jgraph/drawio-desktop

SUSPICIOUS

bccdfd5331e92a4526ff4e7ee0b03cd9c5cd63be3752947ffc4f50962dfb747e · 54%

AI Legitimate JGraph draw.io installer

Mal-ecule

O₃(CAsI)H₅(DbF₈Os₇Po₄U)Md₅(Bi₆BkPa)

Size 125.2 MB download

First seen 18 days ago

Analyzed 13 days ago

Ecosystem github

Source github.com

Elevated NSIS loader with reboot and clipboard access: jgraph-drawio-desktop-v31.1.5-draw.io-ia32-31.1.5-windows-32bit-installer.exe:0x7ce2

Elevated NSIS overlay loader with reboot and clipboard access: jgraph-drawio-desktop-v31.1.5-draw.io-ia32-31.1.5-windows-32bit-installer.exe:0x7ce2

jgraph-drawio-desktop-v31.1.5-draw.io-ia32-31.1.5-windows-32bit-installer.exe pe

0x0	4d5a90000300000004000000ffff0000	MZ..............
0x10	b8000000000000004000000000000000	........@.......
0x20	00000000000000000000000000000000	................
0x30	000000000000000000000000d8000000	................
0x40	0e1fba0e00b409cd21b8014ccd215468	........!..L.!Th
0x50	69732070726f6772616d2063616e6e6f	is program canno
0x60	742062652072756e20696e20444f5320	t be run in DOS
0x70	6d6f64652e0d0d0a2400000000000000	mode....$.......
0x80	ad310881e95066d2e95066d2e95066d2	.1...Pf..Pf..Pf.
0x90	2a5f39d2eb5066d2e95067d24c5066d2	*_9..Pf..Pg.LPf.
0xa0	2a5f3bd2e65066d2bd7356d2e35066d2	*_;..Pf..sV..Pf.
0xb0	2e5660d2e85066d252696368e95066d2	.V`..Pf.Rich.Pf.
0xc0	00000000000000000000000000	.............

0x4f9	ffffff837e58ff7465ff7634ff155480	....~X.te.v4..T.
0x509	400085c089451474558b7d0c6a0157c7	@....E.tU.}.j.W.
0x519	45e410000000c745e808000000ff1550	E......E.......P
0x529	804000ff765857ff1558804000ff7514	.@..vXW..X.@..u.
0x539	8b354c80400057ffd689450c8d45e468	.5L.@.W...E..E.h
0x549	20080000506aff68e02e470057ff152c	...Pj.h..G.W..,
0x559	824000ff750c57ffd6ff7514ffd38d45	.@..u.W...u....E
0x569	a450ff7508ff15848240005f5e33c05b	.P.u.....@._^3.[
0x579	c9c210008b4c2404a128af47008bd153	.....L$..(.G...S
0x589	69d21840000056578b540208f6c20274	i..@..VW.T.....t
0x599	4f8d710133ff3b352caf470073428bce	O.q.3.;5,.G.sB..
0x5a9	69c9184000008d4401088b08f6c10274	i..@...D.......t
0x5b9	0347eb1ef6c10474098bcf	.G.....t...

0x7c62	536574437572736f7200bd014c6f6164	SetCursor...Load
0x7c72	437572736f7257003800436865636b44	CursorW.8.CheckD
0x7c82	6c67427574746f6e00003c014765744d	lgButton..<.GetM
0x7c92	657373616765506f7300b9014c6f6164	essagePos...Load
0x7ca2	4269746d617057001c0043616c6c5769	BitmapW...CallWi
0x7cb2	6e646f7750726f635700b10149735769	ndowProcW...IsWi
0x7cc2	6e646f7756697369626c65004200436c	ndowVisible.B.Cl
0x7cd2	6f7365436c6970626f61726400004a02	oseClipboard..J.
0x7ce2	536574436c6970626f61726444617461	SetClipboardDataElevated NSIS overlay loader with reboot and clipboard access
0x7cf2	0000c100456d707479436c6970626f61	....EmptyClipboaElevated NSIS loader with reboot and clipboard access
0x7d02	72640000f6014f70656e436c6970626f	rd....OpenClipbo
0x7d12	61726400a402547261636b506f707570	ard...TrackPopup
0x7d22	4d656e7500000900417070656e644d65	Menu....AppendMe
0x7d32	6e7557005e00437265617465506f7075	nuW.^.CreatePopu
0x7d42	704d656e75005d014765745379737465	pMenu.].GetSyste
0x7d52	6d4d6574726963730000540253657444	mMetrics..T.SetD
0x7d62	6c674974656d54657874570014014765	lgItemTextW...Ge
0x7d72	74446c674974656d546578745700e301	tDlgItemTextW...
0x7d82	4d657373616765426f78496e64697265	MessageBoxIndire
0x7d92	637457002f0043686172507265765700	ctW./.CharPrevW.
0x7da2	2a00436861724e6578744100d7027773	*.CharNextA...ws
0x7db2	7072696e74664100a200446973706174	printfA...Dispat
0x7dc2	63684d65737361676557000001025065	chMessageW....Pe
0x7dd2	656b4d65737361676557000055534552	ekMessageW..USER
0x7de2	33322e646c6c00000e0253656c656374	32.dll....Select
0x7df2	4f626a65637400003c02536574546578	Object..<.SetTex
0x7e02	74436f6c6f7200001602536574426b4d	tColor....SetBkM
0x7e12	6f6465003d00437265617465466f6e74	ode.=.CreateFont
0x7e22	496e6469726563745700290043726561	IndirectW.).Crea
0x7e32	74654272757368496e64697265637400	teBrushIndirect.
0x7e42	8f0044656c6574654f626a6563740000	..DeleteObject..
0x7e52	6b014765744465766963654361707300	k.GetDeviceCaps.
0x7e62	1502536574426b436f6c6f7200004744	..SetBkColor..GD
0x7e72	4933322e646c6c009b00534846696c65	I32.dll...SHFile
0x7e82	4f7065726174696f6e570000ad005348	OperationW....SH
0x7e92	47657446696c65496e666f5700007a00	GetFileInfoW..z.
0x7ea2	534842726f777365466f72466f6c6465	SHBrowseForFolde
0x7eb2	72570000bd0053484765745061746846	rW....SHGetPathF
0x7ec2	726f6d49444c6973745700000a015368	romIDListW....Sh
0x7ed2	656c6c4578656375746545785700c300	ellExecuteExW...
0x7ee2	53484765745370656369616c466f6c64	SHGetSpecialFold
0x7ef2	65724c6f636174696f6e00005348454c	erLocation..SHEL
0x7f02	4c33322e646c6c00e201526567456e75	L32.dll...RegEnu
0x7f12	6d56616c75655700e001526567456e75	mValueW...RegEnu
0x7f22	6d4b65795700f8015265675175657279	mKeyW...RegQuery
0x7f32	56616c75654578570000050252656753	ValueExW....RegS
0x7f42	657456616c75654578570000cb015265	etValueExW....Re
0x7f52	67436c6f73654b657900d90152656744	gCloseKey...RegD

0x83f0	720020006c00610075006e0063006800	r. .l.a.u.n.c.h.
0x8400	69006e006700200069006e0073007400	i.n.g. .i.n.s.t.
0x8410	61006c006c006500720000002e002e00	a.l.l.e.r.......
0x8420	2e002000250064002500250000000000	.. .%.d.%.%.....
0x8430	53006500530068007500740064006f00	S.e.S.h.u.t.d.o.Elevated NSIS overlay loader with reboot and clipboard access
0x8440	77006e00500072006900760069006c00	w.n.P.r.i.v.i.l.
0x8450	65006700650000004100000000000000	e.g.e...A.......
0x8460	2e0074006d0070000000000041000000	..t.m.p.....A...
0x8470	7e006e00730075000000000020005f00	~.n.s.u..... ._.
0x8480	3f003d000000000054004d0050000000	?.=.....T.M.P...
0x8490	540045004d005000000000004c006f00	T.E.M.P.....L.o.
0x84a0	770000005c00540065006d0070000000	w...\.T.e.m.p...
0x84b0	20002f0044003d00000000004e004300	./.D.=.....N.C.
0x84c0	52004300000000004e00530049005300	R.C.....N.S.I.S.
0x84d0	20004500720072006f00720000000000	.E.r.r.o.r.....
0x84e0	4500720072006f007200200077007200	E.r.r.o.r. .w.r.
0x84f0	6900740069006e006700200074006500	i.t.i.n.g. .t.e.
0x8500	6d0070006f0072006100720079002000	m.p.o.r.a.r.y. .
0x8510	6600	f.

0x24f0e	20002842000002008080000001002000	.(B.......... .
0x24f1e	2808010001000000000001002000a31d	(........... ...
0x24f2e	000004000000000000004c0234000000	..........L.4...
0x24f3e	560053005f0056004500520053004900	V.S._.V.E.R.S.I.
0x24f4e	4f004e005f0049004e0046004f000000	O.N._.I.N.F.O...
0x24f5e	0000bd04effe0000000001001f000000	................
0x24f6e	050001001f0000000500000000000000	................
0x24f7e	00000400000001000000000000000000	................
0x24f8e	000000000000aa010000000053007400	............S.t.
0x24f9e	720069006e006700460069006c006500	r.i.n.g.F.i.l.e.
0x24fae	49006e0066006f000000860100000000	I.n.f.o.........
0x24fbe	30003400300039003000340065003400	0.4.0.9.0.4.e.4.
0x24fce	00002e000700010043006f006d007000	........C.o.m.p.
0x24fde	61006e0079004e0061006d0065000000	a.n.y.N.a.m.e...
0x24fee	00004a00470072006100700068000000	..J.G.r.a.p.h...
0x24ffe	0000480010000100460069006c006500	..H.....F.i.l.e.
0x2500e	44006500730063007200690070007400	D.e.s.c.r.i.p.t.
0x2501e	69006f006e0000000000640072006100	i.o.n.....d.r.a.
0x2502e	77002e0069006f002000640065007300	w...i.o. .d.e.s.
0x2503e	6b0074006f00700000002e0007000100	k.t.o.p.........
0x2504e	460069006c0065005600650072007300	F.i.l.e.V.e.r.s.
0x2505e	69006f006e0000000000330031002e00	i.o.n.....3.1...
0x2506e	31002e00350000000000640020000100	1...5.....d. ...
0x2507e	4c006500670061006c0043006f007000	L.e.g.a.l.C.o.p.
0x2508e	79007200690067006800740000004300	y.r.i.g.h.t...C.
0x2509e	6f007000790072006900670068007400	o.p.y.r.i.g.h.t.
0x250ae	200032003000310037002d0032003000	.2.0.1.7.-.2.0.
0x250be	32003600200064007200610077002e00	2.6. .d.r.a.w...
0x250ce	69006f0020004c007400640000003000	i.o. .L.t.d...0.
0x250de	08000100500072006f00640075006300	....P.r.o.d.u.c.
0x250ee	74004e0061006d006500000000006400	t.N.a.m.e.....d.
0x250fe	7200610077002e0069006f0000003200	r.a.w...i.o...2.
0x2510e	07000100500072006f00640075006300	....P.r.o.d.u.c.
0x2511e	7400560065007200730069006f006e00	t.V.e.r.s.i.o.n.
0x2512e	0000330031002e0031002e0035000000	..3.1...1...5...
0x2513e	00004400000000005600610072004600	..D.....V.a.r.F.
0x2514e	69006c00650049006e0066006f000000	i.l.e.I.n.f.o...
0x2515e	00002400040000005400720061006e00	..$.....T.r.a.n.
0x2516e	73006c006100740069006f006e000000	s.l.a.t.i.o.n...
0x2517e	00000904e404000000003c3f786d6c20	..........<?xml Elevated NSIS overlay loader with reboot and clipboard access
0x2518e	76657273696f6e3d22312e302220656e	version="1.0" en
0x2519e	636f64696e673d225554462d38222073	coding="UTF-8" s
0x251ae	74616e64616c6f6e653d22796573223f	tandalone="yes"?
0x251be	3e3c617373656d626c7920786d6c6e73	><assembly xmlns
0x251ce	3d2275726e3a736368656d61732d6d69	="urn:schemas-mi
0x251de	63726f736f66742d636f6d3a61736d2e	crosoft-com:asm.
0x251ee	763122206d616e696665737456657273	v1" manifestVers
0x251fe	696f6e3d22312e30223e3c617373656d	ion="1.0"><assem

