f2bc804a84dfb3717534856402c6d6959d33d62dfdf7ca990e210f093da1318f

HOSTILE

f2bc804a84dfb3717534856402c6d6959d33d62dfdf7ca990e210f093da1318f · 92%

AI Masquerading dropper with evasion techniques

Mal-ecule

O₂(CEr)H₈(CmCr₂Db₄F₂Mg₂Os₆Po₆U)Md₃(Bi₅PaSi₃)

Size 4.9 MB download

First seen 2 days ago

Analyzed 1 day ago

Ecosystem windows

Source abuse.ch

Also detected by 2 sources

Self-issued Chrome-branded Inno opaque dropper: SecuriteInfo.com.FileRepMalware.75298531:0x0

Self-issued Inno installer masquerades as Chrome: SecuriteInfo.com.FileRepMalware.75298531:0xb77c

SecuriteInfo.com.FileRepMalware.75298531 pe

0x0	4d5a50000200000004000f00ffff0000	MZP.............Self-issued Chrome-branded Inno opaque dropper
0x10	b80000000000000040001a0000000000	........@.......
0x20	00000000000000000000000000000000	................
0x30	00000000000000000000000000010000	................
0x40	ba10000e1fb409cd21b8014ccd219090	........!..L.!..
0x50	546869732070726f6772616d206d7573	This program mus
0x60	742062652072756e20756e6465722057	t be run under W
0x70	696e33320d	in32.

0xb738	6f00630061006c006500730000000000	o.c.a.l.e.s.....
0xb748	53006f00660074007700610072006500	S.o.f.t.w.a.r.e.
0xb758	5c0043006f0064006500470065006100	\.C.o.d.e.G.e.a.
0xb768	72005c004c006f00630061006c006500	r.\.L.o.c.a.l.e.
0xb778	7300000053006f006600740077006100	s...S.o.f.t.w.a.Self-issued Chrome-branded Inno opaque dropper
0xb788	720065005c0042006f0072006c006100	r.e.\.B.o.r.l.a.
0xb798	6e0064005c004c006f00630061006c00	n.d.\.L.o.c.a.l.
0xb7a8	650073000000000053006f00	e.s.....S.o.

0xb52fc	01000000030000000400000005000000	................
0xb530c	496e6e6f205365747570205365747570	Inno Setup SetupSelf-issued Chrome-branded Inno opaque dropper
0xb531c	20446174612028362e372e3029000000	Data (6.7.0)...
0xb532c	00000000000000000000000000000000	................
0xb533c	00000000000000000000000000	.............

0xb6df0	00000000000000000000000000000000	................
0xb6e00	00304c0018304c00143c4b0010404c00	.0L..0L..<K..@L.
0xb6e10	0000000000000000456d626172636164	........EmbarcadSelf-issued Chrome-branded Inno opaque dropper
0xb6e20	65726f2044656c70686920666f722057	ero Delphi for W
0xb6e30	696e333220636f6d70696c6572207665	in32 compiler ve
0xb6e40	7273696f6e2033362e30202832392e30	rsion 36.0 (29.0
0xb6e50	2e35353336322e323031372900000000	.55362.2017)....
0xb6e60	0000000000	.....

0xbf2d8	db3fe63fee3fff3f00000600f0000000	.?.?.?.?........
0xbf2e8	13302430313039304a30593061306f30	.0$01090J0Y0a0o0
0xbf2f8	81308f309730a530b730c930d130df30	.0.0.0.0.0.0.0.0
0xbf308	ee30043116311e312c313e3154316531	.0.1.1.1,1>1T1e1
0xbf318	783189319c31aa31c031d331e131f431	x1.1.1.1.1.1.1.1
0xbf328	03321532283230323e324c3263327632	.2.2(202>2L2c2v2
0xbf338	7e328c329a32ae32c432d732df32ed32	~2.2.2.2.2.2.2.2Self-issued Chrome-branded Inno opaque dropper
0xbf348	fb320f332233313343335c336d337b33	.2.3"313C3\3m3{3
0xbf358	833391339f33b333bb33cc33da33e233	.3.3.3.3.3.3.3.3
0xbf368	f0330234183426343534483472347634	.3.4.4&454H4r4v4
0xbf378	9d34a434ab34b234b934c034c734de34	.4.4.4.4.4.4.4.4
0xbf388	e234e634013509352135253543354735	.4.4.5.5!5%5C5G5
0xbf398	623566358235a535ad35f937513a4a3b	b5f5.5.5.5.7Q:J;
0xbf3a8	7c3b853bbe3bf03bf93bd83c063d233d	\|;.;.;.;.;.<.=#=
0xbf3b8	3b3d6d3d9c3dd13d0d3e303e663e7e3e	;=m=.=.=.>0>f>~>
0xbf3c8	aa3ec03ef13f00000010060028010000	.>.>.?......(...
0xbf3d8	093022303b306f309a303c317f31d231	.0"0;0o0.0<1.1.1
0xbf3e8	5d328732b632fd32293338334f338533	]2.2.2.2)383O3.3
0xbf3f8	b133c033d733a534b2340e3517354a35	.3.3.3.4.4.5.5J5
0xbf408	68358335b435e035f8350b3644366b36	h5.5.5.5.5.6D6k6
0xbf418	7f37c9371938a338ed3837398039a439	.7.7.8.8.879.9.9
0xbf428	b039b439b839bc39c439cc39d039d439	.9.9.9.9.9.9.9.9
0xbf438	d839dc39e039e439e839ec39f039f439	.9.9.9.9.9.9.9.9
0xbf448	f839fc39003a043a083a0c3a103a1e3a	.9.9.:.:.:.:.:.:
0xbf458	303a413a533a6c3a8f3a9d3aa53ab33a	0:A:S:l:.:.:.:.:
0xbf468	c43ae03ae43a003b0c3b103b143b183b	.:.:.:.;.;.;.;.;
0xbf478	203b283b2c3b303b343b383b3c3b403b	;(;,;0;4;8;<;@;
0xbf488	443b483b4c3b503b543b583b5c3b603b	D;H;L;P;T;X;\;`;
0xbf498	643b683b6c3b703b743b783b7c3b803b	d;h;l;p;t;x;\|;.;
0xbf4a8	843b883b8c3b903b943ba23bb43bc53b	.;.;.;.;.;.;.;.;
0xbf4b8	dc3bf33b0f3c173c333c413c493c573c	.;.;.<.<3<A<I<W<
0xbf4c8	693c7d3c853c933ca03cb53cb93cd03c	i<}<.<.<.<.<.<.<
0xbf4d8	d73ce13ce53c023d063d993dc43dcf3d	.<.<.<.=.=.=.=.=
0xbf4e8	253e883e173f353f403f753fa33f0000	%>.>.?5?@?u?.?..
0xbf4f8	00200600cc00000028309830cb301c31	. ......(0.0.0.1
0xbf508	33315b316631dc317432c032cd32ff32	31[1f1.1t2.2.2.2
0xbf518	063322335a33cd332534363444345234	.3"3Z3.3%464D4R4
0xbf528	7d34b234c334ca34fe34433583359a35	}4.4.4.4.4C5.5.5
0xbf538	bc35c3359536b936d536f63604374a37	.5.5.6.6.6.6.7J7
0xbf548	b83768388838dc38143930396b397839	.7h8.8.8.909k9x9
0xbf558	8739fb39243a413a023b273b383b9c3b	.9.9$:A:.;';8;.;
0xbf568	723c763c7a3c7e3c823c863c8a3c8e3c	r<v<z<~<.<.<.<.<
0xbf578	923c	.<

Objectives

0x0	4d5a50000200000004000f00ffff0000	MZP.............
0x10	b80000000000000040001a0000000000	........@.......
0x20	00000000000000000000000000000000	................
0x30	00000000000000000000000000010000	................
0x40	ba10000e1fb409cd21b8014ccd219090	........!..L.!..
0x50	546869732070726f6772616d206d7573	This program mus
0x60	742062652072756e20756e6465722057	t be run under W
0x70	696e33320d	in32.

0xb738	6f00630061006c006500730000000000	o.c.a.l.e.s.....
0xb748	53006f00660074007700610072006500	S.o.f.t.w.a.r.e.
0xb758	5c0043006f0064006500470065006100	\.C.o.d.e.G.e.a.
0xb768	72005c004c006f00630061006c006500	r.\.L.o.c.a.l.e.
0xb778	7300000053006f006600740077006100	s...S.o.f.t.w.a.
0xb788	720065005c0042006f0072006c006100	r.e.\.B.o.r.l.a.
0xb798	6e0064005c004c006f00630061006c00	n.d.\.L.o.c.a.l.
0xb7a8	650073000000000053006f00	e.s.....S.o.

