965029a61506d6	.......+..P)....
0xf200	b50da317dca637a48ac277c39b3fb7c7	......7...w..?..
0xf210	4c9d3dcc757c522a909cd15856d102b1	L.=.u\|R*...XV...
0xf220	09ecb3f3bd5ba8bcc4f6249ea7392422	.....[....$..9$"
0xf230	9231331dd983e6d3b4ec9fbb6b53022a	.13.........kS.*

Metadata

0xefc0	00000000000000000000000000000000	................
0xefd0	00000000000000000000000000000000	................
0xefe0	00000000000000000000000000000000	................
0xeff0	00000000000000000000000000000000	................
0xf000	b4840600000000001083060028830600	............(...
0xf010	328306003c830600508306006a830600	2...<...P...j...
0xf020	7c830600948306009e830600b6830600	\|...............
0xf030	f2830600fc830600148406001e840600	................
0xf040	38840600488406005e8406006a840600	8...H...^...j...
0xf050	7e8406008884060096840600f8820600	~...............
0xf060	d2830600d08406000000000000000000	................
0xf070	330032002e0034003900330030003100	3.2...4.9.3.0.1.
0xf080	3300000062616420616c6c6f63617469	3...bad allocati
0xf090	6f6e0000000000000000000000000000	on..............
0xf0a0	5a4b1b8e899b75d9faa0f4989e49563a	ZK....u......IV:
0xf0b0	6d84e713389dc767d2f780399b800333	m...8..g...9...3
0xf0c0	2079833149f7a2382a240ba58eb2b012	y.1I..8*$......
0xf0d0	74f4905dccf38dd720f3e289cc606ff6	t..].... ....`o.
0xf0e0	49ea27e7cf796926550022b4079f5e61	I.'..yi&U."...^a
0xf0f0	16bffa621ec6e068530e8a2ff93dc56c	...b...hS../.=.l
0xf100	08bd9b184556652c010d760ec7642afe	....EVe,..v..d*.
0xf110	3fe5f3b7560e2e26d0d73f7f46ba9827	?...V..&..?.F..'
0xf120	4080357da4fea9bbd9d84720f63a4975	@.5}......G .:Iu
0xf130	876e63e4caa833ea4d63a29f689ef1ad	.nc...3.Mc..h...
0xf140	ae5d361725a51ef50c24e774638b0d4f	.]6.%....$.tc..O
0xf150	6f9e2d371b6babeceee8cec961212da2	o.-7.k......a!-.
0xf160	f30f7af77c2e0baad72f85c4b86020b4	..z.\|..../...` .
0xf170	4c7e5eab1ccf6c8eba9ce9eba24e6b9b	L~^...l......Nk.
0xf180	837b4d44c26117dec93f0e061a1012c7	.{MD.a...?......
0xf190	58d0470d56980423b55f7963352df268	X.G.V..#._yc5-.h
0xf1a0	8fca7cca4f6b5174f4cc2e47539fcd16	..\|.OkQt...GS...
0xf1b0	0f5fd0274742ab7bdd43920a358e6171	._.'GB.{.C..5.aq
0xf1c0	4cf1c12a56aa6d800cf50cd1566207da	L..*V.m.....Vb..
0xf1d0	4344ef6d369b24b46d441cfd9e19def9	CD.m6.$.mD......
0xf1e0	039f0ffe70f7c549cba474ece0668d0c	....p..I..t..f..
0xf1f0	b2edc486af1fde2bae965029a61506d6	.......+..P)....
0xf200	b50da317dca637a48ac277c39b3fb7c7	......7...w..?..
0xf210	4c9d3dcc757c522a909cd15856d102b1	L.=.u\|R*...XV...
0xf220	09ecb3f3bd5ba8bcc4f6249ea7392422	.....[....$..9$"
0xf230	9231331dd983e6d3b4ec9fbb6b53022a	.13.........kS.*