Objectives

0x7c62	536574437572736f7200bd014c6f6164	SetCursor...Load
0x7c72	437572736f7257003800436865636b44	CursorW.8.CheckD
0x7c82	6c67427574746f6e00003c014765744d	lgButton..<.GetM
0x7c92	657373616765506f7300b9014c6f6164	essagePos...Load
0x7ca2	4269746d617057001c0043616c6c5769	BitmapW...CallWi
0x7cb2	6e646f7750726f635700b10149735769	ndowProcW...IsWi
0x7cc2	6e646f7756697369626c65004200436c	ndowVisible.B.Cl
0x7cd2	6f7365436c6970626f61726400004a02	oseClipboard..J.
0x7ce2	536574436c6970626f61726444617461	SetClipboardData
0x7cf2	0000c100456d707479436c6970626f61	....EmptyClipboa
0x7d02	72640000f6014f70656e436c6970626f	rd....OpenClipbo
0x7d12	61726400a402547261636b506f707570	ard...TrackPopup
0x7d22	4d656e7500000900417070656e644d65	Menu....AppendMe
0x7d32	6e7557005e00437265617465506f7075	nuW.^.CreatePopu
0x7d42	704d656e75005d014765745379737465	pMenu.].GetSyste
0x7d52	6d4d6574726963730000540253657444	mMetrics..T.SetD
0x7d62	6c674974656d54657874570014014765	lgItemTextW...Ge
0x7d72	74446c674974656d546578745700e301	tDlgItemTextW...
0x7d82	4d657373616765426f78496e64697265	MessageBoxIndire
0x7d92	637457002f0043686172507265765700	ctW./.CharPrevW.
0x7da2	2a00436861724e6578744100d7027773	*.CharNextA...ws
0x7db2	7072696e74664100a200446973706174	printfA...Dispat
0x7dc2	63684d65737361676557000001025065	chMessageW....Pe
0x7dd2	656b4d65737361676557000055534552	ekMessageW..USER
0x7de2	33322e646c6c00000e0253656c656374	32.dll....Select
0x7df2	4f626a65637400003c02536574546578	Object..<.SetTex
0x7e02	74436f6c6f7200001602536574426b4d	tColor....SetBkM
0x7e12	6f6465003d00437265617465466f6e74	ode.=.CreateFont
0x7e22	496e6469726563745700290043726561	IndirectW.).Crea
0x7e32	74654272757368496e64697265637400	teBrushIndirect.
0x7e42	8f0044656c6574654f626a6563740000	..DeleteObject..
0x7e52	6b014765744465766963654361707300	k.GetDeviceCaps.
0x7e62	1502536574426b436f6c6f7200004744	..SetBkColor..GD
0x7e72	4933322e646c6c009b00534846696c65	I32.dll...SHFile
0x7e82	4f7065726174696f6e570000ad005348	OperationW....SH
0x7e92	47657446696c65496e666f5700007a00	GetFileInfoW..z.
0x7ea2	534842726f777365466f72466f6c6465	SHBrowseForFolde
0x7eb2	72570000bd0053484765745061746846	rW....SHGetPathF
0x7ec2	726f6d49444c6973745700000a015368	romIDListW....Sh
0x7ed2	656c6c4578656375746545785700c300	ellExecuteExW...
0x7ee2	53484765745370656369616c466f6c64	SHGetSpecialFold
0x7ef2	65724c6f636174696f6e00005348454c	erLocation..SHEL
0x7f02	4c33322e646c6c00e201526567456e75	L32.dll...RegEnu
0x7f12	6d56616c75655700e001526567456e75	mValueW...RegEnu
0x7f22	6d4b65795700f8015265675175657279	mKeyW...RegQuery
0x7f32	56616c75654578570000050252656753	ValueExW....RegS
0x7f42	657456616c75654578570000cb015265	etValueExW....Re
0x7f52	67436c6f73654b657900d90152656744	gCloseKey...RegD

0x83f0	720020006c00610075006e0063006800	r. .l.a.u.n.c.h.
0x8400	69006e006700200069006e0073007400	i.n.g. .i.n.s.t.
0x8410	61006c006c006500720000002e002e00	a.l.l.e.r.......
0x8420	2e002000250064002500250000000000	.. .%.d.%.%.....
0x8430	53006500530068007500740064006f00	S.e.S.h.u.t.d.o.
0x8440	77006e00500072006900760069006c00	w.n.P.r.i.v.i.l.
0x8450	65006700650000004100000000000000	e.g.e...A.......
0x8460	2e0074006d0070000000000041000000	..t.m.p.....A...
0x8470	7e006e00730075000000000020005f00	~.n.s.u..... ._.
0x8480	3f003d000000000054004d0050000000	?.=.....T.M.P...
0x8490	540045004d005000000000004c006f00	T.E.M.P.....L.o.
0x84a0	770000005c00540065006d0070000000	w...\.T.e.m.p...
0x84b0	20002f0044003d00000000004e004300	./.D.=.....N.C.
0x84c0	52004300000000004e00530049005300	R.C.....N.S.I.S.
0x84d0	20004500720072006f00720000000000	.E.r.r.o.r.....
0x84e0	4500720072006f007200200077007200	E.r.r.o.r. .w.r.
0x84f0	6900740069006e006700200074006500	i.t.i.n.g. .t.e.
0x8500	6d0070006f0072006100720079002000	m.p.o.r.a.r.y. .
0x8510	6600	f.

0x24f0e	20002842000002008080000001002000	.(B.......... .
0x24f1e	2808010001000000000001002000a31d	(........... ...
0x24f2e	000004000000000000004c0234000000	..........L.4...
0x24f3e	560053005f0056004500520053004900	V.S._.V.E.R.S.I.
0x24f4e	4f004e005f0049004e0046004f000000	O.N._.I.N.F.O...
0x24f5e	0000bd04effe0000000001001f000000	................
0x24f6e	050001001f0000000500000000000000	................
0x24f7e	00000400000001000000000000000000	................
0x24f8e	000000000000aa010000000053007400	............S.t.
0x24f9e	720069006e006700460069006c006500	r.i.n.g.F.i.l.e.
0x24fae	49006e0066006f000000860100000000	I.n.f.o.........
0x24fbe	30003400300039003000340065003400	0.4.0.9.0.4.e.4.
0x24fce	00002e000700010043006f006d007000	........C.o.m.p.
0x24fde	61006e0079004e0061006d0065000000	a.n.y.N.a.m.e...
0x24fee	00004a00470072006100700068000000	..J.G.r.a.p.h...
0x24ffe	0000480010000100460069006c006500	..H.....F.i.l.e.
0x2500e	44006500730063007200690070007400	D.e.s.c.r.i.p.t.
0x2501e	69006f006e0000000000640072006100	i.o.n.....d.r.a.
0x2502e	77002e0069006f002000640065007300	w...i.o. .d.e.s.
0x2503e	6b0074006f00700000002e0007000100	k.t.o.p.........
0x2504e	460069006c0065005600650072007300	F.i.l.e.V.e.r.s.
0x2505e	69006f006e0000000000330031002e00	i.o.n.....3.1...
0x2506e	31002e00350000000000640020000100	1...5.....d. ...
0x2507e	4c006500670061006c0043006f007000	L.e.g.a.l.C.o.p.
0x2508e	79007200690067006800740000004300	y.r.i.g.h.t...C.
0x2509e	6f007000790072006900670068007400	o.p.y.r.i.g.h.t.
0x250ae	200032003000310037002d0032003000	.2.0.1.7.-.2.0.
0x250be	32003600200064007200610077002e00	2.6. .d.r.a.w...
0x250ce	69006f0020004c007400640000003000	i.o. .L.t.d...0.
0x250de	08000100500072006f00640075006300	....P.r.o.d.u.c.
0x250ee	74004e0061006d006500000000006400	t.N.a.m.e.....d.
0x250fe	7200610077002e0069006f0000003200	r.a.w...i.o...2.
0x2510e	07000100500072006f00640075006300	....P.r.o.d.u.c.
0x2511e	7400560065007200730069006f006e00	t.V.e.r.s.i.o.n.
0x2512e	0000330031002e0031002e0035000000	..3.1...1...5...
0x2513e	00004400000000005600610072004600	..D.....V.a.r.F.
0x2514e	69006c00650049006e0066006f000000	i.l.e.I.n.f.o...
0x2515e	00002400040000005400720061006e00	..$.....T.r.a.n.
0x2516e	73006c006100740069006f006e000000	s.l.a.t.i.o.n...
0x2517e	00000904e404000000003c3f786d6c20	..........<?xml
0x2518e	76657273696f6e3d22312e302220656e	version="1.0" en
0x2519e	636f64696e673d225554462d38222073	coding="UTF-8" s
0x251ae	74616e64616c6f6e653d22796573223f	tandalone="yes"?
0x251be	3e3c617373656d626c7920786d6c6e73	><assembly xmlns
0x251ce	3d2275726e3a736368656d61732d6d69	="urn:schemas-mi
0x251de	63726f736f66742d636f6d3a61736d2e	crosoft-com:asm.
0x251ee	763122206d616e696665737456657273	v1" manifestVers
0x251fe	696f6e3d22312e30223e3c617373656d	ion="1.0"><assem

0x7c62	536574437572736f7200bd014c6f6164	SetCursor...Load
0x7c72	437572736f7257003800436865636b44	CursorW.8.CheckD
0x7c82	6c67427574746f6e00003c014765744d	lgButton..<.GetM
0x7c92	657373616765506f7300b9014c6f6164	essagePos...Load
0x7ca2	4269746d617057001c0043616c6c5769	BitmapW...CallWi
0x7cb2	6e646f7750726f635700b10149735769	ndowProcW...IsWi
0x7cc2	6e646f7756697369626c65004200436c	ndowVisible.B.Cl
0x7cd2	6f7365436c6970626f61726400004a02	oseClipboard..J.
0x7ce2	536574436c6970626f61726444617461	SetClipboardData
0x7cf2	0000c100456d707479436c6970626f61	....EmptyClipboa
0x7d02	72640000f6014f70656e436c6970626f	rd....OpenClipbo
0x7d12	61726400a402547261636b506f707570	ard...TrackPopup
0x7d22	4d656e7500000900417070656e644d65	Menu....AppendMe
0x7d32	6e7557005e00437265617465506f7075	nuW.^.CreatePopu
0x7d42	704d656e75005d014765745379737465	pMenu.].GetSyste
0x7d52	6d4d6574726963730000540253657444	mMetrics..T.SetD
0x7d62	6c674974656d54657874570014014765	lgItemTextW...Ge
0x7d72	74446c674974656d546578745700e301	tDlgItemTextW...
0x7d82	4d657373616765426f78496e64697265	MessageBoxIndire
0x7d92	637457002f0043686172507265765700	ctW./.CharPrevW.
0x7da2	2a00436861724e6578744100d7027773	*.CharNextA...ws
0x7db2	7072696e74664100a200446973706174	printfA...Dispat
0x7dc2	63684d65737361676557000001025065	chMessageW....Pe
0x7dd2	656b4d65737361676557000055534552	ekMessageW..USER
0x7de2	33322e646c6c00000e0253656c656374	32.dll....Select
0x7df2	4f626a65637400003c02536574546578	Object..<.SetTex
0x7e02	74436f6c6f7200001602536574426b4d	tColor....SetBkM
0x7e12	6f6465003d00437265617465466f6e74	ode.=.CreateFont
0x7e22	496e6469726563745700290043726561	IndirectW.).Crea
0x7e32	74654272757368496e64697265637400	teBrushIndirect.
0x7e42	8f0044656c6574654f626a6563740000	..DeleteObject..
0x7e52	6b014765744465766963654361707300	k.GetDeviceCaps.
0x7e62	1502536574426b436f6c6f7200004744	..SetBkColor..GD
0x7e72	4933322e646c6c009b00534846696c65	I32.dll...SHFile
0x7e82	4f7065726174696f6e570000ad005348	OperationW....SH
0x7e92	47657446696c65496e666f5700007a00	GetFileInfoW..z.
0x7ea2	534842726f777365466f72466f6c6465	SHBrowseForFolde
0x7eb2	72570000bd0053484765745061746846	rW....SHGetPathF
0x7ec2	726f6d49444c6973745700000a015368	romIDListW....Sh
0x7ed2	656c6c4578656375746545785700c300	ellExecuteExW...
0x7ee2	53484765745370656369616c466f6c64	SHGetSpecialFold
0x7ef2	65724c6f636174696f6e00005348454c	erLocation..SHEL
0x7f02	4c33322e646c6c00e201526567456e75	L32.dll...RegEnu
0x7f12	6d56616c75655700e001526567456e75	mValueW...RegEnu
0x7f22	6d4b65795700f8015265675175657279	mKeyW...RegQuery
0x7f32	56616c75654578570000050252656753	ValueExW....RegS
0x7f42	657456616c75654578570000cb015265	etValueExW....Re
0x7f52	67436c6f73654b657900d90152656744	gCloseKey...RegD

0x0	4d5a90000300000004000000ffff0000	MZ..............
0x10	b8000000000000004000000000000000	........@.......
0x20	00000000000000000000000000000000	................
0x30	000000000000000000000000d8000000	................
0x40	0e1fba0e00b409cd21b8014ccd215468	........!..L.!Th
0x50	69732070726f6772616d2063616e6e6f	is program canno
0x60	742062652072756e20696e20444f5320	t be run in DOS
0x70	6d6f64652e0d0d0a2400000000000000	mode....$.......
0x80	ad310881e95066d2e95066d2e95066d2	.1...Pf..Pf..Pf.
0x90	2a5f39d2eb5066d2e95067d24c5066d2	*_9..Pf..Pg.LPf.
0xa0	2a5f3bd2e65066d2bd7356d2e35066d2	*_;..Pf..sV..Pf.
0xb0	2e5660d2e85066d252696368e95066d2	.V`..Pf.Rich.Pf.
0xc0	00000000000000000000000000	.............