0xb52fc	01000000030000000400000005000000	................
0xb530c	496e6e6f205365747570205365747570	Inno Setup Setup
0xb531c	20446174612028362e372e3029000000	Data (6.7.0)...
0xb532c	00000000000000000000000000000000	................
0xb533c	00000000000000000000000000	.............

0xb6df0	00000000000000000000000000000000	................
0xb6e00	00304c0018304c00143c4b0010404c00	.0L..0L..<K..@L.
0xb6e10	0000000000000000456d626172636164	........Embarcad
0xb6e20	65726f2044656c70686920666f722057	ero Delphi for W
0xb6e30	696e333220636f6d70696c6572207665	in32 compiler ve
0xb6e40	7273696f6e2033362e30202832392e30	rsion 36.0 (29.0
0xb6e50	2e35353336322e323031372900000000	.55362.2017)....
0xb6e60	0000000000	.....

0xbf2d8	db3fe63fee3fff3f00000600f0000000	.?.?.?.?........
0xbf2e8	13302430313039304a30593061306f30	.0$01090J0Y0a0o0
0xbf2f8	81308f309730a530b730c930d130df30	.0.0.0.0.0.0.0.0
0xbf308	ee30043116311e312c313e3154316531	.0.1.1.1,1>1T1e1
0xbf318	783189319c31aa31c031d331e131f431	x1.1.1.1.1.1.1.1
0xbf328	03321532283230323e324c3263327632	.2.2(202>2L2c2v2
0xbf338	7e328c329a32ae32c432d732df32ed32	~2.2.2.2.2.2.2.2
0xbf348	fb320f332233313343335c336d337b33	.2.3"313C3\3m3{3
0xbf358	833391339f33b333bb33cc33da33e233	.3.3.3.3.3.3.3.3
0xbf368	f0330234183426343534483472347634	.3.4.4&454H4r4v4
0xbf378	9d34a434ab34b234b934c034c734de34	.4.4.4.4.4.4.4.4
0xbf388	e234e634013509352135253543354735	.4.4.5.5!5%5C5G5
0xbf398	623566358235a535ad35f937513a4a3b	b5f5.5.5.5.7Q:J;
0xbf3a8	7c3b853bbe3bf03bf93bd83c063d233d	\|;.;.;.;.;.<.=#=
0xbf3b8	3b3d6d3d9c3dd13d0d3e303e663e7e3e	;=m=.=.=.>0>f>~>
0xbf3c8	aa3ec03ef13f00000010060028010000	.>.>.?......(...
0xbf3d8	093022303b306f309a303c317f31d231	.0"0;0o0.0<1.1.1
0xbf3e8	5d328732b632fd32293338334f338533	]2.2.2.2)383O3.3
0xbf3f8	b133c033d733a534b2340e3517354a35	.3.3.3.4.4.5.5J5
0xbf408	68358335b435e035f8350b3644366b36	h5.5.5.5.5.6D6k6
0xbf418	7f37c9371938a338ed3837398039a439	.7.7.8.8.879.9.9
0xbf428	b039b439b839bc39c439cc39d039d439	.9.9.9.9.9.9.9.9
0xbf438	d839dc39e039e439e839ec39f039f439	.9.9.9.9.9.9.9.9
0xbf448	f839fc39003a043a083a0c3a103a1e3a	.9.9.:.:.:.:.:.:
0xbf458	303a413a533a6c3a8f3a9d3aa53ab33a	0:A:S:l:.:.:.:.:
0xbf468	c43ae03ae43a003b0c3b103b143b183b	.:.:.:.;.;.;.;.;
0xbf478	203b283b2c3b303b343b383b3c3b403b	;(;,;0;4;8;<;@;
0xbf488	443b483b4c3b503b543b583b5c3b603b	D;H;L;P;T;X;\;`;
0xbf498	643b683b6c3b703b743b783b7c3b803b	d;h;l;p;t;x;\|;.;
0xbf4a8	843b883b8c3b903b943ba23bb43bc53b	.;.;.;.;.;.;.;.;
0xbf4b8	dc3bf33b0f3c173c333c413c493c573c	.;.;.<.<3<A<I<W<
0xbf4c8	693c7d3c853c933ca03cb53cb93cd03c	i<}<.<.<.<.<.<.<
0xbf4d8	d73ce13ce53c023d063d993dc43dcf3d	.<.<.<.=.=.=.=.=
0xbf4e8	253e883e173f353f403f753fa33f0000	%>.>.?5?@?u?.?..
0xbf4f8	00200600cc00000028309830cb301c31	. ......(0.0.0.1
0xbf508	33315b316631dc317432c032cd32ff32	31[1f1.1t2.2.2.2
0xbf518	063322335a33cd332534363444345234	.3"3Z3.3%464D4R4
0xbf528	7d34b234c334ca34fe34433583359a35	}4.4.4.4.4C5.5.5
0xbf538	bc35c3359536b936d536f63604374a37	.5.5.6.6.6.6.7J7
0xbf548	b83768388838dc38143930396b397839	.7h8.8.8.909k9x9
0xbf558	8739fb39243a413a023b273b383b9c3b	.9.9$:A:.;';8;.;
0xbf568	723c763c7a3c7e3c823c863c8a3c8e3c	r<v<z<~<.<.<.<.<
0xbf578	923c	.<

0xb738	6f00630061006c006500730000000000	o.c.a.l.e.s.....
0xb748	53006f00660074007700610072006500	S.o.f.t.w.a.r.e.
0xb758	5c0043006f0064006500470065006100	\.C.o.d.e.G.e.a.
0xb768	72005c004c006f00630061006c006500	r.\.L.o.c.a.l.e.
0xb778	7300000053006f006600740077006100	s...S.o.f.t.w.a.
0xb788	720065005c0042006f0072006c006100	r.e.\.B.o.r.l.a.
0xb798	6e0064005c004c006f00630061006c00	n.d.\.L.o.c.a.l.
0xb7a8	650073000000000053006f00	e.s.....S.o.

0xb52fc	01000000030000000400000005000000	................
0xb530c	496e6e6f205365747570205365747570	Inno Setup Setup
0xb531c	20446174612028362e372e3029000000	Data (6.7.0)...
0xb532c	00000000000000000000000000000000	................
0xb533c	00000000000000000000000000	.............

0xb6df0	00000000000000000000000000000000	................
0xb6e00	00304c0018304c00143c4b0010404c00	.0L..0L..<K..@L.
0xb6e10	0000000000000000456d626172636164	........Embarcad
0xb6e20	65726f2044656c70686920666f722057	ero Delphi for W
0xb6e30	696e333220636f6d70696c6572207665	in32 compiler ve
0xb6e40	7273696f6e2033362e30202832392e30	rsion 36.0 (29.0
0xb6e50	2e35353336322e323031372900000000	.55362.2017)....
0xb6e60	0000000000	.....

0xd5ffa	20002000200000000000a2003d000100	. . .......=...
0xd600a	460069006c0065004400650073006300	F.i.l.e.D.e.s.c.
0xd601a	720069007000740069006f006e000000	r.i.p.t.i.o.n...
0xd602a	00004300680072006f006d0065002000	..C.h.r.o.m.e. .
0xd603a	53006500740075007000200020002000	S.e.t.u.p. . . .
0xd604a	20002000200020002000200020002000	. . . . . . . .
0xd605a	20002000200020002000200020002000	. . . . . . . .
0xd606a	20002000200020002000200020002000	. . . . . . . .
0xd607a	2000200020002000200020002000	. . . . . . .

0xd6284	630074004e0061006d00650000000000	c.t.N.a.m.e.....
0xd6294	4300680072006f006d00650020002000	C.h.r.o.m.e. . .
0xd62a4	20002000200020002000200020002000	. . . . . . . .
0xd62b4	20002000200020002000200020002000	. . . . . . . .
0xd62c4	20002000200020002000200020002000	. . . . . . . .
0xd62d4	20002000200020002000200020002000	. . . . . . . .
0xd62e4	200020002000200020002000	. . . . . .