0x0	4d5a90000300000004000000ffff0000	MZ..............
0x10	b8000000000000004000000000000000	........@.......
0x20	00000000000000000000000000000000	................
0x30	00000000000000000000000060020000	............`...
0x40	0e1fba0e00b409cd21b8014ccd215468	........!..L.!Th
0x50	69732070726f6772616d2063616e6e6f	is program canno
0x60	742062652072756e20696e20444f5320	t be run in DOS
0x70	6d6f64652e0d0d0a2400000000000000	mode....$.......
0x80	344c8e9c21f9e0ecc3387c174764223a	4L..!....8\|.Gd":
0x90	7a716c798f77893347e2f877d915d6d9	zqly.w.3G..w....
0xa0	8530444f7efa21020790b1d7e49d02f2	.0DO~.!.........
0xb0	f1d77031c6d6d44d64284e84c9ffe145	..p1...Md(N....E
0xc0	d6c25e196800e4be19044a784e13a025	..^.h.....JxN..%
0xd0	59d0dcd491da7345ea250d	Y.....sE.%.

0xb8887	73747261746f722070726976696c6567	strator privileg
0xb8897	657320746f2072756e2e20506c656173	es to run. Pleas
0xb88a7	65206d616b65207375726520796f7520	e make sure you
0xb88b7	686176652041646d696e697374726174	have Administrat
0xb88c7	6f7220726967687473206f6e20746869	or rights on thi
0xb88d7	73204d616368696e65010a446f776e2e	s Machine..Down.
0xb88e7	2053697a65010a446f776e2e2054696d	Size..Down. Tim
0xb88f7	65010c496e7374616c6c2053697a6501	e..Install Size.
0xb8907	0c496e7374616c6c2054696d6501084c	.Install Time..L
0xb8917	6f672053697a65010850726f64756374	og Size..Product
0xb8927	73011d4372656174696f6e206f662050	s..Creation of P
0xb8937	72	r

0xb9e59	3a20496e76616c69642076616c75652e	: Invalid value.
0xb9e69	01084c616e6775616765011c4c61756e	..Language..Laun
0xb9e79	6368696e67205765624d617472697820	ching WebMatrix
0xb9e89	77697468207b307d011c7b307d2e204c	with {0}..{0}. L
0xb9e99	696e65207b317d2c20706f736974696f	ine {1}, positio
0xb9ea9	6e207b327d2e013f277b307d2720636f	n {2}..?'{0}' co
0xb9eb9	6d6d616e642073686f756c64206e6f74	mmand should not
0xb9ec9	20626520737065636966696564207769	be specified wi
0xb9ed9	746820706172616d65746572733a207b	th parameters: {
0xb9ee9	317d2c20	1},