0x7c62	536574437572736f7200bd014c6f6164	SetCursor...Load
0x7c72	437572736f7257003800436865636b44	CursorW.8.CheckD
0x7c82	6c67427574746f6e00003c014765744d	lgButton..<.GetM
0x7c92	657373616765506f7300b9014c6f6164	essagePos...Load
0x7ca2	4269746d617057001c0043616c6c5769	BitmapW...CallWi
0x7cb2	6e646f7750726f635700b10149735769	ndowProcW...IsWi
0x7cc2	6e646f7756697369626c65004200436c	ndowVisible.B.Cl
0x7cd2	6f7365436c6970626f61726400004a02	oseClipboard..J.
0x7ce2	536574436c6970626f61726444617461	SetClipboardData
0x7cf2	0000c100456d707479436c6970626f61	....EmptyClipboa
0x7d02	72640000f6014f70656e436c6970626f	rd....OpenClipbo
0x7d12	61726400a402547261636b506f707570	ard...TrackPopup
0x7d22	4d656e7500000900417070656e644d65	Menu....AppendMe
0x7d32	6e7557005e00437265617465506f7075	nuW.^.CreatePopu
0x7d42	704d656e75005d014765745379737465	pMenu.].GetSyste
0x7d52	6d4d6574726963730000540253657444	mMetrics..T.SetD
0x7d62	6c674974656d54657874570014014765	lgItemTextW...Ge
0x7d72	74446c674974656d546578745700e301	tDlgItemTextW...
0x7d82	4d657373616765426f78496e64697265	MessageBoxIndire
0x7d92	637457002f0043686172507265765700	ctW./.CharPrevW.
0x7da2	2a00436861724e6578744100d7027773	*.CharNextA...ws
0x7db2	7072696e74664100a200446973706174	printfA...Dispat
0x7dc2	63684d65737361676557000001025065	chMessageW....Pe
0x7dd2	656b4d65737361676557000055534552	ekMessageW..USER
0x7de2	33322e646c6c00000e0253656c656374	32.dll....Select
0x7df2	4f626a65637400003c02536574546578	Object..<.SetTex
0x7e02	74436f6c6f7200001602536574426b4d	tColor....SetBkM
0x7e12	6f6465003d00437265617465466f6e74	ode.=.CreateFont
0x7e22	496e6469726563745700290043726561	IndirectW.).Crea
0x7e32	74654272757368496e64697265637400	teBrushIndirect.
0x7e42	8f0044656c6574654f626a6563740000	..DeleteObject..
0x7e52	6b014765744465766963654361707300	k.GetDeviceCaps.
0x7e62	1502536574426b436f6c6f7200004744	..SetBkColor..GD
0x7e72	4933322e646c6c009b00534846696c65	I32.dll...SHFile
0x7e82	4f7065726174696f6e570000ad005348	OperationW....SH
0x7e92	47657446696c65496e666f5700007a00	GetFileInfoW..z.
0x7ea2	534842726f777365466f72466f6c6465	SHBrowseForFolde
0x7eb2	72570000bd0053484765745061746846	rW....SHGetPathF
0x7ec2	726f6d49444c6973745700000a015368	romIDListW....Sh
0x7ed2	656c6c4578656375746545785700c300	ellExecuteExW...
0x7ee2	53484765745370656369616c466f6c64	SHGetSpecialFold
0x7ef2	65724c6f636174696f6e00005348454c	erLocation..SHEL
0x7f02	4c33322e646c6c00e201526567456e75	L32.dll...RegEnu
0x7f12	6d56616c75655700e001526567456e75	mValueW...RegEnu
0x7f22	6d4b65795700f8015265675175657279	mKeyW...RegQuery
0x7f32	56616c75654578570000050252656753	ValueExW....RegS
0x7f42	657456616c75654578570000cb015265	etValueExW....Re
0x7f52	67436c6f73654b657900d90152656744	gCloseKey...RegD

0x83f0	720020006c00610075006e0063006800	r. .l.a.u.n.c.h.
0x8400	69006e006700200069006e0073007400	i.n.g. .i.n.s.t.
0x8410	61006c006c006500720000002e002e00	a.l.l.e.r.......
0x8420	2e002000250064002500250000000000	.. .%.d.%.%.....
0x8430	53006500530068007500740064006f00	S.e.S.h.u.t.d.o.
0x8440	77006e00500072006900760069006c00	w.n.P.r.i.v.i.l.
0x8450	65006700650000004100000000000000	e.g.e...A.......
0x8460	2e0074006d0070000000000041000000	..t.m.p.....A...
0x8470	7e006e00730075000000000020005f00	~.n.s.u..... ._.
0x8480	3f003d000000000054004d0050000000	?.=.....T.M.P...
0x8490	540045004d005000000000004c006f00	T.E.M.P.....L.o.
0x84a0	770000005c00540065006d0070000000	w...\.T.e.m.p...
0x84b0	20002f0044003d00000000004e004300	./.D.=.....N.C.
0x84c0	52004300000000004e00530049005300	R.C.....N.S.I.S.
0x84d0	20004500720072006f00720000000000	.E.r.r.o.r.....
0x84e0	4500720072006f007200200077007200	E.r.r.o.r. .w.r.
0x84f0	6900740069006e006700200074006500	i.t.i.n.g. .t.e.
0x8500	6d0070006f0072006100720079002000	m.p.o.r.a.r.y. .
0x8510	6600	f.

Micro-behaviors

0x4f9	ffffff837e58ff7465ff7634ff155480	....~X.te.v4..T.
0x509	400085c089451474558b7d0c6a0157c7	@....E.tU.}.j.W.
0x519	45e410000000c745e808000000ff1550	E......E.......P
0x529	804000ff765857ff1558804000ff7514	.@..vXW..X.@..u.
0x539	8b354c80400057ffd689450c8d45e468	.5L.@.W...E..E.h
0x549	20080000506aff68e02e470057ff152c	...Pj.h..G.W..,
0x559	824000ff750c57ffd6ff7514ffd38d45	.@..u.W...u....E
0x569	a450ff7508ff15848240005f5e33c05b	.P.u.....@._^3.[
0x579	c9c210008b4c2404a128af47008bd153	.....L$..(.G...S
0x589	69d21840000056578b540208f6c20274	i..@..VW.T.....t
0x599	4f8d710133ff3b352caf470073428bce	O.q.3.;5,.G.sB..
0x5a9	69c9184000008d4401088b08f6c10274	i..@...D.......t
0x5b9	0347eb1ef6c10474098bcf	.G.....t...

0x939	80af4700e9831500008b45e08d348580	..G.......E..4..
0x949	af470033c08b0e3bcb0f94c0234de48b	.G.3...;....#M..
0x959	4485d8890ee96d1500008b45dcff3485	D.....m....E..4.
0x969	80af470056e9f81400008b0db02e4700	..G.V.........G.
0x979	8b35688240003bcb7409ff75dc51ffd6	.5h.@.;.t..u.Q..
0x989	8b45d88b0dc42e47003bcb0f842b1500	.E.....G.;...+..
0x999	005051ffd6e9221500006af0e8971600	.PQ..."...j.....
0x9a9	00ff75dc50ff157480400085c00f8509	..u.P..t.@......
0x9b9	150000e9ca1200006af0e87916000050	........j..y...P
0x9c9	894508e8694600008bf03bf3745a6a5c	.E..iF....;.tZj\
0x9d9	56e8dd4500008bf0668b3e66891e663b	V..E....f.>f..f;
0x9e9	fb7518395de07413e89542000085c074	.u.9].t...B....t
0x9f9	0aff7508e8ef410000eb08	..u...A....

0x1cb5	ffe8860300008bf0568975c8e8403300	........V.u..@3.
0x1cc5	0085c075076aede87003000056e8b434	...u.j..p...V..4
0x1cd5	00006a02680000004056e8cc34000083	..j.h...@V..4...
0x1ce5	f8ff8945080f8497000000a1f8ae4700	...E..........G.
0x1cf5	8b3534814000506a408945c4ffd68bf8	.54.@.Pj@.E.....
0x1d05	3bfb747553e8380a0000ff75c457e819	;.tuS.8....u.W..
0x1d15	0a0000ff75e06a40ffd68bf03bf38975	....u.j@....;..u
0x1d25	b47434ff75e05653ff75dce8e1070000	.t4.u.VS.u......
0x1d35	eb188b0e8b460483c6085103c7565089	.....F....Q..VP.
0x1d45	4dcce81f3400000375cc381e75e4ff75	M...4...u.8.u..u
0x1d55	b4ff1528814000ff75c457ff7508e8fa	...(.@..u.W.u...
0x1d65	34000057ff15288140005353ff75086a	4..W..(.@.SS.u.j
0x1d75	ffe89b0700008945d0ff75	.......E..u

0x2981	0bfa3bc675068b013bc7741f5351e828	..;.u...;.t.SQ.(
0x2991	2600008bc86683392275024141668b01	&....f.9"u.AAf..
0x29a1	6685c00f8506ffffffeb13668361fc00	f..........f.a..
0x29b1	83c104516800f04c00e8fb2c000033db	...Qh..L...,..3.
0x29c1	8b359c804000bf00f04d005768002000	.5..@....M.Wh. .
0x29d1	00ffd6e885fdffff85c0755668fb1f00	..........uVh...
0x29e1	0057ff159880400068a4a2400057e8e2	.W....@.h..@.W..
0x29f1	2c0000e865fdffff85c075365768fc1f	,...e.....u6Wh..
0x2a01	0000ffd6689ca2400057e8c62c00008b	....h..@.W..,...
0x2a11	3570804000576890a24000ffd6576888	5p.@.Wh..@...Wh.
0x2a21	a24000ffd6e833fdffff85c00f84cb00	.@....3.........
0x2a31	00006800b04d00ff1540814000ff7424	..h..M...@.@..t$
0x2a41	1ce896f8ffff3bc3894424100f85ab00	......;..D$.....
0x2a51	0000391d00af47000f848f0000005355	..9...G.......SU
0x2a61	e8562500008bf03bf5724c0fb70582a2	.V%....;.rL.....
0x2a71	4000990fa4c210c1e0108bd80fb70580	@...............
0x2a81	a240000fb70d7ca24000990bd80fb705	.@....\|.@.......
0x2a91	7ea24000c1e0100bc133	~.@......3

0x2fb0	086a0258e9bf000000e8c2000000393d	.j.X..........9=
0x2fc0	a0af47000f85830000006a05ff352802	..G.......j..5(.
0x2fd0	4500ff1568824000683c834000e8422a	E...h.@.h<.@..B*
0x2fe0	000085c0750a6830834000e8342a0000	....u.h0.@..4*..
0x2ff0	8b3540824000bd18834000535557ffd6	.5@.@....@.SUW..
0x3000	85c0751653680483400057ffd653892d	..u.Sh..@.W..S.-
0x3010	a42e4700ff1534824000a1c02e470057	..G...4.@....G.W
0x3020	83c06968583d40000fb7c05750ff35e0	..ihX=@....WP.5.
0x3030	ae4700ff15448240006a058bf0e8c9d7	.G...D.@.j......
0x3040	ffff6a01e8b1fcffff8bc6eb2b57e8a2	..j.........+W..
0x3050	17000085c07418393dac2e47000f854e	.....t.9=..G...N
0x3060	ffffff6a02e8a1d7ffffe942ffffff6a	...j.......B...j
0x3070	01e895d7ffff33c05f5e5d	......3._^]

0x327c	00ebe0ff742430ff7424306811010000	....t$0.t$0h....
0x328c	ff35b82e4700ff1518824000ff742430	.5..G.....@..t$0
0x329c	ff74243053e8f2030000e9550300008b	.t$0S......U....
0x32ac	44242c8b7c24243bd9a330024500754d	D$,.\|$$;..0.E.uM
0x32bc	8b35e48140006a0157893de8ae4700ff	.5..@.j.W.=..G..
0x32cc	d66a0257a344024500ffd66aff6a1c57	.j.W.D.E...j.j.W
0x32dc	a310024400e84b030000ff35c82e4700	...D..K....5..G.
0x32ec	6af257ff15988140006a04e80fd5ffff	j.W....@.j......
0x32fc	a3ac2e470033c040a3300245008b0d68	...G.3.@.0.E...h
0x330c	a3400033ed8bf1c1e606033520af4700	.@.3.......5 .G.
0x331c	3bcd7c3e83f801753155ff7610e85bd4	;.\|>...u1U.v..[.
0x332c	ffff85c074246a0155680f040000ff35	....t$j.Uh.....5
0x333c	b82e4700ff151882400033	..G.....@.3

0x7c62	536574437572736f7200bd014c6f6164	SetCursor...Load
0x7c72	437572736f7257003800436865636b44	CursorW.8.CheckD
0x7c82	6c67427574746f6e00003c014765744d	lgButton..<.GetM
0x7c92	657373616765506f7300b9014c6f6164	essagePos...Load
0x7ca2	4269746d617057001c0043616c6c5769	BitmapW...CallWi
0x7cb2	6e646f7750726f635700b10149735769	ndowProcW...IsWi
0x7cc2	6e646f7756697369626c65004200436c	ndowVisible.B.Cl
0x7cd2	6f7365436c6970626f61726400004a02	oseClipboard..J.
0x7ce2	536574436c6970626f61726444617461	SetClipboardData
0x7cf2	0000c100456d707479436c6970626f61	....EmptyClipboa
0x7d02	72640000f6014f70656e436c6970626f	rd....OpenClipbo
0x7d12	61726400a402547261636b506f707570	ard...TrackPopup
0x7d22	4d656e7500000900417070656e644d65	Menu....AppendMe
0x7d32	6e7557005e00437265617465506f7075	nuW.^.CreatePopu
0x7d42	704d656e75005d014765745379737465	pMenu.].GetSyste
0x7d52	6d4d6574726963730000540253657444	mMetrics..T.SetD
0x7d62	6c674974656d54657874570014014765	lgItemTextW...Ge
0x7d72	74446c674974656d546578745700e301	tDlgItemTextW...
0x7d82	4d657373616765426f78496e64697265	MessageBoxIndire
0x7d92	637457002f0043686172507265765700	ctW./.CharPrevW.
0x7da2	2a00436861724e6578744100d7027773	*.CharNextA...ws
0x7db2	7072696e74664100a200446973706174	printfA...Dispat
0x7dc2	63684d65737361676557000001025065	chMessageW....Pe
0x7dd2	656b4d65737361676557000055534552	ekMessageW..USER
0x7de2	33322e646c6c00000e0253656c656374	32.dll....Select
0x7df2	4f626a65637400003c02536574546578	Object..<.SetTex
0x7e02	74436f6c6f7200001602536574426b4d	tColor....SetBkM
0x7e12	6f6465003d00437265617465466f6e74	ode.=.CreateFont
0x7e22	496e6469726563745700290043726561	IndirectW.).Crea
0x7e32	74654272757368496e64697265637400	teBrushIndirect.
0x7e42	8f0044656c6574654f626a6563740000	..DeleteObject..
0x7e52	6b014765744465766963654361707300	k.GetDeviceCaps.
0x7e62	1502536574426b436f6c6f7200004744	..SetBkColor..GD
0x7e72	4933322e646c6c009b00534846696c65	I32.dll...SHFile
0x7e82	4f7065726174696f6e570000ad005348	OperationW....SH
0x7e92	47657446696c65496e666f5700007a00	GetFileInfoW..z.
0x7ea2	534842726f777365466f72466f6c6465	SHBrowseForFolde
0x7eb2	72570000bd0053484765745061746846	rW....SHGetPathF
0x7ec2	726f6d49444c6973745700000a015368	romIDListW....Sh
0x7ed2	656c6c4578656375746545785700c300	ellExecuteExW...
0x7ee2	53484765745370656369616c466f6c64	SHGetSpecialFold
0x7ef2	65724c6f636174696f6e00005348454c	erLocation..SHEL
0x7f02	4c33322e646c6c00e201526567456e75	L32.dll...RegEnu
0x7f12	6d56616c75655700e001526567456e75	mValueW...RegEnu
0x7f22	6d4b65795700f8015265675175657279	mKeyW...RegQuery
0x7f32	56616c75654578570000050252656753	ValueExW....RegS
0x7f42	657456616c75654578570000cb015265	etValueExW....Re
0x7f52	67436c6f73654b657900d90152656744	gCloseKey...RegD