Micro-behaviors

0xbf2d8	db3fe63fee3fff3f00000600f0000000	.?.?.?.?........
0xbf2e8	13302430313039304a30593061306f30	.0$01090J0Y0a0o0
0xbf2f8	81308f309730a530b730c930d130df30	.0.0.0.0.0.0.0.0
0xbf308	ee30043116311e312c313e3154316531	.0.1.1.1,1>1T1e1
0xbf318	783189319c31aa31c031d331e131f431	x1.1.1.1.1.1.1.1
0xbf328	03321532283230323e324c3263327632	.2.2(202>2L2c2v2
0xbf338	7e328c329a32ae32c432d732df32ed32	~2.2.2.2.2.2.2.2
0xbf348	fb320f332233313343335c336d337b33	.2.3"313C3\3m3{3
0xbf358	833391339f33b333bb33cc33da33e233	.3.3.3.3.3.3.3.3
0xbf368	f0330234183426343534483472347634	.3.4.4&454H4r4v4
0xbf378	9d34a434ab34b234b934c034c734de34	.4.4.4.4.4.4.4.4
0xbf388	e234e634013509352135253543354735	.4.4.5.5!5%5C5G5
0xbf398	623566358235a535ad35f937513a4a3b	b5f5.5.5.5.7Q:J;
0xbf3a8	7c3b853bbe3bf03bf93bd83c063d233d	\|;.;.;.;.;.<.=#=
0xbf3b8	3b3d6d3d9c3dd13d0d3e303e663e7e3e	;=m=.=.=.>0>f>~>
0xbf3c8	aa3ec03ef13f00000010060028010000	.>.>.?......(...
0xbf3d8	093022303b306f309a303c317f31d231	.0"0;0o0.0<1.1.1
0xbf3e8	5d328732b632fd32293338334f338533	]2.2.2.2)383O3.3
0xbf3f8	b133c033d733a534b2340e3517354a35	.3.3.3.4.4.5.5J5
0xbf408	68358335b435e035f8350b3644366b36	h5.5.5.5.5.6D6k6
0xbf418	7f37c9371938a338ed3837398039a439	.7.7.8.8.879.9.9
0xbf428	b039b439b839bc39c439cc39d039d439	.9.9.9.9.9.9.9.9
0xbf438	d839dc39e039e439e839ec39f039f439	.9.9.9.9.9.9.9.9
0xbf448	f839fc39003a043a083a0c3a103a1e3a	.9.9.:.:.:.:.:.:
0xbf458	303a413a533a6c3a8f3a9d3aa53ab33a	0:A:S:l:.:.:.:.:
0xbf468	c43ae03ae43a003b0c3b103b143b183b	.:.:.:.;.;.;.;.;
0xbf478	203b283b2c3b303b343b383b3c3b403b	;(;,;0;4;8;<;@;
0xbf488	443b483b4c3b503b543b583b5c3b603b	D;H;L;P;T;X;\;`;
0xbf498	643b683b6c3b703b743b783b7c3b803b	d;h;l;p;t;x;\|;.;
0xbf4a8	843b883b8c3b903b943ba23bb43bc53b	.;.;.;.;.;.;.;.;
0xbf4b8	dc3bf33b0f3c173c333c413c493c573c	.;.;.<.<3<A<I<W<
0xbf4c8	693c7d3c853c933ca03cb53cb93cd03c	i<}<.<.<.<.<.<.<
0xbf4d8	d73ce13ce53c023d063d993dc43dcf3d	.<.<.<.=.=.=.=.=
0xbf4e8	253e883e173f353f403f753fa33f0000	%>.>.?5?@?u?.?..
0xbf4f8	00200600cc00000028309830cb301c31	. ......(0.0.0.1
0xbf508	33315b316631dc317432c032cd32ff32	31[1f1.1t2.2.2.2
0xbf518	063322335a33cd332534363444345234	.3"3Z3.3%464D4R4
0xbf528	7d34b234c334ca34fe34433583359a35	}4.4.4.4.4C5.5.5
0xbf538	bc35c3359536b936d536f63604374a37	.5.5.6.6.6.6.7J7
0xbf548	b83768388838dc38143930396b397839	.7h8.8.8.909k9x9
0xbf558	8739fb39243a413a023b273b383b9c3b	.9.9$:A:.;';8;.;
0xbf568	723c763c7a3c7e3c823c863c8a3c8e3c	r<v<z<~<.<.<.<.<
0xbf578	923c	.<

0xb5f60	000052657365744576656e7400000000	..ResetEvent....
0xb5f70	476574566f6c756d65496e666f726d61	GetVolumeInforma
0xb5f80	74696f6e570000004765745665727369	tionW...GetVersi
0xb5f90	6f6e0000000047657444726976655479	on....GetDriveTy
0xb5fa0	7065570000	peW..

0xbf2d8	db3fe63fee3fff3f00000600f0000000	.?.?.?.?........
0xbf2e8	13302430313039304a30593061306f30	.0$01090J0Y0a0o0
0xbf2f8	81308f309730a530b730c930d130df30	.0.0.0.0.0.0.0.0
0xbf308	ee30043116311e312c313e3154316531	.0.1.1.1,1>1T1e1
0xbf318	783189319c31aa31c031d331e131f431	x1.1.1.1.1.1.1.1
0xbf328	03321532283230323e324c3263327632	.2.2(202>2L2c2v2
0xbf338	7e328c329a32ae32c432d732df32ed32	~2.2.2.2.2.2.2.2
0xbf348	fb320f332233313343335c336d337b33	.2.3"313C3\3m3{3
0xbf358	833391339f33b333bb33cc33da33e233	.3.3.3.3.3.3.3.3
0xbf368	f0330234183426343534483472347634	.3.4.4&454H4r4v4
0xbf378	9d34a434ab34b234b934c034c734de34	.4.4.4.4.4.4.4.4
0xbf388	e234e634013509352135253543354735	.4.4.5.5!5%5C5G5
0xbf398	623566358235a535ad35f937513a4a3b	b5f5.5.5.5.7Q:J;
0xbf3a8	7c3b853bbe3bf03bf93bd83c063d233d	\|;.;.;.;.;.<.=#=
0xbf3b8	3b3d6d3d9c3dd13d0d3e303e663e7e3e	;=m=.=.=.>0>f>~>
0xbf3c8	aa3ec03ef13f00000010060028010000	.>.>.?......(...
0xbf3d8	093022303b306f309a303c317f31d231	.0"0;0o0.0<1.1.1
0xbf3e8	5d328732b632fd32293338334f338533	]2.2.2.2)383O3.3
0xbf3f8	b133c033d733a534b2340e3517354a35	.3.3.3.4.4.5.5J5
0xbf408	68358335b435e035f8350b3644366b36	h5.5.5.5.5.6D6k6
0xbf418	7f37c9371938a338ed3837398039a439	.7.7.8.8.879.9.9
0xbf428	b039b439b839bc39c439cc39d039d439	.9.9.9.9.9.9.9.9
0xbf438	d839dc39e039e439e839ec39f039f439	.9.9.9.9.9.9.9.9
0xbf448	f839fc39003a043a083a0c3a103a1e3a	.9.9.:.:.:.:.:.:
0xbf458	303a413a533a6c3a8f3a9d3aa53ab33a	0:A:S:l:.:.:.:.:
0xbf468	c43ae03ae43a003b0c3b103b143b183b	.:.:.:.;.;.;.;.;
0xbf478	203b283b2c3b303b343b383b3c3b403b	;(;,;0;4;8;<;@;
0xbf488	443b483b4c3b503b543b583b5c3b603b	D;H;L;P;T;X;\;`;
0xbf498	643b683b6c3b703b743b783b7c3b803b	d;h;l;p;t;x;\|;.;
0xbf4a8	843b883b8c3b903b943ba23bb43bc53b	.;.;.;.;.;.;.;.;
0xbf4b8	dc3bf33b0f3c173c333c413c493c573c	.;.;.<.<3<A<I<W<
0xbf4c8	693c7d3c853c933ca03cb53cb93cd03c	i<}<.<.<.<.<.<.<
0xbf4d8	d73ce13ce53c023d063d993dc43dcf3d	.<.<.<.=.=.=.=.=
0xbf4e8	253e883e173f353f403f753fa33f0000	%>.>.?5?@?u?.?..
0xbf4f8	00200600cc00000028309830cb301c31	. ......(0.0.0.1
0xbf508	33315b316631dc317432c032cd32ff32	31[1f1.1t2.2.2.2
0xbf518	063322335a33cd332534363444345234	.3"3Z3.3%464D4R4
0xbf528	7d34b234c334ca34fe34433583359a35	}4.4.4.4.4C5.5.5
0xbf538	bc35c3359536b936d536f63604374a37	.5.5.6.6.6.6.7J7
0xbf548	b83768388838dc38143930396b397839	.7h8.8.8.909k9x9
0xbf558	8739fb39243a413a023b273b383b9c3b	.9.9$:A:.;';8;.;
0xbf568	723c763c7a3c7e3c823c863c8a3c8e3c	r<v<z<~<.<.<.<.<
0xbf578	923c	.<