0x685e0	00000000000000000000000000000000	................
0x685f0	00000000000000000000000000000000	................
0x68600	00000000000000000000000000000100	................
0x68610	10000000180000800000000000000000	................
0x68620	00000000000001000100000030000080	............0...
0x68630	00000000000000000000000000000100	................
0x68640	0904000048000000608606009c020000	....H...`.......
0x68650	00000000000000000000000000000000	................
0x68660	9c0234000000560053005f0056004500	..4...V.S._.V.E.
0x68670	5200530049004f004e005f0049004e00	R.S.I.O.N._.I.N.
0x68680	46004f0000000000bd04effe00000100	F.O.............
0x68690	00000200000001000000020000000100	................
0x686a0	3f000000000000000400040003000000	?...............
0x686b0	070000000000000000000000fc010000	................
0x686c0	010053007400720069006e0067004600	..S.t.r.i.n.g.F.
0x686d0	69006c00650049006e0066006f000000	i.l.e.I.n.f.o...
0x686e0	d8010000010030003400300039003000	......0.4.0.9.0.
0x686f0	34006200300000005200190001004300	4.b.0...R.....C.
0x68700	6f006d00700061006e0079004e006100	o.m.p.a.n.y.N.a.
0x68710	6d0065000000000042006c0075007700	m.e.....B.l.u.w.
0x68720	2000280048006f006e00670020004b00	.(.H.o.n.g. .K.
0x68730	6f006e006700290020004c0069006d00	o.n.g.). .L.i.m.
0x68740	6900740065006400000000007a002900	i.t.e.d.....z.).
0x68750	0100460069006c006500440065007300	..F.i.l.e.D.e.s.
0x68760	6300720069007000740069006f006e00	c.r.i.p.t.i.o.n.
0x68770	0000000042007500740074006f006e00	....B.u.t.t.o.n.
0x68780	20004d0069006e00690070006f007200	.M.i.n.i.p.o.r.
0x68790	74002000440072006900760065007200	t. .D.r.i.v.e.r.
0x687a0	200066006f007200200049006e007000	.f.o.r. .I.n.p.
0x687b0	75007400200044006500760069006300	u.t. .D.e.v.i.c.
0x687c0	65007300000000003000080001004600	e.s.....0.....F.
0x687d0	69006c00650056006500720073006900	i.l.e.V.e.r.s.i.
0x687e0	6f006e000000000032002e0030002e00	o.n.....2...0...
0x687f0	31002e00300000005000180001005000	1...0...P.....P.
0x68800	72006f0064007500630074004e006100	r.o.d.u.c.t.N.a.
0x68810	6d006500000000005500530042002000	m.e.....U.S.B. .
0x68820	42007500740074006f006e0020004900	B.u.t.t.o.n. .I.
0x68830	6e007000750074002000440065007600	n.p.u.t. .D.e.v.
0x68840	69006300650000003400080001005000	i.c.e...4.....P.
0x68850	72006f00640075006300740056006500	r.o.d.u.c.t.V.e.
0x68860	7200730069006f006e00000032002e00	r.s.i.o.n...2...
0x68870	30002e0031002e00300000003c000c00	0...1...0...<...
0x68880	01004c006500670061006c0043006f00	..L.e.g.a.l.C.o.
0x68890	70007900720069006700680074000000	p.y.r.i.g.h.t...
0x688a0	a9002000320030003100300020004200	.. .2.0.1.0. .B.
0x688b0	6c007500770000004400000001005600	l.u.w...D.....V.
0x688c0	61007200460069006c00650049006e00	a.r.F.i.l.e.I.n.
0x688d0	66006f00000000002400040000005400	f.o.....$.....T.

0xc3c6d	006765745f436f756c644e6f7446696e	.get_CouldNotFin
0xc3c7d	64006765745f436f756c644e6f744765	d.get_CouldNotGe
0xc3c8d	7456657273696f6e4d616e6167657254	tVersionManagerT
0xc3c9d	797065006765745f436f756c644e6f74	ype.get_CouldNot
0xc3cad	52756e417341646d696e006765745f43	RunAsAdmin.get_C
0xc3cbd	6f756e74657248656164696e67446f77	ounterHeadingDow
0xc3ccd	6e53697a65006765745f436f756e7465	nSize.get_Counte
0xc3cdd	7248656164696e67446f776e54696d65	rHeadingDownTime
0xc3ced	006765745f436f756e74657248656164	.get_CounterHead
0xc3cfd	696e67496e737453697a65006765745f	ingInstSize.get_
0xc3d0d	436f756e74657248656164696e67496e	CounterHeadingIn
0xc3d1d	737454696d65006765745f436f756e74	stTime.get_Count
0xc3d2d	657248656164696e674c	erHeadingL

0xc5447	49534578707265737300436f756c644e	ISExpress.CouldN
0xc5457	6f7446696e6400436f756c644e6f7447	otFind.CouldNotG
0xc5467	657456657273696f6e4d616e61676572	etVersionManager
0xc5477	5479706500436f756c644e6f7452756e	Type.CouldNotRun
0xc5487	417341646d696e00436f756e74657248	AsAdmin.CounterH
0xc5497	656164696e67446f776e53697a650043	eadingDownSize.C
0xc54a7	6f756e74657248656164696e67446f77	ounterHeadingDow
0xc54b7	6e54696d6500436f756e746572486561	nTime.CounterHea
0xc54c7	64696e67496e737453697a6500436f75	dingInstSize.Cou
0xc54d7	6e74657248656164696e67496e737454	nterHeadingInstT
0xc54e7	696d6500436f756e7465724865616469	ime.CounterHeadi
0xc54f7	6e674c6f6753697a6500436f756e7465	ngLogSize.Counte
0xc5507	7248656164696e	rHeadin