0x77cc	4578697450726f636573730014035365	ExitProcess...Se
0x77dc	74456e7669726f6e6d656e7456617269	tEnvironmentVari
0x77ec	61626c655700f40147657457696e646f	ableW...GetWindo
0x77fc	77734469726563746f7279570000d601	wsDirectoryW....
0x780c	47657454656d70506174685700001101	GetTempPathW....
0x781c	476574436f6d6d616e644c696e655700	GetCommandLineW.
0x782c	e80147657456657273696f6e00001503	..GetVersion....
0x783c	5365744572726f724d6f64650000cd03	SetErrorMode....
0x784c	6c7374726c656e570000ca036c737472	lstrlenW....lstr
0x785c	6370796e570050014765744469736b46	cpynW.P.GetDiskF
0x786c	726565537061636557000a02476c6f62	reeSpaceW...Glob
0x787c	616c556e6c6f636b00000302476c6f62	alUnlock....Glob
0x788c	616c4c6f636b00006f00437265617465	alLock..o.Create
0x789c	546872656164000071014765744c6173	Thread..q.GetLas
0x78ac	744572726f7200004e00437265617465	tError..N.Create
0x78bc	4469726563746f727957000069004372	DirectoryW..i.Cr
0x78cc	6561746550726f63657373570000c502	eateProcessW....
0x78dc	52656d6f76654469726563746f727957	RemoveDirectoryW
0x78ec	0000c3036c737472636d706941005600	....lstrcmpiA.V.
0x78fc	43726561746546696c655700d4014765	CreateFileW...Ge
0x790c	7454656d7046696c654e616d65570000	tTempFileNameW..
0x791c	a403577269746546696c6500c6036c73	..WriteFile...ls
0x792c	747263707941000070024d6f76654669	trcpyA..p.MoveFi
0x793c	6c6545785700be036c73747263617457	leExW...lstrcatW
0x794c	0000c20147657453797374656d446972	....GetSystemDir
0x795c	6563746f72795700a00147657450726f	ectoryW...GetPro
0x796c	634164647265737300007f014765744d	cAddress....GetM
0x797c	6f64756c6548616e646c654100005a01	oduleHandleA..Z.
0x798c	47657445786974436f646550726f6365	GetExitCodeProce
0x799c	73730000900357616974466f7253696e	ss....WaitForSin
0x79ac	676c654f626a656374004b45524e454c	gleObject.KERNEL
0x79bc	33322e646c6c0000c800456e64506169	32.dll....EndPai
0x79cc	6e740000bf0044726177546578745700	nt....DrawTextW.
0x79dc	e20046696c6c526563740000ff004765	..FillRect....Ge
0x79ec	74436c69656e7452656374000d004265	tClientRect...Be
0x79fc	67696e5061696e7400008f0044656657	ginPaint....DefW
0x7a0c	696e646f7750726f6357000040025365	indowProcW..@.Se
0x7a1c	6e644d657373	ndMess

0x7c62	536574437572736f7200bd014c6f6164	SetCursor...Load
0x7c72	437572736f7257003800436865636b44	CursorW.8.CheckD
0x7c82	6c67427574746f6e00003c014765744d	lgButton..<.GetM
0x7c92	657373616765506f7300b9014c6f6164	essagePos...Load
0x7ca2	4269746d617057001c0043616c6c5769	BitmapW...CallWi
0x7cb2	6e646f7750726f635700b10149735769	ndowProcW...IsWi
0x7cc2	6e646f7756697369626c65004200436c	ndowVisible.B.Cl
0x7cd2	6f7365436c6970626f61726400004a02	oseClipboard..J.
0x7ce2	536574436c6970626f61726444617461	SetClipboardData
0x7cf2	0000c100456d707479436c6970626f61	....EmptyClipboa
0x7d02	72640000f6014f70656e436c6970626f	rd....OpenClipbo
0x7d12	61726400a402547261636b506f707570	ard...TrackPopup
0x7d22	4d656e7500000900417070656e644d65	Menu....AppendMe
0x7d32	6e7557005e00437265617465506f7075	nuW.^.CreatePopu
0x7d42	704d656e75005d014765745379737465	pMenu.].GetSyste
0x7d52	6d4d6574726963730000540253657444	mMetrics..T.SetD
0x7d62	6c674974656d54657874570014014765	lgItemTextW...Ge
0x7d72	74446c674974656d546578745700e301	tDlgItemTextW...
0x7d82	4d657373616765426f78496e64697265	MessageBoxIndire
0x7d92	637457002f0043686172507265765700	ctW./.CharPrevW.
0x7da2	2a00436861724e6578744100d7027773	*.CharNextA...ws
0x7db2	7072696e74664100a200446973706174	printfA...Dispat
0x7dc2	63684d65737361676557000001025065	chMessageW....Pe
0x7dd2	656b4d65737361676557000055534552	ekMessageW..USER
0x7de2	33322e646c6c00000e0253656c656374	32.dll....Select
0x7df2	4f626a65637400003c02536574546578	Object..<.SetTex
0x7e02	74436f6c6f7200001602536574426b4d	tColor....SetBkM
0x7e12	6f6465003d00437265617465466f6e74	ode.=.CreateFont
0x7e22	496e6469726563745700290043726561	IndirectW.).Crea
0x7e32	74654272757368496e64697265637400	teBrushIndirect.
0x7e42	8f0044656c6574654f626a6563740000	..DeleteObject..
0x7e52	6b014765744465766963654361707300	k.GetDeviceCaps.
0x7e62	1502536574426b436f6c6f7200004744	..SetBkColor..GD
0x7e72	4933322e646c6c009b00534846696c65	I32.dll...SHFile
0x7e82	4f7065726174696f6e570000ad005348	OperationW....SH
0x7e92	47657446696c65496e666f5700007a00	GetFileInfoW..z.
0x7ea2	534842726f777365466f72466f6c6465	SHBrowseForFolde
0x7eb2	72570000bd0053484765745061746846	rW....SHGetPathF
0x7ec2	726f6d49444c6973745700000a015368	romIDListW....Sh
0x7ed2	656c6c4578656375746545785700c300	ellExecuteExW...
0x7ee2	53484765745370656369616c466f6c64	SHGetSpecialFold
0x7ef2	65724c6f636174696f6e00005348454c	erLocation..SHEL
0x7f02	4c33322e646c6c00e201526567456e75	L32.dll...RegEnu
0x7f12	6d56616c75655700e001526567456e75	mValueW...RegEnu
0x7f22	6d4b65795700f8015265675175657279	mKeyW...RegQuery
0x7f32	56616c75654578570000050252656753	ValueExW....RegS
0x7f42	657456616c75654578570000cb015265	etValueExW....Re
0x7f52	67436c6f73654b657900d90152656744	gCloseKey...RegD

0x77cc	4578697450726f636573730014035365	ExitProcess...Se
0x77dc	74456e7669726f6e6d656e7456617269	tEnvironmentVari
0x77ec	61626c655700f40147657457696e646f	ableW...GetWindo
0x77fc	77734469726563746f7279570000d601	wsDirectoryW....
0x780c	47657454656d70506174685700001101	GetTempPathW....
0x781c	476574436f6d6d616e644c696e655700	GetCommandLineW.
0x782c	e80147657456657273696f6e00001503	..GetVersion....
0x783c	5365744572726f724d6f64650000cd03	SetErrorMode....
0x784c	6c7374726c656e570000ca036c737472	lstrlenW....lstr
0x785c	6370796e570050014765744469736b46	cpynW.P.GetDiskF
0x786c	726565537061636557000a02476c6f62	reeSpaceW...Glob
0x787c	616c556e6c6f636b00000302476c6f62	alUnlock....Glob
0x788c	616c4c6f636b00006f00437265617465	alLock..o.Create
0x789c	546872656164000071014765744c6173	Thread..q.GetLas
0x78ac	744572726f7200004e00437265617465	tError..N.Create
0x78bc	4469726563746f727957000069004372	DirectoryW..i.Cr
0x78cc	6561746550726f63657373570000c502	eateProcessW....
0x78dc	52656d6f76654469726563746f727957	RemoveDirectoryW
0x78ec	0000c3036c737472636d706941005600	....lstrcmpiA.V.
0x78fc	43726561746546696c655700d4014765	CreateFileW...Ge
0x790c	7454656d7046696c654e616d65570000	tTempFileNameW..
0x791c	a403577269746546696c6500c6036c73	..WriteFile...ls
0x792c	747263707941000070024d6f76654669	trcpyA..p.MoveFi
0x793c	6c6545785700be036c73747263617457	leExW...lstrcatW
0x794c	0000c20147657453797374656d446972	....GetSystemDir
0x795c	6563746f72795700a00147657450726f	ectoryW...GetPro
0x796c	634164647265737300007f014765744d	cAddress....GetM
0x797c	6f64756c6548616e646c654100005a01	oduleHandleA..Z.
0x798c	47657445786974436f646550726f6365	GetExitCodeProce
0x799c	73730000900357616974466f7253696e	ss....WaitForSin
0x79ac	676c654f626a656374004b45524e454c	gleObject.KERNEL
0x79bc	33322e646c6c0000c800456e64506169	32.dll....EndPai
0x79cc	6e740000bf0044726177546578745700	nt....DrawTextW.
0x79dc	e20046696c6c526563740000ff004765	..FillRect....Ge
0x79ec	74436c69656e7452656374000d004265	tClientRect...Be
0x79fc	67696e5061696e7400008f0044656657	ginPaint....DefW
0x7a0c	696e646f7750726f6357000040025365	indowProcW..@.Se
0x7a1c	6e644d657373	ndMess

0x7c62	536574437572736f7200bd014c6f6164	SetCursor...Load
0x7c72	437572736f7257003800436865636b44	CursorW.8.CheckD
0x7c82	6c67427574746f6e00003c014765744d	lgButton..<.GetM
0x7c92	657373616765506f7300b9014c6f6164	essagePos...Load
0x7ca2	4269746d617057001c0043616c6c5769	BitmapW...CallWi
0x7cb2	6e646f7750726f635700b10149735769	ndowProcW...IsWi
0x7cc2	6e646f7756697369626c65004200436c	ndowVisible.B.Cl
0x7cd2	6f7365436c6970626f61726400004a02	oseClipboard..J.
0x7ce2	536574436c6970626f61726444617461	SetClipboardData
0x7cf2	0000c100456d707479436c6970626f61	....EmptyClipboa
0x7d02	72640000f6014f70656e436c6970626f	rd....OpenClipbo
0x7d12	61726400a402547261636b506f707570	ard...TrackPopup
0x7d22	4d656e7500000900417070656e644d65	Menu....AppendMe
0x7d32	6e7557005e00437265617465506f7075	nuW.^.CreatePopu
0x7d42	704d656e75005d014765745379737465	pMenu.].GetSyste
0x7d52	6d4d6574726963730000540253657444	mMetrics..T.SetD
0x7d62	6c674974656d54657874570014014765	lgItemTextW...Ge
0x7d72	74446c674974656d546578745700e301	tDlgItemTextW...
0x7d82	4d657373616765426f78496e64697265	MessageBoxIndire
0x7d92	637457002f0043686172507265765700	ctW./.CharPrevW.
0x7da2	2a00436861724e6578744100d7027773	*.CharNextA...ws
0x7db2	7072696e74664100a200446973706174	printfA...Dispat
0x7dc2	63684d65737361676557000001025065	chMessageW....Pe
0x7dd2	656b4d65737361676557000055534552	ekMessageW..USER
0x7de2	33322e646c6c00000e0253656c656374	32.dll....Select
0x7df2	4f626a65637400003c02536574546578	Object..<.SetTex
0x7e02	74436f6c6f7200001602536574426b4d	tColor....SetBkM
0x7e12	6f6465003d00437265617465466f6e74	ode.=.CreateFont
0x7e22	496e6469726563745700290043726561	IndirectW.).Crea
0x7e32	74654272757368496e64697265637400	teBrushIndirect.
0x7e42	8f0044656c6574654f626a6563740000	..DeleteObject..
0x7e52	6b014765744465766963654361707300	k.GetDeviceCaps.
0x7e62	1502536574426b436f6c6f7200004744	..SetBkColor..GD
0x7e72	4933322e646c6c009b00534846696c65	I32.dll...SHFile
0x7e82	4f7065726174696f6e570000ad005348	OperationW....SH
0x7e92	47657446696c65496e666f5700007a00	GetFileInfoW..z.
0x7ea2	534842726f777365466f72466f6c6465	SHBrowseForFolde
0x7eb2	72570000bd0053484765745061746846	rW....SHGetPathF
0x7ec2	726f6d49444c6973745700000a015368	romIDListW....Sh
0x7ed2	656c6c4578656375746545785700c300	ellExecuteExW...
0x7ee2	53484765745370656369616c466f6c64	SHGetSpecialFold
0x7ef2	65724c6f636174696f6e00005348454c	erLocation..SHEL
0x7f02	4c33322e646c6c00e201526567456e75	L32.dll...RegEnu
0x7f12	6d56616c75655700e001526567456e75	mValueW...RegEnu
0x7f22	6d4b65795700f8015265675175657279	mKeyW...RegQuery
0x7f32	56616c75654578570000050252656753	ValueExW....RegS
0x7f42	657456616c75654578570000cb015265	etValueExW....Re
0x7f52	67436c6f73654b657900d90152656744	gCloseKey...RegD