0xbf2d8	db3fe63fee3fff3f00000600f0000000	.?.?.?.?........
0xbf2e8	13302430313039304a30593061306f30	.0$01090J0Y0a0o0
0xbf2f8	81308f309730a530b730c930d130df30	.0.0.0.0.0.0.0.0
0xbf308	ee30043116311e312c313e3154316531	.0.1.1.1,1>1T1e1
0xbf318	783189319c31aa31c031d331e131f431	x1.1.1.1.1.1.1.1
0xbf328	03321532283230323e324c3263327632	.2.2(202>2L2c2v2
0xbf338	7e328c329a32ae32c432d732df32ed32	~2.2.2.2.2.2.2.2
0xbf348	fb320f332233313343335c336d337b33	.2.3"313C3\3m3{3
0xbf358	833391339f33b333bb33cc33da33e233	.3.3.3.3.3.3.3.3
0xbf368	f0330234183426343534483472347634	.3.4.4&454H4r4v4
0xbf378	9d34a434ab34b234b934c034c734de34	.4.4.4.4.4.4.4.4
0xbf388	e234e634013509352135253543354735	.4.4.5.5!5%5C5G5
0xbf398	623566358235a535ad35f937513a4a3b	b5f5.5.5.5.7Q:J;
0xbf3a8	7c3b853bbe3bf03bf93bd83c063d233d	\|;.;.;.;.;.<.=#=
0xbf3b8	3b3d6d3d9c3dd13d0d3e303e663e7e3e	;=m=.=.=.>0>f>~>
0xbf3c8	aa3ec03ef13f00000010060028010000	.>.>.?......(...
0xbf3d8	093022303b306f309a303c317f31d231	.0"0;0o0.0<1.1.1
0xbf3e8	5d328732b632fd32293338334f338533	]2.2.2.2)383O3.3
0xbf3f8	b133c033d733a534b2340e3517354a35	.3.3.3.4.4.5.5J5
0xbf408	68358335b435e035f8350b3644366b36	h5.5.5.5.5.6D6k6
0xbf418	7f37c9371938a338ed3837398039a439	.7.7.8.8.879.9.9
0xbf428	b039b439b839bc39c439cc39d039d439	.9.9.9.9.9.9.9.9
0xbf438	d839dc39e039e439e839ec39f039f439	.9.9.9.9.9.9.9.9
0xbf448	f839fc39003a043a083a0c3a103a1e3a	.9.9.:.:.:.:.:.:
0xbf458	303a413a533a6c3a8f3a9d3aa53ab33a	0:A:S:l:.:.:.:.:
0xbf468	c43ae03ae43a003b0c3b103b143b183b	.:.:.:.;.;.;.;.;
0xbf478	203b283b2c3b303b343b383b3c3b403b	;(;,;0;4;8;<;@;
0xbf488	443b483b4c3b503b543b583b5c3b603b	D;H;L;P;T;X;\;`;
0xbf498	643b683b6c3b703b743b783b7c3b803b	d;h;l;p;t;x;\|;.;
0xbf4a8	843b883b8c3b903b943ba23bb43bc53b	.;.;.;.;.;.;.;.;
0xbf4b8	dc3bf33b0f3c173c333c413c493c573c	.;.;.<.<3<A<I<W<
0xbf4c8	693c7d3c853c933ca03cb53cb93cd03c	i<}<.<.<.<.<.<.<
0xbf4d8	d73ce13ce53c023d063d993dc43dcf3d	.<.<.<.=.=.=.=.=
0xbf4e8	253e883e173f353f403f753fa33f0000	%>.>.?5?@?u?.?..
0xbf4f8	00200600cc00000028309830cb301c31	. ......(0.0.0.1
0xbf508	33315b316631dc317432c032cd32ff32	31[1f1.1t2.2.2.2
0xbf518	063322335a33cd332534363444345234	.3"3Z3.3%464D4R4
0xbf528	7d34b234c334ca34fe34433583359a35	}4.4.4.4.4C5.5.5
0xbf538	bc35c3359536b936d536f63604374a37	.5.5.6.6.6.6.7J7
0xbf548	b83768388838dc38143930396b397839	.7h8.8.8.909k9x9
0xbf558	8739fb39243a413a023b273b383b9c3b	.9.9$:A:.;';8;.;
0xbf568	723c763c7a3c7e3c823c863c8a3c8e3c	r<v<z<~<.<.<.<.<
0xbf578	923c	.<

0xbf2d8	db3fe63fee3fff3f00000600f0000000	.?.?.?.?........
0xbf2e8	13302430313039304a30593061306f30	.0$01090J0Y0a0o0
0xbf2f8	81308f309730a530b730c930d130df30	.0.0.0.0.0.0.0.0
0xbf308	ee30043116311e312c313e3154316531	.0.1.1.1,1>1T1e1
0xbf318	783189319c31aa31c031d331e131f431	x1.1.1.1.1.1.1.1
0xbf328	03321532283230323e324c3263327632	.2.2(202>2L2c2v2
0xbf338	7e328c329a32ae32c432d732df32ed32	~2.2.2.2.2.2.2.2
0xbf348	fb320f332233313343335c336d337b33	.2.3"313C3\3m3{3
0xbf358	833391339f33b333bb33cc33da33e233	.3.3.3.3.3.3.3.3
0xbf368	f0330234183426343534483472347634	.3.4.4&454H4r4v4
0xbf378	9d34a434ab34b234b934c034c734de34	.4.4.4.4.4.4.4.4
0xbf388	e234e634013509352135253543354735	.4.4.5.5!5%5C5G5
0xbf398	623566358235a535ad35f937513a4a3b	b5f5.5.5.5.7Q:J;
0xbf3a8	7c3b853bbe3bf03bf93bd83c063d233d	\|;.;.;.;.;.<.=#=
0xbf3b8	3b3d6d3d9c3dd13d0d3e303e663e7e3e	;=m=.=.=.>0>f>~>
0xbf3c8	aa3ec03ef13f00000010060028010000	.>.>.?......(...
0xbf3d8	093022303b306f309a303c317f31d231	.0"0;0o0.0<1.1.1
0xbf3e8	5d328732b632fd32293338334f338533	]2.2.2.2)383O3.3
0xbf3f8	b133c033d733a534b2340e3517354a35	.3.3.3.4.4.5.5J5
0xbf408	68358335b435e035f8350b3644366b36	h5.5.5.5.5.6D6k6
0xbf418	7f37c9371938a338ed3837398039a439	.7.7.8.8.879.9.9
0xbf428	b039b439b839bc39c439cc39d039d439	.9.9.9.9.9.9.9.9
0xbf438	d839dc39e039e439e839ec39f039f439	.9.9.9.9.9.9.9.9
0xbf448	f839fc39003a043a083a0c3a103a1e3a	.9.9.:.:.:.:.:.:
0xbf458	303a413a533a6c3a8f3a9d3aa53ab33a	0:A:S:l:.:.:.:.:
0xbf468	c43ae03ae43a003b0c3b103b143b183b	.:.:.:.;.;.;.;.;
0xbf478	203b283b2c3b303b343b383b3c3b403b	;(;,;0;4;8;<;@;
0xbf488	443b483b4c3b503b543b583b5c3b603b	D;H;L;P;T;X;\;`;
0xbf498	643b683b6c3b703b743b783b7c3b803b	d;h;l;p;t;x;\|;.;
0xbf4a8	843b883b8c3b903b943ba23bb43bc53b	.;.;.;.;.;.;.;.;
0xbf4b8	dc3bf33b0f3c173c333c413c493c573c	.;.;.<.<3<A<I<W<
0xbf4c8	693c7d3c853c933ca03cb53cb93cd03c	i<}<.<.<.<.<.<.<
0xbf4d8	d73ce13ce53c023d063d993dc43dcf3d	.<.<.<.=.=.=.=.=
0xbf4e8	253e883e173f353f403f753fa33f0000	%>.>.?5?@?u?.?..
0xbf4f8	00200600cc00000028309830cb301c31	. ......(0.0.0.1
0xbf508	33315b316631dc317432c032cd32ff32	31[1f1.1t2.2.2.2
0xbf518	063322335a33cd332534363444345234	.3"3Z3.3%464D4R4
0xbf528	7d34b234c334ca34fe34433583359a35	}4.4.4.4.4C5.5.5
0xbf538	bc35c3359536b936d536f63604374a37	.5.5.6.6.6.6.7J7
0xbf548	b83768388838dc38143930396b397839	.7h8.8.8.909k9x9
0xbf558	8739fb39243a413a023b273b383b9c3b	.9.9$:A:.;';8;.;
0xbf568	723c763c7a3c7e3c823c863c8a3c8e3c	r<v<z<~<.<.<.<.<
0xbf578	923c	.<