0xcdb44	7000690063006d006400001569006e00	p.i.c.m.d...i.n.
0xcdb54	7300740061006c006c00650072007300	s.t.a.l.l.e.r.s.
0xcdb64	00196c006f00670073005c0069006e00	..l.o.g.s.\.i.n.
0xcdb74	7300740061006c006c0000032000000b	s.t.a.l.l... ...
0xcdb84	720075006e006100730000032e000009	r.u.n.a.s.......
0xcdb94	2e00740078007400000f2f0074002000	..t.x.t.../.t. .
0xcdba4	300020002f0072000039770069006e00	0. ./.r..9w.i.n.
0xcdbb4	330032005f006c006f00670069006300	3.2._.l.o.g.i.c.
0xcdbc4	61006c006400690073006b002e006400	a.l.d.i.s.k...d.
0xcdbd4	65007600690063006500690064003d00	e.v.i.c.e.i.d.=.
0xcdbe4	22000013460072006500650053007000	"...F.r.e.e.S.p.
0xcdbf4	610063006500000d2500740065006d00	a.c.e...%.t.e.m.
0xcdc04	7000250000315200650062006f006f00	p.%..1R.e.b.o.o.
0xcdc14	74004400650073006300720069007000	t.D.e.s.c.r.i.p.
0xcdc24	74006f007200460069006c0065002e00	t.o.r.F.i.l.e...
0xcdc34	640065007300002f5700650062005000	d.e.s../W.e.b.P.
0xcdc44	490043006d00640049006e0073007400	I.C.m.d.I.n.s.t.
0xcdc54	61006c006c0050006c0061006e002e00	a.l.l.P.l.a.n...
0xcdc64	78006d006c0000197300680075007400	x.m.l...s.h.u.t.
0xcdc74	64006f0077006e002e00650078006500	d.o.w.n...e.x.e.
0xcdc84	006353004f0046005400570041005200	.cS.O.F.T.W.A.R.
0xcdc94	45005c004d006900630072006f007300	E.\.M.i.c.r.o.s.
0xcdca4	6f00660074005c00570069006e006400	o.f.t.\.W.i.n.d.
0xcdcb4	6f00770073005c004300750072007200	o.w.s.\.C.u.r.r.
0xcdcc4	65006e00740056006500720073006900	e.n.t.V.e.r.s.i.
0xcdcd4	6f006e005c00520075006e004f006e00	o.n.\.R.u.n.O.n.
0xcdce4	63006500002157006500620050004900	c.e..!W.e.b.P.I.
0xcdcf4	43006f006d006d0061006e0064004c00	C.o.m.m.a.n.d.L.
0xcdd04	69006e00650000332500770069006e00	i.n.e..3%.w.i.n.
0xcdd14	64006900720025005c00730079007300	d.i.r.%.\.s.y.s.
0xcdd24	740065006d00330032005c0063006d00	t.e.m.3.2.\.c.m.
0xcdd34	64002e00650078006500003953004f00	d...e.x.e..9S.O.
0xcdd44	4600540057004100520045005c004d00	F.T.W.A.R.E.\.M.
0xcdd54	6900630072006f0073006f0066007400	i.c.r.o.s.o.f.t.
0xcdd64	5c005700650062004d00610074007200	\.W.e.b.M.a.t.r.
0xcdd74	69007800001749006e00730074006100	i.x...I.n.s.t.a.
0xcdd84	6c006c005000610074006800001b5700	l.l.P.a.t.h...W.
0xcdd94	650062004d0061007400720069007800	e.b.M.a.t.r.i.x.
0xcdda4	2e	.