0x7c62	536574437572736f7200bd014c6f6164	SetCursor...Load
0x7c72	437572736f7257003800436865636b44	CursorW.8.CheckD
0x7c82	6c67427574746f6e00003c014765744d	lgButton..<.GetM
0x7c92	657373616765506f7300b9014c6f6164	essagePos...Load
0x7ca2	4269746d617057001c0043616c6c5769	BitmapW...CallWi
0x7cb2	6e646f7750726f635700b10149735769	ndowProcW...IsWi
0x7cc2	6e646f7756697369626c65004200436c	ndowVisible.B.Cl
0x7cd2	6f7365436c6970626f61726400004a02	oseClipboard..J.
0x7ce2	536574436c6970626f61726444617461	SetClipboardData
0x7cf2	0000c100456d707479436c6970626f61	....EmptyClipboa
0x7d02	72640000f6014f70656e436c6970626f	rd....OpenClipbo
0x7d12	61726400a402547261636b506f707570	ard...TrackPopup
0x7d22	4d656e7500000900417070656e644d65	Menu....AppendMe
0x7d32	6e7557005e00437265617465506f7075	nuW.^.CreatePopu
0x7d42	704d656e75005d014765745379737465	pMenu.].GetSyste
0x7d52	6d4d6574726963730000540253657444	mMetrics..T.SetD
0x7d62	6c674974656d54657874570014014765	lgItemTextW...Ge
0x7d72	74446c674974656d546578745700e301	tDlgItemTextW...
0x7d82	4d657373616765426f78496e64697265	MessageBoxIndire
0x7d92	637457002f0043686172507265765700	ctW./.CharPrevW.
0x7da2	2a00436861724e6578744100d7027773	*.CharNextA...ws
0x7db2	7072696e74664100a200446973706174	printfA...Dispat
0x7dc2	63684d65737361676557000001025065	chMessageW....Pe
0x7dd2	656b4d65737361676557000055534552	ekMessageW..USER
0x7de2	33322e646c6c00000e0253656c656374	32.dll....Select
0x7df2	4f626a65637400003c02536574546578	Object..<.SetTex
0x7e02	74436f6c6f7200001602536574426b4d	tColor....SetBkM
0x7e12	6f6465003d00437265617465466f6e74	ode.=.CreateFont
0x7e22	496e6469726563745700290043726561	IndirectW.).Crea
0x7e32	74654272757368496e64697265637400	teBrushIndirect.
0x7e42	8f0044656c6574654f626a6563740000	..DeleteObject..
0x7e52	6b014765744465766963654361707300	k.GetDeviceCaps.
0x7e62	1502536574426b436f6c6f7200004744	..SetBkColor..GD
0x7e72	4933322e646c6c009b00534846696c65	I32.dll...SHFile
0x7e82	4f7065726174696f6e570000ad005348	OperationW....SH
0x7e92	47657446696c65496e666f5700007a00	GetFileInfoW..z.
0x7ea2	534842726f777365466f72466f6c6465	SHBrowseForFolde
0x7eb2	72570000bd0053484765745061746846	rW....SHGetPathF
0x7ec2	726f6d49444c6973745700000a015368	romIDListW....Sh
0x7ed2	656c6c4578656375746545785700c300	ellExecuteExW...
0x7ee2	53484765745370656369616c466f6c64	SHGetSpecialFold
0x7ef2	65724c6f636174696f6e00005348454c	erLocation..SHEL
0x7f02	4c33322e646c6c00e201526567456e75	L32.dll...RegEnu
0x7f12	6d56616c75655700e001526567456e75	mValueW...RegEnu
0x7f22	6d4b65795700f8015265675175657279	mKeyW...RegQuery
0x7f32	56616c75654578570000050252656753	ValueExW....RegS
0x7f42	657456616c75654578570000cb015265	etValueExW....Re
0x7f52	67436c6f73654b657900d90152656744	gCloseKey...RegD

0x7c62	536574437572736f7200bd014c6f6164	SetCursor...Load
0x7c72	437572736f7257003800436865636b44	CursorW.8.CheckD
0x7c82	6c67427574746f6e00003c014765744d	lgButton..<.GetM
0x7c92	657373616765506f7300b9014c6f6164	essagePos...Load
0x7ca2	4269746d617057001c0043616c6c5769	BitmapW...CallWi
0x7cb2	6e646f7750726f635700b10149735769	ndowProcW...IsWi
0x7cc2	6e646f7756697369626c65004200436c	ndowVisible.B.Cl
0x7cd2	6f7365436c6970626f61726400004a02	oseClipboard..J.
0x7ce2	536574436c6970626f61726444617461	SetClipboardData
0x7cf2	0000c100456d707479436c6970626f61	....EmptyClipboa
0x7d02	72640000f6014f70656e436c6970626f	rd....OpenClipbo
0x7d12	61726400a402547261636b506f707570	ard...TrackPopup
0x7d22	4d656e7500000900417070656e644d65	Menu....AppendMe
0x7d32	6e7557005e00437265617465506f7075	nuW.^.CreatePopu
0x7d42	704d656e75005d014765745379737465	pMenu.].GetSyste
0x7d52	6d4d6574726963730000540253657444	mMetrics..T.SetD
0x7d62	6c674974656d54657874570014014765	lgItemTextW...Ge
0x7d72	74446c674974656d546578745700e301	tDlgItemTextW...
0x7d82	4d657373616765426f78496e64697265	MessageBoxIndire
0x7d92	637457002f0043686172507265765700	ctW./.CharPrevW.
0x7da2	2a00436861724e6578744100d7027773	*.CharNextA...ws
0x7db2	7072696e74664100a200446973706174	printfA...Dispat
0x7dc2	63684d65737361676557000001025065	chMessageW....Pe
0x7dd2	656b4d65737361676557000055534552	ekMessageW..USER
0x7de2	33322e646c6c00000e0253656c656374	32.dll....Select
0x7df2	4f626a65637400003c02536574546578	Object..<.SetTex
0x7e02	74436f6c6f7200001602536574426b4d	tColor....SetBkM
0x7e12	6f6465003d00437265617465466f6e74	ode.=.CreateFont
0x7e22	496e6469726563745700290043726561	IndirectW.).Crea
0x7e32	74654272757368496e64697265637400	teBrushIndirect.
0x7e42	8f0044656c6574654f626a6563740000	..DeleteObject..
0x7e52	6b014765744465766963654361707300	k.GetDeviceCaps.
0x7e62	1502536574426b436f6c6f7200004744	..SetBkColor..GD
0x7e72	4933322e646c6c009b00534846696c65	I32.dll...SHFile
0x7e82	4f7065726174696f6e570000ad005348	OperationW....SH
0x7e92	47657446696c65496e666f5700007a00	GetFileInfoW..z.
0x7ea2	534842726f777365466f72466f6c6465	SHBrowseForFolde
0x7eb2	72570000bd0053484765745061746846	rW....SHGetPathF
0x7ec2	726f6d49444c6973745700000a015368	romIDListW....Sh
0x7ed2	656c6c4578656375746545785700c300	ellExecuteExW...
0x7ee2	53484765745370656369616c466f6c64	SHGetSpecialFold
0x7ef2	65724c6f636174696f6e00005348454c	erLocation..SHEL
0x7f02	4c33322e646c6c00e201526567456e75	L32.dll...RegEnu
0x7f12	6d56616c75655700e001526567456e75	mValueW...RegEnu
0x7f22	6d4b65795700f8015265675175657279	mKeyW...RegQuery
0x7f32	56616c75654578570000050252656753	ValueExW....RegS
0x7f42	657456616c75654578570000cb015265	etValueExW....Re
0x7f52	67436c6f73654b657900d90152656744	gCloseKey...RegD

0x7c62	536574437572736f7200bd014c6f6164	SetCursor...Load
0x7c72	437572736f7257003800436865636b44	CursorW.8.CheckD
0x7c82	6c67427574746f6e00003c014765744d	lgButton..<.GetM
0x7c92	657373616765506f7300b9014c6f6164	essagePos...Load
0x7ca2	4269746d617057001c0043616c6c5769	BitmapW...CallWi
0x7cb2	6e646f7750726f635700b10149735769	ndowProcW...IsWi
0x7cc2	6e646f7756697369626c65004200436c	ndowVisible.B.Cl
0x7cd2	6f7365436c6970626f61726400004a02	oseClipboard..J.
0x7ce2	536574436c6970626f61726444617461	SetClipboardData
0x7cf2	0000c100456d707479436c6970626f61	....EmptyClipboa
0x7d02	72640000f6014f70656e436c6970626f	rd....OpenClipbo
0x7d12	61726400a402547261636b506f707570	ard...TrackPopup
0x7d22	4d656e7500000900417070656e644d65	Menu....AppendMe
0x7d32	6e7557005e00437265617465506f7075	nuW.^.CreatePopu
0x7d42	704d656e75005d014765745379737465	pMenu.].GetSyste
0x7d52	6d4d6574726963730000540253657444	mMetrics..T.SetD
0x7d62	6c674974656d54657874570014014765	lgItemTextW...Ge
0x7d72	74446c674974656d546578745700e301	tDlgItemTextW...
0x7d82	4d657373616765426f78496e64697265	MessageBoxIndire
0x7d92	637457002f0043686172507265765700	ctW./.CharPrevW.
0x7da2	2a00436861724e6578744100d7027773	*.CharNextA...ws
0x7db2	7072696e74664100a200446973706174	printfA...Dispat
0x7dc2	63684d65737361676557000001025065	chMessageW....Pe
0x7dd2	656b4d65737361676557000055534552	ekMessageW..USER
0x7de2	33322e646c6c00000e0253656c656374	32.dll....Select
0x7df2	4f626a65637400003c02536574546578	Object..<.SetTex
0x7e02	74436f6c6f7200001602536574426b4d	tColor....SetBkM
0x7e12	6f6465003d00437265617465466f6e74	ode.=.CreateFont
0x7e22	496e6469726563745700290043726561	IndirectW.).Crea
0x7e32	74654272757368496e64697265637400	teBrushIndirect.
0x7e42	8f0044656c6574654f626a6563740000	..DeleteObject..
0x7e52	6b014765744465766963654361707300	k.GetDeviceCaps.
0x7e62	1502536574426b436f6c6f7200004744	..SetBkColor..GD
0x7e72	4933322e646c6c009b00534846696c65	I32.dll...SHFile
0x7e82	4f7065726174696f6e570000ad005348	OperationW....SH
0x7e92	47657446696c65496e666f5700007a00	GetFileInfoW..z.
0x7ea2	534842726f777365466f72466f6c6465	SHBrowseForFolde
0x7eb2	72570000bd0053484765745061746846	rW....SHGetPathF
0x7ec2	726f6d49444c6973745700000a015368	romIDListW....Sh
0x7ed2	656c6c4578656375746545785700c300	ellExecuteExW...
0x7ee2	53484765745370656369616c466f6c64	SHGetSpecialFold
0x7ef2	65724c6f636174696f6e00005348454c	erLocation..SHEL
0x7f02	4c33322e646c6c00e201526567456e75	L32.dll...RegEnu
0x7f12	6d56616c75655700e001526567456e75	mValueW...RegEnu
0x7f22	6d4b65795700f8015265675175657279	mKeyW...RegQuery
0x7f32	56616c75654578570000050252656753	ValueExW....RegS
0x7f42	657456616c75654578570000cb015265	etValueExW....Re
0x7f52	67436c6f73654b657900d90152656744	gCloseKey...RegD