0xbf2d8	db3fe63fee3fff3f00000600f0000000	.?.?.?.?........
0xbf2e8	13302430313039304a30593061306f30	.0$01090J0Y0a0o0
0xbf2f8	81308f309730a530b730c930d130df30	.0.0.0.0.0.0.0.0
0xbf308	ee30043116311e312c313e3154316531	.0.1.1.1,1>1T1e1
0xbf318	783189319c31aa31c031d331e131f431	x1.1.1.1.1.1.1.1
0xbf328	03321532283230323e324c3263327632	.2.2(202>2L2c2v2
0xbf338	7e328c329a32ae32c432d732df32ed32	~2.2.2.2.2.2.2.2
0xbf348	fb320f332233313343335c336d337b33	.2.3"313C3\3m3{3
0xbf358	833391339f33b333bb33cc33da33e233	.3.3.3.3.3.3.3.3
0xbf368	f0330234183426343534483472347634	.3.4.4&454H4r4v4
0xbf378	9d34a434ab34b234b934c034c734de34	.4.4.4.4.4.4.4.4
0xbf388	e234e634013509352135253543354735	.4.4.5.5!5%5C5G5
0xbf398	623566358235a535ad35f937513a4a3b	b5f5.5.5.5.7Q:J;
0xbf3a8	7c3b853bbe3bf03bf93bd83c063d233d	\|;.;.;.;.;.<.=#=
0xbf3b8	3b3d6d3d9c3dd13d0d3e303e663e7e3e	;=m=.=.=.>0>f>~>
0xbf3c8	aa3ec03ef13f00000010060028010000	.>.>.?......(...
0xbf3d8	093022303b306f309a303c317f31d231	.0"0;0o0.0<1.1.1
0xbf3e8	5d328732b632fd32293338334f338533	]2.2.2.2)383O3.3
0xbf3f8	b133c033d733a534b2340e3517354a35	.3.3.3.4.4.5.5J5
0xbf408	68358335b435e035f8350b3644366b36	h5.5.5.5.5.6D6k6
0xbf418	7f37c9371938a338ed3837398039a439	.7.7.8.8.879.9.9
0xbf428	b039b439b839bc39c439cc39d039d439	.9.9.9.9.9.9.9.9
0xbf438	d839dc39e039e439e839ec39f039f439	.9.9.9.9.9.9.9.9
0xbf448	f839fc39003a043a083a0c3a103a1e3a	.9.9.:.:.:.:.:.:
0xbf458	303a413a533a6c3a8f3a9d3aa53ab33a	0:A:S:l:.:.:.:.:
0xbf468	c43ae03ae43a003b0c3b103b143b183b	.:.:.:.;.;.;.;.;
0xbf478	203b283b2c3b303b343b383b3c3b403b	;(;,;0;4;8;<;@;
0xbf488	443b483b4c3b503b543b583b5c3b603b	D;H;L;P;T;X;\;`;
0xbf498	643b683b6c3b703b743b783b7c3b803b	d;h;l;p;t;x;\|;.;
0xbf4a8	843b883b8c3b903b943ba23bb43bc53b	.;.;.;.;.;.;.;.;
0xbf4b8	dc3bf33b0f3c173c333c413c493c573c	.;.;.<.<3<A<I<W<
0xbf4c8	693c7d3c853c933ca03cb53cb93cd03c	i<}<.<.<.<.<.<.<
0xbf4d8	d73ce13ce53c023d063d993dc43dcf3d	.<.<.<.=.=.=.=.=
0xbf4e8	253e883e173f353f403f753fa33f0000	%>.>.?5?@?u?.?..
0xbf4f8	00200600cc00000028309830cb301c31	. ......(0.0.0.1
0xbf508	33315b316631dc317432c032cd32ff32	31[1f1.1t2.2.2.2
0xbf518	063322335a33cd332534363444345234	.3"3Z3.3%464D4R4
0xbf528	7d34b234c334ca34fe34433583359a35	}4.4.4.4.4C5.5.5
0xbf538	bc35c3359536b936d536f63604374a37	.5.5.6.6.6.6.7J7
0xbf548	b83768388838dc38143930396b397839	.7h8.8.8.909k9x9
0xbf558	8739fb39243a413a023b273b383b9c3b	.9.9$:A:.;';8;.;
0xbf568	723c763c7a3c7e3c823c863c8a3c8e3c	r<v<z<~<.<.<.<.<
0xbf578	923c	.<

0xbf2d8	db3fe63fee3fff3f00000600f0000000	.?.?.?.?........
0xbf2e8	13302430313039304a30593061306f30	.0$01090J0Y0a0o0
0xbf2f8	81308f309730a530b730c930d130df30	.0.0.0.0.0.0.0.0
0xbf308	ee30043116311e312c313e3154316531	.0.1.1.1,1>1T1e1
0xbf318	783189319c31aa31c031d331e131f431	x1.1.1.1.1.1.1.1
0xbf328	03321532283230323e324c3263327632	.2.2(202>2L2c2v2
0xbf338	7e328c329a32ae32c432d732df32ed32	~2.2.2.2.2.2.2.2
0xbf348	fb320f332233313343335c336d337b33	.2.3"313C3\3m3{3
0xbf358	833391339f33b333bb33cc33da33e233	.3.3.3.3.3.3.3.3
0xbf368	f0330234183426343534483472347634	.3.4.4&454H4r4v4
0xbf378	9d34a434ab34b234b934c034c734de34	.4.4.4.4.4.4.4.4
0xbf388	e234e634013509352135253543354735	.4.4.5.5!5%5C5G5
0xbf398	623566358235a535ad35f937513a4a3b	b5f5.5.5.5.7Q:J;
0xbf3a8	7c3b853bbe3bf03bf93bd83c063d233d	\|;.;.;.;.;.<.=#=
0xbf3b8	3b3d6d3d9c3dd13d0d3e303e663e7e3e	;=m=.=.=.>0>f>~>
0xbf3c8	aa3ec03ef13f00000010060028010000	.>.>.?......(...
0xbf3d8	093022303b306f309a303c317f31d231	.0"0;0o0.0<1.1.1
0xbf3e8	5d328732b632fd32293338334f338533	]2.2.2.2)383O3.3
0xbf3f8	b133c033d733a534b2340e3517354a35	.3.3.3.4.4.5.5J5
0xbf408	68358335b435e035f8350b3644366b36	h5.5.5.5.5.6D6k6
0xbf418	7f37c9371938a338ed3837398039a439	.7.7.8.8.879.9.9
0xbf428	b039b439b839bc39c439cc39d039d439	.9.9.9.9.9.9.9.9
0xbf438	d839dc39e039e439e839ec39f039f439	.9.9.9.9.9.9.9.9
0xbf448	f839fc39003a043a083a0c3a103a1e3a	.9.9.:.:.:.:.:.:
0xbf458	303a413a533a6c3a8f3a9d3aa53ab33a	0:A:S:l:.:.:.:.:
0xbf468	c43ae03ae43a003b0c3b103b143b183b	.:.:.:.;.;.;.;.;
0xbf478	203b283b2c3b303b343b383b3c3b403b	;(;,;0;4;8;<;@;
0xbf488	443b483b4c3b503b543b583b5c3b603b	D;H;L;P;T;X;\;`;
0xbf498	643b683b6c3b703b743b783b7c3b803b	d;h;l;p;t;x;\|;.;
0xbf4a8	843b883b8c3b903b943ba23bb43bc53b	.;.;.;.;.;.;.;.;
0xbf4b8	dc3bf33b0f3c173c333c413c493c573c	.;.;.<.<3<A<I<W<
0xbf4c8	693c7d3c853c933ca03cb53cb93cd03c	i<}<.<.<.<.<.<.<
0xbf4d8	d73ce13ce53c023d063d993dc43dcf3d	.<.<.<.=.=.=.=.=
0xbf4e8	253e883e173f353f403f753fa33f0000	%>.>.?5?@?u?.?..
0xbf4f8	00200600cc00000028309830cb301c31	. ......(0.0.0.1
0xbf508	33315b316631dc317432c032cd32ff32	31[1f1.1t2.2.2.2
0xbf518	063322335a33cd332534363444345234	.3"3Z3.3%464D4R4
0xbf528	7d34b234c334ca34fe34433583359a35	}4.4.4.4.4C5.5.5
0xbf538	bc35c3359536b936d536f63604374a37	.5.5.6.6.6.6.7J7
0xbf548	b83768388838dc38143930396b397839	.7h8.8.8.909k9x9
0xbf558	8739fb39243a413a023b273b383b9c3b	.9.9$:A:.;';8;.;
0xbf568	723c763c7a3c7e3c823c863c8a3c8e3c	r<v<z<~<.<.<.<.<
0xbf578	923c	.<

