I came across CastleLoader malware (sha256: 8b7c1657f4d5cf0cc82d68c1f1a385adf0de27d46fc544bba249698e6b427856) recently. Looking into it, I saw it uses Inno Setup to package its files. Normally, to get those dropped files, you would run the sample and grab them from the file system. But if you are like me and prefer static analysis, running it is...