0x25361	67756167653d222a22202f3e3c2f6465	guage="*" /></de
0x25371	70656e64656e74417373656d626c793e	pendentAssembly>
0x25381	3c2f646570656e64656e63793e3c7472	</dependency><tr
0x25391	757374496e666f20786d6c6e733d2275	ustInfo xmlns="u
0x253a1	726e3a736368656d61732d6d6963726f	rn:schemas-micro
0x253b1	736f66742d636f6d3a61736d2e763322	soft-com:asm.v3"
0x253c1	3e3c73656375726974793e3c72657175	><security><requ
0x253d1	657374656450726976696c656765733e	estedPrivileges>
0x253e1	3c726571756573746564457865637574	<requestedExecut
0x253f1	696f6e4c6576656c206c6576656c3d22	ionLevel level="
0x25401	7265717569726541646d696e69737472	requireAdministr
0x25411	61746f72222075694163636573733d22	ator" uiAccess="
0x25421	66616c7365222f3e3c2f726571756573	false"/></reques
0x25431	74656450726976696c656765733e3c2f	tedPrivileges></
0x25441	73656375726974793e3c2f7472757374	security></trust
0x25451	496e666f3e3c636f6d7061746962696c	Info><compatibil
0x25461	69747920786d6c6e733d2275726e3a73	ity xmlns="urn:s
0x25471	6368656d61732d6d6963726f736f6674	chemas-microsoft
0x25481	2d636f6d3a636f6d7061746962696c69	-com:compatibili
0x25491	74792e7631223e3c6170706c69636174	ty.v1"><applicat
0x254a1	696f6e3e3c737570706f727465644f53	ion><supportedOS
0x254b1	2049643d227b38653066376131322d62	Id="{8e0f7a12-b
0x254c1	6662332d346665382d623961352d3438	fb3-4fe8-b9a5-48
0x254d1	666435306131356139617d222f3e3c73	fd50a15a9a}"/><s
0x254e1	7570706f727465644f532049643d227b	upportedOS Id="{
0x254f1	31663637366337362d383065312d3432	1f676c76-80e1-42
0x25501	33392d393562622d3833643066366430	39-95bb-83d0f6d0
0x25511	64613738	da78

0x83f0	720020006c00610075006e0063006800	r. .l.a.u.n.c.h.
0x8400	69006e006700200069006e0073007400	i.n.g. .i.n.s.t.
0x8410	61006c006c006500720000002e002e00	a.l.l.e.r.......
0x8420	2e002000250064002500250000000000	.. .%.d.%.%.....
0x8430	53006500530068007500740064006f00	S.e.S.h.u.t.d.o.
0x8440	77006e00500072006900760069006c00	w.n.P.r.i.v.i.l.
0x8450	65006700650000004100000000000000	e.g.e...A.......
0x8460	2e0074006d0070000000000041000000	..t.m.p.....A...
0x8470	7e006e00730075000000000020005f00	~.n.s.u..... ._.
0x8480	3f003d000000000054004d0050000000	?.=.....T.M.P...
0x8490	540045004d005000000000004c006f00	T.E.M.P.....L.o.
0x84a0	770000005c00540065006d0070000000	w...\.T.e.m.p...
0x84b0	20002f0044003d00000000004e004300	./.D.=.....N.C.
0x84c0	52004300000000004e00530049005300	R.C.....N.S.I.S.
0x84d0	20004500720072006f00720000000000	.E.r.r.o.r.....
0x84e0	4500720072006f007200200077007200	E.r.r.o.r. .w.r.
0x84f0	6900740069006e006700200074006500	i.t.i.n.g. .t.e.
0x8500	6d0070006f0072006100720079002000	m.p.o.r.a.r.y. .
0x8510	6600	f.

0x7c62	536574437572736f7200bd014c6f6164	SetCursor...Load
0x7c72	437572736f7257003800436865636b44	CursorW.8.CheckD
0x7c82	6c67427574746f6e00003c014765744d	lgButton..<.GetM
0x7c92	657373616765506f7300b9014c6f6164	essagePos...Load
0x7ca2	4269746d617057001c0043616c6c5769	BitmapW...CallWi
0x7cb2	6e646f7750726f635700b10149735769	ndowProcW...IsWi
0x7cc2	6e646f7756697369626c65004200436c	ndowVisible.B.Cl
0x7cd2	6f7365436c6970626f61726400004a02	oseClipboard..J.
0x7ce2	536574436c6970626f61726444617461	SetClipboardData
0x7cf2	0000c100456d707479436c6970626f61	....EmptyClipboa
0x7d02	72640000f6014f70656e436c6970626f	rd....OpenClipbo
0x7d12	61726400a402547261636b506f707570	ard...TrackPopup
0x7d22	4d656e7500000900417070656e644d65	Menu....AppendMe
0x7d32	6e7557005e00437265617465506f7075	nuW.^.CreatePopu
0x7d42	704d656e75005d014765745379737465	pMenu.].GetSyste
0x7d52	6d4d6574726963730000540253657444	mMetrics..T.SetD
0x7d62	6c674974656d54657874570014014765	lgItemTextW...Ge
0x7d72	74446c674974656d546578745700e301	tDlgItemTextW...
0x7d82	4d657373616765426f78496e64697265	MessageBoxIndire
0x7d92	637457002f0043686172507265765700	ctW./.CharPrevW.
0x7da2	2a00436861724e6578744100d7027773	*.CharNextA...ws
0x7db2	7072696e74664100a200446973706174	printfA...Dispat
0x7dc2	63684d65737361676557000001025065	chMessageW....Pe
0x7dd2	656b4d65737361676557000055534552	ekMessageW..USER
0x7de2	33322e646c6c00000e0253656c656374	32.dll....Select
0x7df2	4f626a65637400003c02536574546578	Object..<.SetTex
0x7e02	74436f6c6f7200001602536574426b4d	tColor....SetBkM
0x7e12	6f6465003d00437265617465466f6e74	ode.=.CreateFont
0x7e22	496e6469726563745700290043726561	IndirectW.).Crea
0x7e32	74654272757368496e64697265637400	teBrushIndirect.
0x7e42	8f0044656c6574654f626a6563740000	..DeleteObject..
0x7e52	6b014765744465766963654361707300	k.GetDeviceCaps.
0x7e62	1502536574426b436f6c6f7200004744	..SetBkColor..GD
0x7e72	4933322e646c6c009b00534846696c65	I32.dll...SHFile
0x7e82	4f7065726174696f6e570000ad005348	OperationW....SH
0x7e92	47657446696c65496e666f5700007a00	GetFileInfoW..z.
0x7ea2	534842726f777365466f72466f6c6465	SHBrowseForFolde
0x7eb2	72570000bd0053484765745061746846	rW....SHGetPathF
0x7ec2	726f6d49444c6973745700000a015368	romIDListW....Sh
0x7ed2	656c6c4578656375746545785700c300	ellExecuteExW...
0x7ee2	53484765745370656369616c466f6c64	SHGetSpecialFold
0x7ef2	65724c6f636174696f6e00005348454c	erLocation..SHEL
0x7f02	4c33322e646c6c00e201526567456e75	L32.dll...RegEnu
0x7f12	6d56616c75655700e001526567456e75	mValueW...RegEnu
0x7f22	6d4b65795700f8015265675175657279	mKeyW...RegQuery
0x7f32	56616c75654578570000050252656753	ValueExW....RegS
0x7f42	657456616c75654578570000cb015265	etValueExW....Re
0x7f52	67436c6f73654b657900d90152656744	gCloseKey...RegD

0x7c62	536574437572736f7200bd014c6f6164	SetCursor...Load
0x7c72	437572736f7257003800436865636b44	CursorW.8.CheckD
0x7c82	6c67427574746f6e00003c014765744d	lgButton..<.GetM
0x7c92	657373616765506f7300b9014c6f6164	essagePos...Load
0x7ca2	4269746d617057001c0043616c6c5769	BitmapW...CallWi
0x7cb2	6e646f7750726f635700b10149735769	ndowProcW...IsWi
0x7cc2	6e646f7756697369626c65004200436c	ndowVisible.B.Cl
0x7cd2	6f7365436c6970626f61726400004a02	oseClipboard..J.
0x7ce2	536574436c6970626f61726444617461	SetClipboardData
0x7cf2	0000c100456d707479436c6970626f61	....EmptyClipboa
0x7d02	72640000f6014f70656e436c6970626f	rd....OpenClipbo
0x7d12	61726400a402547261636b506f707570	ard...TrackPopup
0x7d22	4d656e7500000900417070656e644d65	Menu....AppendMe
0x7d32	6e7557005e00437265617465506f7075	nuW.^.CreatePopu
0x7d42	704d656e75005d014765745379737465	pMenu.].GetSyste
0x7d52	6d4d6574726963730000540253657444	mMetrics..T.SetD
0x7d62	6c674974656d54657874570014014765	lgItemTextW...Ge
0x7d72	74446c674974656d546578745700e301	tDlgItemTextW...
0x7d82	4d657373616765426f78496e64697265	MessageBoxIndire
0x7d92	637457002f0043686172507265765700	ctW./.CharPrevW.
0x7da2	2a00436861724e6578744100d7027773	*.CharNextA...ws
0x7db2	7072696e74664100a200446973706174	printfA...Dispat
0x7dc2	63684d65737361676557000001025065	chMessageW....Pe
0x7dd2	656b4d65737361676557000055534552	ekMessageW..USER
0x7de2	33322e646c6c00000e0253656c656374	32.dll....Select
0x7df2	4f626a65637400003c02536574546578	Object..<.SetTex
0x7e02	74436f6c6f7200001602536574426b4d	tColor....SetBkM
0x7e12	6f6465003d00437265617465466f6e74	ode.=.CreateFont
0x7e22	496e6469726563745700290043726561	IndirectW.).Crea
0x7e32	74654272757368496e64697265637400	teBrushIndirect.
0x7e42	8f0044656c6574654f626a6563740000	..DeleteObject..
0x7e52	6b014765744465766963654361707300	k.GetDeviceCaps.
0x7e62	1502536574426b436f6c6f7200004744	..SetBkColor..GD
0x7e72	4933322e646c6c009b00534846696c65	I32.dll...SHFile
0x7e82	4f7065726174696f6e570000ad005348	OperationW....SH
0x7e92	47657446696c65496e666f5700007a00	GetFileInfoW..z.
0x7ea2	534842726f777365466f72466f6c6465	SHBrowseForFolde
0x7eb2	72570000bd0053484765745061746846	rW....SHGetPathF
0x7ec2	726f6d49444c6973745700000a015368	romIDListW....Sh
0x7ed2	656c6c4578656375746545785700c300	ellExecuteExW...
0x7ee2	53484765745370656369616c466f6c64	SHGetSpecialFold
0x7ef2	65724c6f636174696f6e00005348454c	erLocation..SHEL
0x7f02	4c33322e646c6c00e201526567456e75	L32.dll...RegEnu
0x7f12	6d56616c75655700e001526567456e75	mValueW...RegEnu
0x7f22	6d4b65795700f8015265675175657279	mKeyW...RegQuery
0x7f32	56616c75654578570000050252656753	ValueExW....RegS
0x7f42	657456616c75654578570000cb015265	etValueExW....Re
0x7f52	67436c6f73654b657900d90152656744	gCloseKey...RegD

0x7c62	536574437572736f7200bd014c6f6164	SetCursor...Load
0x7c72	437572736f7257003800436865636b44	CursorW.8.CheckD
0x7c82	6c67427574746f6e00003c014765744d	lgButton..<.GetM
0x7c92	657373616765506f7300b9014c6f6164	essagePos...Load
0x7ca2	4269746d617057001c0043616c6c5769	BitmapW...CallWi
0x7cb2	6e646f7750726f635700b10149735769	ndowProcW...IsWi
0x7cc2	6e646f7756697369626c65004200436c	ndowVisible.B.Cl
0x7cd2	6f7365436c6970626f61726400004a02	oseClipboard..J.
0x7ce2	536574436c6970626f61726444617461	SetClipboardData
0x7cf2	0000c100456d707479436c6970626f61	....EmptyClipboa
0x7d02	72640000f6014f70656e436c6970626f	rd....OpenClipbo
0x7d12	61726400a402547261636b506f707570	ard...TrackPopup
0x7d22	4d656e7500000900417070656e644d65	Menu....AppendMe
0x7d32	6e7557005e00437265617465506f7075	nuW.^.CreatePopu
0x7d42	704d656e75005d014765745379737465	pMenu.].GetSyste
0x7d52	6d4d6574726963730000540253657444	mMetrics..T.SetD
0x7d62	6c674974656d54657874570014014765	lgItemTextW...Ge
0x7d72	74446c674974656d546578745700e301	tDlgItemTextW...
0x7d82	4d657373616765426f78496e64697265	MessageBoxIndire
0x7d92	637457002f0043686172507265765700	ctW./.CharPrevW.
0x7da2	2a00436861724e6578744100d7027773	*.CharNextA...ws
0x7db2	7072696e74664100a200446973706174	printfA...Dispat
0x7dc2	63684d65737361676557000001025065	chMessageW....Pe
0x7dd2	656b4d65737361676557000055534552	ekMessageW..USER
0x7de2	33322e646c6c00000e0253656c656374	32.dll....Select
0x7df2	4f626a65637400003c02536574546578	Object..<.SetTex
0x7e02	74436f6c6f7200001602536574426b4d	tColor....SetBkM
0x7e12	6f6465003d00437265617465466f6e74	ode.=.CreateFont
0x7e22	496e6469726563745700290043726561	IndirectW.).Crea
0x7e32	74654272757368496e64697265637400	teBrushIndirect.
0x7e42	8f0044656c6574654f626a6563740000	..DeleteObject..
0x7e52	6b014765744465766963654361707300	k.GetDeviceCaps.
0x7e62	1502536574426b436f6c6f7200004744	..SetBkColor..GD
0x7e72	4933322e646c6c009b00534846696c65	I32.dll...SHFile
0x7e82	4f7065726174696f6e570000ad005348	OperationW....SH
0x7e92	47657446696c65496e666f5700007a00	GetFileInfoW..z.
0x7ea2	534842726f777365466f72466f6c6465	SHBrowseForFolde
0x7eb2	72570000bd0053484765745061746846	rW....SHGetPathF
0x7ec2	726f6d49444c6973745700000a015368	romIDListW....Sh
0x7ed2	656c6c4578656375746545785700c300	ellExecuteExW...
0x7ee2	53484765745370656369616c466f6c64	SHGetSpecialFold
0x7ef2	65724c6f636174696f6e00005348454c	erLocation..SHEL
0x7f02	4c33322e646c6c00e201526567456e75	L32.dll...RegEnu
0x7f12	6d56616c75655700e001526567456e75	mValueW...RegEnu
0x7f22	6d4b65795700f8015265675175657279	mKeyW...RegQuery
0x7f32	56616c75654578570000050252656753	ValueExW....RegS
0x7f42	657456616c75654578570000cb015265	etValueExW....Re
0x7f52	67436c6f73654b657900d90152656744	gCloseKey...RegD