0x685e0	00000000000000000000000000000000	................
0x685f0	00000000000000000000000000000000	................
0x68600	00000000000000000000000000000100	................
0x68610	10000000180000800000000000000000	................
0x68620	00000000000001000100000030000080	............0...
0x68630	00000000000000000000000000000100	................
0x68640	0904000048000000608606009c020000	....H...`.......
0x68650	00000000000000000000000000000000	................
0x68660	9c0234000000560053005f0056004500	..4...V.S._.V.E.
0x68670	5200530049004f004e005f0049004e00	R.S.I.O.N._.I.N.
0x68680	46004f0000000000bd04effe00000100	F.O.............
0x68690	00000200000001000000020000000100	................
0x686a0	3f000000000000000400040003000000	?...............
0x686b0	070000000000000000000000fc010000	................
0x686c0	010053007400720069006e0067004600	..S.t.r.i.n.g.F.
0x686d0	69006c00650049006e0066006f000000	i.l.e.I.n.f.o...
0x686e0	d8010000010030003400300039003000	......0.4.0.9.0.
0x686f0	34006200300000005200190001004300	4.b.0...R.....C.
0x68700	6f006d00700061006e0079004e006100	o.m.p.a.n.y.N.a.
0x68710	6d0065000000000042006c0075007700	m.e.....B.l.u.w.
0x68720	2000280048006f006e00670020004b00	.(.H.o.n.g. .K.
0x68730	6f006e006700290020004c0069006d00	o.n.g.). .L.i.m.
0x68740	6900740065006400000000007a002900	i.t.e.d.....z.).
0x68750	0100460069006c006500440065007300	..F.i.l.e.D.e.s.
0x68760	6300720069007000740069006f006e00	c.r.i.p.t.i.o.n.
0x68770	0000000042007500740074006f006e00	....B.u.t.t.o.n.
0x68780	20004d0069006e00690070006f007200	.M.i.n.i.p.o.r.
0x68790	74002000440072006900760065007200	t. .D.r.i.v.e.r.
0x687a0	200066006f007200200049006e007000	.f.o.r. .I.n.p.
0x687b0	75007400200044006500760069006300	u.t. .D.e.v.i.c.
0x687c0	65007300000000003000080001004600	e.s.....0.....F.
0x687d0	69006c00650056006500720073006900	i.l.e.V.e.r.s.i.
0x687e0	6f006e000000000032002e0030002e00	o.n.....2...0...
0x687f0	31002e00300000005000180001005000	1...0...P.....P.
0x68800	72006f0064007500630074004e006100	r.o.d.u.c.t.N.a.
0x68810	6d006500000000005500530042002000	m.e.....U.S.B. .
0x68820	42007500740074006f006e0020004900	B.u.t.t.o.n. .I.
0x68830	6e007000750074002000440065007600	n.p.u.t. .D.e.v.
0x68840	69006300650000003400080001005000	i.c.e...4.....P.
0x68850	72006f00640075006300740056006500	r.o.d.u.c.t.V.e.
0x68860	7200730069006f006e00000032002e00	r.s.i.o.n...2...
0x68870	30002e0031002e00300000003c000c00	0...1...0...<...
0x68880	01004c006500670061006c0043006f00	..L.e.g.a.l.C.o.
0x68890	70007900720069006700680074000000	p.y.r.i.g.h.t...
0x688a0	a9002000320030003100300020004200	.. .2.0.1.0. .B.
0x688b0	6c007500770000004400000001005600	l.u.w...D.....V.
0x688c0	61007200460069006c00650049006e00	a.r.F.i.l.e.I.n.
0x688d0	66006f00000000002400040000005400	f.o.....$.....T.

20 of 21 traits shown

Identity

SHA-256	ba45d1711ee3ee910c969c0f1573bdd5c93111670b526d812d02d8f93912f235
Filename	virussign.com_99a2bf105df43d45e6ef9383ed788b70.vir
Package	ba45d1711ee3ee910c969c0f1573bdd5c93111670b526d812d02d8f93912f235

Origin

Source	harvest
Feed	virussign
Domain	virussign.com

Timeline

First seen	9 Aug 2026 13:11 UTC
First analyzed	10 Aug 2026 08:40 UTC
Last analyzed	10 Aug 2026 08:40 UTC
Last updated	10 Aug 2026 08:40 UTC