0xb5eb8	790000005265616446696c6500000000	y...ReadFile....
0xb5ec8	43726561746550726f63657373570000	CreateProcessW..
0xb5ed8	00004765744c6173744572726f720000	..GetLastError..
0xb5ee8	00004765744d6f64756c6546696c654e	..GetModuleFileN
0xb5ef8	616d6557000000005365744c61737445	ameW....SetLastE
0xb5f08	72726f720000000046696e645265736f	rror....FindReso
0xb5f18	75726365570000004372656174655468	urceW...CreateTh
0xb5f28	7265616400000000436f6d7061726553	read....CompareS
0xb5f38	7472696e67570000000047657446696c	tringW....GetFil
0xb5f48	6553697a	eSiz

0xbf2d8	db3fe63fee3fff3f00000600f0000000	.?.?.?.?........
0xbf2e8	13302430313039304a30593061306f30	.0$01090J0Y0a0o0
0xbf2f8	81308f309730a530b730c930d130df30	.0.0.0.0.0.0.0.0
0xbf308	ee30043116311e312c313e3154316531	.0.1.1.1,1>1T1e1
0xbf318	783189319c31aa31c031d331e131f431	x1.1.1.1.1.1.1.1
0xbf328	03321532283230323e324c3263327632	.2.2(202>2L2c2v2
0xbf338	7e328c329a32ae32c432d732df32ed32	~2.2.2.2.2.2.2.2
0xbf348	fb320f332233313343335c336d337b33	.2.3"313C3\3m3{3
0xbf358	833391339f33b333bb33cc33da33e233	.3.3.3.3.3.3.3.3
0xbf368	f0330234183426343534483472347634	.3.4.4&454H4r4v4
0xbf378	9d34a434ab34b234b934c034c734de34	.4.4.4.4.4.4.4.4
0xbf388	e234e634013509352135253543354735	.4.4.5.5!5%5C5G5
0xbf398	623566358235a535ad35f937513a4a3b	b5f5.5.5.5.7Q:J;
0xbf3a8	7c3b853bbe3bf03bf93bd83c063d233d	\|;.;.;.;.;.<.=#=
0xbf3b8	3b3d6d3d9c3dd13d0d3e303e663e7e3e	;=m=.=.=.>0>f>~>
0xbf3c8	aa3ec03ef13f00000010060028010000	.>.>.?......(...
0xbf3d8	093022303b306f309a303c317f31d231	.0"0;0o0.0<1.1.1
0xbf3e8	5d328732b632fd32293338334f338533	]2.2.2.2)383O3.3
0xbf3f8	b133c033d733a534b2340e3517354a35	.3.3.3.4.4.5.5J5
0xbf408	68358335b435e035f8350b3644366b36	h5.5.5.5.5.6D6k6
0xbf418	7f37c9371938a338ed3837398039a439	.7.7.8.8.879.9.9
0xbf428	b039b439b839bc39c439cc39d039d439	.9.9.9.9.9.9.9.9
0xbf438	d839dc39e039e439e839ec39f039f439	.9.9.9.9.9.9.9.9
0xbf448	f839fc39003a043a083a0c3a103a1e3a	.9.9.:.:.:.:.:.:
0xbf458	303a413a533a6c3a8f3a9d3aa53ab33a	0:A:S:l:.:.:.:.:
0xbf468	c43ae03ae43a003b0c3b103b143b183b	.:.:.:.;.;.;.;.;
0xbf478	203b283b2c3b303b343b383b3c3b403b	;(;,;0;4;8;<;@;
0xbf488	443b483b4c3b503b543b583b5c3b603b	D;H;L;P;T;X;\;`;
0xbf498	643b683b6c3b703b743b783b7c3b803b	d;h;l;p;t;x;\|;.;
0xbf4a8	843b883b8c3b903b943ba23bb43bc53b	.;.;.;.;.;.;.;.;
0xbf4b8	dc3bf33b0f3c173c333c413c493c573c	.;.;.<.<3<A<I<W<
0xbf4c8	693c7d3c853c933ca03cb53cb93cd03c	i<}<.<.<.<.<.<.<
0xbf4d8	d73ce13ce53c023d063d993dc43dcf3d	.<.<.<.=.=.=.=.=
0xbf4e8	253e883e173f353f403f753fa33f0000	%>.>.?5?@?u?.?..
0xbf4f8	00200600cc00000028309830cb301c31	. ......(0.0.0.1
0xbf508	33315b316631dc317432c032cd32ff32	31[1f1.1t2.2.2.2
0xbf518	063322335a33cd332534363444345234	.3"3Z3.3%464D4R4
0xbf528	7d34b234c334ca34fe34433583359a35	}4.4.4.4.4C5.5.5
0xbf538	bc35c3359536b936d536f63604374a37	.5.5.6.6.6.6.7J7
0xbf548	b83768388838dc38143930396b397839	.7h8.8.8.909k9x9
0xbf558	8739fb39243a413a023b273b383b9c3b	.9.9$:A:.;';8;.;
0xbf568	723c763c7a3c7e3c823c863c8a3c8e3c	r<v<z<~<.<.<.<.<
0xbf578	923c	.<

0xb61a2	47657453797374656d496e666f000000	GetSystemInfo...
0xb61b2	47657454656d70506174685700000000	GetTempPathW....
0xb61c2	4c65617665437269746963616c536563	LeaveCriticalSec
0xb61d2	74696f6e0000000047657450726f6341	tion....GetProcA
0xb61e2	64647265737300000000526573756d65	ddress....Resume
0xb61f2	54687265616400000000476574566572	Thread....GetVer
0xb6202	73696f6e457857000000566572696679	sionExW...Verify
0xb6212	56657273696f6e496e666f5700000000	VersionInfoW....
0xb6222	48656170437265	HeapCre

0xbf2d8	db3fe63fee3fff3f00000600f0000000	.?.?.?.?........
0xbf2e8	13302430313039304a30593061306f30	.0$01090J0Y0a0o0
0xbf2f8	81308f309730a530b730c930d130df30	.0.0.0.0.0.0.0.0
0xbf308	ee30043116311e312c313e3154316531	.0.1.1.1,1>1T1e1
0xbf318	783189319c31aa31c031d331e131f431	x1.1.1.1.1.1.1.1
0xbf328	03321532283230323e324c3263327632	.2.2(202>2L2c2v2
0xbf338	7e328c329a32ae32c432d732df32ed32	~2.2.2.2.2.2.2.2
0xbf348	fb320f332233313343335c336d337b33	.2.3"313C3\3m3{3
0xbf358	833391339f33b333bb33cc33da33e233	.3.3.3.3.3.3.3.3
0xbf368	f0330234183426343534483472347634	.3.4.4&454H4r4v4
0xbf378	9d34a434ab34b234b934c034c734de34	.4.4.4.4.4.4.4.4
0xbf388	e234e634013509352135253543354735	.4.4.5.5!5%5C5G5
0xbf398	623566358235a535ad35f937513a4a3b	b5f5.5.5.5.7Q:J;
0xbf3a8	7c3b853bbe3bf03bf93bd83c063d233d	\|;.;.;.;.;.<.=#=
0xbf3b8	3b3d6d3d9c3dd13d0d3e303e663e7e3e	;=m=.=.=.>0>f>~>
0xbf3c8	aa3ec03ef13f00000010060028010000	.>.>.?......(...
0xbf3d8	093022303b306f309a303c317f31d231	.0"0;0o0.0<1.1.1
0xbf3e8	5d328732b632fd32293338334f338533	]2.2.2.2)383O3.3
0xbf3f8	b133c033d733a534b2340e3517354a35	.3.3.3.4.4.5.5J5
0xbf408	68358335b435e035f8350b3644366b36	h5.5.5.5.5.6D6k6
0xbf418	7f37c9371938a338ed3837398039a439	.7.7.8.8.879.9.9
0xbf428	b039b439b839bc39c439cc39d039d439	.9.9.9.9.9.9.9.9
0xbf438	d839dc39e039e439e839ec39f039f439	.9.9.9.9.9.9.9.9
0xbf448	f839fc39003a043a083a0c3a103a1e3a	.9.9.:.:.:.:.:.:
0xbf458	303a413a533a6c3a8f3a9d3aa53ab33a	0:A:S:l:.:.:.:.:
0xbf468	c43ae03ae43a003b0c3b103b143b183b	.:.:.:.;.;.;.;.;
0xbf478	203b283b2c3b303b343b383b3c3b403b	;(;,;0;4;8;<;@;
0xbf488	443b483b4c3b503b543b583b5c3b603b	D;H;L;P;T;X;\;`;
0xbf498	643b683b6c3b703b743b783b7c3b803b	d;h;l;p;t;x;\|;.;
0xbf4a8	843b883b8c3b903b943ba23bb43bc53b	.;.;.;.;.;.;.;.;
0xbf4b8	dc3bf33b0f3c173c333c413c493c573c	.;.;.<.<3<A<I<W<
0xbf4c8	693c7d3c853c933ca03cb53cb93cd03c	i<}<.<.<.<.<.<.<
0xbf4d8	d73ce13ce53c023d063d993dc43dcf3d	.<.<.<.=.=.=.=.=
0xbf4e8	253e883e173f353f403f753fa33f0000	%>.>.?5?@?u?.?..
0xbf4f8	00200600cc00000028309830cb301c31	. ......(0.0.0.1
0xbf508	33315b316631dc317432c032cd32ff32	31[1f1.1t2.2.2.2
0xbf518	063322335a33cd332534363444345234	.3"3Z3.3%464D4R4
0xbf528	7d34b234c334ca34fe34433583359a35	}4.4.4.4.4C5.5.5
0xbf538	bc35c3359536b936d536f63604374a37	.5.5.6.6.6.6.7J7
0xbf548	b83768388838dc38143930396b397839	.7h8.8.8.909k9x9
0xbf558	8739fb39243a413a023b273b383b9c3b	.9.9$:A:.;';8;.;
0xbf568	723c763c7a3c7e3c823c863c8a3c8e3c	r<v<z<~<.<.<.<.<
0xbf578	923c	.<