0x77cc	4578697450726f636573730014035365	ExitProcess...Se
0x77dc	74456e7669726f6e6d656e7456617269	tEnvironmentVari
0x77ec	61626c655700f40147657457696e646f	ableW...GetWindo
0x77fc	77734469726563746f7279570000d601	wsDirectoryW....
0x780c	47657454656d70506174685700001101	GetTempPathW....
0x781c	476574436f6d6d616e644c696e655700	GetCommandLineW.
0x782c	e80147657456657273696f6e00001503	..GetVersion....
0x783c	5365744572726f724d6f64650000cd03	SetErrorMode....
0x784c	6c7374726c656e570000ca036c737472	lstrlenW....lstr
0x785c	6370796e570050014765744469736b46	cpynW.P.GetDiskF
0x786c	726565537061636557000a02476c6f62	reeSpaceW...Glob
0x787c	616c556e6c6f636b00000302476c6f62	alUnlock....Glob
0x788c	616c4c6f636b00006f00437265617465	alLock..o.Create
0x789c	546872656164000071014765744c6173	Thread..q.GetLas
0x78ac	744572726f7200004e00437265617465	tError..N.Create
0x78bc	4469726563746f727957000069004372	DirectoryW..i.Cr
0x78cc	6561746550726f63657373570000c502	eateProcessW....
0x78dc	52656d6f76654469726563746f727957	RemoveDirectoryW
0x78ec	0000c3036c737472636d706941005600	....lstrcmpiA.V.
0x78fc	43726561746546696c655700d4014765	CreateFileW...Ge
0x790c	7454656d7046696c654e616d65570000	tTempFileNameW..
0x791c	a403577269746546696c6500c6036c73	..WriteFile...ls
0x792c	747263707941000070024d6f76654669	trcpyA..p.MoveFi
0x793c	6c6545785700be036c73747263617457	leExW...lstrcatW
0x794c	0000c20147657453797374656d446972	....GetSystemDir
0x795c	6563746f72795700a00147657450726f	ectoryW...GetPro
0x796c	634164647265737300007f014765744d	cAddress....GetM
0x797c	6f64756c6548616e646c654100005a01	oduleHandleA..Z.
0x798c	47657445786974436f646550726f6365	GetExitCodeProce
0x799c	73730000900357616974466f7253696e	ss....WaitForSin
0x79ac	676c654f626a656374004b45524e454c	gleObject.KERNEL
0x79bc	33322e646c6c0000c800456e64506169	32.dll....EndPai
0x79cc	6e740000bf0044726177546578745700	nt....DrawTextW.
0x79dc	e20046696c6c526563740000ff004765	..FillRect....Ge
0x79ec	74436c69656e7452656374000d004265	tClientRect...Be
0x79fc	67696e5061696e7400008f0044656657	ginPaint....DefW
0x7a0c	696e646f7750726f6357000040025365	indowProcW..@.Se
0x7a1c	6e644d657373	ndMess

0x7c62	536574437572736f7200bd014c6f6164	SetCursor...Load
0x7c72	437572736f7257003800436865636b44	CursorW.8.CheckD
0x7c82	6c67427574746f6e00003c014765744d	lgButton..<.GetM
0x7c92	657373616765506f7300b9014c6f6164	essagePos...Load
0x7ca2	4269746d617057001c0043616c6c5769	BitmapW...CallWi
0x7cb2	6e646f7750726f635700b10149735769	ndowProcW...IsWi
0x7cc2	6e646f7756697369626c65004200436c	ndowVisible.B.Cl
0x7cd2	6f7365436c6970626f61726400004a02	oseClipboard..J.
0x7ce2	536574436c6970626f61726444617461	SetClipboardData
0x7cf2	0000c100456d707479436c6970626f61	....EmptyClipboa
0x7d02	72640000f6014f70656e436c6970626f	rd....OpenClipbo
0x7d12	61726400a402547261636b506f707570	ard...TrackPopup
0x7d22	4d656e7500000900417070656e644d65	Menu....AppendMe
0x7d32	6e7557005e00437265617465506f7075	nuW.^.CreatePopu
0x7d42	704d656e75005d014765745379737465	pMenu.].GetSyste
0x7d52	6d4d6574726963730000540253657444	mMetrics..T.SetD
0x7d62	6c674974656d54657874570014014765	lgItemTextW...Ge
0x7d72	74446c674974656d546578745700e301	tDlgItemTextW...
0x7d82	4d657373616765426f78496e64697265	MessageBoxIndire
0x7d92	637457002f0043686172507265765700	ctW./.CharPrevW.
0x7da2	2a00436861724e6578744100d7027773	*.CharNextA...ws
0x7db2	7072696e74664100a200446973706174	printfA...Dispat
0x7dc2	63684d65737361676557000001025065	chMessageW....Pe
0x7dd2	656b4d65737361676557000055534552	ekMessageW..USER
0x7de2	33322e646c6c00000e0253656c656374	32.dll....Select
0x7df2	4f626a65637400003c02536574546578	Object..<.SetTex
0x7e02	74436f6c6f7200001602536574426b4d	tColor....SetBkM
0x7e12	6f6465003d00437265617465466f6e74	ode.=.CreateFont
0x7e22	496e6469726563745700290043726561	IndirectW.).Crea
0x7e32	74654272757368496e64697265637400	teBrushIndirect.
0x7e42	8f0044656c6574654f626a6563740000	..DeleteObject..
0x7e52	6b014765744465766963654361707300	k.GetDeviceCaps.
0x7e62	1502536574426b436f6c6f7200004744	..SetBkColor..GD
0x7e72	4933322e646c6c009b00534846696c65	I32.dll...SHFile
0x7e82	4f7065726174696f6e570000ad005348	OperationW....SH
0x7e92	47657446696c65496e666f5700007a00	GetFileInfoW..z.
0x7ea2	534842726f777365466f72466f6c6465	SHBrowseForFolde
0x7eb2	72570000bd0053484765745061746846	rW....SHGetPathF
0x7ec2	726f6d49444c6973745700000a015368	romIDListW....Sh
0x7ed2	656c6c4578656375746545785700c300	ellExecuteExW...
0x7ee2	53484765745370656369616c466f6c64	SHGetSpecialFold
0x7ef2	65724c6f636174696f6e00005348454c	erLocation..SHEL
0x7f02	4c33322e646c6c00e201526567456e75	L32.dll...RegEnu
0x7f12	6d56616c75655700e001526567456e75	mValueW...RegEnu
0x7f22	6d4b65795700f8015265675175657279	mKeyW...RegQuery
0x7f32	56616c75654578570000050252656753	ValueExW....RegS
0x7f42	657456616c75654578570000cb015265	etValueExW....Re
0x7f52	67436c6f73654b657900d90152656744	gCloseKey...RegD

Metadata

0x7d3ba05	a00302010202105498d2d1d45b199548	.......T....[..H
0x7d3ba15	1379c811c08799300d06092a864886f7	.y.....0...*.H..
0x7d3ba25	0d01010c05003077310b300906035504	......0w1.0...U.
0x7d3ba35	0613025553311e301c060355040a1315	...US1.0...U....
0x7d3ba45	4d6963726f736f667420436f72706f72	Microsoft Corpor
0x7d3ba55	6174696f6e314830460603550403133f	ation1H0F..U...?
0x7d3ba65	4d6963726f736f6674204964656e7469	Microsoft Identi
0x7d3ba75	747920566572696669636174696f6e20	ty Verification
0x7d3ba85	526f6f74204365727469666963617465	Root Certificate
0x7d3ba95	20417574686f72697479203230323030	Authority 20200
0x7d3baa5	1e170d3230303431363138333631365a	...200416183616Z
0x7d3bab5	170d3435303431363138343434305a30	..450416184440Z0
0x7d3bac5	77310b3009060355040613025553311e	w1.0...U....US1.
0x7d3bad5	301c060355	0...U

0x25580	3430323235663933617d222f3e3c2f61	40225f93a}"/></a
0x25590	70706c69636174696f6e3e3c2f636f6d	pplication></com
0x255a0	7061746962696c6974793e3c2f617373	patibility></ass
0x255b0	656d626c793e00000000000000000000	embly>..........
0x255c0	00000000000000000000000000000000	................
0x255d0	00000000000000000000000000000000	................
0x255e0	00000000000000000000000000000000	................
0x255f0	00000000000000000000000000000000	................
0x25600	00000000efbeadde4e756c6c736f6674	........Nullsoft
0x25610	496e7374a06e02006763d10779950080	Inst.n..gc..y...
0x25620	ed7d097c5c55bdff9d240d14da94ad62	.}.\|\U...$.....b
0x25630	cbd269a10bd0864917da06689ba6fb92	..i....I...h....
0x25640	2e295da45027c924992c939099a44d64	.)].P'.$.,....Md
0x25650	293c50caf25814579e8aa24f64110115	)<P..X.W...Od...
0x25660	0405aa501041500b8aa0568a5810f551	...P.AP...V.X..Q
0x25670	16d91effdf76ee39f7de736f2629f0d7	.....v.9..so&)..
0x25680	f7c9e4339399bb9c7bcef79cf33bbffd	...3....{....;..
0x25690	5ce038cec498e314e1ff02c781afcebc	\.8.............
0x256a0	b98ef33938f0d076875ecf54153823e1	...98..v.^.T.8#.
0x256b0	fffa4c81d3dbeb3dcbeb2428f47fe0ff	..L....=..$(....
0x256c0	dd317dfe87f0fdfa98fd7ae7fff3eba7	.1}.......z.....
0x256d0	461d549dde7ec0711ae03722f079785f	F.T..~.q..7".yx_
0x256e0	0befebe15d0cefacc0f223b8ee1e78ff	....].....#...x.
0x256f0	04dedbe17d3fbcef83f7bdf01e0ee79b	....}?..........
0x25700	e05d08ef9be07d2bbcbf0feffde5fe1f	.]....}+........
0x25710	c33577c1fb4eb91fcbbb1b71f2d56590	.5w..N.....q..e.
0x25720	0fe303e0f70fe0bfed7edb0bebfb9494	.........~......
0x25730	712de07f80f1fcefcb7d61f79f7800ff	q-.......}a..x..
0x25740	c731722434a409be6cde1b73065e03af	.1r$4...l..s.^..
0x25750	81d7c06be035f01a780dbc065e03af81	...k.5..x...^...
0x25760	d7c06be035f01a780dbc065e03af81d7	..k.5..x...^....
0x25770	c06be035f01a780dbc065e03af81d7c0	.k.5..x...^.....
0x25780	6be035f01a780dbc065e03af81d7c06b	k.5..x...^.....k
0x25790	e035f01a780dbc065e03af81d7c06be0	.5..x...^.....k.
0x257a0	35f01a780dbc065e03af81d7c06be035	5..x...^.....k.5
0x257b0	f01a780dbc065e03af81d7c06be035f0	..x...^.....k.5.
0x257c0	1a78fdff7f8d82f7c28873ea15b39c1b	.x........s.....
0x257d0	6a39aece2d89287379c4b99511e7aa23	j9..-.(sy......#
0x257e0	cead8d38b721e2dcc688739b22ced544	...8.!....s."..D
0x257f0	9c4b859c1b11d10f2342b054e70a22ce	.K......#B.T..".
0x25800	15469c2b8a383728e4dc9132261a8d36	.F.+.87(...2&..6
0x25810	a9b180f75c1252e861f0be0a2e6992df	....\.R.a....i..
0x25820	2acfc5efe03d54c64bd858da12529789	*....=T.K.X..R..
0x25830	0ee7def892652cf656971b00b6fed4e5	.....e,.V.......
0x25840	abc66ff3beb0bafc4e727b7c1075d9de	..o.....Nr{\|.u..
0x25850	8fba1c29e3fa55789fe12bf383aae71b	...)..Ux..+.....
0x25860	bdd4f31d4b3df1be4343c6fd0755cf82	....K=..CC...U..
0x25870	d8bf4edf0eed475d460a5d6afc10fb76	..N...G]F.]j...v