Labeling

Label	bad
Label source	harvest
Traits version	73866

Not seeing what you expected? Let us know

0xc970c	696e67006765745f456c61707365644d	ing.get_ElapsedM
0xc971c	696c6c697365636f6e64730053797374	illiseconds.Syst
0xc972c	656d2e546872656164696e67004d6f6e	em.Threading.Mon
0xc973c	69746f7200456e746572004578697400	itor.Enter.Exit.
0xc974c	6765745f53797374656d446972656374	get_SystemDirect
0xc975c	6f72790053746172744e657700526f75	ory.StartNew.Rou
0xc976c	6e6400446f75626c6500416464536572	nd.Double.AddSer
0xc977c	766963650044656275674d6f64650067	vice.DebugMode.g
0xc978c	65745f586d6c4c6f636174696f6e0049	et_XmlLocation.I
0xc979c	7357656c6c466f726d65645572695374	sWellFormedUriSt
0xc97ac	72696e6700537472696e67436f6d7061	ring.StringCompa
0xc97bc	726572006765745f4f7264696e616c49	rer.get_OrdinalI
0xc97cc	676e6f7265436173650049457175616c	gnoreCase.IEqual
0xc97dc	697479	ity

0xca029	740057696e646f77735072696e636970	t.WindowsPrincip
0xca039	616c0057696e646f77734275696c7449	al.WindowsBuiltI
0xca049	6e526f6c65004973496e526f6c650054	nRole.IsInRole.T
0xca059	6f5570706572496e76617269616e7400	oUpperInvariant.
0xca069	50726f636573735374617274496e666f	ProcessStartInfo
0xca079	006765745f5374617274496e666f0073	.get_StartInfo.s
0xca089	65745f46696c654e616d65007365745f	et_FileName.set_
0xca099	5665726200436f6d706f6e656e740057	Verb.Component.W
0xca0a9	696e3332457863657074696f6e006765	in32Exception.ge
0xca0b9	745f4e6f770052656769737472795661	t_Now.RegistryVa
0xca0c9	6c75654b696e640050726f6365737357	lueKind.ProcessW
0xca0d9	696e646f775374796c65007365745f57	indowStyle.set_W
0xca0e9	696e646f775374796c65005379737465	indowStyle.Syste

0xc988d	7900496e636f6d70617469626c655072	y.IncompatiblePr
0xc989d	6f63657373006765745f496e636f6d70	ocess.get_Incomp
0xc98ad	617469626c6550726f63657373657300	atibleProcesses.
0xc98bd	6765745f50726f636573734e616d6500	get_ProcessName.
0xc98cd	47657450726f63657373657342794e61	GetProcessesByNa
0xc98dd	6d65006765745f4d61696e57696e646f	me.get_MainWindo
0xc98ed	775469746c6500496e76616c69644f70	wTitle.InvalidOp
0xc98fd	65726174696f6e457863657074696f6e	erationException
0xc990d	004e6f74537570706f72746564457863	.NotSupportedExc
0xc991d	657074696f6e0053747265616d526561	eption.StreamRea
0xc992d	64657200546578745265616465720052	der.TextReader.R
0xc993d	6561644c696e6500436f6e7461696e73	eadLine.Contains
0xc994d	00537472696e6753706c69744f707469	.StringSplitOpti
0xc995d	6f6e	on

0xc918b	00434f4d457863657074696f6e005374	.COMException.St
0xc919b	617274735769746800476574456c656d	artsWith.GetElem
0xc91ab	656e7442794e616d6500416464004765	entByName.Add.Ge
0xc91bb	745479706546726f6d50726f67494400	tTypeFromProgID.
0xc91cb	416374697661746f7200437265617465	Activator.Create
0xc91db	496e7374616e63650047657454797065	Instance.GetType
0xc91eb	46726f6d434c53494400417070486f73	FromCLSID.AppHos
0xc91fb	7441646d696e4d616e61676572005275	tAdminManager.Ru
0xc920b	6e74696d655479706548616e646c6500	ntimeTypeHandle.
0xc921b	4765745479706546726f6d48616e646c	GetTypeFromHandl
0xc922b	65006765745f4755494400417070486f	e.get_GUID.AppHo
0xc923b	73745772697461626c6541646d696e4d	stWritableAdminM
0xc924b	616e61676572004945	anager.IE