Metadata

0xd6b11	646c6c22206c6f616446726f6d3d2225	dll" loadFrom="%
0xd6b21	53797374656d526f6f74255c73797374	SystemRoot%\syst
0xd6b31	656d33325c22202f3e0d0a3c66696c65	em32\" />..<file
0xd6b41	206e616d653d2277696e687474702e64	name="winhttp.d
0xd6b51	6c6c22206c6f616446726f6d3d222553	ll" loadFrom="%S
0xd6b61	797374656d526f6f74255c7379737465	ystemRoot%\syste
0xd6b71	6d33325c22202f3e0d0a3c2f61737365	m32\" />..</asse
0xd6b81	6d626c793e0d0a50414444494e475858	mbly>..PADDINGXX
0xd6b91	50414444494e4750414444494e475858	PADDINGPADDINGXX
0xd6ba1	50414444494e4750414444494e475858	PADDINGPADDINGXX
0xd6bb1	50414444494e4750414444494e475858	PADDINGPADDINGXX
0xd6bc1	50414444494e4750414444494e475858	PADDINGPADDINGXX
0xd6bd1	50414444494e4750414444494e475858	PADDINGPADDINGXX
0xd6be1	50414444494e4750414444494e475858	PADDINGPADDINGXX
0xd6bf1	50414444494e4750414444494e47587a	PADDINGPADDINGXz
0xd6c01	6c621a16e22852c0045d0026968e7000	lb...(R..].&..p.
0xd6c11	17f7ec05bbeaf4ff94012f44ef7ce6f5	........../D.\|..
0xd6c21	0919440229ff53cdd6d114fe9e619c82	..D.).S......a..
0xd6c31	15f6097aac6bb4ed54109e26ca71cfc5	...z.k..T..&.q..
0xd6c41	472bc8eb2245fe41fab3598f72040980	G+.."E.A..Y.r...
0xd6c51	6f3a6c5ec55405dca827110a5c9f8f51	o:l^.T...'..\..Q
0xd6c61	b9bc65f0245ef5c4c96d789d1a6c01fb	..e.$^...mx..l..
0xd6c71	512311d6da1c24a5f63665968c4c2302	Q#....$..6e..L#.
0xd6c81	1f707fbd54223d5eba4b23d1df35202e	.p..T"=^.K#..5 .
0xd6c91	06e79e16898755a4ce9c5bc030490586	......U...[.0I..
0xd6ca1	7cdc47dc6db38e80d47e1e8a21220026	\|.G.m....~..!".&
0xd6cb1	d52aaf9e309db366053f297cbf00eda2	.*..0..f.?)\|....
0xd6cc1	60b297b183537e62bec1c7a09dff3bf8	`....S~b......;.
0xd6cd1	f21a6eb725754dc051cc9e9de57a2146	..n.%uM.Q....z!F
0xd6ce1	1baf6f16ec47c850680897f33e540bc1	..o..G.Ph...>T..
0xd6cf1	87946241205e200c71212db754c55743	..bA ^ .q!-.T.WC
0xd6d01	069198ea4d5250e0b2def46539aab8bb	....MRP....e9...
0xd6d11	da4b96ef9374a4d224cb9bbf522912b4	.K...t..$...R)..
0xd6d21	46a35bc713651987f84d791dff4a6934	F.[..e...My..Ji4
0xd6d31	a3d3c7dab8310f449dd4523d2bd2ea36	.....1.D..R=+..6
0xd6d41	ad820d63914533a6d29d96bdb3ad4a1a	...c.E3.......J.
0xd6d51	9d4c968325bc0d750de7b4cfdce97274	.L..%..u......rt
0xd6d61	830a1ec8569ee87c6c5aea174ad889d0	....V..\|lZ..J...
0xd6d71	26ef0461afc854491ca5a6aee5a7c0e7	&..a..TI........
0xd6d81	11ac7b1aac0bead7feb5d29fa54b14ed	..{..........K..
0xd6d91	34396a6f72552c3a7b539c34cc426f96	49jorU,:{S.4.Bo.
0xd6da1	9aadadbc22f312e314cf4b218b318535	....".....K!.1.5
0xd6db1	c56ee84e0a82beab584970f1e50edba5	.n.N....XIp.....
0xd6dc1	cfa89c1126785a0c92d92ebdd2440789	....&xZ......D..
0xd6dd1	2b496a692712e5824d6c97d27508a8f6	+Iji'...Ml..u...
0xd6de1	cda23a6b4b51fab699a0997645ef1582	..:kKQ.....vE...
0xd6df1	bb6caa0be0f5b0802b60a1946c68fb0e	.l......+`..lh..
0xd6e01	5e9ef6023fb8ff4d7a8e84a30a68bdfa	^...?..Mz....h..

0x179c9a	035f64fe0be7f426ff5add844123210b	._d....&.Z..A#!.
0x179caa	d5c20ff52224916f48429a535cdb453b	...."$.oHB.S\.E;
0x179cba	0a9c2e2c8d096719d160b5941771340e	...,..g..`...q4.
0x179cca	328c54cf21	2.T.!

0x4194f2	c382cbc289dfd6ba7e7342a7bc0b2a2e	........~sB...*.
0x419502	53495311eac6a8e2d540bff024e852be	SIS......@..$.R.
0x419512	84eb623487da7f97740e7dce0a425562	..b4....t.}..BUb
0x419522	728415	r..

0xb52fc	01000000030000000400000005000000	................
0xb530c	496e6e6f205365747570205365747570	Inno Setup Setup
0xb531c	20446174612028362e372e3029000000	Data (6.7.0)...
0xb532c	00000000000000000000000000000000	................
0xb533c	00000000000000000000000000	.............

