Stardock.Start11.v2
Legitimate Stardock installer
Compact mapped image with embedded stagesSigned host large overlay embeds PEs
SHA-256e3c203eddad37e51c7255dd8bace811327fed127b0f2a5fe10de6846f5f2b6ee
Evidence
0x04d5a90000300000004000000ffff0000MZ..............
0x10b8000000000000004000000000000000........@.......
0x2000000000000000000000000000000000................
0x30000000000000000000000000d8000000................
0x400e1fba0e00b409cd21b8014ccd215468........!..L.!Th
0x5069732070726f6772616d2063616e6e6fis program canno
0x60742062652072756e20696e20444f5320t be run in DOS
⋯11 more rows
⋯5 more rows
0x33df000000000000000000000000000000000................
0x33e00e0e0e1e1e2e2e3e3e4e4e5e5e6e6e7e7................
0x33e1000030000000000000000002c13000000...........,....
0x33e2000004a5d97070407070703070707f8f8..J]............
0x33e300707bf07070707070707470707070707..........G.....
0x33e4007070707070707070707070707070707................
0x33e5007070707070707070707070707071706................
0x33e6007070918bd0907b30eca26bf064bca26..........&..K.&
0x33e70536f6e74277775686075666a27646669Sont'wuh`ufj'dfi
0x33e8069687327656227757269276e69274348ihs'eb'uri'ni'CH
0x33e9054276a686362290a0a0d230707070707T'jhcb)...#.....
0x33ea00707662c03d9224d6d8a224d6d8a224d..f,.."Mm."Mm."M
0x33eb06d8a4d3bc78a534d6d8a2b35e98a234dm.M;..SMm.+5..#M
0x33ec06d8ab103f58a234d6d8a2b35ee8a324dm.....#Mm.+5..2M
0x33ed06d8a39d0f38a194d6d8a4d3bc68a8e4dm.9....Mm.M;...M
0x33ee06d8add6d678a204d6d8a2b35fe8a094dm..mg. Mm.+5...M
0x33ef06d8a224d6c8ad54e6d8a39d0c78afc4dm."Ml..Nm.9....M
0x33f006d8a39d0c68a5e4f6d8a39d0f78a234dm.9...^Om.9...#M
0x33f106d8a39d0f08a234d6d8a556e646f224dm.9...#Mm.Undo"M
0x33f206d8a0707070707070707070707070707m...............
0x33f300707574207074b0604076cf0ed610707..WB..K...l..a..
0x33f40070707070707e70705060c060d0707b7................
0x33f5015070797070707572c0797f13a070767.......W,...:..g
0x33f602c070717390707074707071707070705,...9...G.......
0x33f7007070207060707070707020706070707................
0x33f80070707a7390707030707070707070507....9...........
0x33f9047860707170707170707070717070717G...............
0x33fa007070707070717070707070707070707................
0x33fb00707a78a39079f03070707173907a77a....9.......9..z
0x33fc007070707070707070707070707070707................
0x33fd007073f9539070b070707070707070707..?.9...........
0x33fe007070707070707070707070707070707................
0x33ff007070707070707070707070707070707................
0x3400007070707070707070707070707070707................
0x340100707ef18330767070707070707070707....3.g.........
0x340200707070707070707070752575f370707..........RW_7..
0x34030070707572c0707170707070707070703...W,...........
0x3404007070707070707070707070707078707................
0x3405007e752575f360707070707b715070767..RW_6.........g
0x340602c0707a3150707030707070707070707,...............
0x34070070707070707470707e7297574756407......G...)utud.
0x34080070707970707071739070783070707af........9.......
0x3409015070707070707070707070707074707..............G.
0x1657da340030003900300034006200300000004.0.9.0.4.b.0...
0x1657ea4e001b00010043006f006d006d006500N.....C.o.m.m.e.
0x1657fa6e007400730000004300720065006100n.t.s...C.r.e.a.
0x16580a74006500640020007700690074006800t.e.d. .w.i.t.h.
0x16581a20005300650074007500700020004600 .S.e.t.u.p. .F.
0x16582a6100630074006f007200790000000000a.c.t.o.r.y.....
0x16583a50001800010043006f006d0070006100P.....C.o.m.p.a.
0x16584a6e0079004e0061006d00650000000000n.y.N.a.m.e.....
0x16585a49006e006400690067006f0020005200I.n.d.i.g.o. .R.
0x16586a6f007300 o.s.
0x165f9f203c73656375726974793e0d0a202020 <security>..
0x165faf2020202020202020203c726571756573 <reques
0x165fbf74656450726976696c656765733e0d0atedPrivileges>..
0x165fcf20202020202020202020202020202020
0x165fdf3c726571756573746564457865637574<requestedExecut
0x165fef696f6e4c6576656c206c6576656c3d22ionLevel level="
0x165fff7265717569726541646d696e69737472requireAdministr
0x16600f61746f72222075694163636573733d22ator" uiAccess="
0x16601f66616c7365222f3e0d0a202020202020false"/>..
0x16602f2020202020203c2f7265717565737465 </requeste
0x16603f6450726976696c656765733e0d0a2020dPrivileges>..
0x16604f2020202020203c2f7365637572697479 </security
0x16605f3e0d0a202020203c2f7472757374496e>.. </trustIn
0x16606f666f3e0d0a202020203c636f6d706174fo>.. <compat
0x16607f6962696c69747920786d6c6e733d2275ibility xmlns="u
0x16608f726e3a736368656d61732d6d6963726frn:schemas-micro
0x16609f736f66742d soft-
0x1669ca00000000000000000000000000000000................
0x1669da00000000000000000000000000000000................
0x1669ea00000000000000000000000000000000................
0x1669fa00000000000000000000000000000000................
0x166a0a00000000000000000000000000000000................
0x166a1a0000000000000000881b050000000000................
0x166a2a4d5a90000300000004000000ffff0000MZ..............
0x166a3ab8000000000000004000000000000000........@.......
0x166a4a00000000000000000000000000000000................
0x166a5a000000000000000000000000f0000000................
0x166a6a0e1fba0e00b409cd21b8014ccd215468........!..L.!Th
0x166a7a69732070726f6772616d2063616e6e6fis program canno
0x166a8a742062652072756e20696e20444f5320t be run in DOS
0x166a9a6d6f64652e0d0d0a2400000000000000mode....$.......
0x166aaa968da2dad2eccc89d2eccc89d2eccc89................
0x166abaf52ab789d1eccc89d2eccd89b3eccc89.*..............
0x166acadb944889fbeccc89db94598993eccc89..H.......Y.....
0x166adadb944f8903eccc89db945e89d3eccc89..O.......^.....
0x166aeaccbe5889d3eccc89db945d89d3eccc89..X.......].....
0x166afa52696368d2eccc890000000000000000Rich............
0x166b0a000000000000000000000000000000 ...............