0x39be0	a3e643fc9d02d1771ac494195426f50c	..C....w....T&..
0x39bf0	d9af5b4a5611f3a965241e2da09e85f8	..[JV...e$.-....
0x39c00	720589468ba8e74824ac85687c3544c7	r..F...H$..h\|5D.
0x39c10	a510793fcfaf05d2248e984abcd6706a	..y?....$..J..pj
0x39c20	2235850b6a971faa7835e9e888d724d4	"5..j...x5....$.
0x39c30	fa86ceeb1517bd9c48712dc54f55a2de	........Hq-.OU..
0x39c40	e7ebfff1d695d7ecea0718ea77fc4d79	............w.My
0x39c50	7cc49fae51b5733fc859e23692c2e7d2	\|...Q.s?.Y.6....
0x39c60	cc58d9dd2e2f68a42867fe7c1fe45df8	.X.../h.(g.\|..].
0x39c70	7ccc6a8135be9e532aa04ec640b22b7b	\|.j.5..S*.N.@.+{
0x39c80	06ca34b102aa4c672bdb026532a8b7c9	..4...Lg+..e2...
0x39c90	aeecdcaf04940f949db36b6b2a135045	..........kk*.PE
0x39ca0	d0b6d0aede547cb606eaedb7abf73c94	.....T\|.......<.
0x39cb0	65403d9f35b6b23d50b61bca76dbd5ab	e@=.5..=P...v...
0x39cc0	c7677e6205ffefb356ff3ff8ac958c8a	.g~b....V.?.....
0x39cd0	8ea663326333d4b11931cf509414ce83	..c2c3...1.P....
0x39ce0	e01c4e67e179b053ce9255c55aeab053	..Ng.y.S..U.Z..S
0x39cf0	c99a92a5392bf3a97f081695ac5c5354	....9+.......\ST
0x39d00	bc7ca5369fa2ae0916ad595ab27ce98a	.\|.6......YZ.\|..
0x39d10	228aca76ca2fcecb033173c2e77a562d	"..v./...1s..zV-
0x39d20	a5a85627b8b854534c51d749bd95a4e2	..V'..TSLQ.I....
0x39d30	552c5db9b4682dc5508b16ad5996a75d	U,]..h-.P...Y..]
0x39d40	91b37c654ef1b2128adae0b4bc64cdb2	..\|eN........d..
0x39d50	e29c220d45c99d16ad29292a5cae2dca	..".E....))*\.-.
0x39d60	d16a2881009fef2a5a9e4bcd705a0abd	.j(....*Z.K.pZ..
0x39d70	3f4bfdc5a93867652ec8995309c93439	?K...8ge...S..49
0x39d80	6997af00f87fa1162dc95b06f8698af3	i.......-.[..i..
0x39d90	7272f34a296a1df6ba74a5b6b890a2de	rr.J)j...t......
0x39da0	47fc79f41f4608795ae82da7308fda28	G.y..F.yZ.-.0..(
0x39db0	58b4a264f9f3d04305d62f29ca590af9	X..d...C../).Y..
0x39dc0	a4e4b419f35326e71642dbe484c4f458	.....S&..B.....X
0x39dd0	f52c72f20535a3786d91565dbc4a9bb7	.,r..5.xm.V].J..
0x39de0	541b97a3cda1a8b35c592af46f573a63	T.......\Y*.oW:c
0x39df0	7ea63a850e22adc285897939abf36614	~.:.."....y9..f.
0x39e00	2fd72e07a0c979e45e29a00fa55aa9cd	/.....y.^)...Z..
0x39e10	2b7ea0fcf74e33f3b429cb973e3b6395	+~...N3..)..>;c.
0x39e20	6ea596a23e142517e6e5155197446979	n...>.%....Q.Diy
0x39e30	c5c979da19ab56e62ec7aa493925cf52	..y...V....I9%.R

0x11be40f	73bde1b630d3ca2b0dab869755688edf	s...0..+....Uh..
0x11be41f	50984a4419402b59faf00a713725461a	P.JD.@+Y...q7%F.
0x11be42f	64617269d893620694a3ec34c8f46587	dari..b....4..e.
0x11be43f	be692ff46fa8bb4c7d10be21171382b9	.i/.o..L}..!....
0x11be44f	4efd05edeae35e14c9262a36f6b3cbc9	N.....^..&*6....
0x11be45f	75c843f4f0cb856a9070d33cd03dc2e3	u.C....j.p.<.=..
0x11be46f	ee36e442	.6.B

0x2666709	f10a37a459e377fe0eb2981862a187f3	..7.Y.w.....b...
0x2666719	0b9d3da76ef3d0cab984eb96abf6917c	..=.n..........\|
0x2666729	38713c15882df8ad62abd064fb62af41	8q<..-..b..d.b.A
0x2666739	274f3a5cadc24689a2e2d5cb83f29843	'O:\..F........C
0x2666749	7ad7d9915fc49d04f3ccfca078d1415e	z..._.......x.A^
0x2666759	14f83cdc51ee9db51858efebc79757d8	..<.Q....X....W.
0x2666769	76aa2ec13b8ce9f60323b9d78f8d534d	v...;....#....SM
0x2666779	f20b5ea4f042723c3e88c05e78b2a62d	..^..Br<>..^x..-
0x2666789	9c3a0018a608cc25d89829acadc56155	.:.....%..)...aU
0x2666799	7a97ac3cc13cecadd52a6361d88fa508	z..<.<...*ca....
0x26667a9	333f8b87576e5913bdaff41b875a936b	3?..WnY......Z.k
0x26667b9	2f6f6194f332271b5c98f77864cc5857	/oa..2'.\..xd.XW
0x26667c9	e108775298b8273e49ec636f49	..wR..'>I.coI

0x27c435f	18451d6a821edd15e136aafd9b55c92c	.E.j.....6...U.,
0x27c436f	c36ff6512e2a4775db86a19b7f2f7c42	.o.Q.*Gu...../\|B
0x27c437f	4214aa6c09389cadb7bb9526a038a2db	B..l.8.....&.8..
0x27c438f	acebcd8aca4ae0d13fc9e7e742045ffd	.....J..?...B._.
0x27c439f	64614e73dbf055998146039dd35a9c45	daNs..U..F...Z.E
0x27c43af	b39604e32cf73bba54c9bb873e16f580	....,.;.T...>...
0x27c43bf	71173075058370bff8ea8c2e4898f744	q.0u..p.....H..D
0x27c43cf	3aaf2ec2a66ad249333a7e8cc98932b1	:....j.I3:~...2.
0x27c43df	52cc74c871edcd0bf4a4fc8704535aa9	R.t.q........SZ.
0x27c43ef	eb0d3b2dd6c96090427e086b687abc7f	..;-..`.B~.khz..
0x27c43ff	eb9682369dd5612a7ed16e9c8dd51327	...6..a*~.n....'
0x27c440f	90c1ec888137f1fd39d40aeb659634af	.....7..9...e.4.
0x27c441f	d2ff06b9	....

0x24f0e	20002842000002008080000001002000	.(B.......... .
0x24f1e	2808010001000000000001002000a31d	(........... ...
0x24f2e	000004000000000000004c0234000000	..........L.4...
0x24f3e	560053005f0056004500520053004900	V.S._.V.E.R.S.I.
0x24f4e	4f004e005f0049004e0046004f000000	O.N._.I.N.F.O...
0x24f5e	0000bd04effe0000000001001f000000	................
0x24f6e	050001001f0000000500000000000000	................
0x24f7e	00000400000001000000000000000000	................
0x24f8e	000000000000aa010000000053007400	............S.t.
0x24f9e	720069006e006700460069006c006500	r.i.n.g.F.i.l.e.
0x24fae	49006e0066006f000000860100000000	I.n.f.o.........
0x24fbe	30003400300039003000340065003400	0.4.0.9.0.4.e.4.
0x24fce	00002e000700010043006f006d007000	........C.o.m.p.
0x24fde	61006e0079004e0061006d0065000000	a.n.y.N.a.m.e...
0x24fee	00004a00470072006100700068000000	..J.G.r.a.p.h...
0x24ffe	0000480010000100460069006c006500	..H.....F.i.l.e.
0x2500e	44006500730063007200690070007400	D.e.s.c.r.i.p.t.
0x2501e	69006f006e0000000000640072006100	i.o.n.....d.r.a.
0x2502e	77002e0069006f002000640065007300	w...i.o. .d.e.s.
0x2503e	6b0074006f00700000002e0007000100	k.t.o.p.........
0x2504e	460069006c0065005600650072007300	F.i.l.e.V.e.r.s.
0x2505e	69006f006e0000000000330031002e00	i.o.n.....3.1...
0x2506e	31002e00350000000000640020000100	1...5.....d. ...
0x2507e	4c006500670061006c0043006f007000	L.e.g.a.l.C.o.p.
0x2508e	79007200690067006800740000004300	y.r.i.g.h.t...C.
0x2509e	6f007000790072006900670068007400	o.p.y.r.i.g.h.t.
0x250ae	200032003000310037002d0032003000	.2.0.1.7.-.2.0.
0x250be	32003600200064007200610077002e00	2.6. .d.r.a.w...
0x250ce	69006f0020004c007400640000003000	i.o. .L.t.d...0.
0x250de	08000100500072006f00640075006300	....P.r.o.d.u.c.
0x250ee	74004e0061006d006500000000006400	t.N.a.m.e.....d.
0x250fe	7200610077002e0069006f0000003200	r.a.w...i.o...2.
0x2510e	07000100500072006f00640075006300	....P.r.o.d.u.c.
0x2511e	7400560065007200730069006f006e00	t.V.e.r.s.i.o.n.
0x2512e	0000330031002e0031002e0035000000	..3.1...1...5...
0x2513e	00004400000000005600610072004600	..D.....V.a.r.F.
0x2514e	69006c00650049006e0066006f000000	i.l.e.I.n.f.o...
0x2515e	00002400040000005400720061006e00	..$.....T.r.a.n.
0x2516e	73006c006100740069006f006e000000	s.l.a.t.i.o.n...
0x2517e	00000904e404000000003c3f786d6c20	..........<?xml
0x2518e	76657273696f6e3d22312e302220656e	version="1.0" en
0x2519e	636f64696e673d225554462d38222073	coding="UTF-8" s
0x251ae	74616e64616c6f6e653d22796573223f	tandalone="yes"?
0x251be	3e3c617373656d626c7920786d6c6e73	><assembly xmlns
0x251ce	3d2275726e3a736368656d61732d6d69	="urn:schemas-mi
0x251de	63726f736f66742d636f6d3a61736d2e	crosoft-com:asm.
0x251ee	763122206d616e696665737456657273	v1" manifestVers
0x251fe	696f6e3d22312e30223e3c617373656d	ion="1.0"><assem

0x83f0	720020006c00610075006e0063006800	r. .l.a.u.n.c.h.
0x8400	69006e006700200069006e0073007400	i.n.g. .i.n.s.t.
0x8410	61006c006c006500720000002e002e00	a.l.l.e.r.......
0x8420	2e002000250064002500250000000000	.. .%.d.%.%.....
0x8430	53006500530068007500740064006f00	S.e.S.h.u.t.d.o.
0x8440	77006e00500072006900760069006c00	w.n.P.r.i.v.i.l.
0x8450	65006700650000004100000000000000	e.g.e...A.......
0x8460	2e0074006d0070000000000041000000	..t.m.p.....A...
0x8470	7e006e00730075000000000020005f00	~.n.s.u..... ._.
0x8480	3f003d000000000054004d0050000000	?.=.....T.M.P...
0x8490	540045004d005000000000004c006f00	T.E.M.P.....L.o.
0x84a0	770000005c00540065006d0070000000	w...\.T.e.m.p...
0x84b0	20002f0044003d00000000004e004300	./.D.=.....N.C.
0x84c0	52004300000000004e00530049005300	R.C.....N.S.I.S.
0x84d0	20004500720072006f00720000000000	.E.r.r.o.r.....
0x84e0	4500720072006f007200200077007200	E.r.r.o.r. .w.r.
0x84f0	6900740069006e006700200074006500	i.t.i.n.g. .t.e.
0x8500	6d0070006f0072006100720079002000	m.p.o.r.a.r.y. .
0x8510	6600	f.

build PE manifest requests admin

strings-truncated String extraction truncated due to limits (count: 100000, total bytes: 50 MB)

file

20 of 27 traits shown

Identity

SHA-256	bccdfd5331e92a4526ff4e7ee0b03cd9c5cd63be3752947ffc4f50962dfb747e
Filename	jgraph-drawio-desktop-v31.1.5-draw.io-ia32-31.1.5-windows-32bit-installer.exe
Package	jgraph/drawio-desktop

Origin

Source	harvest
Feed	github.com
Ecosystem	github
Domain	github.com

Timeline

First seen	5 Aug 2026 17:30 UTC
First analyzed	10 Aug 2026 09:47 UTC
Last analyzed	10 Aug 2026 09:47 UTC
Last updated	10 Aug 2026 09:47 UTC

Labeling

Label	unknown
Label source	harvest
Traits version	73866

Not seeing what you expected? Let us know

0x237c	007e000005000200003bf07c028bf857	.~.......;.\|...W
0x238c	53e89f03000085c00f8422010000833d	S........."....=
0x239c	f8ae470000757a6a1c8d45d85350e8bc	..G..uzj..E.SP..
0x23ac	2d00008b45d8a9f0ffffff7572817ddc	-...E......ur.}.
0x23bc	efbeadde7569817de8496e7374756081	....ui.}.Instu`.
0x23cc	7de4736f66747557817de04e756c6c75	}.softuW.}.Nullu
0x23dc	4e0945088b45088b0df881420083e002	N.E..E.....B....
0x23ec	0905a0af47008b45f03bc6890df8ae47	....G..E.;.....G
0x23fc	000f8fb2000000f64508087506f64508	........E..u..E.
0x240c	047541ff45fc8d70fc3bfe76128bfeeb	.uA.E..p.;.v....
0x241c	0ef645080275086a00e84ffeffff593b	..E..u.j..O...Y;
0x242c	35044243007d0d5753ff75f8e84a3700	5.BC.}.WS.u..J7.
0x243c	008945f8013df88142002bf785f60f8f	..E..=..B.+.....
0x244c	20