0xd6b11	646c6c22206c6f616446726f6d3d2225	dll" loadFrom="%
0xd6b21	53797374656d526f6f74255c73797374	SystemRoot%\syst
0xd6b31	656d33325c22202f3e0d0a3c66696c65	em32\" />..<file
0xd6b41	206e616d653d2277696e687474702e64	name="winhttp.d
0xd6b51	6c6c22206c6f616446726f6d3d222553	ll" loadFrom="%S
0xd6b61	797374656d526f6f74255c7379737465	ystemRoot%\syste
0xd6b71	6d33325c22202f3e0d0a3c2f61737365	m32\" />..</asse
0xd6b81	6d626c793e0d0a50414444494e475858	mbly>..PADDINGXX
0xd6b91	50414444494e4750414444494e475858	PADDINGPADDINGXX
0xd6ba1	50414444494e4750414444494e475858	PADDINGPADDINGXX
0xd6bb1	50414444494e4750414444494e475858	PADDINGPADDINGXX
0xd6bc1	50414444494e4750414444494e475858	PADDINGPADDINGXX
0xd6bd1	50414444494e4750414444494e475858	PADDINGPADDINGXX
0xd6be1	50414444494e4750414444494e475858	PADDINGPADDINGXX
0xd6bf1	50414444494e4750414444494e47587a	PADDINGPADDINGXz
0xd6c01	6c621a16e22852c0045d0026968e7000	lb...(R..].&..p.
0xd6c11	17f7ec05bbeaf4ff94012f44ef7ce6f5	........../D.\|..
0xd6c21	0919440229ff53cdd6d114fe9e619c82	..D.).S......a..
0xd6c31	15f6097aac6bb4ed54109e26ca71cfc5	...z.k..T..&.q..
0xd6c41	472bc8eb2245fe41fab3598f72040980	G+.."E.A..Y.r...
0xd6c51	6f3a6c5ec55405dca827110a5c9f8f51	o:l^.T...'..\..Q
0xd6c61	b9bc65f0245ef5c4c96d789d1a6c01fb	..e.$^...mx..l..
0xd6c71	512311d6da1c24a5f63665968c4c2302	Q#....$..6e..L#.
0xd6c81	1f707fbd54223d5eba4b23d1df35202e	.p..T"=^.K#..5 .
0xd6c91	06e79e16898755a4ce9c5bc030490586	......U...[.0I..
0xd6ca1	7cdc47dc6db38e80d47e1e8a21220026	\|.G.m....~..!".&
0xd6cb1	d52aaf9e309db366053f297cbf00eda2	.*..0..f.?)\|....
0xd6cc1	60b297b183537e62bec1c7a09dff3bf8	`....S~b......;.
0xd6cd1	f21a6eb725754dc051cc9e9de57a2146	..n.%uM.Q....z!F
0xd6ce1	1baf6f16ec47c850680897f33e540bc1	..o..G.Ph...>T..
0xd6cf1	87946241205e200c71212db754c55743	..bA ^ .q!-.T.WC
0xd6d01	069198ea4d5250e0b2def46539aab8bb	....MRP....e9...
0xd6d11	da4b96ef9374a4d224cb9bbf522912b4	.K...t..$...R)..
0xd6d21	46a35bc713651987f84d791dff4a6934	F.[..e...My..Ji4
0xd6d31	a3d3c7dab8310f449dd4523d2bd2ea36	.....1.D..R=+..6
0xd6d41	ad820d63914533a6d29d96bdb3ad4a1a	...c.E3.......J.
0xd6d51	9d4c968325bc0d750de7b4cfdce97274	.L..%..u......rt
0xd6d61	830a1ec8569ee87c6c5aea174ad889d0	....V..\|lZ..J...
0xd6d71	26ef0461afc854491ca5a6aee5a7c0e7	&..a..TI........
0xd6d81	11ac7b1aac0bead7feb5d29fa54b14ed	..{..........K..
0xd6d91	34396a6f72552c3a7b539c34cc426f96	49jorU,:{S.4.Bo.
0xd6da1	9aadadbc22f312e314cf4b218b318535	....".....K!.1.5
0xd6db1	c56ee84e0a82beab584970f1e50edba5	.n.N....XIp.....
0xd6dc1	cfa89c1126785a0c92d92ebdd2440789	....&xZ......D..
0xd6dd1	2b496a692712e5824d6c97d27508a8f6	+Iji'...Ml..u...
0xd6de1	cda23a6b4b51fab699a0997645ef1582	..:kKQ.....vE...
0xd6df1	bb6caa0be0f5b0802b60a1946c68fb0e	.l......+`..lh..
0xd6e01	5e9ef6023fb8ff4d7a8e84a30a68bdfa	^...?..Mz....h..

0xb738	6f00630061006c006500730000000000	o.c.a.l.e.s.....
0xb748	53006f00660074007700610072006500	S.o.f.t.w.a.r.e.
0xb758	5c0043006f0064006500470065006100	\.C.o.d.e.G.e.a.
0xb768	72005c004c006f00630061006c006500	r.\.L.o.c.a.l.e.
0xb778	7300000053006f006600740077006100	s...S.o.f.t.w.a.
0xb788	720065005c0042006f0072006c006100	r.e.\.B.o.r.l.a.
0xb798	6e0064005c004c006f00630061006c00	n.d.\.L.o.c.a.l.
0xb7a8	650073000000000053006f00	e.s.....S.o.

0xb6df0	00000000000000000000000000000000	................
0xb6e00	00304c0018304c00143c4b0010404c00	.0L..0L..<K..@L.
0xb6e10	0000000000000000456d626172636164	........Embarcad
0xb6e20	65726f2044656c70686920666f722057	ero Delphi for W
0xb6e30	696e333220636f6d70696c6572207665	in32 compiler ve
0xb6e40	7273696f6e2033362e30202832392e30	rsion 36.0 (29.0
0xb6e50	2e35353336322e323031372900000000	.55362.2017)....
0xb6e60	0000000000	.....

0xd6306	200020002000000000008a0033000100	. . .......3...
0xd6316	500072006f0064007500630074005600	P.r.o.d.u.c.t.V.
0xd6326	65007200730069006f006e0000003100	e.r.s.i.o.n...1.
0xd6336	2e00300020002000200020002000	..0. . . . . .

0xd6284	630074004e0061006d00650000000000	c.t.N.a.m.e.....
0xd6294	4300680072006f006d00650020002000	C.h.r.o.m.e. . .
0xd62a4	20002000200020002000200020002000	. . . . . . . .
0xd62b4	20002000200020002000200020002000	. . . . . . . .
0xd62c4	20002000200020002000200020002000	. . . . . . . .
0xd62d4	20002000200020002000200020002000	. . . . . . . .
0xd62e4	200020002000200020002000	. . . . . .

0xd609e	200020002000000000004a0015000100	. . .....J.....
0xd60ae	460069006c0065005600650072007300	F.i.l.e.V.e.r.s.
0xd60be	69006f006e000000000031002e003000	i.o.n.....1...0.
0xd60ce	20002000200020002000200020002000	. . . . . . . .
0xd60de	20002000200020002000200020002000	. . . . . . . .
0xd60ee	200000000000ee00650001004c00	.......e...L.

0xd5ffa	20002000200000000000a2003d000100	. . .......=...
0xd600a	460069006c0065004400650073006300	F.i.l.e.D.e.s.c.
0xd601a	720069007000740069006f006e000000	r.i.p.t.i.o.n...
0xd602a	00004300680072006f006d0065002000	..C.h.r.o.m.e. .
0xd603a	53006500740075007000200020002000	S.e.t.u.p. . . .
0xd604a	20002000200020002000200020002000	. . . . . . . .
0xd605a	20002000200020002000200020002000	. . . . . . . .
0xd606a	20002000200020002000200020002000	. . . . . . . .
0xd607a	2000200020002000200020002000	. . . . . . .

0xd5f5e	750070002e00000000009a003d000100	u.p.........=...
0xd5f6e	43006f006d00700061006e0079004e00	C.o.m.p.a.n.y.N.
0xd5f7e	61006d006500000000004d0079005300	a.m.e.....M.y.S.
0xd5f8e	6f006600740052007500200020002000	o.f.t.R.u. . . .
0xd5f9e	20002000200020002000200020002000	. . . . . . . .
0xd5fae	20002000200020002000200020002000	. . . . . . . .
0xd5fbe	20002000200020002000200020002000	. . . . . . . .
0xd5fce	20002000200020002000200020002000	. . . . . . . .
0xd5fde	200020002000	. . .

0xd5e52	010020009f4900006a00840534000000	.. ..I..j...4...
0xd5e62	560053005f0056004500520053004900	V.S._.V.E.R.S.I.
0xd5e72	4f004e005f0049004e0046004f000000	O.N._.I.N.F.O...
0xd5e82	0000bd04effe000001000000010000	...............

signed Authenticode chain CN: MySoftRu

signed/certificate PE leaf certificate is self-issued

file

sfx/inno-setup/extraction Innoextract could not determine setup data version

20 of 40 traits shown

Identity

SHA-256	f2bc804a84dfb3717534856402c6d6959d33d62dfdf7ca990e210f093da1318f
Filename	SecuriteInfo.com.FileRepMalware.75298531
Package	f2bc804a84dfb3717534856402c6d6959d33d62dfdf7ca990e210f093da1318f

Origin

Source	harvest
Feed	malwarebazaar
Ecosystem	windows
Domain	abuse.ch

Timeline

First seen	22 Jul 2026 04:40 UTC
First analyzed	23 Jul 2026 14:51 UTC
Last analyzed	23 Jul 2026 15:35 UTC
Last updated	23 Jul 2026 15:35 UTC

Labeling

Label	bad
Label source	harvest
Traits version	b3ead

Not seeing what you expected? Let us know

0xa6ed8	5e5bc300b0040200ffffffff16000000	^[..............
0xa6ee8	4c007a006d0061004400650063006f00	L.z.m.a.D.e.c.o.
0xa6ef8	6400650020006600610069006c006500	d.e. .f.a.i.l.e.
0xa6f08	64002000280025	d. .(.%

0x1bed0	837df0017422a1106c4b008338007411	.}..t"..lK..8.t.
0x1bee0	8b35106c4b008b368d55f08bc3ffd6eb	.5.lK..6.U......
0x1bef0	07b010e8008afeff5f5e5b8be55dc390	........_^[..]..
0x1bf00	558bec81c408ffffff5356	U........SV